# Media

url: https://www.youtube.com/watch?v=FDVcF28PPnI
title: DEF CON 32 - AIxCC Closing Ceremonies
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=FDVcF28PPnI",
  "title": "DEF CON 32 - AIxCC Closing Ceremonies",
  "description": "Closing ceremonies for this round of the AIxCC!",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2271,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.02s - 11.04s | This text was transcribed using whisper model: large-v2

 Hello. Tess, Tess, Tess, you can all hear me? Wonderful, I see some thumbs up. I'm Perry
11.04s - 21.15s |  Adams. I'm Special Assistant to the Director at DARPA and the creator of the AI Cyber Challenge.
21.15s - 33.71s |  I'm Andrew Carney. I'm Program Manager at DARPA and ARPA-H for the AI Cyber Challenge.
33.71s - 39.03s |  So I see many, many competitors in the audience today. So I think that many people here are
39.03s - 47.03s |  very familiar with the AI Cyber Challenge. We announced at Black Hat and DEF CON last
47.03s - 51.75s |  year and I think we upended some of your years. We were very excited for all the hard work
51.75s - 57.43s |  that went into the challenge and we were very excited to bring it to DEF CON. So I want
57.43s - 63.63s |  to first start by thanking DEF CON for having us, thanking all of you for being such wonderful
63.63s - 71.57s |  participants in the AI Cyber Challenge either as competitors or as folks visiting the village
71.57s - 79.55s |  walking through it. We had I think over 12,000 folks walk through the AI Cyber Challenge
79.55s - 86.67s |  space and we are so thrilled, so thrilled for that. So when we announced it last year
86.67s - 91.91s |  I think many people were asking what is this? What would it become? I hope that we answered
91.91s - 96.95s |  many of those questions in the village space if you weren't participating. I think many
96.95s - 104.67s |  of you have spent the last year working very hard on developing systems that can find and
104.67s - 111.43s |  fix vulnerabilities in software and that really goes to the why of the challenge. Why did
111.43s - 117.35s |  we do this? Why did DARPA think it was important not just to put on a challenge but to come
117.35s - 122.31s |  to DEF CON and to put on a show? Why did ARPA-H think it was important to partner with
122.31s - 129.23s |  DARPA for this effort? And that goes, it comes down to the fact that our critical infrastructure
129.23s - 135.51s |  is very insecure. Software is what undergirds our world and software has vulnerabilities.
135.51s - 140.23s |  If you visited the village, if you've been to half of the talks at DEF CON you're already
140.23s - 145.35s |  sick of hearing about this, about this problem. I know Andrew and I talk about it all the
145.35s - 150.87s |  time. Software is everywhere and there's vulnerabilities in it and especially our
150.87s - 156.35s |  healthcare infrastructure, our medical infrastructure, which is why it's so important that this is
156.35s - 162.43s |  not just a DARPA effort but an ARPA-H effort and we're incredibly excited to have them
162.43s - 171.75s |  come on as partners. I've had many people ask me why, why X? Why AI X CC? And this idea
171.83s - 178.11s |  actually was suggested not by me but by another program manager at DARPA who used to go by
178.11s - 185.11s |  the handle SIGTRAP and it's because X, hex CC, is SIGTRAP. It's a debug instruction in X86
187.11s - 191.55s |  and it's essentially an instruction that will stop program execution and say, hey, we're
191.55s - 194.79s |  going to debug this. We're going to see what's wrong. And that's essentially what the
194.79s - 199.99s |  challenge is about. It's about finding these vulnerabilities in software. Finding these
200.03s - 205.39s |  issues and not just doing it at scale, not just doing it automatically, but then fixing
205.39s - 211.51s |  those vulnerabilities automatically and developing systems that can be given to communities,
211.51s - 216.51s |  that can be given to industry so that they can secure their own code. So AI CC consists of
219.35s - 225.19s |  two competitions. We announced last year and we just wrapped up our semi-final competition.
225.19s - 230.87s |  I know many of you are here, very excited to hear the results. And then next year we'll be
230.87s - 236.47s |  running our final competition. Seven of the teams that competed this year will be advancing
236.47s - 243.47s |  to our final competition and we will be back in August of 2025 to run that. We're very
243.47s - 248.09s |  excited about that. Andrew, do you want to talk a little bit about ARPA-H and that
248.09s - 254.63s |  collaboration? Absolutely. So when Perry, when AI CC began at DARPA, Perry and I were
254.63s - 259.83s |  already talking about the potential collaboration and transition opportunities into healthcare. I
259.83s - 265.31s |  actually had been at DARPA for many years and had gone to ARPA-H, a new federal agency focused
265.31s - 270.23s |  on improving the healthcare of all Americans. It's an incredible place to work. I was very
270.23s - 276.79s |  excited to be there and sort of the magnitude of the problems, the complexity of the environment
277.43s - 285.11s |  was pretty unreal. And so when AI CC sort of came into being, the idea of very early on that we
285.11s - 290.23s |  would have some kind of collaboration or transition kind of working together was like always in the
290.23s - 295.27s |  cards. And then, you know, the stars aligning so that we could work together in a very real way
295.27s - 300.23s |  and sort of make the challenge real together has been an incredible experience. And I'm very
300.23s - 309.67s |  excited for next year as well. And we've had fantastic partnership on the AI Cyber Challenge.
309.67s - 315.19s |  So I started talking about, I started with thanking DEF CON for having us. And that has been a truly
315.19s - 321.03s |  fundamental part of this challenge. Last summer, I called up Jeff and I said, listen, I want to do
321.03s - 326.31s |  this thing. And he said, okay, let's do it. And that was pretty much the conversation. And he was
326.31s - 331.59s |  an enthusiastic participant from the start. And that's pretty much been the case with all of our
331.59s - 337.43s |  collaborators. When I approached them and said, here's what I'd like to do, all of them were on
337.43s - 343.91s |  board. Because they understood the importance of securing the software. Many of these are technology
343.91s - 347.99s |  companies. Actually, all of these are technology companies. So they themselves are software. So
347.99s - 353.35s |  they understood the need to secure their own software. They understood the value that their
353.43s - 363.03s |  tools, their AI could bring to software security. And so we had Anthropic, Google, OpenAI, and
363.03s - 369.75s |  Microsoft as our corporate partners, corporate collaborators on this effort. And they have been
369.75s - 378.15s |  fantastic bringing not just their models and making them available to the competitors, but also
378.15s - 385.51s |  bringing their expertise, both about AI and about software security. And then finally, we have the
385.51s - 391.19s |  Linux Foundation, the open source security foundation. And these, exactly, I see Omkar in the
391.19s - 396.71s |  crowd right there. Similarly, when I called up Omkar and I said, listen, I want to do this, he said,
396.71s - 401.51s |  how soon can I get there? And they have been fantastic partners in this effort.
402.31s - 407.03s |  Because the goal of the challenge is to focus on finding and fixing vulnerabilities
407.03s - 412.79s |  in software. We needed software to focus on. And that's open source software. Open source
412.79s - 419.59s |  software is the majority of software. It's what undergirds everything. The Linux kernel is
419.59s - 425.03s |  everywhere. Nginx is everywhere. Open source software makes up a majority of our software.
425.67s - 429.75s |  And so the challenges that we have, which Andrew is going to talk about in a little bit,
430.39s - 436.79s |  are based on open source software. And that's in part because of all of the examples I just gave,
436.79s - 442.31s |  but also because we wanted to make sure our challenges were modeled on real world examples.
443.43s - 450.47s |  We wanted the tools that teams developed on this challenge to be able to apply to real world
450.47s - 457.03s |  problems. And that brings me to the other open source aspect of the challenge, which is that
457.03s - 463.03s |  all of the tools from prize winning teams will be open sourced. So the research that's been done on
463.03s - 470.33s |  this challenge will be brought back to the community by open sourcing it. So yeah, that's
470.33s - 479.22s |  amazing, right? I'd like to take a moment before we get into the technical details of the challenge
479.22s - 486.10s |  to just a huge shout out to the massive dedicated team spanning technical disciplines, production,
486.10s - 494.10s |  logistics, every flavor of support, and every role just filled across industry, academia,
494.74s - 501.22s |  our collaborators. It has been a tremendous... Making this happen in the time frame that we
501.22s - 506.18s |  were shooting for is immense. The challenges do not come together quickly, and this one did,
506.90s - 510.98s |  and it came together successfully. And so that's something to be extremely proud of. And just,
510.98s - 516.26s |  I mean, a round of applause for all of the folks that made all of this happen, the experience,
516.26s - 523.30s |  the challenges, everything. Thank you. The joke I've been making all week is that it took a
523.30s - 528.90s |  village to put on the AICC village. I don't know how funny that is, but I thought it was very funny.
531.14s - 532.58s |  Oh. This is you, baby.
532.58s - 533.30s |  I have the clicker now.
535.30s - 540.98s |  Or this is actually me, I think. So I talked a little bit about the kinds of challenges that we
541.62s - 548.42s |  focused on, and these were real open source projects that we chose. We were very lucky,
548.42s - 552.90s |  again, to have folks like the Open Source Security Foundation come on board to make
552.90s - 558.74s |  sure that we were doing this in a way that fit with open source community guidelines,
558.74s - 563.62s |  that gave back to the open source community, and we found their support to be incredibly
563.62s - 569.14s |  impactful for this. We also needed to focus on real world vulnerabilities. We wanted to
569.14s - 574.26s |  focus on vulnerabilities that are actually causing problems today. I don't know if any
574.26s - 579.62s |  of you all have been tracking, but there was a recent rather large cybersecurity incident that
579.62s - 586.82s |  took out a few systems across the world. And that was memory corruption vulnerabilities. It
586.82s - 591.78s |  was memory corruption vulnerabilities at a high privilege level. And so we have the Linux kernel
591.78s - 600.42s |  here. We have things running in ring zero for our challenge. We have real world CVEs, CWEs,
600.42s - 605.78s |  classes of vulnerabilities that we are using to model our vulnerabilities on top of.
606.10s - 612.02s |  And finally, we have our sanitizers. So I talked about how we have these classes of
612.02s - 616.42s |  vulnerabilities. The way that these challenges work is we take this open source software,
616.42s - 622.34s |  we put our vulnerabilities in it for our competitors to find. But the question maybe you're
622.34s - 626.66s |  asking is, well, this is open source software. It might have vulnerabilities. This is real
626.66s - 630.98s |  world software, and as we just talked about, there's vulnerabilities everywhere. And so we
630.98s - 636.82s |  couldn't just have this nice little answer key for us to find and fix vulnerabilities on. We
636.82s - 641.78s |  couldn't just judge teams based on that. So we had to find a way to check if a vulnerability
641.78s - 645.94s |  was actually a vulnerability that a team found, and if they fixed those correctly. And what we
645.94s - 652.98s |  did was we used sanitizers for this. These are sanitizers like Address Sanitizer, KSAN, JASR,
652.98s - 658.50s |  et cetera, that are themselves open source projects that are maintained by some of our
658.50s - 663.70s |  collaborators, by some other folks that are used in program analysis tools today. And one of the
663.70s - 669.14s |  reasons for this is to design a competition, which does have to be gamified in some ways,
669.14s - 674.18s |  but to design it using tools that are already present in software development life cycles.
674.18s - 678.02s |  Again, to make sure the things that came out of this challenge can be given back to the community.
680.02s - 684.42s |  So the first challenge project that was announced was the Linux kernel. Not a single kernel module,
684.42s - 689.54s |  not a driver, the Linux kernel. Both the scale, the complexity, the size,
689.54s - 694.10s |  and also the ubiquity of it in real life. This was an incredible challenge project to start with.
695.54s - 699.14s |  And the amount of the Linux kernel that was harnessed in this case was pretty significant.
700.10s - 708.34s |  We saw approaching 20% of the code in scope was available for potential CPVs.
709.22s - 714.26s |  And also the way the code, the CPVs or the challenge projects and challenge project
714.26s - 718.18s |  vulnerabilities, forgive my lack of acronym kind of clarification up here.
722.98s - 727.22s |  If anyone's ever, raise your hand if you've ever written a fuzzer or a harness.
728.90s - 733.38s |  Right. It's super easy, right? It doesn't take any time at all. It's not a huge time
733.38s - 736.18s |  sink for you actually finding vaults. No, it's incredibly challenging.
736.18s - 737.46s |  You're just being sarcastic there.
737.46s - 743.78s |  Slash S, right? It's very, very challenging. And I just like to say just generally to a huge
743.78s - 749.22s |  shout out to Jonathan Metzman, the Google Project Zero team for working directly with us on
749.22s - 755.30s |  infrastructure and sort of tackling some of the fully automated evaluation and the infrastructure
755.30s - 761.38s |  challenges with running this competition at this scale in this way. So yeah, thank you to OSS Fuzz,
761.38s - 762.26s |  Google for that.
762.26s - 767.06s |  We're very lucky that OSS Fuzz has already gone through some of the pain and suffering
767.06s - 771.14s |  of doing vulnerability discovery on open source software at scale.
771.14s - 773.94s |  And they brought a lot of those lessons learned and they were very helpful.
773.94s - 781.38s |  Absolutely. So the second challenge project that we'll talk about is Engine X. This is
782.26s - 786.26s |  one of the most popular web servers running 20% of the world's busiest websites.
787.22s - 793.94s |  A good chunk of its code base is open source. The statefulness of this code is significant.
793.94s - 800.66s |  It's a lot of S's. But this was another of our challenge projects. And once again,
800.66s - 804.74s |  harnessing a significant portion of the code base, but not the entirety.
807.85s - 813.37s |  SQLite was the third of the five. SQLite has an extraordinary
814.33s - 821.21s |  a community-producing unit tests and tests for it. This makes patching it challenging
821.21s - 825.85s |  because you have to pass a lot of those tests. And it's also been looked at a lot.
827.21s - 831.77s |  It's an OSS Fuzz project. And so we took that into the competition knowing that if we could
831.77s - 835.61s |  find things that were different than what was being found within the community at large,
835.61s - 842.70s |  that would be extra exciting. Jenkins. So something that we haven't maybe touched on.
842.86s - 849.58s |  Or the fact that Java was in scope was a big deal here. Java is everywhere. One of the major
849.58s - 854.86s |  projects that we've been talking about is actually the payment system that's used for Medicare.
854.86s - 860.86s |  So in health and human services, about 5% of our GDP and the healthcare of 50 to 70 million
860.86s - 867.66s |  Americans, depending on how you slice it, goes through a code base that is COBOL and Java.
867.66s - 872.30s |  Ancient COBOL and new Java. Surely nothing will go wrong.
874.06s - 878.62s |  But reasoning over this code base, especially while it's transitioning, this is a huge
878.62s - 882.46s |  undertaking. And so it's one of the many challenges that when we're talking about
882.46s - 888.30s |  critical infrastructure across sectors and places where the DEF CON community can potentially help,
888.30s - 895.42s |  can plug in, can really make a big difference both personally and just for society at large.
895.42s - 898.78s |  That's one of them. And so we're hoping to point out more of those.
899.82s - 901.82s |  Very little of that has to do with Jenkins. That's all Java.
902.78s - 907.42s |  But Java is incredibly important because the first two challenges we talked about are
908.22s - 915.82s |  compiled languages C and C++. They focus on memory corruption vulnerabilities. Largely,
915.82s - 920.46s |  they see challenges. And then Java focuses on a different class of vulnerability.
920.46s - 925.02s |  I know that lately, especially over the last couple of years, memory corruption, memory safety
925.02s - 930.38s |  has been a major topic of conversation. And we wanted to make sure that was front and center
930.38s - 935.02s |  of this challenge. But of course, it's not the only class of vulnerabilities that we need to
935.02s - 939.42s |  worry about. As Andrew says, these kinds of vulnerabilities, these kinds of software
939.42s - 943.82s |  languages are present in our healthcare industry. They're present across the board.
943.82s - 949.26s |  And so Java and the kinds of vulnerabilities that aren't necessarily memory corruption that
949.26s - 955.50s |  you find in there, we also had in scope, which is very difficult to develop sanitizers that can
955.50s - 959.98s |  find and identify whether or not teams have accurately identified a vulnerability.
961.18s - 965.90s |  And just to even hit that a little more, sanitizers, the ability to automatically
966.70s - 971.74s |  have a high confidence indicator or Oracle that you found something worth addressing,
971.74s - 975.18s |  that's huge. Knowing that there's something there that you should investigate further or
975.18s - 980.94s |  allocate resources towards is tremendous. But that instrumentation on its own needs TLC.
980.94s - 986.94s |  It needs support. It's hard to do. So once again, if you're looking for an additional hobby,
986.94s - 993.74s |  maybe working on Jazzer or sanitizers for Java generally is something to consider.
994.86s - 998.94s |  I'll also say that for Jenkins, it was especially interesting. You'll see that the CPV entry points,
998.94s - 1003.42s |  kind of the reachable functions and nodes, feels relatively low. It has to do with the
1003.42s - 1009.18s |  plugin architecture of Jenkins. And so the fact that the base reachability seems low,
1009.18s - 1012.78s |  but as you start loading plugins and at runtime, things get far more complex very quickly.
1013.50s - 1019.58s |  And when Andrew says reachability, what he's getting at is, well, maybe there might be a flaw
1019.58s - 1026.46s |  in the code, but can you actually reach that flaw? Can an attacker actually start from an
1026.46s - 1033.26s |  entry point into that code and get to that what we call a sink, get to that flaw? So that's one
1033.26s - 1038.22s |  thing that you're checking when assessing if a team has actually found their vulnerabilities,
1038.22s - 1041.58s |  reachability. And so that's some of what went into the design of these challenges.
1042.14s - 1047.74s |  And then again, when Andrew talks about the sanitizers and puts out a call for help with
1047.74s - 1055.42s |  Jazzer, it's because it can be very difficult to say, okay, I've injected code in a command line
1055.42s - 1059.58s |  or something, something like that, but was that actually attacker controlled malicious code?
1059.58s - 1063.82s |  What kind of constraints were on it? Is it actually a vulnerability? This challenge runs
1063.82s - 1069.74s |  into fundamentally hard problems in program analysis, such as vulnerability metrology.
1069.74s - 1074.38s |  How do we assess if a vulnerability is real or not? And how do we assess its severity?
1074.38s - 1078.86s |  And that was an interesting part about running this challenge was for the technical team putting
1078.86s - 1083.98s |  together these challenges. How do you address this in a creative way in a, how do you create
1083.98s - 1089.10s |  a gamified environment that's not too gamified? So these are real world tools, but also allows
1089.10s - 1093.66s |  the teams to compete against each other in the timeframe. And I think if you visited the village,
1093.66s - 1098.70s |  if you went through Northbridge City, you were able to talk to some of our challenge developers
1098.70s - 1105.66s |  and hear about the thought and the serious effort that went into creating this competition.
1106.38s - 1112.22s |  Also say that we have, we've been interviewing our challenge developers. And once, after we
1112.22s - 1117.26s |  announced the results from this first year, we're hoping to put a lot more information just to share
1117.26s - 1122.62s |  because this process is fascinating. The idea of creating a gamified challenge as Perry's saying,
1122.62s - 1129.02s |  but that is at the scale and scope and complexity of real software. I mean, it's very challenging.
1130.46s - 1136.94s |  It's perhaps more type two fun than type one fun relative to like CTF work. So it's not fun when
1136.94s - 1146.60s |  you do it, it's fun afterwards. So the last challenge project is Apache Tikka. And a huge
1146.60s - 1151.64s |  thanks to Tim Allison, one of the primary maintainers and someone who has written challenges
1151.64s - 1157.48s |  for this, who's shared war stories and perspective. And this is just, it's been incredible to have
1157.48s - 1163.32s |  someone who's so tightly integrated into this code base working with us. Apache Tikka, actually
1164.28s - 1169.48s |  it's parsers. It's thousands and thousands of parsers, which are some of the safest code on
1169.48s - 1174.44s |  the planet, right? Like parsers, parsers are... Andrew's being sarcastic again.
1174.44s - 1180.28s |  Once again, I should be more sarcastic and maybe careful with that. But it's all parsers and it's
1180.28s - 1186.76s |  parsers that are used all over the place, places you would not expect. So this is kind of thinking
1186.76s - 1191.56s |  about that invisible software infrastructure that we rely on, that we may not know we depend on,
1192.20s - 1197.16s |  the services that may be backed by Apache Tikka that you're using as an API happily,
1198.12s - 1201.72s |  you may really want that Java to be more secure without realizing it.
1207.16s - 1212.36s |  Another big piece of this challenge and something that affected the teams, affected the challenge
1212.36s - 1217.96s |  development and organization was leveraging external resources. The collaborators provided
1217.96s - 1226.44s |  us access to their LLMs, to these services that were changing. Very grateful for their
1226.44s - 1232.36s |  involvement, but we never expected any of them to change their release cycles based on our needs.
1232.36s - 1235.72s |  So we had to meet them kind of based on where they were and where they were going.
1236.76s - 1242.92s |  These models were changing every few months, every few, well, fast, they were changing fast.
1242.92s - 1246.28s |  And so over the year of the challenge, I mean, the models that were available when the challenge was
1246.28s - 1251.24s |  announced are not currently available, or at least these are not the ones that we're focused
1251.24s - 1257.48s |  on. And that's a big difference from a lot of DARPA or just ARPA-flavored challenges generally.
1257.48s - 1262.04s |  When you're trying to frame the problem, when you're trying to create sort of momentum in a
1262.04s - 1267.16s |  direction and bring communities together to solve something, part of the design, a big component,
1267.16s - 1272.44s |  is how do I define the problem in a way that won't change while the competition is running,
1272.44s - 1278.52s |  or that will change in a way that is manageable? These changes were manageable.
1279.96s - 1285.64s |  They were very challenging. And so a huge just thanks once again to the organizers and the
1285.64s - 1292.44s |  competitors who hit this timeline, who were able to move at the speed of industry leaders. That's
1292.44s - 1299.56s |  incredible. Yeah. So we've talked a lot up until this point about the cyber part of the AI Cyber
1299.56s - 1306.52s |  Challenge, and this is really one of the AI parts of the AI Cyber Challenge. One thing that I was
1306.52s - 1312.76s |  asked a number of times is, do I have to use AI? Can I just create a system? Is there a requirement?
1312.76s - 1318.52s |  And no, we don't believe in mandating approaches. The thesis, though, of the challenge is that AI
1318.52s - 1325.96s |  could make a fundamental difference. It could be a revolutionary add-on to existing program
1325.96s - 1331.72s |  analysis methods for finding and fixing vulnerabilities. And so one way in which
1331.72s - 1339.40s |  our collaborators participated was to provide access to their cutting-edge large language models
1339.40s - 1345.32s |  and other large models for this challenge. And part of the reason why Andrew and I are getting
1345.32s - 1350.92s |  into the weeds a little bit is because running a challenge like this is hard and required quite a
1350.92s - 1356.04s |  lot of coordination with the partners, and we're just incredibly happy that we had that.
1356.68s - 1364.84s |  Absolutely. Also, we were not prescriptive within this list. The competitors could use whichever
1364.84s - 1370.44s |  models they chose with constraints that we'll discuss a little bit later, but it was their
1370.44s - 1376.20s |  choice. We were not forcing them to use a specific model within this set. And we had a shout out to
1376.20s - 1381.64s |  LightLLM, which is the proxy that we used as a means of providing them access in a way that we
1381.64s - 1390.44s |  could regulate, speaking of resources. So in addition to the LLM access, these fully autonomous
1390.44s - 1395.32s |  systems that were not touched by the competitor teams while they were running, this was the amount
1395.32s - 1401.48s |  of compute that they were given. It's significant. It's not insignificant. But it's still, when we're
1401.48s - 1405.56s |  talking about relative cost, we're talking about tens to hundreds of thousands of dollars per
1406.12s - 1412.28s |  week, or tens to hundreds of dollars per week or month, depending on your usage.
1414.84s - 1419.56s |  And the other big constraint was how do we limit the use of the LLMs? So we actually used their
1419.56s - 1424.20s |  pricing. We pinned their pricing. And each challenge project, each team was given a budget
1424.20s - 1431.56s |  of $100 across those models to allocate as they saw fit, and then four hours of wall clock time
1432.36s - 1438.36s |  with this compute and access to those LLM APIs. And that's sort of what they were working with.
1439.48s - 1444.04s |  Those were their tools or the resources they had in addition for their CRSs to leverage.
1445.00s - 1450.12s |  And this goes back to the fundamental idea of the challenge. We want to create
1451.08s - 1456.28s |  software security systems that are usable by the community. So not only open sourcing them,
1456.28s - 1461.80s |  but making sure that the resources needed to run them are reasonable.
1461.80s - 1473.03s |  Absolutely. The competitors. So we had an incredible response to the competition call to
1473.03s - 1479.51s |  action. And we ended up getting 91 teams sign up, verified, go through all of the initial registration
1479.51s - 1485.59s |  and validate that they're interested in competing. As we released the challenge exemplars, things for
1485.59s - 1490.31s |  them to practice on is what will the competition look like? How do I know what scoring? How do I
1490.31s - 1497.19s |  know if I'm winning? How do I know what will win? As they got more and more details on that between
1497.19s - 1502.23s |  April of this year and July of this year, which once again, that is a very, very tight timeline
1502.23s - 1509.03s |  to operate on. Very tight window. We narrowed the field to 39 teams that kind of made it to
1509.03s - 1514.55s |  the starting line. Those teams had something that could be proficient, could be performant
1514.55s - 1519.83s |  in this competition. And that was very exciting. And just once again, I have immense respect for
1519.83s - 1525.11s |  all the teams, whether or not they made it to that starting line, just this was an extremely
1525.11s - 1529.83s |  challenging challenge. The software development challenge, I'm saying challenge a lot,
1531.11s - 1537.59s |  the difficulties of creating fully autonomous closed loop systems that you expect to run with
1537.59s - 1546.23s |  a lot of resources. It's not easy. And so being good at VR, being good at vulnerability
1546.23s - 1550.63s |  research, being excellent in other kind of programming disciplines does not necessarily
1550.63s - 1557.91s |  equip you to produce software that can survive in this challenge environment. And so we worked
1557.91s - 1562.71s |  with the teams, but we really just saw it was exciting to see the growth. Folks really mature
1562.95s - 1569.11s |  their capabilities from a development and stability and performance side on top of the
1569.11s - 1576.62s |  amazing program analysis and AI-based tools that they were developing. I guess I could
1576.62s - 1581.82s |  have teed that up a bit more. Yeah. So just to be clear, Andrew and I are doing this to torture you
1581.82s - 1586.14s |  if you are a team in the audience. I think it's been about 20- We're watching that timer real
1586.14s - 1591.18s |  close. Since we started. I'm not going to say whether we're close or not. You'll just have to
1591.18s - 1597.58s |  sit there. But our overall results, Andrew, do you want to talk about the slide? Absolutely. So
1597.58s - 1602.14s |  this is the scoreboard that you saw in the city. Each of those hexes actually represents one of
1602.14s - 1608.06s |  the CPVs that we inserted into the challenge projects. And this was sort of the performance
1608.06s - 1614.06s |  across all of the competitors over the course of the competition. We saw a really strong performance
1614.06s - 1621.82s |  in Nginx. We saw that lone discovery in the Linux kernel, but that is a discovery. That is an
1621.82s - 1626.46s |  achievement. And then we saw kind of performance across that range with the other challenge
1626.46s - 1632.62s |  projects. It was really interesting to see the fact that the patching was successful, that we
1632.62s - 1636.78s |  saw successful patches across a range of CWEs, a range of challenge projects, and a range of
1636.78s - 1646.31s |  languages. Getting in a little bit to more detail. So this is probably one of those slides that's way
1646.31s - 1652.23s |  better to either screenshot or like watch the video later and read about. Are you saying there's
1652.23s - 1657.99s |  going to be additional material later that talks about this? I mean, details. We love details, right?
1657.99s - 1663.35s |  We're looking forward to releasing more competition kind of details to the community
1663.51s - 1671.75s |  at large soon. But this is the high level cut here. And the takeaways are some of what we
1671.75s - 1676.95s |  expected, right? We expected people to do well with whether it was a write or a read, but some flavor
1676.95s - 1682.47s |  of heap or buffer overflow, or stack-based buffer overflow. We saw strong patching, strong discovery
1682.47s - 1693.99s |  there. We saw, you know, the Java results. I think perhaps the Java software security ecosystem
1693.99s - 1699.91s |  could use a bit more love. Like we would love to see that space get more love. But we saw a
1699.91s - 1704.39s |  promise there too. So the fact that we did see successful discoveries and finds across
1705.03s - 1713.43s |  command injection and SSRF, it's very exciting. Yeah, that's important. We're finding both memory
1713.43s - 1717.11s |  corruption vulnerabilities and non-memory corruption vulnerabilities like command
1717.11s - 1726.06s |  injection. So we have some fantastic coverage there. If you were paying very close attention
1726.06s - 1731.82s |  to the numbers there, they did not necessarily match the scoreboard because we actually had a
1731.82s - 1738.62s |  team find something that we did not insert. We found, or one of the teams found something,
1738.62s - 1745.26s |  found a bug in SQLite. If you recall from earlier, SQLite has an extremely active user base. It's an
1745.26s - 1753.90s |  OSS fuzz project. It has an extremely comprehensive corpus of unit tests. And we found, or one of the
1753.90s - 1762.22s |  teams found an all deref in SQLite and it has been patched. So that, I mean, that is very exciting.
1762.22s - 1770.22s |  Like real code was both analyzed, a defect was discovered, and a patch, or a defect was
1770.22s - 1775.66s |  discovered. We can't take for the patch, credit for the patch in this case, but like year two,
1775.74s - 1778.54s |  hashtag year two. But that was very exciting.
1787.02s - 1791.66s |  Also, credit where credit is due, that was team Atlanta. So give it up for team Atlanta.
1794.46s - 1795.02s |  Good job, guys.
1800.65s - 1809.29s |  Okay. I think we're getting a little closer. So these were all of the semi-final competitors.
1809.29s - 1810.01s |  Do you want to say anything?
1810.89s - 1811.69s |  Good job.
1811.69s - 1818.41s |  Yeah. Thank you all so much for participating. Thank you all so much for your hard work,
1818.41s - 1822.33s |  for developing these systems, for working with us as you submitted it.
1825.00s - 1830.92s |  I'll say also, you know, there is so much opportunity for this type of work. I mean,
1831.88s - 1838.20s |  no one here lacks for opportunities for work, but if you've done this, regardless of where you land,
1838.20s - 1843.16s |  regardless of if you move on to finals or not, like what you developed, what you produced
1843.16s - 1848.28s |  has value. And I strongly encourage you to think about ways of keeping that momentum going,
1848.92s - 1851.96s |  perhaps not at the breakneck pace of the challenge, you know, live your lives.
1853.00s - 1856.92s |  But there are lots of places that could benefit from this work and lots of ways for you to turn
1856.92s - 1861.72s |  this into something very real. If you're not going to use it any further, if you're like, nope,
1861.72s - 1870.44s |  I'm out, open source your CRS, please. Like give that back to like, please. I will bake you cookies.
1870.92s - 1879.80s |  Andrew's cookies are very good. I can attest. And just to echo Andrew, thank you so much for
1879.80s - 1887.24s |  all of the work that you did. Every single team that participated provided value. You gave back
1887.24s - 1894.92s |  to your community. You invested in the software security of our nation, of our world. And that
1895.88s - 1901.16s |  has been really impactful. We are so grateful to have so many fantastic competitors.
1901.72s - 1909.56s |  And we are so grateful for you working with us over the last year, for your understanding that
1909.56s - 1918.20s |  a challenge like this is a hard thing to do. It's hard to drive innovation in software security. And
1919.16s - 1926.28s |  we were thrilled to have such fantastic, intelligent competitors who, to Andrew's point,
1927.32s - 1931.72s |  do not lack for job opportunities. One more time, guys, the competitors.
1940.41s - 1947.37s |  You ready? Okay. So there is actually a point
1948.73s - 1954.49s |  that we are building towards, and that is to announce the results of the challenge.
1955.37s - 1962.22s |  Are you all ready? I don't know. It didn't sound like you all were ready. Can we do that again?
1966.98s - 1972.82s |  Okay. What you just did, I'm going to need you to do that after every competitor that we announced.
1972.82s - 1981.78s |  And we are about to go into the seven finalists of AICC. Each team will win $2 million.
1983.38s - 1990.14s |  And so here we go. These are in alphabetical order. Okay. It's the next.
1990.30s - 2003.11s |  The safety slide, the safety slide, right? 42 Beyond Bug. One of them tweeted,
2003.11s - 2008.79s |  I think yesterday, that just seeing the first bloods they were getting on the scoreboard
2008.79s - 2012.47s |  made all the sleepless nights worth it. And so I hope this does as well.
2012.47s - 2019.51s |  Yeah. Really appreciate their balanced approach, both over C and the Java challenges. Great job.
2019.51s - 2040.78s |  All you need is fuzzing brain. So this is my favorite kind of, like,
2040.78s - 2046.70s |  characterization. All you need is fuzzing brain had the most aggressive use of the LLMs.
2049.50s - 2054.38s |  Apparently, you need more. What Andrew means is for a challenge
2054.38s - 2057.98s |  where many competitors used a lot of fuzzing, they used a lot of LLM.
2068.78s - 2077.22s |  Very nice. Team Lacrosse, you had the most memorable patch when we were doing validation.
2077.22s - 2099.86s |  So thank you for that. Shellfish. I take it there are some
2099.86s - 2102.10s |  shellfish folks in the crowd. Just a few.
2104.34s - 2109.94s |  Yeah. Your software engineering approach was
2111.14s - 2121.16s |  ambitious, I'll say. Team Atlanta.
2127.56s - 2131.40s |  Yeah. Fabulous job with the SQLite find. Very cool. Awesome work.
2143.38s - 2147.38s |  At some point, I'd like it confirmed to me if Theory is actually two guys,
2149.46s - 2152.66s |  because that's the rumor. But congratulations, Theory.
2152.66s - 2156.82s |  Do you have a theory about that? I think I may have just shared it with the crowd.
2156.82s - 2157.86s |  Yeah. It's good. It's good.
2157.86s - 2159.06s |  Thank you. Yeah.
2159.06s - 2164.28s |  We're here all day. Trail of bits.
2173.50s - 2176.70s |  Your judicious use of the LLMs was also appreciated.
2178.78s - 2186.30s |  I also appreciate the information that you all have put out about your thoughts on the challenge
2186.30s - 2194.54s |  as well as your thoughts behind your system for a competition where many folks, understandably,
2194.54s - 2197.58s |  are keeping it a little close to the vest before finals.
2197.58s - 2200.22s |  The fact that you're sharing with the community some of the lessons learned
2200.22s - 2202.94s |  has really been fantastic, and I've heard that feedback.
2204.46s - 2206.62s |  The backup scoreboard on Twitter wasn't bad either.
2207.82s - 2213.51s |  Yes. Thank you, Dan. And ladies and gentlemen, the finalists.
2214.07s - 2233.43s |  Teams is winning $2 million and a chance to come back to DEF CON in 2025 to compete in AICC finals.
2240.31s - 2245.19s |  So to all the competitors, we will be reaching out shortly to provide detailed scoring information.
2245.19s - 2248.31s |  We have a lot more information to share about the competition of the results are out
2249.11s - 2251.19s |  and just really looking forward to engaging more
2251.83s - 2254.95s |  over the next year and seeing what we can all do working together.
2255.67s - 2266.92s |  Thank you. Congratulations, everyone.
2266.92s - 2268.12s |  Thank you so much.


url: https://www.youtube.com/watch?v=4cx0RUV7i0s
title: DEF CON 32 - Unsaflok: Hacking millions of hotel locks - Lennert Wouters, Ian Carroll
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=4cx0RUV7i0s",
  "title": "DEF CON 32 - Unsaflok: Hacking millions of hotel locks - Lennert Wouters, Ian Carroll",
  "description": "Electronic hotel locks have been in use for over three decades, and have become an integral part of the hospitality sector. Las Vegas has over 150.000 hotel rooms, many of which use an RFID based electronic lock for access control. Most hotel guests rely on these locks to safeguard personal belongings and to protect their personal safety. However, some of these long-deployed locks have never been publicly scrutinized by the research community.\n\nThis presentation covers the discovery of vulnerabilities affecting three million dormakaba Saflok locks. The Saflok system relied on a proprietary key derivation function for its MIFARE Classic cards and a proprietary encryption algorithm for the card contents. Reverse engineering the Saflok system allowed us to forge valid keycards. After reading a single, low privilege, guest card we are able to create a pair of forged key cards that allow us to deactivate the deadbolt and open any room at the property.\n\nWe reported these vulnerabilities to dormakaba in September of 2022, as part of this presentation we will discuss the responsible disclosure and mitigation processes. Additionally, we will demonstrate how you can determine if your own hotel room has been patched to help ensure your personal safety.\n\nMy Arduino can beat up your hotel room lock - Onity locks - Cody Brocious - Blackhat 2012\nGhost In The Locks: Owning Electronic Locks Without Leaving A Trace - Vingcard locks - Tomi Tuominen and Timo Hirvonen - HITBGSEC 2018",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2492,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

2.35s - 7.43s | This text was transcribed using whisper model: large-v2

 Thanks everyone. Welcome to our talk titled Unsaflock, Unlocking Millions of
7.43s - 12.71s |  Hotel Locks. I'm Lennart, I'm a hardware security researcher at the KU Leuven
12.71s - 17.11s |  University in Belgium. I typically do research related to voltage glitching
17.11s - 23.03s |  and other hardware attacks. I'm Ian, I'm an application security researcher. I was
23.03s - 26.45s |  formerly at the red team at Robin Hood and now I run a point search engine
26.45s - 34.09s |  called C-SERA. We got sued by Air Canada. So as you can probably tell from the
34.09s - 39.25s |  first slide, neither of us is really working on locks or RFID stuff all of the
39.25s - 43.81s |  time. So when we started working on this it was all relatively new to us. And the
43.81s - 49.57s |  reason we started looking at these locks is that a group of us got invited to
49.57s - 53.61s |  hack some Las Vegas hotels back in 2022 and they were running a bug bounty
53.61s - 57.77s |  program. And one of the elements of the hotel room that was in scope were the
57.77s - 62.05s |  hotel locks. And that's how we got nerd sniped and started looking at these
62.05s - 66.53s |  hotel locks. Now it wasn't just Ian and me, there were more people involved and
66.53s - 75.44s |  some of them are sitting here on the on the first row. So thanks everyone. So
75.44s - 82.12s |  here's some related research of other researchers. So back in 2012,
82.12s - 87.76s |  C-SERA looked at the Onity locks and she found that there is a programming part
87.76s - 91.28s |  on the outside of the door. And if you plug into this you can actually start
91.28s - 97.28s |  reading memory of the lock itself. And if you analyze this memory you can extract
97.28s - 101.24s |  the side code. And this side code is enough to send an unlock command to the
101.24s - 106.36s |  door and then open it up. Back then C-SERA immediately published all of the
106.36s - 110.00s |  details of the attack. And this resulted in some people making their own devices,
110.00s - 115.52s |  going to hotels, opening all of the doors, stealing TVs and so on. There's a very
115.52s - 120.28s |  nice Wired article about this sort of hacking spree that some people went on.
120.28s - 127.48s |  It's well worth the read I would say. Then six years later in 2018 there was
127.48s - 131.64s |  an attack on the VIN card system by Essa Abloy. This was an attack by
131.64s - 135.36s |  researchers from F-Secure and they figured out that if you can read one
135.36s - 140.56s |  card from the hotel that they can make a master key and then open every door in
140.56s - 145.48s |  the hotel essentially. In this case F-Secure worked with Essa Abloy on a fix.
145.48s - 149.76s |  And this also meant that the talk didn't include a lot of technical details. And
149.76s - 153.96s |  this is something where we want to strike a balance. So instead of
153.96s - 158.00s |  publishing all of the details immediately we went to a long responsible
158.00s - 162.08s |  disclosure process. And now we are sharing some of the details of what we
162.08s - 169.68s |  found. So this talk is about Dormakabos Saflock. It was introduced in 1988 by
169.72s - 173.52s |  Computerized Security Systems. Back then it was a mag stripe lock and then they
173.52s - 178.04s |  became RFID locks. It has kind of a weird corporate history. Computerized
178.04s - 182.80s |  Security Systems was acquired by Kava in 2006. And then in 2015 two companies
182.80s - 189.24s |  called Dorma and Kava merged and now it's called Dormakaba. Saflock is used
189.24s - 194.36s |  on three million doors in 13,000 hotels in 131 countries. So this is one of the
194.36s - 198.92s |  biggest brands of hotel locks. It's important to talk about the architecture
198.92s - 203.20s |  before we start. So these locks are usually entirely offline. So there's the
203.20s - 206.88s |  front desk server and the front desk computers have a connection. But they're
206.88s - 210.44s |  not connected to the actual hotel locks. And so the front desk will write the key
210.44s - 214.76s |  card that contains the information of what doors it should open. And then the
214.76s - 218.40s |  locks make the decisions entirely themselves. They don't contact any server
218.40s - 222.68s |  or anything. But in the case of when the lock needs to be upgraded or if you need
222.68s - 226.72s |  to see the access history there's this unit called the HH6. And you can plug
226.72s - 230.56s |  into a USB port on the bottom of the lock to use this. So generally that's the
230.56s - 236.20s |  only connection these locks have. In some places especially in large Vegas hotels
236.20s - 239.98s |  they use a kind of a semi-online architecture. So in this case the
239.98s - 243.20s |  hallways have Zigbee coordinators in them. And this allows the front desk to
243.20s - 247.52s |  kind of see the audit log. It still doesn't make it an online system. The key
247.52s - 251.44s |  cards are still read by the lock and the lock determines if it opens or not. But
251.44s - 256.32s |  afterwards it tells the front desk, hey this key opened this lock. This might be
256.32s - 259.84s |  beneficial for hotels because you can kind of detect what keys are being used.
259.84s - 268.92s |  So when we were starting out we needed a hotel to do our research on. We don't own
268.92s - 273.08s |  a hotel so we had to build one ourselves. And that first meant acquiring the
273.08s - 277.64s |  system 6000 software. As with any software this is software you can find
277.64s - 283.24s |  on some places on the internet. The other thing you need is an RFID encoder. So
283.24s - 288.48s |  this is the device that the front desk will use to encode a new key card. Back
288.48s - 294.64s |  in 2022 these were very expensive on eBay. $600 to just get one. Now thanks to
294.64s - 298.20s |  our research these have really come down in price. So now you can find them for
298.20s - 308.14s |  $45 online. So the reason they are much cheaper these days is they all have to
308.14s - 311.22s |  be replaced. So all of the hotels are essentially selling their old encoders
311.22s - 316.30s |  online. So another thing you need are my fair classic 1k cards. These are very
316.30s - 321.78s |  common, very cheap. You can find them everywhere. And optionally if you want to
321.78s - 327.02s |  actually open some doors you can also buy on eBay some door locks or a HH6
327.02s - 331.38s |  programmer if you want to play with one of those. So now that we have all of the
331.38s - 335.22s |  elements for our hotel we have to set it up. So we start by installing the
335.22s - 340.10s |  software. If you open the manual, the installation manual, the first step it
340.10s - 344.06s |  tells you is to disable all of the Windows security features and then you're
344.06s - 348.94s |  good to start running the installer. Once you've installed the software you copy
349.06s - 352.98s |  over a GDB database file to the installation directory and then you can
352.98s - 358.94s |  start the software. This database file is very useful to us. It's a Firebird
358.94s - 363.58s |  database file. It has a default username and password on there. And so you can
363.58s - 367.34s |  start reading all of the elements in the database. So this contains
367.34s - 371.66s |  configuration data for your specific hotel but also all of the cards that
371.66s - 375.94s |  were created by the hotel software. So this means that if you create a card you
375.94s - 379.50s |  can go look in the database and look at all the different fields that are
379.50s - 385.58s |  encoded on the card. Now as I said back in 2022 real encoders were very
385.58s - 391.58s |  expensive but we figured out that this system used to support just commercial
391.58s - 396.38s |  RFID reader writers at some point. So that means that you can go into the
396.38s - 400.70s |  Firebird database and you can set the hide legacy encoders flag to zero and
401.18s - 405.98s |  now you can use a cheap off-the-shelf encoder essentially. So that this is
405.98s - 414.22s |  what we used back in 2012. So about the handheld programmer. So as I
414.22s - 417.98s |  mentioned before all of these blocks have a mini USB port on the bottom of it
417.98s - 421.02s |  and obviously that struck our interest pretty quickly because it's you know
421.02s - 428.02s |  behind and it's in the hallway. So we bought the HH6 off of eBay and we tried
428.02s - 431.66s |  to use it in a lock at first and we hit an issue where it detected it was being
431.66s - 434.94s |  used at the wrong property. And so we were like okay there's some kind of
434.94s - 438.86s |  authentication here. But then we quickly realized that if we just change the
438.86s - 441.90s |  property ID in our database to the property we were staying at it would
441.90s - 446.70s |  start working. And so there's a lot of interesting features in here and we
446.70s - 450.06s |  didn't use it too much in our attack but the main interesting thing is you can
450.06s - 454.10s |  actually interrogate these locks and you can view every entry and every exit to
454.10s - 457.90s |  the room. So for example you can even see you know when housekeeping entered
457.90s - 461.82s |  your room. You can see when they left. You can see the previous guests. You can
461.82s - 465.14s |  see when they were coming and going. And if you know the property ID you can
465.14s - 469.34s |  actually do this to any door on any hotel. It was also useful for our
469.34s - 473.14s |  purposes. It will tell you why I refused to open the door. So for a long time we
473.14s - 475.58s |  were making fake key cards and we couldn't figure out why it wasn't
475.58s - 478.90s |  opening. But the HH6 will actually tell you hey this is why your key card
478.90s - 486.08s |  didn't work. So it was very useful for our purposes. So the next step was to
486.08s - 490.68s |  reverse engineer the system 6000 software. The software consists out of
490.68s - 494.80s |  some Delphi executables which are very annoying to reverse engineer. But
494.80s - 499.20s |  luckily there are also some .NET binaries in there and those are very
499.20s - 502.76s |  easy to reverse engineer. We can simply decompile them and look at the code in
502.76s - 507.32s |  .wik. Now we had a few goals for reverse engineering the system. We wanted to
507.32s - 512.52s |  understand how the my fair sector keys are derived. How the data stored on the
512.52s - 517.28s |  card is encrypted. And then once the data is decrypted what is actually the
517.28s - 522.64s |  meaning of the different fields of this data. So first a quick introduction to
522.64s - 527.00s |  MyFairClassic. Most of the Cephalog deployments use MyFairClassic 1k cards.
527.00s - 532.92s |  These 1k cards have 16 sectors each containing four 16 byte blocks. So they
532.92s - 538.40s |  are essentially just storing data. Block 0 is special. It's the manufacturer block.
538.44s - 544.16s |  It contains the UID and the manufacturer data. And then the last block of every
544.16s - 548.68s |  sector contains the keys. So the keys that you need to authenticate and to
548.68s - 554.20s |  read the data on the cards. Every sector has two keys associated to it. Key A and
554.20s - 559.96s |  key B. And then essentially the access conditions indicate what actions you
559.96s - 565.08s |  are allowed to perform with either of these keys. Now if you look specifically
565.48s - 570.00s |  at the Cephalog cards. And in the case of the Cephalog system all of the
570.00s - 575.08s |  interesting data is stored in sector 0. And the key to read that sector is
575.08s - 580.36s |  derived from the UID. So all of the keys marked in orange on the slide are unique
580.36s - 584.72s |  for every key card. So they always change. But they are derived from the UID. Which
584.72s - 590.08s |  is not a very secure way of implementing this. The key for sector 1 is the same on
590.08s - 593.64s |  every Cephalog card across all of the deployments. And that means that if you
593.72s - 597.68s |  read one of these cards and you see this key. Then you immediately know it's a
597.68s - 604.56s |  Cephalog system. So the key derivation function. To read the data from the card
604.60s - 608.84s |  we need the keys to authenticate to this sector. There's a few ways you can get
608.84s - 613.68s |  those keys. You can use a Poxmark tree. Run HFMF autophone. And it will
613.68s - 618.04s |  immediately spit out all of the keys for you. The other way to do it is to
618.04s - 621.92s |  actually reverse engineer the key derivation function. And it turns out
621.96s - 626.24s |  that back in 2022 multiple people had already done this. They had
626.24s - 630.32s |  reverse engineered the KDF. But they hadn't published it. So at the time we
630.32s - 634.76s |  had to reverse engineer it ourselves. In the meantime someone has published the
634.76s - 639.48s |  KDF. And now it's also implemented in the Poxmark tree project and in the
639.48s - 646.48s |  Flipper 0. It's maybe interesting to know that knowing the KDF is not
646.48s - 650.76s |  strictly necessary for our attack. And that's because there are cryptographic
650.76s - 657.10s |  attacks on the MyFair Classic cards. So reverse engineering the KDF. We
657.10s - 662.30s |  figured out that the Cephalog card encoder DLL contains a Kaba get secured
662.30s - 667.54s |  keys function which implements this KDF. Initially we weren't 100 percent sure
667.54s - 670.74s |  that this is the correct function we wanted to reverse engineer. So we we
670.74s - 674.78s |  made a simple Python wrapper that uses the DLL. And then we could feed in some
674.78s - 679.58s |  new IDs and check if the response was the same key as what we were seeing in
679.58s - 683.30s |  the Poxmark project essentially. And then later on when we were sure this was
683.30s - 687.34s |  the correct function we translated it to Python so that we had our own library
687.34s - 693.33s |  for it. So now we have a pretty good way of reading the data on the MyFair card.
693.33s - 696.73s |  But of course our goal is not just to clone it. We want to modify what rooms
696.73s - 701.05s |  the key can open. And so we learned that really the only data that matters is the
701.05s - 705.21s |  16 bytes on block 1 which kind of tells lock which doors the lock can open. And
705.21s - 709.85s |  then the first byte on block 2 is a checksum of the first block. And so we
709.85s - 713.17s |  wanted to figure out it looked like the data was encrypted on the sector because
713.17s - 716.89s |  we didn't really see anything meaningful in it. And we found this encrypt card and
716.89s - 721.05s |  decrypt card function in the Firebird services DLL. And so using that we
721.05s - 724.65s |  discovered that the data on the card was actually encrypted using just a
724.65s - 728.87s |  substitution table. And we unfortunately also learned that that substitution
728.87s - 733.61s |  table is the same for every Saflock hotel. So every Saflock installation has
733.61s - 739.92s |  the keys to decrypt and encrypt every Saflock card. And so now we know how to
739.96s - 744.20s |  decrypt it. And now we want to start changing what the fields are. But we had
744.20s - 746.72s |  to decrypt the data but we still didn't really know what the 16 bytes
746.72s - 750.60s |  represented. Luckily in the same DLL we found a function that we didn't think
750.60s - 755.16s |  was actually being used. But it basically assembled the 16 bytes for an emergency
755.16s - 758.56s |  card. And so we kind of took a look at this function and saw you know what
758.56s - 762.96s |  fields is it writing to on sector 1. And we were able to kind of work from there.
762.96s - 766.36s |  Work backwards and say OK these bytes are the expiration. These bytes are the
766.36s - 770.44s |  room number. Stuff like that. And being able to create cards was also very
770.44s - 773.48s |  useful. We had our fake hotel so we created some cards and we were able to
773.48s - 777.12s |  decrypt that data. And see you know through this field's line with what we
777.12s - 781.52s |  expected. And so slowly byte by byte we figured out what the data was starting
781.52s - 789.94s |  to mean. So this is the full card data format for the Saflock systems. It is in
789.94s - 793.18s |  alphabetical order. So if you want to reproduce it you will have to figure out
793.18s - 797.42s |  the correct order of the fields. There's a few logical fields in here. There's the
797.46s - 802.10s |  card creation date. So this is like up to the second when the card was created at
802.10s - 806.94s |  the front desk. There are card levels indicating if this is a guest key, a
806.94s - 811.38s |  master key or an emergency key. There's quite a few of these levels. There's a
811.38s - 816.06s |  few different types of cards but we'll get into those later on. There's a
816.06s - 820.46s |  deadbolt override bit which sounds very interesting obviously. And then there's a
820.46s - 825.74s |  few more fields. So the lock ID is an interesting one. This is just a numerical
825.82s - 830.66s |  indicator in a database linking a specific, linking to a specific lock. So
830.66s - 834.74s |  you can't simply figure out what the lock ID is for a specific room number.
834.74s - 839.66s |  But if you know the lock ID for your room number you can sort of guess what
839.66s - 845.18s |  the room next door has as a lock ID. The other thing that we need to know to make
845.18s - 850.46s |  cards for every deployment is the property ID. So this is a 12-bit number
850.46s - 854.54s |  that is supposed to be different for every hotel. And to make a card for a
854.54s - 858.78s |  hotel you need to know this property ID. And finally there's a sequence and
858.78s - 862.82s |  combination field. And this was by far the most annoying field in this entire
862.82s - 869.78s |  data format. And it took us quite a while to figure out how to work around this. So
869.78s - 875.30s |  as I mentioned before, multiple card levels and card types. Most of the keys
875.30s - 879.94s |  you will get when you check into a hotel will have lower levels. So guest keys,
879.94s - 884.50s |  connector keys, suite keys and so on. And they typically only open a single room
884.50s - 889.10s |  in the property. Then there's more special cards like housekeeping keys
889.10s - 893.98s |  that typically open a range of rooms. So maybe a floor or a specific tower in the
893.98s - 898.06s |  hotel. And then finally we get to the interesting ones like the emergency key.
898.06s - 902.90s |  And the emergency key is interesting because since it's used for emergencies
902.90s - 907.22s |  it also overrides the deadbolt. So if someone inside of the room flips the
907.22s - 910.82s |  deadbolt and someone taps an emergency key on the card it will allow them to
910.86s - 914.58s |  override this deadbolt. I think it's important to realize if you're staying in
914.58s - 920.18s |  a hotel the deadbolt is just software controlled. Two more interesting key
920.18s - 923.86s |  levels are the programming, primary programming key and secondary programming
923.86s - 928.34s |  key. And we think the idea here is that you would tap one of these cards to a
928.34s - 935.77s |  lock before you can actually reprogram the lock with an H86 programmer. So as
935.77s - 939.01s |  Leonard said we spent quite a lot of time on the sequence and combination
939.01s - 942.05s |  because we knew what every field meant but we couldn't figure out the valid
942.05s - 946.25s |  sequence combination for a lock. So each lock has its own combination value
946.25s - 951.21s |  between 0 and 4095. And as Leonard said you can kind of guess what lock IDs are
951.21s - 954.77s |  but guessing the combination is very painful. And there's also a sequence
954.77s - 957.89s |  number and so this is used just as you check in and check out each guest gets
957.89s - 961.13s |  their own sequence number. So for example if someone checks in after you they'll
961.13s - 964.79s |  tap their sequence number and that will invalidate all the previous ones. So that
964.79s - 968.05s |  prevents you know two people from having a valid key to the same room as that
968.05s - 971.73s |  would be pretty bad. And the field is just the sequence encrypted and
971.73s - 975.81s |  combined with a combination. And as I said this is really the only field that
975.81s - 981.41s |  gave us any trouble in making a valid guess key. At first we tried to brute
981.41s - 986.25s |  force the field. Leonard tapped the Proxmark about 4,000 times trying to
986.25s - 991.97s |  guess what the valid sequence number was. This doesn't work. I don't suggest it. The
991.97s - 995.65s |  lock does detect that you're trying to just guess key cards and it kind of
995.65s - 1001.33s |  shuts itself down. It's also very physically strenuous and annoying. Later
1001.33s - 1004.73s |  kind of the crux of our discovery it was that we found that because these
1004.73s - 1007.73s |  locks are offline they sometimes have to be re-sequenced if they become
1007.73s - 1012.25s |  desynchronized with the front desk. And what a re-sequencing card does is it
1012.25s - 1015.21s |  just simply tells lock hey this is your new sequence and this is your new
1015.21s - 1018.21s |  combination. And that's perfect for us because those were the only two fields
1018.21s - 1022.41s |  we didn't know. So we were able to create a key card that simply re-sequenced as a
1022.41s - 1025.77s |  lock and tells it hey this is your new secret value and that's the only one you
1025.77s - 1031.56s |  need to create a forged key card. So now we have all the elements to make a full
1031.56s - 1036.12s |  attack. So the idea is that you would start by obtaining any card from the
1036.12s - 1040.44s |  hotel just to get the property ID. This can be your own card, this can be an
1040.44s - 1044.92s |  expired card, can be a card you found on the floor from the Express checkout box
1044.92s - 1049.80s |  or simply one you bought from eBay. So once you have the property ID we can
1049.80s - 1055.12s |  start forging keys. So we forge a re-sequencing key card for a privileged
1055.12s - 1060.08s |  level. So emergency or grandmaster. And the reason for picking emergency is that
1060.08s - 1064.52s |  it works on all of the doors so you don't have to guess a lock ID anymore.
1064.52s - 1069.92s |  Then you walk up to a door, you tap your re-sequencing key card, it re-sequences
1069.92s - 1073.28s |  the lock and then you have your second key card that is an opening key for the
1073.28s - 1078.00s |  same level and it will open the door. And the nice thing is you make this pair of
1078.00s - 1081.84s |  cards once for every property and you can now walk around and open every
1081.84s - 1094.59s |  single door in the hotel. So of course we also implemented this as a full
1094.63s - 1099.15s |  proof-of-concept attack. At this point we had already written a PySaflock module.
1099.15s - 1102.75s |  So it's a Python module that supports doing the key derivation function,
1102.75s - 1107.59s |  decrypting the card data, deserializing it into the different fields. Then we can
1107.59s - 1112.39s |  change fields, re-encrypt it or re-serialize it, re-encrypt it and then write it
1112.39s - 1116.11s |  back to a card. And instead of implementing all of this within the
1116.11s - 1119.95s |  Proxmark codebase, since we already had the Python script, we sort of made
1119.95s - 1124.43s |  simple wrapper functions that call Proxmark codes to read and write stuff
1124.43s - 1131.07s |  to a card. Then obviously these days we have to implement the same thing on a
1131.07s - 1136.47s |  Flipper 0. This was relatively straightforward. You can make an NFC
1136.47s - 1140.11s |  supported card plugin and that essentially has to implement three
1140.11s - 1144.47s |  functions. So the first function is verify and that's essentially a function
1144.47s - 1148.83s |  that tries to verify if the card you tapped is a Saflock card. As I mentioned
1148.83s - 1153.31s |  earlier, sector 1 has a default key and you can use that default key to detect
1153.31s - 1158.19s |  if the card is a Saflock card. Now that you should have a Saflock card, you go to
1158.19s - 1162.83s |  the read function. The read function derives the key, so implements the KDF
1162.83s - 1167.95s |  and then reads the relevant data blocks. Now that you have those data blocks, you
1167.95s - 1172.91s |  can decrypt them, parse out the data and then from there generate, re-sequence an
1172.91s - 1178.67s |  emergency card that gets stored on the Flipper's file system. Before anyone asks,
1178.67s - 1184.15s |  we're not releasing this plugin, but there is a KDF plugin available on
1184.15s - 1187.75s |  GitHub that someone else made and you can actually use that plugin to check
1187.75s - 1195.72s |  if you're staying at a Saflock hotel. So as I mentioned previously, we actually
1195.72s - 1200.96s |  found this at DEF CON two years ago and it was a very long disclosure process. So
1200.96s - 1204.80s |  in August we kind of found, you know, the decryption key and we were able to read
1204.80s - 1207.92s |  and write to the card, but we didn't actually figure out the re-sequencing
1208.08s - 1212.96s |  until a month later. Finally, we were able to figure that out and we
1212.96s - 1217.36s |  created a complete proof of concept. Unfortunately, Dorma Kava didn't have any
1217.36s - 1222.84s |  disclosure process and so I had to message their CISO on LinkedIn. Luckily,
1222.84s - 1226.32s |  he actually took it seriously and responded quickly and they actually have
1226.32s - 1231.80s |  a VDP now, I think, which is great. We had our first meeting with them in October
1231.80s - 1236.50s |  and from there I think we had at least 13 meetings with Dorma Kava talking
1236.50s - 1240.46s |  about the vulnerability and how they were going to fix it. As I mentioned, it's
1240.46s - 1244.58s |  three million hotel locks and I don't think they were fully ready to do that
1244.58s - 1250.24s |  upgrade for a while and it was quite a painful change. But in November 2023, they
1250.24s - 1254.62s |  upgraded the first hotels to resolve the vulnerability, which was great. And then,
1254.62s - 1259.50s |  as you may have seen, in March of 2024 we did a limited disclosure of saying, you
1259.50s - 1262.06s |  know, these hotel locks have a vulnerability but, you know, we're not
1262.06s - 1266.34s |  gonna say exactly what it is. At the time we published it, 36% of
1266.34s - 1271.14s |  the locks have been upgraded. Today is our DEF CON talk. They only told us the
1271.14s - 1273.90s |  majority of the locks have been updated. We don't have a specific percentage
1273.90s - 1278.34s |  anymore. And they said nearly all Las Vegas properties are in the process of
1278.34s - 1283.22s |  being mitigated or have been mitigated, more or less.
1284.74s - 1289.54s |  Remediation. They added a new enhanced security mode and this is to their
1289.54s - 1293.90s |  Ambiance software. So we mostly looked at system 6000. That's kind of deprecated
1293.90s - 1297.14s |  now. There is a fix for it but it's not as good as the enhanced
1297.14s - 1302.06s |  security mode. The new enhanced security mode has a new KDF. It encrypts the card
1302.06s - 1307.22s |  data using AES, which is much better than a hard-coded substitution cipher. And it
1307.22s - 1310.74s |  also uses MyFair Ultralight C. So even if you're able to decrypt the card data,
1310.74s - 1313.62s |  it's still hard to actually write it to the card because you don't know the card
1313.62s - 1318.06s |  keys. And as I mentioned previously, they also replaced all of the encoders and so
1318.06s - 1321.30s |  there's a new encoder for making the keys that also has a secure element
1321.30s - 1328.25s |  inside of it. So a lot of people ask us why did it take so long to fix these
1328.25s - 1332.21s |  hotel locks? Why did it take two years? And it turns out that the main issue are
1332.21s - 1336.29s |  the integrations. So of course first, Tomacabra had to come up with a fix for
1336.29s - 1340.49s |  their own hotel locks. But then if you start thinking about especially big Las
1340.49s - 1344.49s |  Vegas properties, they have so many integrations with the hotel locks. So
1344.49s - 1349.45s |  maybe you use the kiosk to check in. You've used the elevators. There's payment
1349.45s - 1353.97s |  solutions in some hotels. And some hotels even have towel machines. And so
1353.97s - 1358.01s |  when a hotel decides to upgrade their hotel locks, all of these systems have to
1358.01s - 1361.05s |  be upgraded as well. And that typically means that they have to contact the
1361.05s - 1364.69s |  manufacturers of these systems. And so you can imagine this takes a long time.
1364.69s - 1370.13s |  Most of the locks have to be updated manually. That means that someone has to
1370.13s - 1373.05s |  walk up to the door and hold the programmer in front of the lock for two
1373.05s - 1378.73s |  minutes. Three million locks times two minutes is a lot of minutes. So that's it
1378.73s - 1384.61s |  takes a long time. Then additionally you have to convince property owners to
1384.61s - 1388.05s |  perform this update. And that's also one of the reasons we had this limited
1388.05s - 1391.85s |  disclosure initially. To make hotel owners aware of the vulnerability and
1391.85s - 1397.09s |  give them some extra time to implement a fix. We were told that at the peak of
1397.09s - 1402.33s |  deploying this fix, Tomacabra was resolving 500 properties per week.
1402.33s - 1408.88s |  Another thing that has changed now in the new update is that the standard guest
1409.00s - 1413.76s |  cards will be using ultralight C. And one of the reasons people are making the
1413.76s - 1417.48s |  switch over to ultralight C now is that the cost of ultralight C cards has come
1417.48s - 1423.48s |  down a lot over the last few years. So if we talk about card cost, we found a few
1423.48s - 1432.32s |  statistics online. So on average a hotel is occupied 65%. An average stay at a
1432.32s - 1437.76s |  hotel takes 1.8 nights. The average number of cards that gets made per stay
1437.76s - 1444.00s |  is 2. And only 25% of all cards are returned when you check out. Now if we
1444.00s - 1448.08s |  think about big Las Vegas properties that have between 3,000 and 7,000 rooms,
1448.08s - 1453.04s |  then you can imagine they make a lot of cards. So if we do a bit of simple math
1453.04s - 1461.84s |  then we end up with a hotel with 5,000 rooms having roughly 660,000 stays per
1461.84s - 1466.76s |  year. That means that around 1.3 million cards are made at one of these big
1466.76s - 1472.60s |  properties of which only 300,000 are being returned after stays. So that means
1472.60s - 1478.16s |  that a hotel needs to buy roughly 1 million cards per year. If you assume 10
1478.16s - 1483.44s |  cents per card that's $100,000 just in RFID cards. Now if you think about a
1483.44s - 1488.64s |  MyFair Classic card which is very cheap and maybe those were 10 cents, if an
1488.64s - 1494.00s |  ultralight C card a few years back was 20 cents then that would mean $200,000
1494.24s - 1498.16s |  in cards. And that's the reason you still find a lot of MyFair Classic cards
1498.16s - 1503.80s |  around. But luckily prices have been coming down also because there's more of
1503.80s - 1508.08s |  these systems asking for ultralight C cards. And so they've become cheap enough
1508.08s - 1514.42s |  to the point where hotels are now using ultralight C. So I guess most of the
1514.42s - 1517.70s |  people in this room are staying at a hotel this week. So how can you tell if
1517.70s - 1523.02s |  the hotel you're staying at is using Saflock and if it's fixed or not? It's
1523.02s - 1527.42s |  relatively easy to see if a hotel is using Saflock. Typically you can only
1527.42s - 1531.18s |  tell when you're checking in. If you look over the counter you can see the
1531.18s - 1536.26s |  encoders. So we have two pictures of encoders on the slide here. The leftmost
1536.26s - 1541.62s |  one is an old encoder. It's thicker, it's bigger. And the one on the right is a
1541.62s - 1546.82s |  new one. Now if you see the old one you know it's a vulnerable system. If you see
1546.82s - 1551.18s |  the new one it could be a fixed system or it can be a system that is in the
1551.18s - 1556.90s |  progress of being mitigated to the new solution. You can also quickly recognize
1556.90s - 1562.10s |  the locks that are used in these systems. So the small black puck type lock with
1562.10s - 1567.82s |  the S going to it is very common here. And those are Saflock locks. So if you
1567.82s - 1573.18s |  see those you know it's a Saflock system. Then the next thing you can do is you
1573.18s - 1578.02s |  get a card from when checking in. You can tell if it's a Mifer Classic or an
1578.02s - 1583.26s |  Oatail HC card. So then you use your your favorite RFID tool which we all
1583.26s - 1587.82s |  know is the Flipper Zero with Iceman firmware. Or you use an Android phone
1587.82s - 1591.34s |  with the NFC tag info app and that allows you to tell what type of card it
1591.34s - 1596.74s |  is. So if it's a Mifer Classic card then you know that the system is still
1596.74s - 1601.54s |  vulnerable to this attack. Or it's not a Saflock deployment so you have to
1601.54s - 1607.94s |  really do all three of the steps. So how to protect yourself in Oatail. You see
1607.94s - 1612.46s |  it's Saflock. You see it's Mifer Classic. Well you're probably screwed. But
1612.46s - 1617.82s |  there's some things you can buy. There's a door bolt deadbolt velcro
1617.82s - 1620.46s |  strap and that kind of holds the deadbolt closed. And so that kind of
1620.46s - 1624.20s |  prevents it from opening externally. You can also get under door wedges which
1624.20s - 1626.98s |  kind of drill themselves into the carpet and prevent the door from opening.
1626.98s - 1630.22s |  Obviously there's a gun of hacks but they could be good if you travel a lot.
1630.22s - 1634.38s |  And Deviant has some great videos about hotel security as well. And just in
1634.42s - 1638.06s |  general even if you're not staying in a Saflock hotel you know maybe next year
1638.06s - 1644.98s |  there'll be more vulnerabilities. So that's it. Summary. Reading a single card
1644.98s - 1649.10s |  at a hotel allows us to open any door at the property if it's vulnerable. The
1649.10s - 1654.06s |  system has been in use since 1988. You'd say hey they didn't have Mifer Classic
1654.06s - 1657.50s |  back then and it's true. But they did the same thing for MagStripe cards. So
1657.50s - 1661.62s |  unfortunately the system has been vulnerable since before Leonard and I
1661.62s - 1668.66s |  were even born. And you know many aspects of these systems still haven't
1668.66s - 1672.18s |  been looked at. Once we found a way to you know make these master keys we
1672.18s - 1675.98s |  didn't really care about the rest of it. But there's a wide scope. The locks have
1675.98s - 1680.58s |  USB ports. The you know there's many many aspects to these systems and more
1680.58s - 1684.78s |  vulnerabilities likely exist somewhere. Luckily the cost of the secure cards
1684.78s - 1688.70s |  have come down a lot. Ultralight C, Deathfire, stuff like that. Obviously it's
1688.70s - 1692.54s |  a lot better than using Mifer Classic which has been broken forever. And
1692.54s - 1695.54s |  overall even though we had to message them on LinkedIn at first we did have a
1695.54s - 1698.86s |  positive experience working with Dorma Kava. They didn't take it seriously and
1698.86s - 1705.46s |  they didn't sue me. So that's always great. It's time for a demo.
1708.10s - 1727.76s |  Okay we have two demos. Are we gonna attempt to show two demos? So for the
1727.76s - 1737.16s |  first demo we'll be using the Proxmark 3. I have a few RFID cards here. One of
1737.16s - 1745.74s |  them says valid. As you can tell it opens the lock. Now if someone is staying
1745.74s - 1750.38s |  inside of the room and they have the deadbolt on then this card no longer
1750.38s - 1760.30s |  works. So that's a normal behavior of regular guest cards. The second card I
1760.30s - 1769.79s |  have says expired or invalid and that card obviously doesn't work. So we assume
1769.79s - 1773.79s |  that this is the card the attacker finds in the hallway or it's maybe the
1773.79s - 1779.59s |  card to their room. And finally I have the the two attacker cards labeled one
1779.59s - 1783.59s |  and two. And just to show you that I'm not cheating for the demo I'll tap these
1783.59s - 1792.79s |  to the lock and show that the lock doesn't open. Okay so now we'll start by
1792.79s - 1803.78s |  reading the expired or the invalid card with the Proxmark. So what we do here is
1803.78s - 1808.06s |  we take the UID that we read from the card. We derive the key for the sectors.
1808.06s - 1813.18s |  We read the data from the card. We decrypt it. We deserialize it. And here
1813.18s - 1816.86s |  we're printing a few of the fields that are stored on the card. So you can see
1816.86s - 1821.18s |  this is a level one card. So it's a regular guest key. It was made for the
1821.18s - 1825.54s |  for the lead room. And you can also see that the card was created in 1990. And
1825.54s - 1829.06s |  that means the card is expired and that's why it no longer works on this
1829.06s - 1834.46s |  lock. Now what we really need from this card is the property ID. And using this
1834.50s - 1841.77s |  property ID we can now start making new cards. So I'll first reprogram the first
1841.77s - 1852.00s |  card. So what we're making now is an emergency level re-sequence card. So
1852.00s - 1859.52s |  that's the re-sequencing key. And the next key we make is an opening key. And
1859.52s - 1866.50s |  now we're ready to break into hotel rooms. I'm gonna assume the person that's
1866.50s - 1869.42s |  staying in this room has a deadbolt turned on and then we'll start carrying
1869.42s - 1877.86s |  out the attack. So the first key re-sequences the lock and essentially
1877.86s - 1897.84s |  enables the second card. And like I mentioned before you can use these two
1897.84s - 1901.60s |  cards over and over again in the same property and open all of the all of the
1901.60s - 1906.20s |  doors. Now the second demo is essentially the same thing but using the
1906.20s - 1913.74s |  flipper zero. I hope it's visible on the screen. But the idea is that whatever I'm
1913.74s - 1916.58s |  doing here on the flipper is the same thing as you see on the screen over
1916.58s - 1924.50s |  there. So essentially we just go into the NFC menu. I'm using the expired card
1924.50s - 1939.87s |  again. So I'll read the expired card. It tells us it's a Zephyr card. We can
1939.87s - 1944.03s |  again see that the card level, the property ID, the lock ID and that this
1944.03s - 1949.51s |  card was created in the 1990s. And in the background what this flipper app has
1949.51s - 1955.35s |  done is it has automatically created two extra cards. So this first entry is a
1955.35s - 1959.79s |  copy of the card we just read. And then the second one is the re-sequencing key.
1959.79s - 1972.49s |  So we can start emulating this one. So now now the lock has been re-sequenced.
1972.49s - 1983.03s |  We go back into the menu. We take our opening key. We emulate it. And it opens
1983.03s - 1996.30s |  the lock. So thanks everyone for coming to the talk. If anyone has questions we'll
1996.30s - 2014.49s |  try to answer them. I'm too short for this. Hello. Um is that the Iceman firmware
2014.67s - 2019.67s |  up there? Yeah it's a special beta release. Alright. Ok actual question. Um you know
2023.37s - 2028.55s |  considering what you said about like the you know the software from Dormakaba uh do
2028.55s - 2032.55s |  you think the responsibility lies on Dormakaba or like the hotels for how long it's
2032.55s - 2036.69s |  taking them to upgrade their systems? Thinking about like the the logging and even
2036.69s - 2043.54s |  like the encryption method used for their cards? It's a good question. Um we also
2043.58s - 2048.82s |  don't know entirely how Dormakaba is handling the like resolving or doing the the
2048.82s - 2053.82s |  updates. How much of it hotels have to pay. How much Dormakaba pays and so on. Um I
2054.52s - 2058.60s |  think that the logging stuff is more an idea we came up with ourselves. Like our idea
2058.60s - 2063.70s |  was if if the front desk can can see logs of who's entering the rooms and so on. Then
2063.70s - 2068.14s |  in theory it shouldn't be too difficult to check if someone is using a re-sequencing
2068.14s - 2071.78s |  card for example. And you could have some alerts triggered when something like that
2071.82s - 2076.92s |  happens. Ok and then Ian um you know I heard you were a degenerate gambler. Are you up or
2076.92s - 2081.92s |  down? No I think I'm even now. Are you? Hell yeah. Ooh what's going on? Uh thank you so
2088.77s - 2093.45s |  much for talking about the disclosure process and explaining all the other factors that
2093.45s - 2098.15s |  weigh on timelines and things like that. Uh it's really important for all the researchers
2098.15s - 2101.95s |  to understand that and I think it's wonderful. Did you find the process of working with
2101.95s - 2106.15s |  them to be smooth the whole time? Or did was it like smooth with an executive and then
2106.15s - 2112.75s |  like lawyers? Like how did that go? Uh they did ask us to sign an NDA at first but we
2112.75s - 2119.07s |  said no. And from there it was pretty good. Uh I think obviously it was I think one of
2119.07s - 2123.17s |  their first times you know going through this process. And so you know we just had to set
2123.17s - 2127.43s |  our our expectations of like you know we're eventually going to disclose this and it needs
2127.43s - 2131.57s |  to be fixed. And I think once once we all understood that it was it was ok. They were
2132.09s - 2136.73s |  they never threatened to sue us or anything. Uh so it was never hostile at all. Cool. We're
2136.73s - 2141.41s |  really proud of you. Thank you guys. I'll just add that I think for them it was very new.
2141.41s - 2148.65s |  And thanks. Um and like the picture you see in this slide is actually um a video set that
2148.65s - 2153.95s |  they had at their facilities. And on the website on unsafelock.com we have a small video
2153.95s - 2160.66s |  showing the attack and that video was actually shot at the facility from Dormakabu. Thank
2160.68s - 2166.82s |  you to them for that. Um did you say that the substitution table was the same for every
2166.82s - 2173.46s |  property? So you said they replaced that with AES? Um in the enhanced mode it uses AES. Um I
2173.46s - 2178.10s |  think they made if you're still using the old system 6000 my understanding is it's no longer
2178.10s - 2182.94s |  a substitution table. I don't know if it uses AES or um but it's it's something that's
2182.94s - 2186.58s |  specific to each hotel at least which is better than what they had before. That was my
2186.60s - 2191.14s |  question. Are the keys now specific to each property like or do you know one way or the
2191.14s - 2199.17s |  other? That's our understanding. Yeah. Fingers crossed. Alright thank you. Hi. Um so you
2199.17s - 2205.11s |  mentioned when you re-sequence a lock um it invalidates all of the existing cards with I'm
2205.11s - 2210.41s |  assuming lower sequence numbers. Does that also happen with the emergency card that you
2210.41s - 2217.77s |  re-sequence the lock with? So I I think you were asking about invalidating older cards and
2217.79s - 2223.33s |  sequence numbers right? Yeah. Yeah. Um so the idea or at least the way we think it works is if
2223.33s - 2227.67s |  you check in at the hotel the sequence gets incremented and once a lock sees a higher
2227.67s - 2232.87s |  sequence number it stop accept stops accepting older sequence numbers. And the same thing
2232.87s - 2237.65s |  is probably true for emergency cards. Uh but since our first card sort of re-sequences the
2237.65s - 2242.31s |  lock and tells it this is now your sequence number we can then use our our lock. So the
2242.39s - 2249.43s |  re-sequencing cards can have any sequence number you want. So then the older cards that
2249.43s - 2254.87s |  worked on the lock before that will get invalidated as a result? I couldn't get it. So I
2254.87s - 2258.95s |  think you're asking if we do our attack do the guest key cards get invalidated? Yeah. So the
2258.95s - 2263.01s |  sequence is specific to each level so in our attack we're doing the emergency key cards so it
2263.01s - 2267.55s |  would break the emergency key cards for the hotel but the guest keys would be unaffected. Um
2268.23s - 2279.20s |  Gotcha. Thank you. Is it possible to brute force the property ID so then you wouldn't need
2279.20s - 2284.90s |  another key from the same hotel? Um we could speculate that there's a way to do it. I don't
2284.90s - 2288.30s |  know if I would do it via brute forcing because it is pretty painful like you have to
2288.30s - 2293.54s |  physically move the device you know across the lock each time. Um but as I said like the USB
2293.54s - 2297.62s |  port seemed pretty interesting to us and there may be a way to like get that info from it. Uh
2297.66s - 2305.50s |  we just didn't look at that surface at all really so. Thanks. Two questions um one are you
2305.50s - 2313.94s |  staying at Resort World? Two is Resort World a Safelock co- hotel? I'm sorry I couldn't hear
2313.94s - 2322.58s |  the question. The second one was uh is Resort World a Safelock hotel? Yeah I. We've we've
2322.58s - 2326.42s |  both stayed at Resort World and uh we believe it's been fixed there. I believe all the cards
2326.42s - 2336.44s |  are ultralight C there so. So for the uh legacy encoder that uh Dormakaba is replacing um it
2336.44s - 2341.30s |  appears that that can also write ultralight C. So do you know why they replaced that
2341.30s - 2346.84s |  encoder? I'm sorry I think the mic is a little low so I'm having trouble hearing the
2346.84s - 2350.92s |  question sorry. Sorry I was saying um so for the legacy encoder that Dormakaba is
2350.92s - 2355.88s |  replacing it appears that with the system 6000 software it can also read and write the
2355.88s - 2360.92s |  ultralight C cards. So do you know like what additional security they got by replacing it?
2362.12s - 2367.08s |  Um they told us that they added a secure element to the new encoder um we didn't we didn't look
2367.08s - 2371.96s |  and they didn't tell us on exactly how that's used um but I think that was part of the reason
2371.96s - 2376.20s |  um I'm not sure if the old encoders support ultralight C or not as well. I'm not sure.
2377.64s - 2383.00s |  I think the older system supported other cards not just Minecraft Classic I think they had
2383.00s - 2387.64s |  even support for ultralight for a while and just no one really seemed to use it like all of the
2387.64s - 2395.59s |  software deployments we've seen were Minecraft Classic. Thank you awesome talk. Hi I've read
2395.59s - 2401.59s |  my photos card and it's not my fair but it's ST chip do you know if it's valuable or not?
2403.11s - 2409.27s |  ST chip? It's quite difficult to understand the questions up here but. I have a card with ST chip
2409.27s - 2415.59s |  not my fair. Did you look at those? I haven't looked at any hotels that had ST chips in them
2415.59s - 2423.43s |  but maybe Iceman knows about this specific card for a moment. I don't know sorry. Okay thank you.
2432.50s - 2437.54s |  Now he's gonna heckle us. Hi I'm Iceman I have a question to you.
2440.26s - 2444.66s |  Uh no the ST card is not vulnerable in that sense yes it's true but
2444.66s - 2452.42s |  Jen Benjamin Dupree did some work with it. Awesome fucking research I'm in awe by it.
2453.30s - 2466.92s |  It's amazing. I bow to the gods of RD hacking but to be honest it was Minecraft Classic and
2466.92s - 2471.64s |  you did do have .NET so I think that's cheating I thought you would done more hardware.
2473.00s - 2478.04s |  With that said give them a well-rounded applause for us they are fucking amazing.
2478.44s - 2488.81s |  I guess that's it. All right thank you so much appreciate it.


url: https://www.youtube.com/watch?v=8oAxv7UBZJA
title: DEF CON 32 - Atomic Honeypot-A MySQL Honeypot That Drops Shells - Alexander Rubin, Martin Rakhmanov
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=8oAxv7UBZJA",
  "title": "DEF CON 32 - Atomic Honeypot-A MySQL Honeypot That Drops Shells - Alexander Rubin, Martin Rakhmanov",
  "description": "Meet an attacking MySQL honepot which can \u201cAttack the attackers\u201d. In 2023 we have found a CVE (CVE-2023-21980) in MySQL that allows a rogue MySQL \u201cserver\u201d to attack a client connecting to it; attack meaning RCE on the client side. Since then we were thinking on how to use it for good. One obvious application is to create a honeypot which will attack the attackers. In 2024 we have found another RCE in mysqldump utility (CVE-2024-21096), so we have created a rogue MySQL server and weaponized it with a chain of 3 vulnerabilities: 1/ arbitrary file read 2/ RCE from 2023 (CVE-2023- 21980) 3/ the new RCE (CVE-2024-21096). With this atomic honeypot we were able to discover 2 new attacks against MySQL server. Using arbitrary file read vulnerability in MySQL we were able to download and analyze the attackers' code and then execute an \u201cattack against attackers\u201d using a chain of exploits.\n\nCVE-2023-21980 CVE-2024-21096",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1318,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 6.88s | This text was transcribed using whisper model: large-v2

 attack. We know that bots are everywhere, they're scanning your servers, they're doing it fast,
6.88s - 13.51s |  and database servers is obviously a big target. So we have um create uh we have created a high
17.25s - 22.25s |  interaction MySQL honeypot. So we create a tool that mimics the database, implements
22.25s - 27.25s |  MySQL protocol, and those bots start connecting to this honeypot. So we need to understand
35.64s - 40.64s |  the MySQL protocol. And MySQL protocol, unlike other database protocols, actually a
43.18s - 48.18s |  server initiated. So if we just start a TCP server, then it will not be enough. If you connect
48.88s - 53.88s |  to your MySQL server using Telnet, on the port 3306, you will see this. And this is what
59.72s - 65.62s |  MySQL server provides for the client to be able to connect. It specifies the version, it
65.62s - 70.64s |  specifies salt, it specifies a client plugin. So listening to the port, a TCP server is not
70.64s - 75.64s |  enough. So what we did to create the high interaction MySQL honeypot is we used the
81.98s - 86.98s |  Python module. The Python provides, there is a module called MySQL mimic. It implements
89.66s - 94.66s |  MySQL protocol, it's a really powerful thing. Uh and you can do lots of things with it. So
95.62s - 100.62s |  from there, we started the honeypot, and we start receiving the connections. So you start
103.86s - 110.40s |  the honeypot as a fake MySQL server on an open port from the internet. And you start
110.40s - 115.94s |  receiving the connections. And you can see lots of information about the connection
115.94s - 120.94s |  actually. Like the HTTP protocol, MySQL protocol also have this client version record,
121.94s - 126.94s |  and stuff like that. So this is called attributes. MySQL provides a lot of attributes as a
131.04s - 136.08s |  part of the connection. That's part of protocol. We have client version, OS, and stuff
136.08s - 142.28s |  like that. So we started the honeypot and we immediately see the fingerprints of the
142.28s - 148.56s |  connections. And you can see the version of the client library, you can see the operating
148.58s - 153.58s |  system, you can see all other stuff. This is very useful actually. Now from there, the
156.46s - 161.46s |  part two is what kind of attacks we have. We have seen from this honeypot, high
167.06s - 174.04s |  interaction honeypot, we see two major attacks on MySQL. The first is an attempt to own
174.06s - 179.46s |  MySQL server and create a backdoor. This is actually pretty well known attack, and there's a
179.46s - 184.46s |  blog post about that. What is interesting about that is we can see right away that it's using a
187.70s - 192.70s |  very old MySQL client version. It's actually only works for older servers as well. So the second
196.24s - 201.24s |  is even more interesting attack. It's a ransomware. It tries to download your data, basically
201.78s - 206.78s |  brute force the password first, then connects, tries to download the data, and then drops the
211.58s - 218.60s |  databases and asks for ransom. So this is exactly the same thing. We see the fingerprints. We see
218.60s - 224.60s |  what OS version, we see what the client is using. So now from there, we started an atomic version
225.08s - 230.08s |  of the honeypot. Honeypot that strikes back. So what we want to do, our goal is actually
238.42s - 243.42s |  interact with those attacks. And our goal was to see what they're doing, how they do that, and
246.00s - 251.00s |  potentially download the code, the malicious code that they're using. So our atomic honeypot
251.34s - 257.34s |  now strikes back. What do we have? So we have been juggling with different CVEs in MySQL client.
265.22s - 271.22s |  And we have arbitrary file read, which is a super old issue. We have the remote code execution
272.22s - 278.22s |  where MySQL server attacks you. We actually found that issue a year ago, 2023. We have
283.80s - 289.80s |  presented it and we can use that to actually execute code on the client. And then finally, this
290.16s - 296.16s |  year, we have found another issue in MySQL client utility. We reported it to Oracle. This is a
302.04s - 309.48s |  second remote code execution in MySQL client. All right. So MySQL server attacks MySQL client.
314.02s - 320.02s |  This is how it works. There are two things here. The first thing is that we have a MySQL server
321.56s - 327.56s |  client arbitrary file read. And we create a server. And then your client connects to a server. And
329.34s - 335.34s |  the server will request a file. So we can have an arbitrary file read from the client. The second is
338.94s - 344.52s |  the one that we found a year ago and we presented it at last year. There are lots of details
344.52s - 350.96s |  there. And basically, the prerequisite of this attack is that you need to have the shared
350.98s - 357.46s |  library uploaded to the client first. Then, whatever the connection will be established, you
357.46s - 363.46s |  can actually take that client connection to execute your shared library. You don't need to
366.30s - 372.30s |  execute the shared library itself. You just need to have that file on the client. And finally, we
374.10s - 380.58s |  have found this year, we have found a new issue in MySQL client utility. And then I will
380.60s - 386.60s |  invite Martin, my colleague Martin, to explain how it works. And this is the first time we're
387.98s - 396.09s |  releasing the details about this CVE. Martin? Hi. So let's jump into this CVE. As you probably
399.93s - 405.93s |  know, MySQL dump is a tool which allows you to produce logical backups of a database. Script
406.39s - 412.39s |  tables and other objects and data to be transferred to another server. So this is an example
418.27s - 424.27s |  how you can use MySQL dump together with MySQL. You just pipe the output of MySQL dump to
426.43s - 432.47s |  MySQL to recreate a database on another server. And this is pretty close to what official
432.49s - 438.49s |  documentation says. Where is the problem? MySQL utility allows you to use so-called meta
440.93s - 446.93s |  comments. For example, if you do backslash, exclamation mark, and then space and a comment, it's
448.63s - 455.27s |  going to execute a shell comment on a computer where the MySQL tool is running. So the CVE
455.27s - 461.27s |  itself is about tricking MySQL dump to emit such a shell comment, for example. So the CVE
462.47s - 468.47s |  is a tool which allows you to use MySQL dump together with MySQL. So how this works exactly? By
468.47s - 474.47s |  default, MySQL dump tries to process everything it receives from a server. But it's not a case
474.47s - 480.49s |  for the version. As you can see, there is a version string coming from a server, and it is emitted
480.49s - 486.49s |  as a comment in the output of MySQL dump. But this is not processed, this is not sanitized, and
486.91s - 492.91s |  this is sent back to output as is. We can leverage this by simply creating our own server, the
495.95s - 501.71s |  patched version of a server. As you can see here, I just replaced a version with a hard-coded
501.71s - 507.39s |  string, a new line, and then my comment of choice to be executed on the machine. Here, I just
507.39s - 513.19s |  created a file. And if you could tell that to this patched server, you will see this. In red, you
513.21s - 519.21s |  will see our comment. And then, this is output of a MySQL dump. We have a comment execution for
522.01s - 528.01s |  this vulnerability. All we need to do is to provide a fake server. So we have created a honey pot,
531.55s - 537.55s |  which is a Python code, which allows you to exploit this specific vulnerability, and also the
537.91s - 543.91s |  plugin-loading vulnerability by passing specific configuration options to this honey pot. The goal
548.89s - 554.89s |  is simple. We try to run code on the clients who connect to our honey pot by leveraging these
556.67s - 566.03s |  vulnerabilities. And here's a demo. So let's see. We have a payload script, a VBS script, which
566.03s - 572.03s |  will be running on Windows, which just pops up a message, you have been pwned. Now, we start our
575.99s - 581.99s |  honey pot and pass a payload. And also, we start a HTTP server. And once MySQL dump is executed on
583.67s - 589.67s |  Windows now, the version is 36, which is one version before the latest, we get this pwned message.
601.69s - 606.69s |  That's it. Back to you, Alex.
606.69s - 612.69s |  Thank you very much. All right. So now, we successfully pwned the client. We were able to
614.77s - 620.77s |  do this because we were actually trying to figure out and scratching our heads, how do we actually
625.81s - 631.81s |  attack those bad guys? So, back to the two attacks that we have been working with. The first attack, this
636.49s - 642.49s |  is what we have captured, a fingerprint. Right? So, from the fingerprint itself, we can already see
645.73s - 651.73s |  what we can or cannot do. So, arbitrary file read, we know this is old version. We know that it will work.
655.11s - 661.11s |  Remote code execution with a plugin, we don't know. We will try it out. And there is no MySQL dump in this
662.39s - 668.39s |  particular attack, so we will not be able to use the newest version. So, how do we use the arbitrary file
668.95s - 674.95s |  read? Arbitrary file read is super easy. There is a tool that you can download from the internet, from the
676.83s - 682.83s |  GitHub. You start this tool and you simply specify the file that you want to download from the client.
685.19s - 691.19s |  Again, the client will be connecting to the server. This is fake server. And then we will be able to read the file.
691.75s - 697.75s |  So, this is how the client arbitrary file read works. I will go through this real quick. So, you have this, I
707.47s - 713.47s |  download this tool. I start this tool on port 3306. And I request a password. And now, I am connecting
714.47s - 720.47s |  from my machine with the old version of MySQL. And I connect into this fake server. And here I go. I got the
729.07s - 735.07s |  file. So, I obtained this file. This is an old attack. Now, how can we use that? What we want to do is, we
735.07s - 743.25s |  want to first understand which version of Windows those attackers, those bots are using. There are a
750.63s - 756.63s |  number of ways how you can determine the version of Windows by downloading the file. So, we started this
758.81s - 764.81s |  file list and we determined that this is really old version of Windows. This is Windows Server 2003.
767.31s - 773.31s |  Alright, so with this attack, we were able to understand and get more details about what the attackers are
774.95s - 780.95s |  using. Now, let's try the remote code execution. The remote code execution is, actually on Windows you need
784.49s - 790.49s |  DLL. We need to deliver that DLL to the attacker's machines, to the client, to be able to trigger it. So, we
791.05s - 797.05s |  started to think, how do we deliver this code? Again, DLL doesn't need to be triggered on the client. We are
804.03s - 810.03s |  triggering through the remote code execution. What we did is, we collected the fingerprint, the actual
812.37s - 818.37s |  commands that the server, the client, is running, is trying to run on the server. And what we did is, we
820.55s - 826.55s |  can see that what they are trying to do is, they are trying to download the malicious code on the server. So,
830.93s - 836.93s |  they are running an FTP server on their own machine. And we know the password, the username, and the port of
839.67s - 845.67s |  the server. So, we started creating the simulation. Here's our plan of attack. We will upload the DLL to a
846.39s - 852.39s |  public location on the client, on the actual server, Windows 2003. And then we will run the honey pot, wait
860.31s - 865.81s |  for the connection, and through the connection we will trigger that DLL so we will have the remote code
865.81s - 870.81s |  execution. So, we created this RCE via the simulation. So, this is how it could work. First of all, we
875.93s - 881.93s |  have, we are connecting to FTP server here, simulating that we are connecting to the actual machine. We do the
887.07s - 895.12s |  demo, demo, now we will put our evil DLL. And now, after we put the evil DLL in a public location, then we will
900.30s - 906.30s |  start the server, the honey pot. This is the server that is running on the server. So, this is the server.
907.74s - 913.74s |  We run the startup script. We specify the plug-in dir, public documents, and then this thing will actually
917.32s - 923.32s |  trigger the execution of our DLL via the directory traversal. I don't have much time to explain this attack, but
927.90s - 933.90s |  this has been explained last year. You can actually see the recording from the HIDBI. Basically, there is a
934.06s - 940.06s |  plug-in dir in MySQL and the file name, and we use the directory traversal to actually trigger DLL open,
943.40s - 949.40s |  which, or load library on Windows, which is in the server. Now, I'm listening on the port, and now here's my
951.88s - 956.88s |  DDL. My DDL is displaying the text and actually create the, um, um, the dialogue. So, this is the
964.16s - 970.16s |  code. Here's how it works. So, we have this MySQL command line utility, and we have the evil DLL, uh,
975.14s - 981.14s |  uploaded to the client. Now, the client, in this simulation, that's the bad actor. They are connecting to us,
984.04s - 990.04s |  and here's, here we go. We actually executed the code, remote code execution. Thank you. Alright, so,
992.37s - 1001.98s |  this is done. We demonstrated arbitrarily file read. We demonstrated remote code execution, uh, with a plug-in.
1006.82s - 1012.82s |  So, the second attack is even more interesting. Now, from the fingerprint, what do we see? We see this is
1015.16s - 1021.16s |  later versions of MySQL client. We know that this remote code execution via plug-in will not work, but we
1026.10s - 1031.12s |  see immediately is that it's using MySQL dump. This is the utility. We actually found a way to, to do the, the
1034.48s - 1040.86s |  code execution. And then again, we were scratching our heads, and then we decide, well, let's collect
1040.86s - 1045.86s |  more information. Let's understand how this attack is being, uh, executed. So, this is what we see. The, the
1046.02s - 1052.02s |  application that connects to, uh, our server, right, it, um, uh, connects to the server, do the show
1058.46s - 1063.46s |  databases, and then what it will do is it will run, it will execute MySQL dump utility and, uh, pass the
1064.46s - 1069.46s |  database and the table name. So, basically what it do, the, the goal of this thing is to download the
1082.34s - 1087.34s |  database so that they can actually claim that they download your data. But, we can see that the only
1087.50s - 1092.50s |  downloaded 10 records. So, don't pay, obviously, right? Don't pay. Those guys don't have your data.
1100.98s - 1107.32s |  They claim that they have downloaded, backed it up, backed your database, but they didn't. They only
1107.32s - 1112.32s |  have 10 records. Right? And then from here, we were started brainstorming. Can we download the code
1112.78s - 1117.78s |  via arbitrary file read? No. Can we execute code via plugin? Actually, no as well. Right? We know
1124.76s - 1129.76s |  because this is the newer versions. So, we started looking again how this attack is being handled. So, we
1132.20s - 1138.16s |  see that's the using MySQL, MyADB connector, right? This is from the fingerprint. This should be
1138.18s - 1144.86s |  some application there, right? And then suddenly, MySQL dump connects to our server. So, they
1144.86s - 1149.86s |  probably do some execution of the MySQL dump and then we see back, we see that the application
1153.36s - 1158.36s |  connects back. So, we also see this. Again, we are providing the server. Whatever client will
1158.48s - 1163.48s |  execute, we will see immediately. And this is what we see. This is our table that we generated. It's
1169.42s - 1174.42s |  send it up, up, back to us. So, maybe if this is what they're doing, maybe we can actually do a
1178.42s - 1183.42s |  command injection. And we started experimenting with this. We created a fake database, a schema
1184.06s - 1189.06s |  name as a database in MySQL. We created this, a classical command injection. And uh, we were
1195.64s - 1200.64s |  surprised. It actually worked. So, we used the command injection on this client attack, right? On
1204.80s - 1210.62s |  this board, just like this, and we receive all the information uh, out of this command back to
1210.66s - 1215.66s |  us. So, we downloaded the evil code from those attackers. This is how it is looking like. It's a
1220.10s - 1225.10s |  MySQL dump. We have a command injection here and here's what we see. We got the evil code. So, it's
1227.44s - 1232.44s |  a Python script. It's a Python script that connects to your database, try to brute force the
1232.64s - 1237.64s |  password, and then execute the MySQL dump. The multiple injections. We were looking at this
1242.08s - 1247.08s |  code and we were like, well, there are multiple places where you can execute the command. Alright,
1249.52s - 1254.52s |  so we successfully, we achieved our goal, but not the way we thought originally. We executed the
1254.72s - 1259.72s |  command injection. How do you try that at home? Uh, I'm pretty sure this will be fixed shortly, so
1268.36s - 1275.20s |  you need to try it right now if you want to see what it looks like. Uh, and you don't even need a
1275.20s - 1280.20s |  tool. You can start a MySQL database server, any version, you will create a root with no
1280.86s - 1285.86s |  password. This is a born version of MySQL server, right? You don't care if they will be
1290.84s - 1295.84s |  downloading your data. I'm done almost. And then you open that and this is the injections that you
1297.48s - 1302.48s |  will do. Create database, put it in a backticks, and that's it. This is how you will be able to
1302.48s - 1307.70s |  attack, uh, the bad guys. Alright, this is done. All done. So, new CVE details and thank you.


url: https://www.youtube.com/watch?v=BN07rjaNqXk
title: DEF CON 32 - The Way To Android Root: Exploiting Smartphone GPU - Xiling Gong, Eugene Rodionov
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=BN07rjaNqXk",
  "title": "DEF CON 32 - The Way To Android Root: Exploiting Smartphone GPU - Xiling Gong, Eugene Rodionov",
  "description": "GPU security is a vital area of mobile security highlighted both by public security research as well as by in-the-wild attacks. Due to the high complexity of the GPU software/firmware along with a widely available attack surface, issues in GPU provide strong exploitation primitives for local privilege escalation attacks by the code running in unprivileged context.\n\nIn this talk, we will focus our research on the Qualcomm Adreno GPU, which is a very popular GPU implementation in mobile devices. We will do a deep dive into Adreno GPU kernel module implementation focusing on the most recent GPU versions, reveal its complex and new attack surfaces, and discuss vulnerabilities we discovered in this component.\n\nIn total we identified 9+ exploitable vulnerabilities in Adreno GPU driver leading to kernel code execution and affecting Qualcomm-based devices using the latest GPU models. We will demonstrate the exploitation of one of the race condition issues on a fully-patched widely used Android device to obtain root privileges from zero-permission application with 100% success rate.\n\nAndroid kernel mitigations such as CFI and W^X create significant hurdles for exploiting vulnerabilities in kernel to achieve code execution. Also race condition usually means unstable, low success rate. We'll explain how we overcome these challenges with a novel, generic exploit method that leverages GPU features to achieve arbitrary physical memory read/write. This technique bypasses key mitigations (CFI, W^X) and has broader implications for kernel heap buffer overflows. We will cover the technical details of the exploitation, and especially the novel generic exploit method.\n\nWe will also discuss the action items that the vendors could take to minimize the impact of this exploit method, as well as general methods to improve the overall security status of the GPU.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2778,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.59s - 3.07s | This text was transcribed using whisper model: large-v2

 OK.
3.07s - 5.67s |  OK, sorry for that.
5.67s - 7.35s |  Good afternoon, everyone.
7.35s - 8.75s |  My name is Xuexin.
8.75s - 10.63s |  I'm the manager of Android Red team.
14.11s - 18.27s |  Today, I'm really honored to present you
18.27s - 20.19s |  the way to Android root exploiting
20.19s - 26.25s |  your GPU on smartphone with these two gentlemen.
26.25s - 29.41s |  This is Shilin Gong, our security researcher.
29.41s - 33.25s |  And he actually did most of the technical work.
33.25s - 35.53s |  So big credit to him.
35.53s - 39.25s |  And also next to Shilin is our tech lead, Eugene Rodionov.
39.25s - 42.37s |  Eugene did a lot of work to help us create the slides
42.37s - 44.77s |  and make sure our demo runs smoothly.
44.77s - 48.06s |  Big shout out to him.
48.06s - 51.66s |  So our story dated back to the earliest year
51.66s - 58.62s |  when Shilin decided to take a look at Qualcomm GPU drivers.
58.62s - 60.78s |  But before we go into details, here's
60.78s - 62.82s |  a brief introduction of our team.
62.82s - 66.14s |  So we are the Android Red team.
66.14s - 69.94s |  Our goal is to increase the Android and Pixel security.
69.94s - 75.34s |  And we do this by simulating adversaries attacking
75.34s - 77.34s |  Android key features.
77.34s - 81.78s |  And our work can be broken down into a couple of different ways.
81.78s - 85.50s |  Most obviously, we do offensive security research review
85.50s - 89.50s |  to verify our breaking security assumptions, which
89.50s - 91.82s |  means finding bugs.
91.82s - 94.78s |  And we scale our work by developing
94.78s - 100.38s |  tools such as continuous fuzzing or static analysis.
100.38s - 105.02s |  And once we find issues, we develop proof of concept
105.02s - 107.94s |  just to show the real world impact,
107.94s - 110.58s |  as some issues are not so straightforward
110.58s - 113.30s |  to see their impact.
113.30s - 116.38s |  Lastly, while we are developing the exploits,
116.38s - 118.50s |  we're also assessing the efficacy
118.50s - 120.82s |  of the security mitigations that our feature
120.82s - 124.58s |  team implemented.
124.58s - 128.30s |  The more pain we experience during our work,
128.30s - 131.66s |  the more security our end user will gain.
131.66s - 134.98s |  So we are literally making our work harder
134.98s - 139.91s |  to help end users.
139.91s - 141.71s |  So here's today's agenda.
141.71s - 146.03s |  We'll first talk about the GPU and security background.
146.03s - 149.07s |  And then we'll go through the Qualcomm Adrena GPU
149.07s - 151.71s |  introduction, talking about its architecture
151.71s - 153.91s |  and where the issue patterns are.
153.91s - 157.19s |  And then we'll dive into very technical details
157.19s - 160.91s |  for the CVE-2024-23380 and how we
160.91s - 164.43s |  exploit to gain root privilege.
164.43s - 167.55s |  Lastly, we'll conclude our talk with the methodology
167.55s - 172.42s |  discussions.
172.42s - 177.94s |  So before we jump into engagement,
177.94s - 180.50s |  usually we need to ask ourselves questions.
180.50s - 182.70s |  Why do we look into this one?
182.70s - 186.26s |  The reason is that, compared to the Android ecosystem,
186.26s - 188.62s |  our team is very small.
188.62s - 193.86s |  So we want to spend our time into the most impactful areas.
193.86s - 196.06s |  So why GPU drivers?
196.06s - 199.06s |  Here, we think these are the answers to that question.
199.06s - 202.30s |  The biggest one is there is no permission
202.30s - 207.86s |  required for applications to look into GPU driver.
207.86s - 210.16s |  On the right side, you can see a diagram.
210.16s - 212.76s |  And the unprivileged applications,
212.76s - 216.04s |  whatever user space library they call OpenGL, Vulkan,
216.04s - 220.68s |  anything else, those libraries talk into the device node
220.68s - 223.96s |  directly in the application's process.
223.96s - 226.44s |  So that means this device driver has to be
226.44s - 228.44s |  exposed to the application.
228.44s - 230.80s |  So no permission required.
230.80s - 233.36s |  This is the biggest problem.
233.36s - 237.68s |  And this is why researchers love GPU drivers.
237.68s - 242.88s |  Next one, GPU driver performance is the key.
242.88s - 246.52s |  And because of that, they need to have some powerful functions
246.52s - 248.60s |  to do this.
248.60s - 250.96s |  The most important one is that they usually
250.96s - 254.00s |  have access to the system physical RAMs
254.00s - 257.28s |  and so that they can map in memories from user space
257.28s - 261.72s |  to kernel space and to the hardware without copying them.
261.72s - 263.92s |  This is a very powerful primitive,
263.92s - 266.64s |  and attackers want them.
266.64s - 270.00s |  We'll explain more later why it's powerful.
270.00s - 274.20s |  And lastly, again, because of the performance requirement,
274.20s - 279.08s |  this involves high complexity code in the GPU driver.
279.08s - 282.60s |  And because of that, it's really, really hard
282.60s - 284.36s |  to develop bug-free code.
284.36s - 286.96s |  I'm not sure if anybody here write bug-free code.
286.96s - 288.80s |  Raise your hand if you did.
288.80s - 291.92s |  Wow, very brave.
291.92s - 295.42s |  Anyway, and it's even harder to fix an issue.
295.42s - 298.66s |  And it's very common that you fix an issue,
298.66s - 300.86s |  but it's not 100% fixed.
300.86s - 303.02s |  There's still something left over.
303.02s - 306.06s |  And oh, even worse, you fixed one issue,
306.06s - 311.43s |  and you introduced another new issue, or two issues.
311.43s - 314.21s |  So this high complexity is another reason
314.21s - 317.79s |  one look into this area.
317.79s - 322.19s |  But why Qualcomm GPU?
322.19s - 328.01s |  Hello?
328.01s - 345.41s |  There's an audio problem.
345.41s - 345.97s |  Hello?
345.97s - 348.49s |  Hello?
348.49s - 349.29s |  I can use this one.
349.29s - 349.79s |  All right.
349.79s - 350.29s |  All right.
355.10s - 359.86s |  OK, we have issues, so we fix them.
359.86s - 362.14s |  So why Qualcomm?
362.14s - 365.30s |  Qualcomm is one of the most important smartphone SoC
365.30s - 369.90s |  vendors, and many devices use the Qualcomm SoCs.
369.90s - 374.70s |  And on those SoCs, Adreno GPU is the one used the most.
374.70s - 379.62s |  And last one is, this applies to all GPUs,
379.62s - 384.78s |  that GPU is a very actively developing area because
384.98s - 386.94s |  all the requirements, all the games
386.94s - 391.66s |  keep having high resolutions, faster speed, faster FPS.
391.66s - 393.98s |  So there's lots of development happening
393.98s - 398.46s |  that involves revolutions in the architecture, hardware,
398.46s - 399.62s |  software.
399.62s - 402.94s |  And coincidentally, we noticed that there
402.94s - 407.02s |  is a new architecture recently in the Qualcomm GPU.
407.02s - 411.10s |  New architecture, new software means new bugs.
411.10s - 414.26s |  So we want to take a look and see what's the difference,
414.26s - 419.44s |  and is there any issues there.
419.44s - 424.84s |  And another study we did before we look into our source code,
424.84s - 427.36s |  I mean, not our source, Qualcomm source code,
427.36s - 431.24s |  is to check the security bulletins
431.24s - 434.08s |  and understand any historical issues.
434.08s - 435.84s |  And here's a chart that we manually
435.84s - 439.92s |  created from the Qualcomm security bulletin.
439.92s - 442.84s |  The size of the bars might look a little bit scary,
442.84s - 445.64s |  but you can see the numbers actually are single digits.
446.08s - 450.36s |  There's not a lot of issues, but my point here
450.36s - 454.12s |  is that you can see this is more like constant issues
454.12s - 456.88s |  happening every quarter.
456.88s - 460.16s |  So this chart gives us a little bit of confidence
460.16s - 465.76s |  that if we look into the code, we might as well find issues.
465.76s - 467.64s |  Oh, by the way, I forgot to mention,
467.64s - 470.68s |  all our work is based on the open source Qualcomm drivers.
470.68s - 472.24s |  So everything is public.
472.24s - 476.33s |  There's no private information involved.
476.33s - 479.41s |  Among all those issues, there are quite some high profile
479.41s - 484.17s |  issues disclosed and talked by previous security researchers.
484.17s - 489.13s |  These talks are great, and we learn a lot from the talks.
489.13s - 491.57s |  Really big credit to them for helping
491.57s - 497.37s |  us to jump into an area we never looked at before.
497.37s - 500.81s |  And now we look back into the just recent three months.
500.81s - 504.17s |  Here are all the issues reported to Qualcomm,
504.17s - 508.09s |  disclosed by Qualcomm security bulletin.
508.09s - 512.09s |  Our security researcher, Xilin, did a little bit analysis
512.09s - 515.73s |  and focused on the last two columns.
515.73s - 519.17s |  You can see the tech area, mostly many of the issues
519.17s - 522.05s |  are focusing on IOMMUs.
522.05s - 524.05s |  That matches to our previous assumption
524.05s - 527.29s |  that, OK, physical memory is the key.
527.29s - 532.53s |  And also, very subjective, but based on Xilin's experience,
532.53s - 536.05s |  most of the issues are easy to exploit.
536.05s - 540.37s |  And once exploited, they are pretty stable.
540.37s - 542.69s |  Attackers want the stabilities.
542.69s - 546.90s |  They want their code to be good.
546.90s - 549.06s |  So over the course of our engagement,
549.06s - 553.06s |  Xilin has identified more than nine issues.
553.06s - 556.42s |  We report all the issues to Qualcomm immediately.
556.42s - 560.70s |  And today, we're going to talk about CVE-2024-23380.
560.70s - 563.22s |  This is one of the issues we reported.
563.22s - 566.38s |  This issue has been patched and published
566.38s - 569.14s |  in the security bulletin of July 2024.
569.14s - 572.18s |  And Qualcomm communicated to all the device vendors
572.18s - 575.42s |  in April before the disclosure.
575.42s - 578.62s |  So go to their security bulletins.
578.62s - 580.86s |  You can see what's affecting devices.
580.86s - 583.58s |  But don't worry if your device is affected.
583.58s - 585.22s |  And check your security patch level.
585.22s - 588.94s |  If it's July or later, it's fixed.
588.94s - 592.06s |  And from here, I'll hand over to Xilin
592.06s - 594.46s |  to talk about technical details and how we
594.46s - 599.42s |  exploit to gain root privilege.
599.42s - 602.20s |  XILIN LIU.
602.20s - 604.44s |  Yeah, thank you, Xilin.
604.44s - 613.44s |  So I'll quickly introduce the basic knowledge of Andrino GPU.
613.44s - 616.44s |  So here is the basic architecture.
616.44s - 620.84s |  You can see in the middle is the KGSL driver,
620.84s - 624.68s |  which is a glue between the user space and the hardware.
624.68s - 627.88s |  So from the perspective of the user space,
627.88s - 631.40s |  we will have a set of interfaces.
631.40s - 633.80s |  The first one is a context, which
633.80s - 638.28s |  is used to identify user space application
638.28s - 643.08s |  and also to manage the GPU driver or hardware resources.
643.08s - 644.88s |  And also, the user space maybe want
644.88s - 648.04s |  to share memory with the GPU hardware.
648.04s - 650.48s |  So we will have memory interfaces.
650.48s - 652.40s |  There are three types of memory.
652.40s - 656.32s |  The basic memory, the user space memory, the DMA memory.
656.32s - 659.44s |  And previously, we also have the sparse memory.
659.44s - 664.48s |  But now, this sparse memory already not used anymore.
664.48s - 668.12s |  And the user space also want to send the customer GPU
668.12s - 669.92s |  commands to the GPU hardware.
669.92s - 673.52s |  So we will have some commands interfaces.
673.52s - 676.40s |  And also, the user space want to get
676.40s - 678.44s |  synced with the GPU hardware.
678.44s - 681.76s |  So we will have synchronization interfaces.
681.76s - 685.84s |  To accomplish these tasks in the GPU driver,
685.84s - 688.20s |  we will have a command queue, which
688.20s - 691.32s |  receives commands from the user space.
691.32s - 693.88s |  And then the software dispatcher will
693.88s - 696.52s |  get the command from the queue and add
696.52s - 702.20s |  the necessary informations and maybe modify the GPU command
702.20s - 704.92s |  and then send them to the ring buffer.
704.92s - 708.00s |  There is a simple firmware in the GPU hardware,
708.00s - 711.48s |  which will receive commands from the ring buffer
711.48s - 713.52s |  and send the command to the hardware.
713.52s - 718.68s |  So GPU customer commands will be run in the GPU hardware.
718.68s - 722.16s |  Also, we will have something like the global buffer,
722.16s - 726.16s |  the registers to control the GPU hardware.
726.16s - 728.08s |  For memory management, we will have
728.08s - 732.28s |  a memory pool and MMU for the user space memory
732.28s - 738.16s |  and IOMMU for control the GPU memory.
738.16s - 741.04s |  So this is the new architecture starting
741.08s - 745.72s |  from generation seven in the later generation.
745.72s - 750.48s |  You can see we have lots of new stuff in red color.
750.48s - 753.76s |  The most important change is the software dispatcher
753.76s - 756.44s |  is replaced by the hardware scheduler, which
756.44s - 761.44s |  means the GPU command comes from the user space.
761.44s - 763.64s |  We are not to be sent to the ring buffer directly
763.64s - 765.12s |  by the driver.
765.12s - 768.48s |  The driver will not touch the ring buffer anymore.
768.48s - 772.76s |  Instead, the driver will send this command directly
772.76s - 774.96s |  to a HiFi command queue.
774.96s - 778.24s |  So there is a simple firmware.
778.24s - 783.52s |  And this firmware will take over and finish the job previously
783.52s - 785.28s |  finished by the driver.
785.28s - 789.12s |  So a lot of software dispatcher jobs
789.12s - 791.32s |  will be moved to the firmware.
791.32s - 793.80s |  So we don't have the source code of the firmware.
793.80s - 798.04s |  So I can just guess that this job previously
798.04s - 800.28s |  finished by the software dispatcher
800.28s - 801.88s |  will move to the firmware.
801.88s - 807.00s |  But how it works and whether there are any vulnerabilities,
807.00s - 809.04s |  I have no idea now.
809.04s - 813.20s |  And also to coordinate with these new features,
813.20s - 817.28s |  some other new features like the hardware fence is added.
817.28s - 819.96s |  Previously, we only have the software fence.
819.96s - 822.64s |  Now we also have hardware fence.
822.64s - 826.96s |  There, we introduce a lot of new code, new features,
826.96s - 830.96s |  and also a new hardware fence queue and new hardware fence
830.96s - 831.84s |  event here.
834.48s - 838.20s |  For the memory, we will have a new virtual buffer object.
838.20s - 840.76s |  You can see here, this is a new VBO.
840.76s - 843.68s |  And the previously ARM, IOMMU, you
843.68s - 846.92s |  will replace it by the Qualcomm-owned IOMMU.
846.92s - 850.56s |  So these new features will, of course,
850.56s - 852.76s |  enhance the GPU capability.
852.76s - 860.19s |  But also, we introduce lots of new attack surface.
860.19s - 864.31s |  If you want to look into some new vulnerability,
864.31s - 867.83s |  you can start from the new features.
867.83s - 870.79s |  Here, I'll also introduce the memory management.
870.79s - 874.23s |  You can see here is the basic memory management
874.23s - 876.19s |  called a basic memory object.
876.19s - 878.07s |  So it's used in most of the cases
878.07s - 881.91s |  you want to share some memory to the GPU from the user space.
882.75s - 885.03s |  You request a basic memory object.
885.03s - 885.99s |  It's a basic.
885.99s - 888.27s |  So it's used in most of the cases.
888.27s - 889.91s |  You call this our control.
889.91s - 892.87s |  And then you set a parameter to tell the driver
892.87s - 895.19s |  how much physical pages you want.
895.19s - 897.75s |  Then the driver will allocate this number
897.75s - 899.59s |  of physical pages for you.
899.59s - 902.15s |  And then the second step, the driver
902.15s - 906.71s |  will allocate address range in the GPU virtual address space.
906.71s - 911.07s |  So you can see here, we have this virtual GPU address.
911.07s - 915.95s |  And then the GPU driver will set this physical to virtual
915.95s - 917.23s |  mapping for you.
917.23s - 920.51s |  So at this time, the GPU hardware
920.51s - 924.15s |  will be able to access to the physical page using this GPU
924.15s - 926.03s |  virtual address.
926.03s - 928.39s |  And in most of the cases, the user space
928.39s - 931.67s |  will also want to access to the physical page.
931.67s - 935.39s |  So the user space will do memory map
935.39s - 937.51s |  on this basic memory object.
937.51s - 939.51s |  And then the driver will help you
939.51s - 944.19s |  to set up the physical page to virtual mapping,
944.19s - 945.67s |  so through the MMU.
945.67s - 948.75s |  So at this time, the physical page
948.75s - 952.75s |  can be accessed from both the GPU hardware and the user
952.75s - 953.79s |  space.
953.79s - 955.87s |  So that's the basic memory object.
955.87s - 958.63s |  The driver will manage all the objects in the kernel
958.63s - 962.91s |  and also manage the back-end physical memory.
962.91s - 965.87s |  And here is the second type of memory object.
965.87s - 967.95s |  It's called the user space memory.
967.95s - 971.55s |  So suppose you already have a user space memory.
971.55s - 973.19s |  You have a back-end physical memory.
973.19s - 976.23s |  You can use this user space memory object
976.23s - 981.83s |  to import memory from the user space into the GPU hardware.
981.83s - 984.51s |  And here is the third type of memory.
984.51s - 986.95s |  It's called a virtual buffer object.
986.95s - 992.55s |  From the name virtual, you maybe guess that it's virtual.
992.55s - 995.27s |  So for this type of memory, it doesn't
995.27s - 999.23s |  have its own back-end physical memory.
999.23s - 1002.43s |  So you call this out control with this flag.
1002.43s - 1007.07s |  Then the driver will simply allocate a GPU virtual address
1007.07s - 1008.07s |  for you.
1008.07s - 1011.51s |  And then it will map this virtual address
1011.51s - 1013.35s |  to a dummy zero page.
1013.35s - 1015.27s |  So it's a dummy zero page.
1015.27s - 1018.03s |  It's just a placeholder.
1018.03s - 1021.59s |  Of course, you can access it to the virtual memory
1021.59s - 1022.71s |  in the GPU hardware.
1022.71s - 1023.91s |  But it's no effect.
1023.91s - 1026.83s |  Whatever you read or write will have no effect.
1026.83s - 1028.83s |  It's just a zero page.
1028.83s - 1030.15s |  It will have no effect.
1030.15s - 1033.51s |  So how to use this virtual buffer object?
1033.51s - 1039.63s |  You can actually map a basic memory object into this VBO.
1039.63s - 1044.67s |  So suppose you already have two basic memory object, A and B.
1044.67s - 1048.47s |  Both of them have their own back-end physical memory.
1048.47s - 1052.69s |  You can bind these two basic memory object into this VBO.
1052.69s - 1055.45s |  So you call this bindRangeOutControl.
1055.45s - 1057.73s |  Then the driver will do the work.
1057.73s - 1061.05s |  The first step, the driver will remove any existing
1061.05s - 1063.05s |  mapping from the VBO.
1063.05s - 1066.33s |  Here, we already mapped the zero page to the VBO.
1066.33s - 1068.45s |  So this mapping will be removed.
1068.45s - 1072.05s |  If you have previously mapped any other basic memory
1072.05s - 1077.73s |  object to this VBO, so this map will also be removed.
1077.73s - 1081.49s |  So the first step, we will remove any existing mapping
1081.49s - 1082.97s |  from the VBO.
1082.97s - 1085.33s |  And then we will get a connection
1085.33s - 1089.93s |  between this basic memory object and the VBO.
1089.93s - 1093.37s |  So the driver will know that there is a connection.
1093.37s - 1096.57s |  Somebody is using this basic memory object.
1096.57s - 1099.33s |  So this object cannot be freed.
1099.33s - 1100.93s |  And also, the driver will help you
1100.93s - 1104.69s |  to find out the physical memory page of this basic memory
1104.69s - 1105.73s |  object.
1105.73s - 1110.45s |  And then the driver will help you to set up this connection.
1111.37s - 1114.05s |  Here is the physical memory to virtual mapping.
1114.05s - 1118.57s |  We'll map this physical page into the VBO's region
1118.57s - 1121.49s |  at a specified offset.
1121.49s - 1126.17s |  And also, the driver will continue these two steps,
1126.17s - 1129.97s |  find all the basic memory object you want,
1129.97s - 1132.97s |  and get all the connections between the basic memory
1132.97s - 1134.65s |  object and the VBO.
1134.65s - 1139.13s |  And then map all the physical pages to this VBO.
1139.17s - 1144.81s |  So that's the basic memory object binding to the VBO.
1144.81s - 1151.89s |  It's very powerful and flexible, but also very vulnerable.
1151.89s - 1157.13s |  You can see here we have this CVE-2024-23380,
1157.13s - 1162.73s |  which happens when you bind a basic memory object into a VBO.
1162.73s - 1165.01s |  So we will take a look at the code.
1165.01s - 1167.13s |  You can see when we do the binding,
1167.13s - 1171.41s |  we will get a connection between this basic memory
1171.41s - 1172.57s |  object and the VBO.
1172.57s - 1175.61s |  So the connection is finished by this function,
1175.61s - 1177.45s |  intervalTreeInsert.
1177.45s - 1182.33s |  So insert this basic memory object into the VBO.
1182.33s - 1188.49s |  Then we will get a physical page and virtual address mapping.
1188.49s - 1192.85s |  We will set up this mapping using this function,
1192.85s - 1195.93s |  mmuMapChild.
1196.93s - 1200.93s |  Of course, we will have to protect our global status.
1200.93s - 1205.93s |  So we will use this mutex lock to protect the interval tree.
1205.93s - 1209.97s |  So this interval tree is a global status.
1209.97s - 1212.05s |  This will be protected by the lock.
1212.05s - 1214.73s |  And when we finish, we will do unlock.
1214.73s - 1219.41s |  And here, the vulnerabilities, this physical to virtual mapping
1219.41s - 1222.25s |  is also a global resource, so it should also
1222.25s - 1224.33s |  be protected by the lock.
1224.37s - 1227.13s |  But you can see here, this physical to virtual mapping
1227.13s - 1229.09s |  is outside of the lock.
1229.09s - 1233.61s |  So it's possible, from the driver's perspective,
1233.61s - 1236.49s |  we already have this basic memory object
1236.49s - 1238.93s |  connected to the VBO.
1238.93s - 1241.41s |  When we do the physical to virtual mapping,
1241.41s - 1245.01s |  this connection might be removed by somebody else.
1245.01s - 1247.97s |  So that's the vulnerability.
1247.97s - 1249.61s |  Let's take a look at the fix.
1249.61s - 1253.41s |  You can see the fix simply moves this physical
1253.41s - 1255.93s |  to virtual mapping inside of the lock.
1255.93s - 1258.13s |  It's very simple fix.
1258.13s - 1260.77s |  It just protects this mapping.
1260.77s - 1263.53s |  So that's the vulnerability.
1263.53s - 1266.69s |  Let's take a look at how to trigger this vulnerability.
1266.69s - 1271.77s |  We will need two threads, one to the mapping, to the binding,
1271.77s - 1274.33s |  binding a basic memory object to the VBO.
1274.33s - 1278.09s |  And at the same time, somebody else do the unbinding.
1278.09s - 1279.53s |  So look at the code.
1279.53s - 1281.69s |  You can see, when do the binding,
1281.69s - 1283.77s |  we are getting into this add range.
1283.77s - 1286.45s |  This is the function we just read.
1286.45s - 1287.97s |  You can see, we have the lock.
1287.97s - 1293.33s |  We will insert the basic memory object into the VBO.
1293.33s - 1295.97s |  Then we unlock and do the physical mapping.
1295.97s - 1299.53s |  And another thread, you do the unbinding.
1299.53s - 1302.85s |  You can see, it's just the reverse of the binding.
1302.85s - 1309.01s |  You will have a lock, and then you remove the binding,
1309.01s - 1311.61s |  and then you do the unlock.
1311.61s - 1314.45s |  So here is how we trigger the vulnerability.
1314.45s - 1318.41s |  We have two threads, thread A, running, and lock,
1318.41s - 1323.73s |  and then undo the tree insert and do the unlock.
1323.73s - 1327.21s |  And at the same time, we can run thread B,
1327.21s - 1331.21s |  because it's unlocked, so the thread B can run in.
1331.21s - 1334.61s |  Then we get the lock removed and unlock.
1334.61s - 1337.17s |  And finally, we do the mapping.
1337.17s - 1342.17s |  So here is the detailed vulnerability.
1342.17s - 1345.49s |  We run thread A. We acquire the mutex.
1345.49s - 1346.37s |  Then we connect.
1346.37s - 1349.17s |  You can see this connection is set up.
1349.17s - 1352.57s |  So we connect the basic memory object to the VBO
1352.57s - 1354.57s |  and release the lock.
1354.57s - 1357.45s |  Then we get to thread B. Thread B also
1357.45s - 1359.33s |  acquires the same mutex.
1359.33s - 1362.33s |  And you can see this connection between the basic memory
1362.33s - 1364.97s |  object and the VBO is removed.
1364.97s - 1370.65s |  So this is thread B, unbinding, and release the mutex.
1370.65s - 1374.41s |  Then we get back to thread A. The thread A
1374.41s - 1380.13s |  will map the victim's physical page to this virtual address.
1380.13s - 1383.97s |  So because from the driver's perspective,
1383.97s - 1390.53s |  the basic memory object already have no connection with VBO,
1390.53s - 1392.21s |  so it can be freed.
1392.21s - 1396.09s |  So we can delete the basic memory object in the driver.
1396.09s - 1400.05s |  So all the resource related with this basic memory object
1400.05s - 1403.45s |  could be freed, as well as the back-end physical memory.
1403.45s - 1406.41s |  You can see this page has been freed.
1406.41s - 1409.17s |  But the connection here, the connection
1409.17s - 1411.61s |  between the physical memory and the virtual address
1411.61s - 1413.09s |  is still mapped.
1413.09s - 1414.49s |  So it's still there.
1414.49s - 1415.85s |  That's the vulnerability.
1415.85s - 1419.17s |  So we have run this code sequence
1419.17s - 1423.53s |  and triggered the vulnerability.
1423.53s - 1428.37s |  It's a physical page used after free.
1428.37s - 1431.97s |  So we can read and write to free the physical page.
1431.97s - 1433.57s |  You can see we can read and write
1433.57s - 1439.37s |  to this free the physical page from the GPU's virtual address.
1439.37s - 1442.29s |  And also, it's a worst condition issue.
1442.29s - 1446.33s |  We require the two threads to do binding and unbinding
1446.33s - 1448.85s |  at the same time.
1448.85s - 1453.49s |  And here, let's summarize the exploit primitive.
1453.49s - 1456.41s |  We have a physical page used after free.
1456.41s - 1459.57s |  We return this physical virtual mapping.
1459.57s - 1463.09s |  So we can access free the physical page.
1463.09s - 1466.85s |  And this vulnerability is pretty stable.
1466.85s - 1472.85s |  Usually, when we trigger used after free issue or rate
1472.85s - 1476.17s |  condition issue, we have to trigger it multiple times.
1476.21s - 1479.33s |  So it's very dangerous you trigger this issue
1479.33s - 1483.21s |  because it will cause the system status, wrong status,
1483.21s - 1484.77s |  maybe crash the kernel.
1484.77s - 1486.77s |  But this issue is pretty stable.
1486.77s - 1488.65s |  You can trigger it multiple times
1488.65s - 1493.73s |  without worrying about it fails or causing any crash.
1493.73s - 1497.97s |  And also, we have a method to get the feedback
1497.97s - 1500.17s |  whether this issue is triggered or not.
1500.17s - 1503.45s |  If it's not triggered, we will get this feedback.
1503.45s - 1506.09s |  And if it's triggered, then we know
1507.01s - 1510.61s |  so that we can know exactly how many pages we have controlled.
1510.61s - 1513.61s |  This will make our exploit more stable.
1513.61s - 1516.93s |  And this issue is pretty easy to trick.
1516.93s - 1519.57s |  Without any special tricks, you don't
1519.57s - 1521.85s |  have to adjust the thread priority
1521.85s - 1524.37s |  or add more entries to the list.
1524.37s - 1527.25s |  You can easily trigger this issue.
1527.25s - 1532.65s |  So this is a pretty nice exploit primitive.
1532.65s - 1538.73s |  So far, we have tricked the vulnerability.
1538.73s - 1543.25s |  We have controlled a lot of physical memory pages.
1543.25s - 1547.57s |  The questions became the following question.
1547.57s - 1550.05s |  Suppose we already controlled a large amount
1550.05s - 1551.93s |  of physical memory page.
1551.93s - 1553.41s |  What are we going to do?
1553.41s - 1555.69s |  There are lots of answers and solutions
1555.69s - 1558.17s |  for an experienced kernel hacker.
1558.17s - 1561.53s |  For example, we can supply lots of this structure
1561.53s - 1564.09s |  created into the kernel heap and then
1564.09s - 1566.61s |  modify the UID and the GID.
1566.61s - 1570.09s |  We can also supply lots of structure file
1570.09s - 1573.01s |  and then modify the file permission.
1573.01s - 1577.89s |  And also, we can use this kernel space memory mirroring attack.
1577.89s - 1581.33s |  So we can modify and control the GPU page table
1581.33s - 1584.37s |  and then do the mirroring.
1584.37s - 1587.45s |  Here, we will introduce our new method.
1587.45s - 1594.41s |  So we are spraying structure KGS memory description.
1594.41s - 1596.57s |  So you can see on the right, we are
1596.57s - 1601.41s |  spraying this structure, KGS memory entry.
1601.41s - 1604.61s |  It contains the target structure we want to spray.
1604.61s - 1607.21s |  It contains the memory description structure.
1607.21s - 1610.05s |  Also, it contains metadata.
1610.05s - 1612.05s |  And for this memory description, we
1612.05s - 1615.65s |  can see they have a physical address and a size.
1615.65s - 1618.41s |  So why we are using this method?
1618.41s - 1621.01s |  The first reason is easy to spray.
1621.01s - 1625.25s |  You can simply call this GPU allocator control.
1625.25s - 1626.89s |  Then you can spray a large amount
1626.89s - 1629.45s |  of this structure in the kernel.
1629.45s - 1633.09s |  And also, because we have this metadata,
1633.09s - 1635.49s |  this is fully controlled by the user space.
1635.49s - 1638.61s |  So the user space can set a unique metadata
1638.61s - 1642.61s |  so that it can be defined easily in the memory.
1642.61s - 1646.05s |  And it's easy to use and very useful.
1646.05s - 1648.53s |  You can spray this structure and then
1648.53s - 1650.69s |  modify the physical address.
1650.69s - 1653.61s |  And then do memory map in the user space.
1653.61s - 1655.57s |  When you do memory map, you will be
1655.57s - 1659.53s |  able to map the physical address to user space.
1659.53s - 1662.85s |  And also, if you check the result of the memory map,
1662.85s - 1666.01s |  then you know whether your exploit is working or not.
1666.01s - 1671.25s |  So you can easily know how the exploit works.
1671.25s - 1673.53s |  And there's one extra bonus.
1673.53s - 1675.33s |  It's possible you use this method
1675.33s - 1678.09s |  to bypass the KSR directly.
1678.09s - 1680.09s |  Even if you don't have a KSR, you
1680.09s - 1683.21s |  can use this method to bypass the KSR.
1683.21s - 1686.09s |  We will discuss this later.
1686.09s - 1691.33s |  Now, suppose we already have a physical page controlled.
1691.33s - 1693.53s |  Like this, we control this physical page.
1693.53s - 1697.69s |  And in this page, we have our package structure,
1697.69s - 1700.41s |  memory entry, which contains the metadata
1700.41s - 1702.81s |  so that we can find this metadata.
1702.81s - 1708.65s |  And then we find this memory description structure.
1708.65s - 1712.73s |  In this structure, it will have a physical address
1712.73s - 1715.29s |  and a size and ops.
1715.29s - 1717.57s |  We will modify these three fields.
1717.57s - 1719.17s |  We will modify the physical address
1719.17s - 1722.97s |  to the physical address of the kernel
1722.97s - 1725.51s |  and the size to the kernel size.
1725.51s - 1729.25s |  And also, we will modify the ops from the KSR ops
1729.25s - 1733.45s |  to this continuous ops.
1733.45s - 1735.73s |  Why we will modify this ops?
1735.73s - 1736.93s |  Look at the new ops.
1736.93s - 1739.13s |  You can see it have a VM folder.
1739.13s - 1756.84s |  This is used when we do a new continuous ops, which
1756.84s - 1759.60s |  contains a new VM folder.
1759.64s - 1764.84s |  So when the user space do memory mapping on this memory object,
1764.84s - 1769.32s |  it will get a user space virtual address,
1769.32s - 1773.08s |  which the user space can access to the virtual address.
1773.08s - 1775.92s |  But at the first time, when the user space access
1775.92s - 1779.24s |  to the address, because the physical to virtual mapping
1779.24s - 1783.68s |  is not set up yet, so it will get into a VM folder.
1783.68s - 1786.16s |  So the driver will get into the VM folder
1786.16s - 1788.48s |  to set up the physical to virtual mapping
1788.48s - 1789.76s |  and look at the code.
1789.76s - 1792.12s |  You can see this mapping is quite simple.
1792.12s - 1795.72s |  It just gets the physical address we just modified.
1795.72s - 1798.68s |  So it will use the physical address we want
1798.68s - 1802.80s |  and then map this physical address to the user space.
1802.80s - 1806.24s |  So if we modify this physical address
1806.24s - 1809.32s |  to the kernel physical address, then the kernel memory
1809.32s - 1811.72s |  will be mapped to the user space.
1811.72s - 1815.24s |  So we can do arbitrary read write to the kernel memory.
1815.24s - 1820.24s |  So that's why we use this structure memory description
1820.24s - 1824.20s |  and how the exploit works.
1824.20s - 1826.44s |  Let's summarize the exploitation.
1826.44s - 1829.32s |  So we trigger the vulnerability, and then we
1829.32s - 1831.68s |  get a controlled physical page.
1831.68s - 1835.44s |  We repeat this step 200 times.
1835.44s - 1839.40s |  Then we get 200 physical pages controlled.
1839.40s - 1841.72s |  Then we can get to the next step.
1841.72s - 1846.00s |  We can force the system memory into a low memory status.
1846.00s - 1849.36s |  So all the used kernel memory, all the caches
1849.36s - 1854.40s |  will be returned to the system, including the physical pages
1854.40s - 1855.44s |  that we controlled.
1855.44s - 1861.12s |  So the 200 pages will also be returned to the kernel.
1861.12s - 1862.84s |  Then we get to the next step.
1862.84s - 1865.36s |  We do kernel heap spray using the structure
1865.36s - 1867.44s |  we just described.
1867.44s - 1872.00s |  So if we are lucky, some of the entries
1872.00s - 1874.60s |  will be located in the controller page.
1874.60s - 1883.24s |  So we can find these structures in the controller page
1883.24s - 1885.56s |  using the metadata we just assert.
1885.56s - 1890.08s |  So we can scan the controller memory and find the structure.
1890.08s - 1891.80s |  And then we get this structure.
1891.80s - 1895.02s |  You can see on the right, we get the memory description
1895.02s - 1898.22s |  structure, which contains the physical address side
1898.22s - 1900.30s |  and the ops we want to modify.
1900.30s - 1905.54s |  And here, one thing you can see, the ops is a pointer.
1905.54s - 1909.82s |  It's a point to something in the kernel memory.
1909.82s - 1913.06s |  So if we read this ops out, then we
1913.06s - 1916.10s |  can get the KSL information.
1916.10s - 1920.78s |  So in our exploiter, we bypass the KSL at this step.
1920.78s - 1924.06s |  So we can bypass the KSL here, and then
1924.06s - 1925.70s |  get to the next step.
1925.70s - 1929.10s |  We can modify the physical address, modify the size,
1929.10s - 1930.90s |  modify the ops.
1930.90s - 1933.14s |  We will modify the kernel physical address
1933.14s - 1935.50s |  to the kernel physical address, and the size
1935.50s - 1936.78s |  to the kernel size.
1936.78s - 1939.54s |  Then finally, we can map the whole kernel memory
1939.54s - 1941.10s |  to the user space.
1941.10s - 1943.66s |  Then we can do arbitrary read-write to the kernel
1943.66s - 1945.74s |  memory in the user space.
1945.74s - 1948.86s |  So that's the exploiter.
1948.86s - 1954.38s |  We can actually expand this method to a more generic case.
1954.38s - 1960.18s |  Suppose you have kernel heap buffer overflow,
1960.18s - 1962.02s |  or you have a risk condition issue,
1962.02s - 1967.58s |  you can also use this method to make your exploiter easier.
1967.58s - 1971.62s |  The first step, you can spray a large amount of this memory
1971.62s - 1974.58s |  descript into the kernel heap.
1974.58s - 1977.14s |  And then you trigger your vulnerability.
1977.14s - 1980.62s |  Suppose you have a kernel heap overflow issue.
1980.62s - 1985.42s |  You can overflow it from here into this ops.
1985.42s - 1990.22s |  Then you can control the physical address and ops.
1990.22s - 1992.30s |  And then you can try to do memory
1992.30s - 1995.58s |  map on this memory object.
1995.58s - 1997.58s |  If you are lucky, you succeed.
1997.58s - 2001.38s |  Then you can map the whole kernel physical memory
2001.38s - 2002.70s |  to the user space.
2002.70s - 2005.66s |  But if you are not lucky, you can try it again and again
2005.74s - 2007.50s |  until you succeed.
2007.50s - 2012.46s |  So that's how we expand this method to a more generic case.
2012.46s - 2016.26s |  And maybe you remember we have a bonus,
2016.26s - 2019.70s |  which we can bypass the case using this method.
2019.70s - 2022.82s |  So look at the structure carefully.
2022.82s - 2027.22s |  You may find that there are lots of kernel points,
2027.22s - 2031.54s |  like the page table is a pointer and the host PTR.
2031.54s - 2033.30s |  And also we have the SGT.
2033.30s - 2035.90s |  You might think, oh, we will need
2035.90s - 2038.50s |  to get a case information first.
2038.50s - 2043.58s |  We have to point this point to a digital address.
2043.58s - 2047.30s |  But in fact, you don't have to worry about this field.
2047.30s - 2048.94s |  Because in most of the case, if you
2048.94s - 2052.70s |  don't call some special control by yourself,
2052.70s - 2056.10s |  these fields are not used in most of the case.
2056.10s - 2061.22s |  So you can just overwrite these fields with a capital value
2061.22s - 2062.70s |  or whatever you want.
2062.70s - 2065.90s |  You can just overwrite the page table, the host PTR,
2065.90s - 2067.78s |  and the GPU address.
2067.78s - 2071.06s |  All this stuff are not used.
2071.06s - 2073.90s |  The only thing you care about is the physical address,
2073.90s - 2076.30s |  the size, and the ops.
2076.30s - 2079.10s |  You might all think, oh, here we have the ops.
2079.10s - 2080.82s |  It's also a pointer.
2080.82s - 2083.98s |  So you have to know the original value,
2083.98s - 2086.74s |  or you have to know the ASR information.
2086.74s - 2091.90s |  But actually, no, you don't have to know the KSR information.
2091.90s - 2094.22s |  You look at the original value carefully.
2094.22s - 2097.10s |  You can see this is the original value,
2097.10s - 2101.34s |  and this is the target value we want to modify.
2101.34s - 2105.30s |  You can see that the high bytes are actually the same.
2105.30s - 2106.62s |  Why are they the same?
2106.62s - 2111.02s |  Because the KSR is based on the page.
2111.02s - 2112.10s |  It's page-based.
2112.10s - 2115.86s |  So if the two function points are in the same page,
2115.86s - 2120.50s |  so they have the same high bytes that are in the same page.
2120.50s - 2122.98s |  So all these bytes are the same.
2122.98s - 2124.86s |  So you can actually ignore these bytes
2124.86s - 2128.70s |  and overwrite from the beginning to the lowest byte,
2128.70s - 2130.14s |  overwrite it to here.
2130.14s - 2133.02s |  Then you don't have to care about the KSR.
2133.02s - 2135.78s |  So that's how we bypass the KSR.
2135.78s - 2139.62s |  And once in here, you can see the lowest byte already
2139.62s - 2141.78s |  known from the kernel firmware.
2141.78s - 2145.54s |  So you don't have to acquire additional information.
2145.54s - 2149.66s |  You can bypass the KSR and get the expert working.
2149.66s - 2152.86s |  You just overwrite to the lowest byte
2152.86s - 2155.74s |  and ignore the high bytes.
2155.74s - 2158.18s |  Yeah, that's how we bypass the KSR.
2158.18s - 2161.10s |  And in some case, maybe you are not so lucky.
2161.10s - 2164.38s |  You get the following situation.
2164.38s - 2166.58s |  You can see it's not in the same page,
2166.58s - 2169.34s |  but in the source code, they're near each other.
2169.34s - 2172.98s |  So in most of our case, the original value
2172.98s - 2175.18s |  is near the target value.
2175.18s - 2178.18s |  So it's just like a 4-bit difference.
2178.18s - 2181.54s |  So for 4-bit, it's just a 16 possibility.
2181.54s - 2183.94s |  You can try 16 times.
2183.94s - 2187.26s |  So you can undo the brute force for 16 times.
2187.26s - 2189.30s |  Then you can bypass the KSR.
2189.30s - 2194.66s |  So that's how we bypass the KSR, and that's the exploit.
2194.66s - 2197.30s |  We'll get to the demo.
2197.30s - 2198.66s |  The demo is online.
2198.66s - 2201.86s |  You can view the demo online.
2201.86s - 2203.62s |  Also, we'll play it here.
2203.62s - 2208.54s |  You can see here, when we record this demo,
2208.54s - 2212.66s |  we are recording it on a pretty famous smartphone
2212.66s - 2216.86s |  using the latest Qualcomm SoC, using
2216.86s - 2222.46s |  Snapdragon generation 8 with the latest security patching.
2222.46s - 2225.22s |  That will start with the shell user.
2225.22s - 2228.26s |  Of course, you can also use untracked application user.
2228.26s - 2229.86s |  It's no difference.
2229.86s - 2232.50s |  So we are trying to get a root shell.
2232.50s - 2237.38s |  Of course, we don't have a root privilege now, so this fails.
2237.38s - 2239.30s |  We will start our exploit.
2239.30s - 2242.02s |  And the first step is to trigger the vulnerability
2242.02s - 2246.54s |  and control a large amount of physical pages.
2246.54s - 2249.14s |  So we trigger the vulnerability again and again.
2249.14s - 2253.38s |  And here, we think we have enough pages.
2253.38s - 2255.58s |  So now you can see we have controlled
2255.58s - 2257.30s |  enough physical pages.
2257.30s - 2259.22s |  Then we go to the next step.
2259.22s - 2261.78s |  We trigger a system no memory.
2261.78s - 2265.22s |  We allocate a lot of memory from the user space.
2265.22s - 2270.38s |  So all the cached memory, all the system memory,
2270.38s - 2273.82s |  unused system memory will be returned to the kernel.
2273.82s - 2276.06s |  So we can do heap spray.
2276.06s - 2280.02s |  We create a lot of these VBO entries.
2280.02s - 2281.82s |  And then we are lucky.
2281.82s - 2287.14s |  Some of the VBO entries will be located in the controller page.
2287.14s - 2289.58s |  So we scan the controller page.
2289.58s - 2294.02s |  And then we can find this controlled object.
2294.02s - 2298.18s |  You can see we found one controlled memory description
2298.18s - 2299.06s |  object.
2299.06s - 2301.94s |  So this object has a physical address, size,
2301.94s - 2303.62s |  and the ops we want.
2303.62s - 2308.86s |  So we can patch this structure, the ops.
2308.86s - 2310.62s |  We will modify the physical address.
2310.62s - 2314.70s |  You can see this A801 is actually
2314.70s - 2316.54s |  the kernel physical address.
2316.54s - 2318.46s |  And the size is the kernel size.
2318.46s - 2321.78s |  So we have patched the structure.
2321.78s - 2325.14s |  And now we can do memory map, map this structure
2325.14s - 2327.34s |  to the user space.
2327.34s - 2330.78s |  So we can map the whole kernel memory to the user space
2330.78s - 2333.38s |  and patch the kernel memory.
2333.38s - 2335.86s |  Here we have patched the kernel version.
2335.86s - 2339.50s |  And also we patched some of the code in the kernel.
2339.50s - 2340.98s |  So we can get a root.
2340.98s - 2344.34s |  So you can see now we are the root user.
2344.34s - 2346.86s |  So that's the demo.
2346.86s - 2350.17s |  Yeah.
2350.17s - 2351.01s |  Thank you.
2351.01s - 2355.13s |  I will transfer to Eugene for the next content.
2355.13s - 2356.73s |  Thank you very much, Shilin.
2356.73s - 2358.69s |  And with that, I will be speaking
2358.69s - 2361.77s |  about the last section of this presentation, how
2361.77s - 2364.81s |  we found this vulnerability, which methodology is
2364.81s - 2367.61s |  applicable when you are doing bug hunting for GPU kernel
2367.61s - 2372.81s |  modules, and what we can do to improve security of the GPU
2372.81s - 2375.65s |  in the mobile space.
2375.65s - 2378.01s |  Well, first of all, we identified this vulnerability
2378.01s - 2380.85s |  via manual code review when we were doing patch analysis.
2380.85s - 2383.05s |  And by patch analysis, essentially,
2383.05s - 2385.77s |  we use a collective term where we
2385.77s - 2388.13s |  look at the security fixes, which
2388.13s - 2390.81s |  are published in the Android Qualcomm Security Bulletin.
2390.81s - 2393.25s |  We also look at the security research published
2393.25s - 2395.09s |  by other security researchers.
2395.09s - 2397.13s |  And this is very important for such complex cases
2397.13s - 2400.69s |  and big targets such as GPU, because the state is very big.
2400.69s - 2403.17s |  And as Shilin explained earlier in this presentation,
2403.17s - 2404.49s |  there is a lot of moving parts.
2404.49s - 2407.33s |  So in order to have a holistic understanding,
2407.49s - 2413.69s |  it's important to read others' blog reports
2413.69s - 2418.41s |  to better understand the domain in this area.
2418.41s - 2420.17s |  Originally, we wanted to put on the slide
2420.17s - 2423.09s |  a very cool chain of vulnerabilities, which
2423.09s - 2425.65s |  we did variant analysis for.
2425.65s - 2428.13s |  So for example, Qualcomm internally
2428.13s - 2429.81s |  identified one of the issues.
2429.81s - 2432.13s |  They published a fix in their security bulletin.
2432.13s - 2436.21s |  Then a security researcher looked at this fix.
2436.21s - 2439.57s |  They found another related issue in this area.
2439.57s - 2442.37s |  They wrote a blog post and published it.
2442.37s - 2445.77s |  While looking at these two fixes by Qualcomm and the security
2445.77s - 2448.73s |  researcher, we managed to identify another problem
2448.73s - 2451.69s |  in the related area.
2451.69s - 2453.85s |  But later, we decided to remove this information,
2453.85s - 2457.97s |  because the issue might still be under remediation
2457.97s - 2460.97s |  and not to tip off the folks working
2460.97s - 2462.61s |  on the other side of the fence.
2462.61s - 2464.53s |  We decided to put this quote here,
2464.53s - 2466.81s |  which I think reflects the idea which we
2466.81s - 2470.54s |  would like to convey in the slide.
2470.54s - 2472.50s |  While speaking about methodologies,
2472.50s - 2474.50s |  we cannot skip fuzzing, because fuzzing
2474.50s - 2477.06s |  is one of the central methodologies we use.
2477.06s - 2479.54s |  This is one of the most efficient and productive ways
2479.54s - 2483.42s |  of finding bugs in the modern complicated software
2483.42s - 2484.50s |  and the firmware.
2484.50s - 2488.58s |  And there is a lot of benefits, I think,
2488.58s - 2489.74s |  quite obvious for fuzzing.
2489.74s - 2491.66s |  So on this slide, particularly, we
2491.74s - 2494.94s |  will focus on challenges applicable to fuzzing GPU
2494.94s - 2501.90s |  targets and think about how can we overcome those
2501.90s - 2504.30s |  or how can we solve them.
2504.30s - 2509.50s |  So first of all, to enable efficient fuzzing of the GPU
2509.50s - 2513.94s |  drivers, there is a lot of dependence on the hardware.
2513.94s - 2516.10s |  As we have seen, this particular vulnerability
2516.10s - 2518.62s |  is in the misconfiguration of the IOMMU.
2518.62s - 2521.66s |  So in order to theoretically find this vulnerability,
2521.66s - 2523.62s |  we would need to do on-device fuzzing.
2523.62s - 2525.66s |  And although this is possible, this
2525.66s - 2528.14s |  makes fuzzing a little bit less scalable,
2528.14s - 2529.86s |  because we would actually need to run it
2529.86s - 2531.74s |  on the hardware versus, let's say,
2531.74s - 2533.82s |  pure software fuzzing, which can scale
2533.82s - 2536.18s |  with the number of the fuzzing cores.
2536.18s - 2538.46s |  This is not a limitation, but this
2538.46s - 2541.78s |  is one of the interesting observations,
2541.78s - 2544.86s |  because I know that there are some other GPU vendors which
2544.86s - 2546.74s |  enable building their kernel mode
2546.74s - 2549.58s |  components in the architecture-independent way.
2549.58s - 2551.66s |  So basically, there is a separation
2551.66s - 2553.34s |  between software and hardware logic,
2553.34s - 2558.98s |  so it's possible to build driver and run it
2558.98s - 2562.22s |  without the hardware to be able to test and fuzz
2562.22s - 2565.50s |  the generic functionality implemented in the software.
2565.50s - 2567.90s |  And another approach is using the emulation-based fuzzing
2567.90s - 2569.78s |  to have an emulator for that.
2569.78s - 2572.78s |  But I guess this is a little bit more complicated approach,
2572.78s - 2574.98s |  because this requires manual work in order
2574.98s - 2576.98s |  to understand how the hardware actually works,
2576.98s - 2584.18s |  in order to be able to emulate it in the emulator.
2584.18s - 2585.90s |  This particular issue was identified
2585.90s - 2589.22s |  in the MMU and IOMMU domain.
2589.22s - 2591.14s |  And this is actually a very common pattern
2591.14s - 2594.22s |  in the GPU bugs reported these days,
2594.22s - 2597.38s |  where the physical pages for the back-end storage
2597.38s - 2599.98s |  are released back to the kernel, while at the same time,
2599.98s - 2603.54s |  there is a mapping in the IOMMU for the GPU,
2604.54s - 2607.90s |  which maps these released pages back to the virtual address
2607.90s - 2608.90s |  space of the GPU.
2608.90s - 2611.02s |  And this is very difficult to detect with fuzzing,
2611.02s - 2612.94s |  because this doesn't lead to any crash.
2612.94s - 2616.22s |  Even if we are lucky enough to hit the race condition here,
2616.22s - 2618.86s |  still, there is no sanitizers which
2618.86s - 2623.38s |  would report us that, hey, you have dangling MMU
2623.38s - 2625.50s |  entries in the page tables.
2625.50s - 2626.74s |  So this is one thing.
2626.74s - 2630.46s |  So probably manual instrumentation of the driver
2630.46s - 2632.18s |  with such checks would help.
2632.22s - 2635.46s |  But again, this is manual work, which makes it less scalable.
2635.46s - 2638.54s |  GPU has a very complicated state machine.
2638.54s - 2640.46s |  As we have seen, there is multiple components.
2640.46s - 2642.50s |  And sometimes, in order to hit certain functions,
2642.50s - 2648.18s |  we would need to have a set of syscalls executed
2648.18s - 2649.46s |  in a very precise sequence.
2649.46s - 2651.82s |  Or if we're speaking about fuzzing with syscaller,
2651.82s - 2653.94s |  probably this is additional custom syscalls,
2653.94s - 2656.02s |  which needs to be written for that.
2656.02s - 2660.82s |  And of course, fuzzing concurrency, concurrent code
2660.86s - 2663.34s |  is not straightforward.
2663.34s - 2665.86s |  Because there are some problems with reproducing
2665.86s - 2669.58s |  and problems with hitting those vulnerabilities.
2672.70s - 2674.58s |  Probably the final slide before we wrap it up,
2674.58s - 2676.42s |  the ultimate mitigations question mark.
2676.42s - 2677.26s |  Why question mark?
2677.26s - 2680.66s |  Because, well, I guess suggesting mitigations for GPU
2680.66s - 2683.06s |  is really not straightforward.
2683.06s - 2688.58s |  And this is more about thinking in points about how can we
2688.58s - 2691.58s |  make GPU security better in the mobile space.
2691.58s - 2693.82s |  First of all, one of the major points
2693.82s - 2696.82s |  why GPU is so attractive is because it is widely
2696.82s - 2699.10s |  accessible to untrusted code.
2699.10s - 2702.02s |  Because the untrusted code can directly open the driver
2702.02s - 2704.66s |  and send arbitrary data to it.
2704.66s - 2708.70s |  Android is very known for using IPC and binder in order
2708.70s - 2710.26s |  to isolate components.
2710.26s - 2714.30s |  So maybe one of the ideas is to move a GPU from in-process hull
2714.30s - 2715.70s |  into the out-of-process hull.
2715.70s - 2718.18s |  I know this will impact performance.
2718.18s - 2720.18s |  And performance is very important for GPU.
2720.18s - 2722.38s |  This might create some backward compatibility issues.
2722.38s - 2724.42s |  But this is one of the ideas to think about.
2724.42s - 2728.02s |  And additionally, the usage of memory-safe languages
2728.02s - 2732.26s |  in the driver, I think, based on our experience,
2732.26s - 2736.06s |  they might mitigate the majority of root causes, which
2736.06s - 2738.70s |  lead to problems such as integer overflows,
2738.70s - 2744.26s |  or in this particular case, integer race conditions.
2744.26s - 2747.30s |  And I think with that, we hit almost end of our time.
2747.30s - 2750.14s |  And last slide, thank you very much for your attention.
2750.14s - 2753.10s |  A small, shameless marketing plug here.
2753.10s - 2756.58s |  We have our Android offset with google.com,
2756.58s - 2758.90s |  where we publish our security research.
2758.90s - 2762.50s |  And with that, yeah, I think we're
2762.50s - 2765.94s |  happy to take any questions here on stage or offline using
2765.94s - 2768.90s |  this content information here.
2768.90s - 2770.82s |  Thank you very much.


url: https://www.youtube.com/watch?v=z33TSv9EXBQ
title: DEF CON 32 - Nano Enigma Uncovering the Secrets in eFuse Memories - Michal Grygarek, Martin Petr
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=z33TSv9EXBQ",
  "title": "DEF CON 32 - Nano Enigma Uncovering the Secrets in eFuse Memories -  Michal Grygarek, Martin Petr",
  "description": "For years, eFuse-based memories were used to store sensitive information such as encryption keys, passwords, and other potentially confidential pieces of information. This practice was encouraged by several vendors who leverage such memory types for protecting the debugging interfaces using a password or for official way to store encryption keys for external flash memories.\n\nHowever, with the advances in technology and threat actors\u2019 creativity, eFuse-based memories may take a hard hit on their confidentiality assurance as their physical properties could allow for a relatively easy extraction of the stored information.\n\nIn this talk we will walk you through the journey of revealing one such data storage from decapsulating the chip itself, delayering it using common household items all the way to using advanced tools such as Scanning Electron Microscope (SEM) to read value of an encryption key and thus break the confidentiality of the encrypted flash memory.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2286,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 5.84s | This text was transcribed using whisper model: large-v2

 I'd like to welcome you on our talk, Nano Enigma, Uncovering the Secrets within EFUSE
5.84s - 10.50s |  Memories. Uh first of all, allow me a brief introduction. Uh my name is Martin and I'm here
10.50s - 15.74s |  together with my colleague Michal. We also have a third partner in crime named Hayan,
15.74s - 20.88s |  however he couldn't come here with us so we just have pre-recorded message from him. Uh we
20.88s - 24.88s |  all work in the embedded system security testing team that's based in Prague, Czech
24.88s - 29.66s |  Republic, which is under Accenture Umbrella and we all have different fields of focus. So
29.68s - 33.98s |  for me that's reverse engineering, so I'm usually that person that wants that firmware
33.98s - 40.46s |  image unencrypted. So making me shut up was partial motivation of this talk. Uh I'm pretty
40.46s - 44.26s |  sure the other guys will tell you briefly about themselves when their time comes so I'm
44.26s - 48.90s |  just gonna jump straight ahead into the overview. Uh we have it in the title, we will be
48.90s - 54.04s |  talking about EFUSES and EFUSE is an electronic component which is just uh 2 points
54.04s - 59.54s |  interconnected with a connection that has a property that it burns or terminates when
59.56s - 64.66s |  the current flowing through it exceeds certain threshold. Uh this is really useful when
64.66s - 68.76s |  you want to protect your home appliances from over current and but it's also really
68.76s - 73.30s |  useful when you want to create something called one time programmable memory. Because if
73.30s - 79.60s |  you represent bits with EFUSES, once you change state of a bit from 0 to 1, you cannot
79.60s - 86.42s |  ever unchange it back to 0. This basically means that you you can change the the state of
86.46s - 91.26s |  the device permanently. This is really useful for security because now you can use these
91.26s - 97.10s |  types of memories to for example disable debugging interfaces or enable secure boot or
97.10s - 102.74s |  put there public keys for secure boot. However some manufacturers took it one step further
102.74s - 107.68s |  and they actually use these EFUSE based memories for storing information that requires
107.68s - 113.36s |  confidentiality protection. Uh meaning that you can find there also flash memory
113.36s - 118.60s |  encryption keys or passwords for debugging interfaces. Uh but since I mentioned that
118.60s - 124.10s |  that connection burns or terminates, there's actual physical change inside that component.
124.10s - 128.58s |  So how do you protect confidentiality of something that could be observed through
128.58s - 132.78s |  microscope? Because for example if I Google EFUSE microscope, you're gonna get all the
132.78s - 139.28s |  images like burned and unburned examples. So the protection measure you you mainly used
139.28s - 145.08s |  in some of the chips we looked at was layering. So layering is normal way of making chips
145.08s - 150.12s |  where you stack components on top of each other. However if you put that EFUSE based memory
150.12s - 154.50s |  in the very bottom layer, you can then consider it protection because you can't directly
154.50s - 160.80s |  observe it. Uh this is based mainly on an assumption that performing the layering process,
160.80s - 165.98s |  so removing carefully the layers from the chip so that you can extract information from it
165.98s - 171.48s |  is very complex and expensive process. But we are here at DEF CON because we have proved
171.48s - 177.78s |  this assumption wrong and we will demonstrate you all these techniques on an ESP32 chip
177.78s - 183.90s |  from Espressif. However keep in mind that all of what we will be presenting here is also
183.90s - 188.90s |  generally applicable to just about any chip that is using an EFUSE based memory. And with
188.90s - 194.00s |  that uh I would like to pass my word to Michal who's gonna walk you to the details of the
194.00s - 205.58s |  ATT&CK. Hello my name is Michal Grigarek and I'm also proud uh sorry I'm also a part
205.58s - 212.66s |  of Accenture Prague. At first I must say I'm really proud to be here on this stage to present
212.66s - 223.97s |  you results of our work. So my colleague Martin just explained what EFUSE is for and now let's
224.03s - 230.63s |  take a look more closely how we can observe these structures in much more detail and what
230.63s - 242.71s |  technologies and skills we will need. First we must decapsulate the chip. Decapsulation is
242.71s - 249.43s |  the process when we extract the silicon plate from the from the epoxy housing. Of course
249.43s - 256.43s |  there exist some other material for for housings but for purposes this presentation we only
256.43s - 268.13s |  consider only epoxy materials. There we see four basic techniques for decapsulation. Thermal,
268.13s - 278.37s |  chemical, laser and plasma. Thermal method, this method use only a blowtorch or heat gun. Simply
278.43s - 286.83s |  heat up the epoxy housing and then slowly and carefully break it and obtain the epoxy,
286.83s - 297.03s |  sorry epoxy silicon plate. Chemical decapsulation use concentrate chemicals, concentrate acid to
297.03s - 307.17s |  dissolve the epoxy housings. Laser etching use a strong laser beam to vaporize the epoxy material
307.17s - 317.55s |  but this method is quite risky because it is very easy to burn the silicon plate and my problem
317.55s - 329.37s |  lies in the heat deposition to the sample. And the last plasma one, this process involves ionized
329.47s - 340.37s |  gas or plasma to selective etching of materials. So due to its availability and good traceability
340.37s - 349.21s |  we decided to use chemical method of decapsulation. Especially we used concentrated acid. In our case
349.21s - 361.45s |  concentrated acid means 96% of concentration which must be heated to the approximately
361.67s - 370.39s |  150 degrees Fahrenheit. The chemical methods can be effectively combined with laser ablation. At
370.39s - 377.75s |  first laser removes a large part of the housing and then the remaining can be dissolved in the
377.75s - 395.27s |  acid. This short process during the exposure to the acid which is needed. The acid will dissolve
395.27s - 407.17s |  the housing residue and leaving only the dye. Of course we must use appropriate protective
407.55s - 418.59s |  equipment. After this process we obtain a beautiful etched chip suitable for other investigation.
418.59s - 436.69s |  Because the chip has typically metallization on its two layers, we do not see any internal layers
436.75s - 447.87s |  at the first. So we must etch the surface to obtain these structures and this process is
447.87s - 457.03s |  called de-layering. Again we have seen on this slide four types of basic method of de-layering.
457.21s - 468.25s |  Mechanical is the cheapest and starting about $100. Chemical, when we consider only chemical it is
468.25s - 480.09s |  also not expensive. Laser ablation uses very short precise femtoseconds pulses of laser beam to
481.03s - 491.67s |  ablate the surface but it is quite costly starting at 50k USD. And the last, the plasma. This is
491.67s - 500.15s |  simply the nanomachining using an ion beam. It offers maximum precision but comes of course
500.15s - 512.52s |  with maximum price tag as well. Due to cost effectiveness we choose to mechanical etching
512.58s - 522.38s |  with a wet stone. I just slide a piece of silicon with my finger over the stone. Of course we must
522.38s - 531.78s |  use a grinding stone with highest possible grit size. In our case it is 8000 grit. Of course it
531.78s - 541.26s |  requires some skill and I personally mastered it around 10 samples. Too much pressure quickly
541.26s - 549.24s |  obtain the background and it means we must start again. But with patience and systematic polishing
549.24s - 561.36s |  we can obtain beautiful etched chip within 30 minutes or 1 hour. Unfortunately wet stone etching
561.36s - 572.56s |  alone isn't enough. Our stone has grain size about 2 microns but for the final stage it is necessary
572.56s - 584.10s |  to use a diamond lapping foil which grain size has less than 0.5 microns. These foils made a
584.10s - 591.26s |  significant difference providing much more smoother surface and of course reducing the number of
591.26s - 607.67s |  scratches. I tried to prepare the sample on the industrial machine costing around 65 KSV and as we
607.67s - 616.91s |  see on these pictures mostly the same results can be achieved when I use wet knife etching stone and
616.91s - 629.00s |  the lapping foils purchased on Aliexpress for 100 bucks. Another important task is to locate the
629.00s - 640.84s |  eFuse memory bank itself. The largest part of the chip is taken up by logical circuits. It is easily
640.84s - 654.88s |  identified and can be skipped. The other radio frequency part is good visible too and can be skipped.
654.88s - 664.56s |  And the rest we left with the rectangle purple areas and these are memory types such as RAM, flash and our
664.68s - 677.06s |  eFuses. The eFuse memory cells is essentially a fuse which is conductive structures with a weak point.
677.06s - 688.18s |  In our case it's looking like some triangle with a line going through it. It's looking like a flag maybe.
688.18s - 696.48s |  And at approximately 500 times magnification clear repeating isolated structures of our eFuses become
696.48s - 708.02s |  visible. They are relatively small and each eFuse represents once bit is smaller than 1 micron. We have
708.02s - 719.50s |  successfully located these eFuse banks on ESP32 version S2, S3 and C6. It is positioned slightly differently
719.50s - 736.16s |  on the C6 but the construction is the same. And now optical microscopy. Observation with optical microscopy
736.16s - 745.36s |  has its limits. Maximum resolution of optical microscopy is around 400 nanometers which corresponds with
745.36s - 757.80s |  2000 times magnification. That is nearly physical limits. This magnification is suitable for locating our
758.64s - 770.93s |  structures, our eFuse bank. And on well-prepared sample we can even see if the eFuse is burned or not or programmed
770.93s - 781.05s |  or not. The term burned is fitting because when we program data into the eFuse memory bits during
781.05s - 792.37s |  programmation going current through the fuse and physically change its structures and these changes are
792.37s - 803.74s |  observable by optical or scanning electron microscopy technology. For the size comparison a human hair is 100
803.74s - 815.58s |  times bigger than our eFuses. In order to read their states correctly and repeatedly we of course need
815.58s - 822.54s |  some much more advanced imaging technique. And it is scanning electron microscopy which provides much more
822.54s - 833.14s |  higher resolution. Scanning electron microscopy provides approximately 100 times better resolution. As I said
833.14s - 841.50s |  since optical microscopy has a resolution around 400 nanometers, scanning electron microscopy has a resolution
841.54s - 850.78s |  approximately 5 nanometers which corresponds to magnification 100,000 times. Of course these parameters can apply
850.78s - 860.38s |  specifically to our scanning electron microscope. It is Hitachi FlexSAM. The image compares the level of detail we can
860.38s - 870.30s |  achieve with these methods and the difference is significant. This is what the eFuse looks like at even higher
870.30s - 879.06s |  magnification using a large electron microscope. This image shows the 3D structure which essentially looks like a
879.06s - 889.06s |  printed circuit board. Everything is visible at the nanoscale. On the right image we see detail of unburned eFuse,
889.10s - 904.82s |  clear eFuse representing logical zero and on the left image we see burned eFuse representing logical one. Once we obtain
904.82s - 914.30s |  higher resolution images of our eFuses we can read the data stored in them. In my initial experiments I manually
914.30s - 928.18s |  transcribed the data to the Excel bit by bit, fuse by fuse, which was extremely time consuming and it requires intense
928.18s - 942.90s |  focus to avoid error because bits look very similar. It takes about 10 hours to read one bit of 4096 bits and
942.90s - 952.90s |  additionally mapping the logical memory address to a specific cell on the silicon die was also very, very challenging. I had to
952.90s - 963.70s |  carefully read and transcript about 20 kilobytes of data before we had enough for our analysis. It truly feels like a forensic
963.70s - 972.22s |  investigation. And now my colleague demonstrates how to assign a logical address to a physical location of given memory.
973.22s - 985.99s |  Thank you Michal for extracting all this data during your vacation. Now that we have the raw data we have to somewhat put meaning to it so that we have
985.99s - 993.55s |  some useful information out of it. The best place to start with is documentation because it actually mentions a lot of information about both
993.55s - 1001.15s |  logical and physical alignment of the memory. From the logical perspective it will tell us that there are 11 of eFuse blocks and that blocks zero,
1001.15s - 1010.35s |  one and two are used for system purposes. These basically store MAC address, chip ID and chip configuration that you can set. The rest of the
1010.35s - 1017.71s |  blocks are user programmable, meaning you could put whatever you want there, however their primary purpose is actually to store the secure boot
1017.71s - 1025.99s |  keys or the flash memory encryption keys. From the physical perspective the information is a little scarce, but it will tell us that there are
1025.99s - 1035.55s |  four backups of block zero, meaning that any single eFuse burned in block zero will actually result in four actual fuses burned. And blocks one to
1035.55s - 1044.23s |  ten are using Reed-Solomon coding scheme for automatic error correction. This is just 12 bytes added to each of the blocks, uh but it could prove
1044.23s - 1052.15s |  useful in case we cause some damage during the delayering process so we'll talk about that briefly later. So with that, let's summarize what we
1052.15s - 1060.03s |  want to know. We have a lot of bits we now need to assign them to the bytes, then we want to take those bytes, put them in the correct order and
1060.03s - 1069.91s |  have them assigned in the blocks and then voila, we will have our flash memory encryption key. To do that we performed several experiments and the
1069.91s - 1078.15s |  first one was a really stupid one and I came up with it. And it was like let's burn values FF into the first block of an eFuses so that we can locate
1078.15s - 1086.83s |  where it is. However at that time we didn't really know how painful it is to actually read them so we kind of wasted this experiment because if you burn
1086.83s - 1096.19s |  only FF values you can very well detect where the first block is but you really can't detect how the bit assignment works inside these bytes and how the byte
1096.19s - 1106.07s |  order works in the blocks because that information just doesn't exist in such a memory. So we quickly transitioned to the second experiment. In this case we
1106.07s - 1114.71s |  were a bit smarter so we burned in unique patterns into the eFuse blocks and these unique patterns had something in common and that is that the most
1114.71s - 1125.67s |  significant bits of all of the bytes in these patterns were set to 1, either 3 or 4 of them. This was because just from an overview of the memory, if you look at
1125.67s - 1134.99s |  the middle picture, the big one, you can see a lot of red color in the upper portion, those are the 1s and that the lower portion has a lot of variety in it. You may
1134.99s - 1144.75s |  think there's an ASCII text written at the bottom line, at the bottom of the picture, there are no hidden messages, this is purely coincidence. But if we take the
1144.75s - 1154.71s |  only useful information from the very first experiment and filter out in those Excel files the rows that were associated with the first block, we can clearly see our
1154.71s - 1163.99s |  pattern. So in this case we now know that the bits are organized in columns with the most significant bits in the upper portion of the memory and we also know the byte
1163.99s - 1173.63s |  and the NS inside the blocks. This is enough for us to just extract any information we want from these memories. We did several other experiments, mainly to
1173.63s - 1184.19s |  confirm that the memory is working the same way also on the other lines of the chip, so we did on S2, S3, C6, as Michal was saying. And the third one I'm showing you
1184.19s - 1195.19s |  here isn't really interesting from the memory layout evaluation, but it's rather interesting because of those white fields there. Again I am to blame for that, because when you do the
1195.19s - 1206.03s |  layering on the whetstone and you don't clean the whetstone you have a debris that's left there and when you keep scratching with your finger you create these gigantic canyons in
1206.03s - 1218.07s |  that memory where the e-fuses are just completely gone. In this case that Reed-Solomon automatic error correction could actually prove useful to recover the information, however for like
1218.07s - 1228.11s |  future proofing these methods we rather spend the time on improving the layering method because for example block 0 here doesn't have any automatic error correction and the other
1228.15s - 1242.17s |  chips don't have that as well. It was just that in case of ESP32, if you do some damage to the chip you can actually recover for it using this automatic error correction. Uh so now this image will show you the layout of the
1242.17s - 1257.17s |  memory so the full green row at the top and the bottom of the picture and 6 others, full green rows in between, that's block 0 so that's where those 4 times duplicated values actually go to. Uh for example if you
1257.17s - 1262.17s |  disable JTAG, that's where 4 e-fuses will be burned. And the
1262.17s - 1265.21s |  rest of the colorful blocks, and I'm sorry for using too many
1265.21s - 1268.21s |  shades of green, but I'm bad with colors. Anyway, the rest of
1268.21s - 1270.91s |  this color of, uh, the rest of the blocks here are the user
1270.91s - 1275.01s |  writable blocks. Most tutorials on the internet will just tell
1275.01s - 1279.49s |  you please put your encryption key into the purple one here. So
1279.49s - 1283.89s |  that's where we will be focusing the most. Uh, but once you know
1283.89s - 1286.13s |  the alignment of the blocks, it doesn't really matter which
1286.13s - 1289.09s |  blocks you extract. You just get the coordinates from the
1289.09s - 1293.07s |  extracted data. Uh, the biggest problem at this point was that
1293.07s - 1296.81s |  Michal refused to read that manually, uh, anymore after
1296.81s - 1301.21s |  whatever amount of bits he read. So we had to turn to our machine
1301.21s - 1304.71s |  learning guru to help us automate the process. Uh, his
1304.71s - 1307.25s |  name is Hayan and he unfortunately couldn't be here
1307.25s - 1311.05s |  with us. Uh, but he prerecorded the message, uh, prerecorded his
1311.05s - 1314.39s |  part of the presentation, which I'll try to play now. There's
1314.39s - 1319.59s |  about a 50% chance it's going to play. Uh, if it does not, I
1319.59s - 1322.25s |  will still play it and I'll try to comment it. So you will not
1322.25s - 1323.93s |  learn anything useful. So let's see.
1325.87s - 1328.93s |  Hello, I'm Hayan Eri, security database senior analyst in
1328.93s - 1331.87s |  Accenture. And also I'm doing a PhD in music, which I learned
1331.87s - 1334.91s |  in the four violin clubs. I will go through the automation
1334.91s - 1338.95s |  process and show you finally a demo about it. Let's go.
1339.91s - 1344.95s |  Instead of a visual reading of the effuses from the images, we
1344.95s - 1347.95s |  automated the process. We started from the output of
1347.95s - 1351.75s |  microscope, where there are around 200 images for each one.
1352.59s - 1355.69s |  First we stitched these images to get only one image per one,
1356.03s - 1359.67s |  then pre-processing before applying the machine learning,
1359.87s - 1362.27s |  then applying the machine learning object detection model,
1362.63s - 1368.43s |  then extracting the effuses values into the arrays.
1369.91s - 1373.51s |  The microscope provides high resolution images when working
1373.51s - 1378.31s |  in zigzag mode. In zigzag mode, the microscope scans the palm in
1378.31s - 1382.31s |  zigzag line, as we see here in the figure, generating around
1382.59s - 1389.43s |  200 images for each one. Each image is 2,560 by 1,920. We can
1389.43s - 1393.03s |  see this image is high resolution image as we can
1393.03s - 1396.23s |  distinguish between the off effuse, which is the default
1396.31s - 1403.39s |  state, and the blown one, which is the on case. We keep margin
1403.39s - 1411.27s |  by 35% between images to avoid wasting any pixels. Then we
1411.27s - 1417.03s |  stitch these images to get one image per bank. But when using
1417.31s - 1422.51s |  the embedded stitching tool in the microscope, we get bad
1422.55s - 1426.67s |  stitching. For example, there is misalignment between zero and
1426.67s - 1430.43s |  one, or two, one, two, two, or between first row and second
1430.43s - 1435.95s |  row. The reason behind this misalignment is that the margin
1435.99s - 1441.75s |  is theoretically 35%. But practically speaking is
1442.35s - 1447.67s |  something random around this value. That's why we suggested
1448.07s - 1452.63s |  a new stitching method. In this method, to stitch two images,
1452.63s - 1455.11s |  one and two, we define comparison strip in the first
1455.11s - 1461.43s |  image and look for the similar strip in a stitching area in the
1461.43s - 1466.47s |  second image. A stitching area is plus minus 200 pixels around
1466.47s - 1471.43s |  the margin line. When defining the similar strip, we determine
1471.43s - 1475.35s |  the margin accurately and also the vertical shift between
1475.35s - 1478.75s |  images. Here we can see the result of stitching image one
1478.75s - 1483.23s |  and two. The advantage of this method is to accurate, but
1483.27s - 1488.59s |  downside is the long time it takes. For example, to stitch
1488.71s - 1492.87s |  200 images to constitute one bank image, it will take around
1492.87s - 1496.95s |  five hours. Here we can see the result of stitching for one
1496.95s - 1505.83s |  bank image. Its high resolution image is 34,000 by 12,000 image.
1506.63s - 1511.91s |  To effectively use AI to extract the fuses, we use Jetson
1511.91s - 1517.19s |  Ajax Orion from NVIDIA. It has 64 gigabyte RAM and 2048 CUDA
1517.19s - 1522.79s |  cores and 64 tensor cores, which makes it good for the image
1522.79s - 1528.15s |  based AI projects like object detection projects. We use also
1528.19s - 1533.15s |  MobileNet SSD model, which provides a balance between speed
1533.15s - 1539.51s |  and accuracy. This model is trained to detect fuses in the
1539.51s - 1542.79s |  images in terms of the coordinates of the fuses in the
1542.79s - 1547.39s |  images. Also, it's a class whether it is on or off. Here
1548.39s - 1553.99s |  the example of on if-use and this is off if-use, which is the
1554.03s - 1561.39s |  default state of the if-use. What is the optimal input of the
1561.39s - 1567.55s |  model? We read from the MobileNet SSD model documents, the
1567.59s - 1571.91s |  optimal size for training and also for inference is 300 by
1571.91s - 1578.03s |  300. Also, we should meet another condition, which is the
1578.71s - 1583.83s |  object, which is if-use size to the image size should be bigger
1583.83s - 1587.71s |  than predefined ratio. This ratio, in our case, is defined
1587.71s - 1593.99s |  using practical experience. It is 0.04. Here we can see the
1593.99s - 1598.55s |  example of the optimal image and we can see also the size of the
1598.71s - 1603.55s |  if-use regarding to the image size. We meet these two
1603.55s - 1607.79s |  conditions using resizing and tiling. When tiling the
1607.83s - 1612.15s |  stitched image, we keep 100 pixels overlapping between
1612.15s - 1617.55s |  tiles to be sure that the whole size of if-use is exist, at
1617.55s - 1624.31s |  least in one tile. When training the model, we used 3500 training
1624.31s - 1628.55s |  tiles with balanced number between on and off fuses. We
1628.55s - 1634.03s |  used CFAT tool, which is a web-based AI free tool to
1634.03s - 1637.99s |  annotate the if-uses. Here we can see example of annotation.
1638.03s - 1642.07s |  We use different colors when drawing boxes about the on and
1642.07s - 1648.67s |  off if-uses. The training results, the detection accuracy
1648.71s - 1654.23s |  99%, the classification accuracy 97% and also we got fake
1654.23s - 1658.79s |  detection where non-if-use objects are detected as if-uses,
1659.07s - 1663.39s |  but these fake detections will be resolved during the post
1663.43s - 1669.59s |  processing after prediction. Now we have stitched image. What
1669.59s - 1675.75s |  do we do to extract the if-uses? First, we tile this stitched
1675.75s - 1680.35s |  image to 2500 tiles. Then we apply the inference using the
1680.35s - 1685.35s |  trained machine learning model. The inference results for each
1685.35s - 1690.91s |  tiles are three things. First, the continuous of if-uses in the
1690.91s - 1693.83s |  tile and also the classification of the if-uses
1693.83s - 1698.07s |  whether they are on or off and also the confidence score which
1698.07s - 1701.67s |  corresponds to how the machine learning model is confident
1701.75s - 1706.59s |  about the classification. These three things, results from all
1706.59s - 1711.15s |  the tiles will be re-aggregated again on the stitched image.
1712.39s - 1718.71s |  Then the duplicates will be removed with keeping only the
1718.75s - 1724.35s |  highest confidence score. Finally, any if-use with
1724.59s - 1730.39s |  confidence score less than 95% will be visually checked.
1732.19s - 1737.63s |  Finally, we will use dbScan clustering method to define the
1737.67s - 1743.23s |  outliers out of the columns and remove them. Then we use another
1743.23s - 1748.35s |  clustering method to group the if-uses in columns and exporting
1748.55s - 1754.39s |  their values into the arrays 1s and 0s. We repeat the same
1754.39s - 1759.11s |  process for another bank as we know there are lower bank and
1759.11s - 1764.83s |  upper bank. Finally, we will get a 64 by 64 array and then we'll
1764.83s - 1771.11s |  go through the next steps as my colleagues explained. We will
1771.15s - 1777.63s |  extract the encryption key from the array and use this key to
1777.67s - 1782.19s |  decrypt the encrypted firmware. We will see these steps in the
1782.19s - 1797.01s |  demo. Let's go. We have firmware image where the main program
1797.37s - 1802.09s |  prints periodically the sentence Hello Las Vegas. This firmware
1802.13s - 1805.37s |  is encrypted. That's why when we look for Hello World, we can
1805.37s - 1814.90s |  find nothing. Here we will see the images of lower bank and
1814.90s - 1823.46s |  upper bank of the chip holding the encrypted firmware. Here are
1823.46s - 1831.62s |  the images of lower bank before stitching. Here the image of
1832.26s - 1838.70s |  stitched lower bank. You can see the high resolution of the
1838.70s - 1844.42s |  stitched image. Now we will apply the if-use detection
1844.86s - 1851.30s |  script. This script will go through the stitched lower bank
1851.30s - 1855.26s |  and upper bank, do pre-processing, tiling of the
1855.26s - 1860.82s |  images, and prepare the images to be optimal input for the
1860.86s - 1866.22s |  model. These tiles will be stored in the folder for
1866.22s - 1876.70s |  inference, this folder. Now, the script will run the machine
1876.70s - 1883.46s |  learning model, which is trained. This model will do the
1883.46s - 1891.82s |  inference and detect the if-uses classes on and off, and
1891.82s - 1895.86s |  also the confidence scores of the classifications. Starting
1895.86s - 1912.81s |  from the upper bank, then the lower bank script will store all
1912.81s - 1916.29s |  of these inference results or in-folder inference results.
1917.65s - 1923.77s |  Now the script will ask for visually checking the if-uses
1924.05s - 1927.53s |  where there are different classifications due to tiles
1927.53s - 1933.29s |  overlapping. For the lower bank, we have 11 if-uses should be
1933.29s - 1941.91s |  checked. The checking should be whether the if-use unbound
1941.91s - 1953.29s |  means off or bound means on or not if-use. For the upper bank,
1953.29s - 1974.14s |  we have zero if-uses to be checked. Visually, if the if-use
1974.46s - 1980.02s |  with confidence score is then 95%. We have eight if-uses to be
1980.02s - 2008.82s |  checked in the lower bank and 13 in the upper bank. After that,
2008.82s - 2012.38s |  the script will show us the distribution of the if-uses in
2012.38s - 2020.22s |  the image. We can note that no outliers and also in the upper
2020.22s - 2026.66s |  bank. As everything is okay, the script will export the values
2026.66s - 2036.71s |  of if-uses as zeros at once. The script also will extract the
2036.71s - 2041.67s |  flush key file, which contains the encryption keys of the
2041.67s - 2051.19s |  firmware and here the 64 by 64 array of ones and zeros. We will
2051.19s - 2055.35s |  use the flush key file to decrypt the encrypted firmware
2055.71s - 2063.59s |  and get the decrypt.bin file, which is the decrypted firmware.
2069.54s - 2077.06s |  Here is the decrypted.bin file. We should look for hello in this
2077.06s - 2086.94s |  file. We should find something. And here we are. Thanks. I will
2086.94s - 2090.90s |  go back to my colleagues to conclude the presentation.
2093.39s - 2096.63s |  Okay, I know it's 3am in Prague, but Haijan, if you're watching,
2096.63s - 2103.23s |  thanks for the video. Now to conclude real quick. If you have
2103.23s - 2108.23s |  an information that you would like to store, if you like have
2108.23s - 2110.75s |  an information that you would like to keep secret and you need
2110.75s - 2114.75s |  to store it in a chip and you have a choice to do so, please
2114.75s - 2118.87s |  do not put it in any fuse-based memory. In the case of ESP32
2118.87s - 2121.91s |  chip, if you want to encrypt the flash memory, and you really
2121.91s - 2125.39s |  should if you want to, you have no other choices. So in this
2125.39s - 2128.67s |  case, you should use countermeasures such as using a
2128.67s - 2133.55s |  unique key per each chip, not just use the same key for every
2133.55s - 2138.59s |  device. If you have a choice to store it in some HSM module,
2138.59s - 2142.35s |  physical unclonable functional protected memory or anti-fuses,
2142.35s - 2146.67s |  whatever you have, it would be a better way. Because any fuse
2146.67s - 2151.15s |  based memory is just readable based on its physical
2151.15s - 2154.67s |  properties. And the readability protection methods such as
2154.67s - 2158.71s |  layering, they do increase the effort by putting obstacles in
2158.71s - 2161.59s |  between the malicious actor and the information that you're
2161.59s - 2165.19s |  trying to protect. They don't prevent reading. In this case,
2165.19s - 2167.95s |  we had to destroy the chip in process of recovering this
2167.95s - 2172.51s |  information. But since our goal was to recover an unencrypted
2172.51s - 2175.83s |  firmware image, we didn't really care about that, because we
2175.83s - 2180.39s |  don't need it to run, we just want to read the firmware. The
2180.39s - 2184.07s |  assumption about the delay ring being expensive, complex and
2184.07s - 2189.31s |  whatnot has basically been destroyed. Because if you have a
2189.31s - 2195.99s |  sink, whetstone, and at least two fingers, you could do that
2196.27s - 2199.51s |  in your home conditions. And if you also can rent a microscope
2199.51s - 2202.55s |  on your local university for a couple hours to just scan some
2202.71s - 2206.95s |  location on chip, then you can do the recovery of the
2206.95s - 2212.11s |  information at home. So it's rather easy and cheap, if you're
2212.11s - 2216.03s |  willing to sacrifice a bit of your fingers. Are there two
2216.03s - 2220.31s |  things I'd like to point out still. The first one is to thank
2220.31s - 2223.71s |  to Espressif, because they allowed us to have this talk. And
2223.71s - 2226.31s |  the communication with them was really smooth. So thanks for
2226.31s - 2230.27s |  that. And finally, I'd like to admit to a lie, because at the
2230.27s - 2234.71s |  very beginning, I told you that if you burn an eFuse from state
2234.71s - 2241.51s |  zero to one, you cannot unburn it. I lied because you can. But
2241.51s - 2244.51s |  the processes around this are really complex and really
2244.51s - 2248.79s |  expensive. So I'd like to keep this as a separate topic for
2248.79s - 2254.27s |  perhaps next time. And we can transition into the Q&A session,
2254.27s - 2257.79s |  which as I've heard, we will be doing as we will be going. But
2257.79s - 2262.75s |  wait, we also have a giveaway. We have 20 decapsulated ESP32
2262.75s - 2266.83s |  chips in a vials that look like that they hold some bacteria,
2266.83s - 2271.31s |  but we promise that they did not. And we could just take them
2271.31s - 2275.23s |  and try the layering process at home if you want to, or you just
2275.23s - 2278.83s |  as a souvenir. So thank you for attention. And we will be
2278.83s - 2280.15s |  answering questions as we go.


url: https://www.youtube.com/watch?v=sfma7ymwmdA
title: DEF CON 32 - Bug Hunting In VMware Device Virtualization - JiaQing Huang, Hao Zheng, Yue Liu
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=sfma7ymwmdA",
  "title": "DEF CON 32 - Bug Hunting In VMware Device Virtualization - JiaQing Huang, Hao Zheng, Yue Liu",
  "description": "In this presentation, we will unveil a new attack surface: Device Virtualization in VMKernel. This isan unknown territory that has not been explored by security researchers to date. During the reverse engineering of the VMware Hypervisor, we discovered 8 vulnerabilities related to device virtualization, 3 of them have been assigned CVE number (some vulnerabilities have even been successfully exploited in Tianfu Cup), and the remaining 5 of our vulnerabilities have been officially confirmed by VMware.\n\nFirstly we will delve into the loading process of vmm, the implementation of data sharing between vmm and vmx, and VMware's UserRPC, which facilitates communication between the Hypervisor and the Host. These mechanisms are crucial in virtual device emulation.\n\nThen We will explain security issues in various parts of the USB system, including the host controller, VUsb middleware, and VUsb backend devices, based on the vulnerabilities we have unearthed.\n\nIn the end, We will primarily discuss the similarities and differences in SCSI-related device emulation in the virtual disk system between VMware Workstation and ESXi Additionally, we will cover design flaws related to disk device emulation that we discovered in VMKernel.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2351,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

1.36s - 11.52s | This text was transcribed using whisper model: large-v2

 We are excited to share our talk with you and also feel a little disappointed for we
11.52s - 14.96s |  cannot arrive at DEF CON in person.
14.96s - 20.00s |  And we do hope our talk will serve as a guide for anyone who's looking to start VMware security
20.00s - 21.00s |  research.
21.00s - 28.40s |  Firstly, allow me to introduce us to you.
28.40s - 33.80s |  My name is Jiaxin Huang, and Hao Zheng and me are both security researchers of Tenggong
33.80s - 36.36s |  team at Xianxin Group.
36.36s - 41.12s |  And we are both interested in reverse engineering and visualization security.
41.12s - 49.20s |  Yueliu is our team leader, and our team consists of lots of people interested in viral security
49.20s - 50.20s |  domain.
50.20s - 53.56s |  And we have a website to post our blog on it.
53.56s - 57.96s |  So if you are interested in it, make sure to follow us.
57.96s - 65.20s |  And if you have any questions, feel free to DM or email us.
65.20s - 66.60s |  Here's the short story.
66.60s - 69.96s |  Let's describe our visualization backcounting journey.
69.96s - 76.32s |  We actually started to research visualization security from the end of 2022.
76.32s - 81.76s |  And in that time, we basically know nothing about visualization.
81.76s - 85.24s |  So why are we interested in it?
85.24s - 89.60s |  Because visualization is involved in lots of hacking contests.
89.60s - 93.28s |  And it's a very hard, very challenging target.
93.28s - 98.88s |  And for myself, I want to reverse engineer it and learn how it works.
98.88s - 102.30s |  So what have we achieved in last year?
102.30s - 108.80s |  We successfully escaped from the paralyzed desktop on GeekCon 2023.
108.80s - 115.44s |  And we reported lots of workstation EXXI bugs to VMware.
115.44s - 125.41s |  And we learned a lot, not just about visualization, but about the whole architecture of the entire
125.41s - 126.41s |  computer.
126.41s - 129.21s |  So what can we bring to you today?
129.21s - 135.09s |  Firstly, we will introduce the VMware visualization architecture to you.
135.09s - 141.77s |  Most people hunting bugs directly from debugging the virtual device is code, but we choose
141.77s - 143.89s |  to take a bigger view.
143.89s - 149.41s |  We studied it from reverse engineering the whole VMware visualization architecture.
149.41s - 154.29s |  And this helped us to figure out which code and how they can be influenced by the guest
154.29s - 155.69s |  OS.
155.69s - 161.05s |  And hopefully, it will bring some new idea to you.
161.05s - 167.33s |  And later, we will use the bugs that we found in USB visualization and SCSI visualization
167.33s - 172.41s |  to explain the possible source of 3D in virtual device.
172.41s - 179.01s |  And anyway, a virtual device is still the most cost-effective choice in visualization
179.01s - 180.01s |  bug hunting.
180.01s - 190.08s |  Okay, let's start the first part, VMware Hypervisor Reverse Engineering.
190.08s - 195.40s |  If you are new to VMware visualization, I do have some tips for you.
195.40s - 202.12s |  The most important binary on VMware workstation or EXXI is VMX.
202.12s - 208.44s |  It is responsible for starting the virtual machine and contains most of virtual device
208.44s - 209.44s |  code.
209.44s - 215.96s |  And no matter it is EXXI or workstation, their VMX is identical.
215.96s - 219.68s |  And basically, just use different system API.
219.68s - 224.60s |  And in this part, we will use workstation for example.
224.60s - 231.20s |  And also, debugging VMware workstation on the Windows can be much easier.
231.20s - 239.60s |  OpenVM tools shares a lot of code with VMX, like IO function, event loop, and this can
239.60s - 243.80s |  really speed up your reverse engineering procedure.
243.92s - 252.48s |  And also, as a beginner, you may need to collect CVs, papers, device documents, and even check
252.48s - 254.60s |  the QEMU code.
254.60s - 261.00s |  Just utilize every information you can find to reverse engineering.
261.00s - 265.80s |  So first question, where should we start?
265.80s - 271.40s |  If you already learned something about Hypervisor, there's always a loop that handles switching
271.40s - 273.92s |  or switch out of virtual machine.
273.92s - 281.92s |  So we will locate the loop code and start reverse engineering the Hypervisor from there.
281.92s - 288.24s |  Also, we know that VMX is a user mode process.
288.24s - 291.64s |  So it should access the kernel for switching.
291.64s - 294.36s |  So they should have a kernel module.
294.36s - 298.56s |  And on Windows, it's VMX86.
298.56s - 307.64s |  And if we are talking about the EXXI, it just directly communicates with the VM kernel.
307.64s - 313.64s |  And tools such as API monitor can help us analyze the communication process between
313.64s - 320.69s |  the VMX and the host OS kernel.
320.69s - 328.25s |  So of course, the OS lock screen can help us to figure out the meaning of the device
328.25s - 331.86s |  IO control.
331.86s - 336.46s |  So it won't be hard to locate the main loop code.
336.46s - 342.98s |  You can see that VMX uses the IO control ROM VM switch into the virtual machine.
342.98s - 348.58s |  And it's blocked until the virtual machine needs to force you to help.
348.58s - 354.18s |  The VMX will get the return code of the IO control ROM VM and call the corresponding
354.18s - 360.86s |  user RPC handler to handle the virtual machine request.
360.86s - 364.22s |  So what is the user RPC?
364.22s - 372.02s |  And it's a mechanism that VMware designed for VMM to interact with VMX on host.
372.02s - 379.38s |  And very similar to Hypercall, but on user space process VMX.
379.38s - 383.66s |  User RPC contains lots of code related to device emulation.
383.66s - 389.50s |  And basically, it is the start of device emulation.
389.50s - 395.78s |  And it will only take one argument, which is user RPC block pointer.
395.78s - 399.18s |  And it's a shared area memory region.
399.18s - 405.06s |  Shared area is another mechanism for shared data with VMX and VMM.
405.06s - 412.58s |  You may not be able to see some data be changed in VMX because they may be modified in VMM.
412.58s - 418.42s |  So if we want to know what is passed in user RPC block, we should figure out how the shared
418.42s - 421.69s |  area works.
421.69s - 429.05s |  The implementation of shared area is related to creation and loading of VMM.
429.05s - 436.69s |  So we need to study it from the initialization process and pay attention to every memory
436.69s - 438.49s |  location cost.
438.49s - 446.94s |  And also remember to check the interaction between VMware VMX and VMX86.
446.94s - 455.10s |  We will notice that there is a EOF object called VMM block embedded into VMX binary.
455.10s - 460.74s |  Also there are lots of VMM extensions stored in VMM block section.
460.74s - 463.54s |  And these are also EOF object.
463.54s - 472.18s |  VMX will link them with VMM block in memory to construct the actual VMM binary according
472.18s - 476.77s |  to the user's configuration.
476.77s - 481.41s |  Okay, let's take a look at the VMM block.
481.41s - 490.09s |  We can see there are predefined export symbols such as user RPC block and their corresponding
490.09s - 494.97s |  mapping address in the shared per-VCPU VMX section.
494.97s - 499.01s |  And some virtual devices require the shared memory too.
499.01s - 504.13s |  So VMX will define this export symbol in it too.
504.17s - 510.05s |  After these symbols have been defined, VMX will calculate the total size of shared area
510.05s - 515.17s |  memories and allocate the corresponding memory space.
515.17s - 523.25s |  Now we have seen how shared memory were allocated, but how do VMM access them?
523.25s - 527.61s |  You will notice that VMM block has two sections.
527.61s - 534.37s |  One of them contains VMM's GDT information and the other contains the VMM's virtual address
534.37s - 538.52s |  mapping information.
538.52s - 546.08s |  And combined with this information, we will see VMX is responsible for allocating memory
546.08s - 551.40s |  and building the page table structures based on VMM block's information.
551.40s - 559.52s |  And VMX86 will further populate the page table information and allow the VMM EOF file, which
559.52s - 562.68s |  is constructed by VMX.
562.68s - 570.84s |  And VMX, VMM block, VMX86 work together to build the VMM's environment and mapping the
570.84s - 574.76s |  host allocated address to VMM's virtual address.
574.76s - 580.72s |  So if you need to know how to manipulate data in shared area region, you will need to check
580.72s - 584.48s |  the VMM's code.
584.48s - 590.24s |  And VMX choose to run which user RPC code handler is depending on the return code of
590.24s - 593.26s |  the IO control VM run.
593.26s - 598.86s |  So it's time for us to check how VMWare's VMM switch works.
598.86s - 603.94s |  And the most important structure is cross page.
603.94s - 612.34s |  It's a one page size memory region allocated for each vCPU by VMX86.
612.34s - 619.10s |  And it's responsible for storing the context between VMM and the host.
619.10s - 625.02s |  Just like the VM says, VMCS in Intel VT.
625.02s - 633.78s |  We can check the monitor loader section to see its virtual address on the VMM's environment.
633.78s - 643.98s |  When VMX code IO control run VM, it will cause the VMX86 cause the host switch to VMM code
644.30s - 652.34s |  and saving the crew and CPU state to cross page and restore the VMM's CPU state.
652.34s - 659.08s |  And the operation to switch out is the opposite of this process.
659.08s - 666.12s |  Now we can check the VMM's code to see user RPC is implemented through the platform user
666.12s - 667.12s |  code.
667.12s - 675.64s |  It saves the user RPC opcode and the platform code invocation number 100 to the cross page.
675.64s - 685.60s |  And the platform code 100 will cause the VMX86 to return the user RPC code to VMX.
685.60s - 693.68s |  So when IO control run VM returned, VMX can call the corresponding user RPC code handler.
693.68s - 702.16s |  Also whenever VMM prepare to call user RPC, you will see VMM modify the user RPC block
702.16s - 707.97s |  to transfer data to VMX process.
707.97s - 713.69s |  So now we finally understand the whole user RPC implementation.
713.69s - 722.49s |  And based on this knowledge, we are able to further reverse engineering the device visualization.
722.49s - 730.81s |  For port IO emulation, VMM will reserve the x86 IO instructions and may attempt to use
730.81s - 737.32s |  the user RPC to call VMX to process.
737.32s - 743.40s |  And not all of the port IO callback will be registered in VMX process.
743.40s - 750.02s |  There are some devices implement their IO callback in VMM.
750.02s - 759.18s |  For MMM IO, in most cases, VMX associates the memory region with an ID and implement
759.18s - 764.04s |  the callback in VMM.
764.60s - 772.20s |  Most MMM IO functions in VMM automatically will call user RPC to handle the device emulation.
772.20s - 777.56s |  But they may access the shared area to transfer data to VMX.
777.56s - 784.16s |  So you need to check the code in VMM to understand what happened when you access the MMM IO region
784.16s - 788.24s |  in guest machine.
788.24s - 794.76s |  Also, physical memory access is another important part we need to analyze.
794.76s - 800.52s |  We will not discuss too much about the memory mapping structure, but you should know that
800.52s - 805.40s |  on Windows, the main guest memory is mapped as a file.
805.40s - 811.24s |  And on EXXI, it is mapped by vmkernel.
811.24s - 817.68s |  When VMX gets the physical memory region object, it will first check the object's type.
817.68s - 824.75s |  And in most cases, it will directly access the point field.
824.75s - 833.83s |  And the last interesting thing is we also found that on EXXI's VMM, some virtual devices
833.83s - 837.79s |  MMM IO will not always call user RPC.
837.79s - 843.35s |  They will call user RPC only when hosted emulation is enabled.
843.35s - 851.87s |  Instead of using user RPC to interact with VMX, they use vmk code directly call vmkernel
851.87s - 855.51s |  to handle device emulation.
855.51s - 861.83s |  So although VMX are identical on EXXI and Workstation,
861.83s - 869.19s |  virtual device emulation code won't always be the same by default.
869.19s - 881.77s |  And basically, this graph describes the result of our VMware hypervisor analysis.
881.77s - 887.53s |  Anyway, it is important for you to check the VMM code when you reverse engineering the
887.53s - 889.93s |  device visualization.
889.93s - 897.41s |  If you are not sure where device's data comes from, you can go check the VMM's code.
897.41s - 904.97s |  If you are not sure how to trigger the device's code, you can go check the VMM's code.
904.97s - 916.00s |  And if you want to find some new device's code, go check the VMM's code.
916.00s - 926.97s |  Okay, let's enter in the second part, VMWare device visualization bug hunting.
926.97s - 929.45s |  Let's start from the USB part.
929.45s - 934.73s |  Basically, we can divide the USB emulation into three parts.
934.73s - 944.93s |  USB host controller emulation, like EHCI, EHCI, XHCI.
944.93s - 948.77s |  The second part, VUSB emulation.
948.77s - 952.93s |  These are objects described in the USB specification.
952.93s - 960.85s |  For example, URB object, USB pipe object, and USB port object.
960.85s - 965.73s |  And the third part, VUSB backend device emulation.
965.73s - 977.33s |  And these are actual USB devices, such as Bluetooth, HID, and RNG, and so on.
977.33s - 986.17s |  So as you can see, when guests want to access the USB device, it will need to put data in
986.17s - 993.25s |  memory and access the host controller MMIO space, which will trigger the VMM handles
993.49s - 999.49s |  MMIO access, causing the corresponding user RPC co-handler in VMX.
999.49s - 1007.73s |  Then it will convert the data into URB object, and eventually processed by the backend USB
1007.73s - 1008.73s |  device.
1008.73s - 1015.45s |  If it tries to access a USB device plugged in the host machine, it will also need another
1015.45s - 1018.01s |  service to help.
1018.01s - 1025.08s |  And we actually find bugs in all these three parts.
1025.08s - 1034.00s |  The first bug is in the host controller part, and it's an uninitialized memory.
1034.00s - 1038.52s |  Before we start it, let me just explain some concepts.
1038.52s - 1045.36s |  In control transfer, a USB device accepts a type of request called a standard device
1045.36s - 1051.36s |  request, which begins in the format offset setup packet.
1051.36s - 1062.52s |  So it will be 8 bytes at least, and it has a WLAN field, in the case of subsequent data.
1062.52s - 1067.64s |  The USB device may use this type of data, but the host controller does not transfer
1067.64s - 1070.36s |  data based on this unit.
1070.36s - 1079.20s |  For example, in UHCI, data is transferred in units of transfer descriptors.
1079.20s - 1088.16s |  So when VMX handles the UHCI emulation, it retrieves the first TD on Quickhead, and extracts
1088.16s - 1094.40s |  the WLAN field from the setup packet, and uses this size to determine the size of data
1094.40s - 1097.72s |  buffer for URB object.
1097.72s - 1104.52s |  After allocation is finished, it will copy the data into URB object, and they do lots
1104.52s - 1108.96s |  of checks to prevent buffer overflow.
1109.00s - 1111.88s |  Let's back to the allocation process.
1111.88s - 1119.88s |  It's actually when we're depending on the target USB device you are transferring to.
1119.88s - 1127.60s |  A different type of backend USB device will result in URB object with different fields.
1127.60s - 1133.72s |  For example, HID device will allocate URB object with all the additional fields besides
1133.72s - 1136.52s |  the data buffer of the URB.
1136.68s - 1145.67s |  Also, HID device will use Matlock for data allocation.
1145.67s - 1148.59s |  So there are some problems here.
1148.59s - 1155.31s |  Allocating WLAN-sized URB doesn't mean you will get WLAN-sized data from guest sub-ITDs.
1155.31s - 1159.31s |  And Matlock allocation lets the memory un-initialized.
1159.31s - 1165.19s |  Also backend USB device will return data through the same URB buffer, so it will eventually
1165.19s - 1171.16s |  let the HIP data leak to the guest OS.
1171.16s - 1177.52s |  And the second bug is user-after-free appeared in BUSB emulation code.
1177.52s - 1183.04s |  Again, let's first explain some concepts.
1183.04s - 1191.72s |  In XHCI, there is a structure called device context which stores the USB device status.
1191.72s - 1197.48s |  It is constructed by device load context and end-point context.
1197.48s - 1202.20s |  Device load context holds the USB device information.
1202.20s - 1205.44s |  End-point context holds the information for a single end-point.
1205.44s - 1210.04s |  Also, each end-point has one or more transfer rings.
1210.04s - 1215.32s |  They are transfer request blocks on the transfer rings.
1215.32s - 1220.28s |  And XHCI transfer data are based on this unit.
1220.28s - 1225.20s |  In order to explain this bug, we need to look back at an older bug.
1225.20s - 1228.40s |  And the old bug's part is very interesting.
1228.40s - 1233.84s |  It only alters the sequence between the calls to release transfer ring and the code that
1233.84s - 1238.32s |  assign values to end-point context.
1238.32s - 1244.34s |  Let's first figure out how transfer ring release works.
1244.34s - 1251.66s |  Firstly, it will get transfer ring object from the end-point context.
1251.66s - 1258.02s |  Second, it will retrieve the VUSB device object based on the USB port number saved
1258.02s - 1261.90s |  in the device load context.
1261.90s - 1269.34s |  Then it will obtain the VUSB pipe object from the VUSB device object based on the end-point
1269.34s - 1270.86s |  ID.
1270.86s - 1277.66s |  And after that, it will release all the URB object on that VUSB pipe object.
1277.66s - 1283.53s |  And finally, it will release the transfer ring object.
1283.53s - 1292.05s |  Also, it will release the possible URB object on back-end USB device in case there may be
1292.05s - 1296.79s |  dangling pointer on back-end USB device.
1296.79s - 1299.71s |  So it seems no problems here.
1299.71s - 1307.51s |  However, it's actually not the URB object could become the dangling pointer.
1307.51s - 1313.15s |  It is because that the transfer ring object pointer is not only hold by the end-point
1313.15s - 1314.15s |  context.
1314.15s - 1320.95s |  A URB object also holds a point that point to a field of transfer ring object.
1320.95s - 1327.79s |  And this field is responsible for tracking the corresponding TRP when XHCI return the
1327.79s - 1332.80s |  USB device response to the guest.
1332.80s - 1339.52s |  And before the patch, XHCI command-like configure end-point could modify the end-point context
1339.52s - 1344.40s |  contents before releasing the transfer ring.
1344.40s - 1351.00s |  So it may lead the type stored in end-point context mismatch with the VUSB pipe object
1351.00s - 1354.20s |  type.
1354.20s - 1361.56s |  And this will cause the function return without a VUSB pipe object and left the URB object
1361.56s - 1365.92s |  on that VUSB pipe object not be freed.
1365.92s - 1373.56s |  And the previous pointer now becomes the dangling pointer and causing user after free.
1373.56s - 1382.32s |  So now our question is, after this patch, is it possible to make the VUSB pipe object
1382.32s - 1385.36s |  mismatch again?
1385.36s - 1392.12s |  We know VMX will need to check the port number stored in slot context to find the VUSB device
1392.12s - 1393.68s |  object.
1393.68s - 1400.84s |  So if we can modify the port number, it may lead VMX find a wrong VUSB device object.
1400.84s - 1407.86s |  So in that case, it will also find a wrong VUSB pipe object.
1407.86s - 1412.16s |  We do have address device command can make this possible.
1412.16s - 1417.36s |  You can see the address device command only modifies the slot context and the control
1417.36s - 1420.60s |  end-point context.
1420.60s - 1425.32s |  So firstly, we finish the device configuration process.
1425.32s - 1430.12s |  And we create the transfer ring on non-control end-point.
1430.12s - 1434.64s |  And then we transfer URB data on these transfer rings.
1434.64s - 1441.20s |  In the end, we use the address device command on that device to modify the device port number.
1441.24s - 1446.40s |  Now, if we try to release the transfer ring on that end-point, it will fail to find the
1446.40s - 1451.24s |  right VUSB pipe object and causing UAF again.
1451.24s - 1457.00s |  So this is a bug that happens between host controller and the VUSB emulation.
1457.00s - 1465.44s |  And the cause is it fails to manage the object lifetime in VUSB emulation.
1465.44s - 1470.60s |  And the third bug is in the USB backend device emulation.
1470.60s - 1479.38s |  And it is out-of-boundary will be triggered within the system API.
1479.38s - 1481.98s |  Let's start with some concepts.
1481.98s - 1489.22s |  The guest OS communicates with the smart card through the virtual smart card reader.
1489.22s - 1496.94s |  And the guest OS uses CCID protocol to interact with the virtual smart card reader.
1496.94s - 1503.66s |  The application data units, APD, serve as the payload for interaction between the smart
1503.66s - 1507.02s |  card reader and the smart card.
1507.02s - 1513.38s |  And you can see their relationship are very like the host controller and the USB device.
1513.38s - 1522.10s |  And you may already seen that both of these data structure has the length field.
1522.10s - 1528.70s |  And it is always need to be careful handling this length field.
1528.70s - 1534.82s |  VMware do checks whether the message length field of CCID protocol match the length field
1534.82s - 1535.82s |  of command APD.
1535.82s - 1543.86s |  But it fails to verify whether these two fields conform to the size of URP buffer.
1543.86s - 1550.62s |  It directly uses this field as arguments to call the Windows S card transmit API.
1550.62s - 1556.74s |  Clearly, S card transmits cannot check whether the length match the data buffer.
1556.74s - 1562.34s |  So it will out-of-bound access to the heap data and write it to the smart card on your
1562.34s - 1563.34s |  host.
1563.34s - 1566.94s |  Also, you may be able to read it back.
1566.94s - 1572.34s |  So it's kind of interesting.
1572.34s - 1579.10s |  Okay, in conclusion, it's very challenging to defend such complex system.
1579.18s - 1587.22s |  VUSB emulation can be attacked, USB device emulation can be attacked, and host controller
1587.22s - 1589.86s |  emulation can be attacked too.
1589.86s - 1600.62s |  Also, we still have cases cannot present, but you can defer the binary to found.
1600.62s - 1605.14s |  And maybe more attack scenarios in the future.
1605.14s - 1615.14s |  We will be plugging EVO USB device and leverage the VMX to execute the code, or leverage local
1615.14s - 1621.02s |  USB service to privilege the escalation.
1621.02s - 1625.06s |  And anyway, that's the USB part.
1625.06s - 1631.46s |  And next part will be presented by my colleague.
1631.46s - 1637.98s |  And we will show you that how SCSI works different on ESXi and Workstation by default.
1637.98s - 1644.96s |  Hello, everyone.
1644.96s - 1645.96s |  I'm Zhenghao.
1645.96s - 1649.72s |  I'm the speaker on this topic.
1649.72s - 1655.76s |  Now it's my turn to expose VMkernel, a whole new attack surface.
1655.76s - 1663.04s |  But I will first talk about some differences between ESXi and Workstation.
1663.04s - 1668.48s |  Because our new attack surface is hidden in these small differences.
1668.48s - 1679.24s |  ESXi is a Type-1 hypervisor that runs directly on the host's physical hardware, while Workstation
1679.24s - 1689.20s |  is a Type-2 hypervisor that is installed on top of an existing host operating system.
1689.20s - 1695.96s |  Workstation supports more configurations and devices than ESXi, which means that in
1695.96s - 1704.16s |  certain situations, Workstation can be audited at more points than ESXi.
1704.16s - 1713.36s |  In some specific devices, the data flow direction of ESXi and Workstation is different.
1713.52s - 1723.56s |  Next, I will take SCSI device emulation as an example to demonstrate the vulnerabilities
1723.56s - 1731.72s |  on different attack surfaces caused by different data flow orientations.
1731.72s - 1736.48s |  This is an overview of the SCSI data flow.
1736.48s - 1742.36s |  You can see that there are two paths for writing data to the disk.
1742.36s - 1747.04s |  One through VMkernel and one through VMX.
1747.04s - 1757.80s |  These are two completely different code paths, belonging to ESXi and Workstation, respectively.
1757.80s - 1765.36s |  The specific code path of SCSI in Workstation is shown in the figure.
1765.36s - 1777.28s |  If the user calls the MPI function SCSIORequest command, it will enter the LSILogic MPO process
1777.28s - 1787.84s |  SCSIOMessage function, where it will confirm whether the environment is the hosted emulation.
1788.00s - 1799.76s |  Finally, the LSILogic hosted process SCSIOMessage function calls the relevant handler in VMX
1799.76s - 1803.32s |  through user RPC.
1803.32s - 1811.40s |  The specific code path of SCSI in ESXi is shown in the figure.
1811.40s - 1821.92s |  ESXi divides the situation into whether the environment itself is in hosted emulation.
1821.92s - 1828.76s |  If it's in hosted emulation, it's the same as the Workstation path.
1828.76s - 1838.32s |  Otherwise, it goes to LSILogic VMk process SCSIOMessage.
1838.32s - 1846.16s |  Go to VMkernel through VMk core arguments.
1846.16s - 1856.20s |  Because of this small code gap, ESXi has a new attack surface that Workstation does not have.
1856.20s - 1865.20s |  Next, I will introduce the vulnerabilities I found on these two different paths.
1865.20s - 1875.24s |  The first vulnerability we will talk about is located in VMX, and the official description
1875.24s - 1880.84s |  is out-of-bounds read-write vulnerability.
1880.84s - 1889.80s |  As a tool for storing data, stability is the most critical and basic requirement for disks.
1890.20s - 1898.84s |  VMware implements corresponding disk verification capabilities in device emulation.
1898.84s - 1907.60s |  One of the disk verification capabilities is to detect data corruption through checksum.
1907.60s - 1912.96s |  This is where the vulnerability occurs.
1912.96s - 1919.08s |  Before we start, let's first introduce a SCSI command.
1919.08s - 1930.28s |  In the SCSI command reference menu, there is a command called write16 that allows the
1930.28s - 1938.32s |  operation of 8-byte logical block address and 4-byte transfer length.
1938.32s - 1948.52s |  This shows that we can use this command to access any address in the 64-bit space, provided
1948.52s - 1952.92s |  there is no disk capacity limit check.
1952.92s - 1962.20s |  VMware did not implement the disk capacity limit check in its disk verification program
1962.20s - 1964.92s |  implementation.
1964.92s - 1973.56s |  As can be seen in the figure, after applying for a heap of a corresponding size according
1973.72s - 1985.40s |  to the disk capacity, only the operation is checked to see if it is a read or write operation.
1985.40s - 1989.88s |  Obviously, this is a heap overflow.
1989.88s - 1999.88s |  The write16 and other read and write commands in the SCSI command reference menu allow us
1999.88s - 2003.72s |  to access any 8-byte address.
2003.72s - 2011.97s |  This allows us to easily perform arbitrary read and write operations.
2011.97s - 2020.53s |  The vulnerability we will discuss next is located in VMkernel, and the official description
2020.53s - 2024.37s |  is out-of-bounds read.
2024.37s - 2029.73s |  Still start with the SCSI command reference menu.
2029.81s - 2038.69s |  In the SCSI command reference menu, there is a command called unmap, which can unmap
2038.69s - 2044.53s |  one or more logical basic addresses.
2044.53s - 2054.77s |  The structure of unmap itself is relatively complex and is divided into three parts.
2054.77s - 2062.37s |  unmap command, unmap parameter list, and unmap block descriptor.
2062.37s - 2071.57s |  Let's first look at the structure definition of unmap command in the SCSI command reference
2071.57s - 2073.01s |  menu.
2073.01s - 2082.05s |  The focus of the figure is the parameter length, which indicates the total length of the unmapped
2082.13s - 2085.09s |  parameter data.
2085.09s - 2093.73s |  The unmapped parameter list is divided into two parts, unmapped parameter list header
2093.73s - 2098.05s |  and unmapped block descriptor data.
2098.05s - 2106.37s |  The unmapped parameter list header consists of three fields, unmapped data length, unmapped
2106.37s - 2111.49s |  block descriptor data length, and reserved.
2111.49s - 2119.49s |  The unmapped block descriptor consists of two fields, unmapped logical block address
2119.49s - 2123.33s |  and number of logical blocks.
2123.33s - 2131.01s |  These two fields indicate the starting address and length of the block that the user wants
2131.01s - 2133.89s |  to unmap.
2133.97s - 2142.93s |  This is an open view of the three unmapped structures so that everyone can easily understand
2142.93s - 2147.33s |  the structure of the unmapped command.
2147.33s - 2156.53s |  The three structures are very closely related, and we will focus on parameter list length
2156.53s - 2160.77s |  and unmapped block descriptor data length.
2160.85s - 2164.05s |  Those fields indicate the length.
2164.05s - 2171.89s |  Unmapped block descriptor data length indicates the length of all subsequent unmapped block
2171.89s - 2174.69s |  descriptors.
2174.69s - 2182.53s |  Parameter list length includes not only the length of all unmapped block descriptors,
2182.53s - 2188.93s |  but also the length of the unmapped parameter list header.
2188.93s - 2197.25s |  Let's see how VMware implements the unmapped command according to the SCSI commands reference
2197.25s - 2199.81s |  menu.
2199.81s - 2208.21s |  Before actually running the unmapped command, the vscsi-check-unmapped-cmd function will
2208.21s - 2210.77s |  be entered first.
2210.77s - 2219.09s |  In this function, a heap of the corresponding size is requested according to the parameter
2219.09s - 2226.45s |  list length, and all the unmapped data is copied to the heap.
2226.45s - 2235.33s |  After the unmapped data is copied, the content of the data will be checked, but it forgets
2235.41s - 2242.93s |  to check the relationship between parameter list length and unmapped block descriptor
2242.93s - 2252.05s |  data length, and the number of unmapped block descriptors is determined based on the unmapped
2252.05s - 2254.93s |  block descriptor data length.
2254.93s - 2263.01s |  The user can set a special parameter list to carry a large number of unmapped block
2263.01s - 2268.69s |  descriptors, but only check the first unmapped block descriptor.
2270.69s - 2274.53s |  Check completed, enter the actual use stage.
2275.57s - 2284.85s |  According to the code in the figure, parameter list length is used as the boundary length,
2284.85s - 2292.85s |  which allows the previously unchecked unmapped block descriptor to be put into use.
2293.97s - 2302.45s |  The unchecked logical block size is used as the size variable in the code shown in the
2302.45s - 2307.01s |  figure, and overviews out-of-bounds read.
2307.01s - 2316.61s |  In fact, it is this out-of-bounds read that actually causes the crash, not the so-called
2316.61s - 2318.05s |  out-of-bounds read.
2318.53s - 2326.37s |  Regarding the new attack surface of VMkernel, I have summarized the following three major
2326.37s - 2326.93s |  points.
2327.65s - 2337.57s |  Modify the existing sandbox protection mechanism, elevate the current process privileges, virtual
2337.57s - 2338.61s |  machine escape.
2339.65s - 2342.53s |  OK, thank you for your listening.
2342.53s - 2348.85s |  If you have any problem, you can contact us with Twitter.


url: https://www.youtube.com/watch?v=zGgPm2LeM8A
title: DEF CON 32 - DC101 - Panel
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=zGgPm2LeM8A",
  "title": "DEF CON 32 - DC101 - Panel",
  "description": "What you need to know to get the most out of your first DEF CON.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2708,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 6.82s | This text was transcribed using whisper model: large-v2

 My name is Nikita. I am the Director of Content and Coordination for DEF CON. I am the
6.82s - 11.82s |  Chief Hacker Wrangler. Um so I handle a lot of the logistical operations for DEF CON as well
15.56s - 22.56s |  as um sort of wrangle a lot of the department leads like that you see here. I wanted to
22.56s - 27.56s |  start out with um a little quick introduction and then give you a brief overview. Um we
28.56s - 33.56s |  have um a null value Drew. Yeah. Did I just dox him? I just. You said his name. I'm so
37.74s - 42.74s |  sorry. Oh man. Then we have. That's how we start this off. This is going great. That
44.88s - 49.88s |  too. Then we have Grifter. Grifter is the lead for our contest and uh events for DEF
50.08s - 55.08s |  CON and then we have Ada who runs our wonderful hotline program and um I have some notes
63.06s - 68.30s |  here and I will be perfectly honest with you I am a nervous speaker so I'm clutching
68.30s - 73.10s |  the podium. You're doing great. I mean I'm like you're it's fantastic. Is she doing
73.10s - 80.21s |  great? Absolutely. I thought that cheering would make you more nervous. Did it work? A
80.21s - 85.95s |  little bit. Alright. Alright. Thank you. Back me up when we do that again. Okay. So
85.95s - 94.27s |  um some things I wanted to let you know is that um if you are looking for something to
94.27s - 99.27s |  do um you can come to this facility between 8 a.m. and 2 a.m. So we are open that whole
102.45s - 108.01s |  entire time so if you are bored in your hotel room and you don't know anybody you can come
108.01s - 113.01s |  down. There's some social events tonight. There's parties. There's people that are just
113.01s - 119.09s |  sitting around hacking on stuff. Um I'm plenty of people to talk to. Plenty of things to do.
119.09s - 125.83s |  Lots of stuff happens at night that is just unplanned and um it's always fun to see what
125.83s - 132.73s |  people come up with every year but um we have things like laser Tetris. We have um multiple
132.75s - 140.19s |  parties so if you are here just because these halls close at 6 p.m. doesn't mean the rest of
140.19s - 145.21s |  Defcon does. So from 8 a.m. to 2 a.m. and then in our hall in the halls that you're in now are
148.91s - 153.91s |  open from 10 to 6 so villages, contests, those are those all close around at 6. Um oh we have
153.91s - 158.91s |  one really really important rule and usually we refer to it as the 3-2-1 rule and that means
165.11s - 170.11s |  3 hours of sleep, 2 meals, 1 shower. Now we're kind of all getting on in our age and um this is
174.39s - 179.39s |  my 21st Defcon. Speak for yourself I'm spring chicken. And I can't do 3 hours of sleep
179.61s - 184.61s |  anymore so I have made an executive decision to therefore mandate that it is now 6 hours of
188.39s - 193.39s |  sleep. So 6 hours of sleep, 2 meals, and 1 shower every day. Please. I advocate for uh 6 hours of
196.33s - 201.33s |  sleep. 3 meals, 2 showers. Last night I got 3 hours and 3 minutes of sleep. I am killing it.
202.29s - 209.78s |  It's important to take care of yourself. Las Vegas is really big. It's hot outside. There's lots
212.22s - 216.92s |  of traveling. Um it's really easy to get dehydrated. It's one of the number 1 things that
216.92s - 221.70s |  happens to people when they're not feeling well at Defcon. It's because you are dehydrated and
221.70s - 226.70s |  speaking from personal personal experience here you need to drink water or you might die. So
227.12s - 232.12s |  drink water. Um another thing another rule is listen to the goons. I'm sure you guys have
235.30s - 242.86s |  noticed the goons in the hallways directing you to the left to the right. Whoever just made
242.86s - 247.86s |  that announcement I heard. Um listen to them and if they're yelling it's only to get your
250.40s - 255.40s |  attention. Um never really to be unkind intentionally. Um if you do have any problems
263.32s - 270.16s |  with goons you can either email feedback at Defcon.org or you can call the hotline and um we'll
270.16s - 275.16s |  get to that. Um Defcon is about trying new things. Um we're all noobs here. Even me. I may be
282.58s - 287.58s |  21 years but I still consider myself a noob at lots of stuff and that's cool. That's okay. Um
288.28s - 293.28s |  it's a choose your own adventure here. You don't have to think oh I have to have this
296.66s - 300.52s |  checklist. I have to go to talks. I have to go to this village. I have to go to that village. I
300.52s - 306.70s |  have to go to that village. You if you find something that you are interested in 1 the talks
306.70s - 313.70s |  will be online later. So you can catch them later. You can catch up later. But also find your
313.72s - 320.06s |  people. Find the thing that gets you really jazzed up. And you'll know it when you find it.
320.06s - 326.48s |  You'll know when you don't really want to leave an area. Don't. It's okay. It'll all that other
326.48s - 331.48s |  stuff will be here next year. Um have fun. Uh try new things. And there's a lot of things.
334.82s - 341.18s |  One of the things about our villages and and to a degree a lot of our contests is I try to
341.20s - 348.20s |  ensure that no matter where you are at DAF CON you can have 0 knowledge about a subject. It
348.20s - 354.82s |  doesn't matter what village it is. They have a something that you can walk in and you can
354.82s - 359.82s |  learn. You can go in. Do a thing. Have a workshop. Do a an activity. Build a badge. Um work
362.80s - 368.06s |  a solution out for something. Right off the street anybody's grandmother can come in and learn
368.08s - 373.08s |  something new and then walk walk out the better or more curious or for it. Um so don't be
376.08s - 381.08s |  afraid to ask questions. Don't be afraid to say I don't I don't know how to do this. Show me. Or
383.50s - 389.36s |  um hey I'm really interested in this but I don't want to do it alone. It's okay to collaborate.
389.36s - 395.60s |  And it's okay to compete too. We have things like scavenger hunt which are absolutely amazing
395.62s - 400.98s |  for going out and meeting people and trying new things. Getting these new experiences. Things
400.98s - 405.98s |  that you're not going to get at other conferences because we are so very unique as a culture, as a
409.40s - 414.40s |  community, as a conference that we have so many things that you can do to collaborate.
419.10s - 424.00s |  Can I make a comment on that too? Um so you're saying like yeah go out and try new things. Do
424.24s - 429.38s |  new things. I I think something that I hear really often is people will say oh well I don't know
429.38s - 433.78s |  anything about that. Like so it's like oh you should go check out the aerospace village. And
433.78s - 438.92s |  they're like but I don't know anything about that. And it's like there's this misconception that
438.92s - 445.92s |  you're going there to um use your vast amount of knowledge of the aerospace industry to it. That's
445.92s - 450.44s |  that's not what that's about. The people who are in there and creating the villages are really
450.44s - 456.72s |  excited about sharing what they know with you. So you can walk in with absolutely no knowledge. I
456.72s - 461.38s |  hear people say things like oh I don't really go to DEF CON because I'm not very technical. And
461.38s - 466.38s |  it's like it's not necessarily about just being technical. It's about going, learning, growing and
469.10s - 474.00s |  again trying new things. You may be the best car hacker that exists and you don't know because
474.00s - 478.94s |  you've never given it a shot. So go in and just approach somebody and say I've never done
478.94s - 484.18s |  anything with this before. Can somebody show me? And if they don't immediately show you they'll
484.18s - 488.68s |  point you to the person who will. So just don't be shy. I know it's difficult for us. It's very
488.68s - 495.22s |  prevalent that we're introverted in this in this community, in this industry and all those things.
495.22s - 500.86s |  Just just try. Just go up and be like I don't know how to do this. Will somebody show me? And you
500.86s - 505.84s |  can have some of the best experiences. I know that's been huge personally for me and for my own
505.84s - 511.74s |  growth as a person and as a hacker. Just walking up and being like what are you doing? What does
511.74s - 517.74s |  that mean? And then watching the other person get excited about sharing that with you. So yeah.
519.08s - 525.62s |  Yeah in my opinion the the only precursor or prerequisite for attending DEF CON successfully is a
525.62s - 531.36s |  willingness to learn. If you're not willing to learn, why are you here? Everyone's willing to
531.36s - 539.92s |  help. The $25 chicken tenders. Yes. That's why they're here. Or the $30 burgers. Yeah I agree with
539.92s - 546.80s |  that. And I would say that I've noticed some people their first DEF CON say you can see when
546.80s - 554.64s |  they've been they've been shut down before and they say I'm sorry sorry I'm going on a rant. Don't
554.64s - 559.72s |  be sorry. That's what we're all here for. Go on the damn rant. Say the thing. Tell us what you're
559.72s - 567.98s |  excited about. Talk about it. Because we're all like that. We're all here for a reason. And I I
567.98s - 572.82s |  feel like I've heard it bunches and bunches of times. People they come and they're like I found my
572.82s - 580.16s |  people. Yeah. And that's why we've got people who have been gooning for so long. It's because we
580.16s - 587.20s |  found our people. We want to make sure everybody else does too. So. Grifter. Yes. What type of
587.20s - 594.56s |  contests do we have this year? I'm so glad you asked me that question Nikita. As the head of the
594.56s - 601.86s |  contest and events here at DEF CON. Honestly we've got everything. If you for me I like our motto for
601.86s - 607.12s |  the contest and events is not one talk not even one. All right. And Nikita mentioned that a little
607.12s - 615.16s |  bit. I'm sorry I say to the head of content. But but our our thing is that you can watch the talks
615.16s - 622.50s |  later on YouTube but you won't have the people that are here sitting around you at home. They may be
622.50s - 630.08s |  watching you but they're just not there in the room. Yeah that's good for your anxiety. Anyway. So I
630.08s - 634.46s |  always say like go and try the things that are here that you can't have when you're when you're gone.
634.46s - 637.80s |  Now that doesn't mean if there's something that you're super passionate about and you know there's a
637.80s - 644.80s |  talk that you want to see or your friend is speaking go support you know yell woo out in the crowd. But
645.34s - 652.12s |  but genuinely like for me one of the things that I enjoyed the most about DEF CON in the early years
652.12s - 660.74s |  that I was coming was competing in a contest like it forced me to get outside of my comfort zone forced
660.74s - 668.62s |  me to interact with strangers frankly right. Who all you know use spooky names and and work on things
668.62s - 677.70s |  that I didn't know how to do like I a contest is what introduced me to lock picking like I just I there
677.70s - 683.38s |  was a part of a contest that I didn't know how to do it and I was like oh no and I couldn't get past a
683.38s - 689.44s |  certain thing and eventually I got help from someone else and then I was like okay that's something I
689.44s - 694.74s |  need to learn. So I I went and bought a bunch of picks and I spent the next year picking locks so that
694.74s - 699.78s |  when I came back the next year to compete in the contest I knew when I hit that bar I would be ready to go
699.78s - 708.46s |  right so it forced me to continue to develop myself. So we have everything from again aerospace type of car
708.46s - 715.02s |  hacking or just plain weird like the scavenger hunt and I love the scavenger hunt. I ran it for years back
715.02s - 719.76s |  when we were at the Alexis Park. Didn't you create it? What's that? Didn't you create it? No Pinguino
719.76s - 724.26s |  created it. Oh okay. Yeah I didn't create it. Pinguino created it she ran it for a couple of years and then
724.26s - 730.76s |  she reached out to me and said I'm not going to be able to be at DEF CON can you take this over and so we
730.76s - 736.86s |  just we we removed answer it who is it no answer it answer it on stage answer it on stage do it please
736.86s - 743.64s |  please please do it. Oh Nikita it would have been weird. Oh keep DEF CON weird. So speaking of the
743.64s - 749.84s |  scavenger hunt we just put a bunch of really weird stuff on there and so when you see somebody doing
749.86s - 758.90s |  something incredibly odd it might be the scavenger hunt or they might just be neuro spicy I don't know but but go
758.90s - 767.18s |  and and compete in things that push you to learn new skills or just push you to keep DEF CON weird and I know
767.18s - 775.12s |  we all try to do that. So I have another question for you. How many black badges do you have and what are they
775.14s - 781.84s |  and how can you get them. Yeah I don't know how many. How many do I have Nikita. You tell me since you're the one who
781.84s - 790.26s |  tells me. I've given up at this point. Okay so normally I mean how many have you won. How many have I won personally.
790.30s - 799.56s |  Three. So I competed in a contest. Oh what's a black badge you ask. A black badge is when you certain contests will be
799.58s - 808.14s |  given a black badge for the winner of that contest and that gets you free entry into DEF CON for life. And that started at
808.14s - 816.22s |  DEF CON I guess 10 technically or 9 technically because somebody got it for the cyber ethical challenge or something and
816.22s - 824.60s |  then the next year we had actual black badges. So it started really at DEF CON 10 and has gone ever since. And no one
824.60s - 831.98s |  knows which contest is going to get that up front. And that's on purpose. We want you to compete in the contest that are of
831.98s - 840.34s |  interest to you. And then maybe you might win a black badge versus just being like oh that contest gets a black badge. I'll
840.34s - 842.84s |  focus on that. Right. Yeah.
845.36s - 852.16s |  18 by the way. That's the number of badges. There are 18 black badges. Eight of them go to CTF. The rest of them go to the
852.16s - 860.04s |  rest of the contest. The black badge is also known as the uber badge. Uber. Yeah. So that could be you. I mean super in German.
860.24s - 869.51s |  One of you out here. Does that mean that. Hello German friends. No. Scheisse. Ada.
874.34s - 882.90s |  Many fans. And thank you. Just the ones in the front row. What. I would like to ask you a couple of questions. What is
882.90s - 892.46s |  hotline. So hotline is a service that's been going for five DEF CONs now but that's seven years. So you know canceled DEF CONs
892.46s - 903.06s |  unfortunately. You can call it for a number of things. We have people who are there all throughout the con to answer your questions
903.06s - 916.06s |  about various information things but even more so if you have conduct issues with anybody we can call and talk to us. If you are in a
916.06s - 925.82s |  crisis if you're having a panic attack if you are not feeling comfortable at con if you just need somebody to talk to they're trained to
925.82s - 930.50s |  handle all of those things. And that's why the front row is screaming at me. Yeah.
930.50s - 943.86s |  I personally can say that there are a lot of people who are very happy for what hotline does. And I know that you spent several weeks doing
943.86s - 953.78s |  training with our goons with volunteers to talk about how to escalate a call how to deescalate a call how to you know deal with the things
953.78s - 964.22s |  that hotline is there for for our attendees. And I just think that's amazing. They actually start. I start looking for people in February. We
964.22s - 974.86s |  pick people early March. They start class late March. They go once a week every week until DEF CON. So it's a little extensive but it's also the
974.86s - 985.70s |  same training that I did when I used to work for suicide prevention hotlines. So they can help you with anything. You can just call and talk if
985.70s - 1000.98s |  you need to. Yeah. And why did hotline start. Hotline started in 2018 and the year before. We had an issue where someone came forward with an
1000.98s - 1011.62s |  issue. The goon who tried to take the incident from her didn't know how to handle it properly. So he's looking for me because I come from a background in
1011.62s - 1023.90s |  psychology. Suicide prevention hotline. And couldn't find me. And when he finally found me, she had disappeared. And at that point in time, all of the
1023.90s - 1033.14s |  people at DEF CON were like, how can we make this not happen again? How can we get somebody who's going through that someplace to talk to so they can come
1033.14s - 1044.22s |  forward and they can feel comfortable from the comfort of their hotel room if they need to. And that's sort of where we came from. Just someplace with a
1044.22s - 1054.78s |  comforting voice to talk to. Yeah. I'm sure you take a lot of like serious calls, serious things that you, you know, but what is your kind of corkiest, your
1054.78s - 1066.10s |  weirdest, your funniest? I have to say we do get calls from people trapped in back of house. If you find a door and you don't know where it goes to, I highly
1066.10s - 1076.70s |  recommend not going in it. I, on the other hand, say go through the door. Do it. You may get trapped. We've already had one this year. And we've had a few in the
1076.70s - 1088.30s |  past. Strange doors may lead to a bunch of locked rooms that you can't get out of. Go through the door. But Holloween is there for you to make sure that you find your way
1088.30s - 1102.02s |  out. You have a backup. They'll come get you. Go through the door. Facilities might come get you too. And they might not like you after that. Nikita, can I go up there? No, please. No. Can
1102.02s - 1111.10s |  someone take me? No, please. No. Somebody turn off this mic. Immediately. No.
1111.58s - 1129.55s |  I know he wakes up every morning and chooses violence. He really does. He is. Get up. I mean, he's like, he's like a little kitten. Oh, I'm getting up there. I'm throwing it down. Selfie kicked out of
1129.55s - 1159.92s |  facilities. That's only if you get caught. And no, I don't know. But that's my boy right there. I bet. Let me ask you a question. Tell us a little bit about what Hacker Tracker is. Obviously, an app that tracks hackers now. Can it track them across the rafters? Only if they're up there and they're not.
1162.24s - 1192.12s |  Hacker Tracker is the conference information app for DEF CON and numerous other conferences. DEF CON is the biggest by far. We were started by Whitney maybe a decade ago. I joined the team in DC 27, I believe it was. We're the ones that provide the schedule to you. Please install Hacker Tracker on your phone. We don't actually track hackers. It doesn't matter how many comments we get on
1192.12s - 1201.00s |  Google or Apple asking us to track hackers. We're not going to do it. It's an open source app. You can read our source if you want. It's on GitHub.
1203.12s - 1211.32s |  So tracking hackers is not a feature. But what is your favorite feature about or your newest features about Hacker Tracker?
1213.54s - 1233.54s |  So the newest features are a more easy way to see contests and events and parties so that you can just look at the list of them on screen rather than having to search through the schedule for them. And this year we added a feedback option for all of the official content. So please use that feature.
1234.98s - 1237.54s |  And how does the feedback? How does the feedback work?
1237.54s - 1267.32s |  As soon as this talk starts, you're short a few minutes after, I think. You can open the talk. Just search for it if you don't already have it open in Hacker Tracker. A button will appear at the bottom. Just clearly says submit feedback. We've, Ada and I, have worked closely to select the questions. Our big question we want to know is, quote unquote, is it hacker? Courtesy of DT.
1271.16s - 1272.12s |  Give me my microphone back.
1272.12s - 1298.20s |  So please click yes on that or we're all going to be fired. So just say yes, positive feedback. And you know, the what is hacker thing, I can speak to that a little bit, is that it's really important to Jeff that we maintain hacker culture, even though InfoSec has expanded to be so great compared to what it was, you know, back when this was started.
1298.92s - 1327.32s |  Now all of our hackers are in InfoSec. We still we're finding things that people want to share things. But we are not an InfoSec conference. We are not about that. And so sometimes what is hacker can be what is just the curious nature of what you found and how and why. And it's not for a corporation. It's not for your job. It's not for anybody. But you and the information and sharing that knowledge so that it is open and free. Now, obviously, we like, you know,
1327.40s - 1328.68s |  like what's behind that door.
1333.62s - 1344.66s |  I will say that when we were told that are we were supposed to find out, is it hacker? We kind of just walked around for a while going, is it hacker? Is it hacker? Is it hacker? Is this hacker?
1346.66s - 1348.78s |  Yeah, we're not tracking those.
1349.78s - 1363.10s |  I realized that I said courtesy of DT. Since this is a one on one panel, you may not know much about DEF CON. DT is the dark tangent, or Jeff. He is Nikita's boss.
1364.78s - 1365.90s |  Sometimes my boss.
1367.90s - 1368.62s |  Sometimes
1369.50s - 1385.26s |  So this, I don't know if you can see that it says definitely not a tracker. And it has a tile in it. Because the number one question asked to the contest and events goon is where is grifter? Or have you seen grifter? And so this year, they low jacked me.
1385.26s - 1396.22s |  So all of them have access to a shared link that will tell them where I am in the facility at any given time, or if I've left my hotel. So hacker tracker.
1397.82s - 1414.06s |  He has not given me that link. And I don't know to next year, it will be revised so that he has a boundary zone. So instead, he will have to remain in a certain area or it will go off. And he will get a few warnings, almost like how I trained my dog.
1415.50s - 1417.02s |  Dog not to leave the yard.
1418.38s - 1443.58s |  It's a good time to do it. He will get a shock. That's my you know what I might just create that next year. We will have a button to shock grifter. Can you shock him? And the more people who who vote to shock you, you'll get a shot. Push the button. How much does the FF get for every time I get shocked? How much do you want to get? Let's talk. You guys were talking right now. I'm serious. I will arrange this. It will have DEF CON weird.
1444.54s - 1465.18s |  $5. So you have it has to be done on the catwalk. You have a hacker tracker. Does it know your elevation? Like how can you get caught if it doesn't? That's a good question. Oh, yeah. Does it track his elevation? They can't see me up there. Yes, they can. Right through that window.
1465.18s - 1473.47s |  Getting up there. He's not. When you get stuck, you can call hotline.
1475.39s - 1492.67s |  He would get stuck too. This is the part of the panel where we like to take questions from the audience. And we have a microphone there in the middle aisle. And you are free to ask any question you want to ask. And we will try to do our best to answer it.
1492.75s - 1505.31s |  Seriously, and with respect, he noticed I looked at him. I have tiny chickens for people to ask questions. All right. All right. What does the chicken sound like? Chicken?
1507.07s - 1521.90s |  I don't know. I don't want that. Do it. Are they transcribing this live? I don't know. Transcription right now. I was a chicken sound. What is what do they type when when she does the chicken sound? Do the chicken sound? What did they type?
1522.86s - 1540.06s |  Nothing. Do it louder. They didn't get it. They're glaring at us from offstage. I was a moderately sane person about two rubber chickens ago. They're little. You know, after that, um, give me that chicken. Those dang things.
1540.06s - 1568.22s |  If anybody doesn't have a question, I found these cute little camp talk conversation question cards, gather around and make new friends with camp talk. And we are often referred to as the part of hacker summer camp, which is, you know, besides Black Hat, DEF CON. So if people don't come up soon, I'm going to start asking them random questions from the from the deck.
1568.22s - 1600.67s |  Question. We've got one, which is, we've got to take it. Yes, she should have a chicken. Oh, that's can she have a date? That's that was hacker shit right there. That is that is it. That is it. Next year. We need need to be more specific. Good. Ask questions. Um, I've been I've been gooning for 23 years. So it's a long time you what you say 21 years. We've been around a while. How many years?
1601.67s - 1605.67s |  Six years. That's all right. And how many years?
1605.67s - 1608.67s |  Uh, let's see. I've been working for 10 this year.
1608.67s - 1610.67s |  You're gonna retire, aren't you?
1610.67s - 1611.67s |  No, no, no.
1611.67s - 1612.67s |  Yeah.
1612.67s - 1616.67s |  But I've been around since the rib days.
1616.67s - 1617.67s |  All right. Nice.
1618.67s - 1639.67s |  There's a lot of DEF CON experience up here as also as attendees. And I mentioned something and I'll tell you what what I'm what that means what I said at 10 years if you've been a goon for 10 years you can retire and when you retire you get a gold badge like a gold goon badge and you can come to DEF CON for free for life just like the black badge because you put in your 10 years.
1639.67s - 1659.67s |  So I will also add to that. So if you see somebody like Nikita who has 20 years on their patch on their lanyard like they could have stopped doing this a long time ago and just started coming. So when you see any number above 10 they love this right they choose to do this and that doesn't mean that somebody has been doing it six years doesn't love it.
1659.67s - 1674.67s |  I'm sure there will be a 10 year patch and a 15 year patch and 25 year patch right like so. So, the people who are are wearing those patches they they love being here so, you know, approach them ask them questions.
1674.67s - 1692.43s |  How do you become a goon?
1692.43s - 1693.43s |  Okay.
1693.43s - 1697.43s |  Would you like a chicken? It's happening right now. You're becoming a goon.
1697.43s - 1700.43s |  This is this is how you're chosen.
1700.43s - 1710.43s |  So that is a very good question and I will say right now we are in a transition period where we are trying to come up with a formal application process to become a goon.
1710.43s - 1718.43s |  Traditionally in the past you would become a goon because you went out and you said I can help with that.
1718.43s - 1738.43s |  And you and the person was like fuck yeah I need help with that come on over here and you developed trust you developed a relationship with a goon you started working with them they're like hey you're you're helpful can you come back next year and be a goon and that's usually how it happened or it's like I know a guy a friend knows a guy they recommend each other.
1738.43s - 1764.43s |  But over the years we have like 600 goons now and we don't want it just to be someone you know to in order to get to be a goon. So if you are an attendee and you don't know a goon, you know, go out make friends with goons we love it, but we also want a process that is a little bit more open to to apply to.
1764.43s - 1784.43s |  I will say that 10 years ago I watched a panel about women at DEF CON and CJ the guy who was in charge of the SOC said we just need more women to be SOC goons and we don't know how to get them and I just literally stood up and said I do that job and he said email me.
1784.43s - 1785.43s |  Yeah.
1785.43s - 1786.43s |  10 years later I'm still here.
1787.43s - 1815.43s |  It was last night actually my my best friend was saying to me that she heard from a couple of people that were having a conversation and they said yeah DEF CON is not the same as what it used to be and that they feel like that we've become more diverse and they actually felt safer here because of our diversity and also because of our wonderful programs like hotline and you know we have all of our goons now.
1816.43s - 1819.43s |  Oh please answer it. Come on. Do it this time. Who is it? Who is it?
1819.43s - 1820.43s |  Who is it?
1820.43s - 1822.43s |  It's the lead I got not the lead I wanted.
1823.43s - 1824.43s |  Let's go.
1824.43s - 1825.43s |  Hello?
1825.43s - 1826.43s |  Put them near the speaker.
1826.43s - 1833.43s |  You're on stage. You're on stage right now with me. I'm giving a talk. You had the audacity to call me.
1836.43s - 1837.43s |  Make them say hi.
1837.43s - 1838.43s |  What do you want to say to the audience?
1839.43s - 1841.43s |  See if I put you on speaker. Hold on.
1841.43s - 1842.43s |  Say it loud. Okay.
1842.43s - 1843.43s |  Go ahead.
1843.43s - 1855.32s |  Hello audience. I want to help rectify the situation that is people modifying the lighting situation inside of the entire hall.
1856.32s - 1857.32s |  Boring.
1857.32s - 1862.32s |  You have to put me on blast for that. I'll deal with that when I'm off stage.
1863.32s - 1866.32s |  Bye now. Bye. No, they're boring. Hang on right now. They're boring.
1868.32s - 1871.32s |  Boring. No, you're boring. You're boring. Goodbye. You're cut off.
1872.32s - 1873.32s |  That's another question.
1873.32s - 1875.32s |  As I was talking to him, someone else was calling me.
1877.32s - 1879.70s |  What was I saying?
1879.70s - 1880.70s |  I have no idea.
1881.70s - 1883.70s |  This is what peer pressure will get to you.
1885.70s - 1886.70s |  Diversity at DefCon.
1886.70s - 1887.70s |  You said a best friend.
1888.70s - 1891.70s |  We used to all wear different colored shirts depending on what we did.
1891.70s - 1893.70s |  Info booth would have a green shirt.
1894.70s - 1896.70s |  Sock would have a red shirt.
1896.70s - 1897.70s |  Speaker ops would blue.
1897.70s - 1899.70s |  We used to color code what we did.
1901.70s - 1903.70s |  The rest of the goons blended in.
1904.70s - 1909.70s |  It felt like people didn't see the diversity of our real goon stuff, which is absolutely amazing.
1909.70s - 1912.70s |  I've never really experienced that anywhere else.
1913.70s - 1914.70s |  Any other con even.
1917.70s - 1920.70s |  That guy has a question, so I'm going to stop talking.
1936.09s - 1937.09s |  Really quick before she answers.
1937.09s - 1938.09s |  They're really light.
1938.09s - 1940.09s |  You just pick them up and carry them.
1940.09s - 1941.09s |  No.
1942.09s - 1943.09s |  I knew it.
1946.09s - 1947.09s |  Come at me, front row.
1947.09s - 1948.09s |  I'm ready.
1948.09s - 1949.09s |  Would you like your chicken?
1950.09s - 1952.09s |  I made sure that you can have multiple colors.
1952.09s - 1953.09s |  In case you don't want pink.
1957.09s - 1958.09s |  Put my psychology hat back on.
1959.09s - 1964.09s |  There's some research that suggests that we tend to lose girls in middle school.
1965.09s - 1970.09s |  They may be brilliant at math and sciences in elementary school.
1970.09s - 1972.09s |  But in middle school, they're told girls don't do that.
1973.09s - 1989.09s |  So my priority has always been going into the middle schools and teaching soldering or coding or making fun projects and trying to get the girls involved at that point.
1989.09s - 1992.09s |  I know there's a lot of work being done in that space.
1992.09s - 2005.09s |  So even if you talk to your local high schools and middle schools, you might find that there's already a girls program for STEM where you could come in and talk to them about what it is you do and maybe lead them through a cool project.
2006.09s - 2008.09s |  Like I said, soldering and coding.
2009.09s - 2018.09s |  We made little necklaces that have little space invaders on them when I did one of my projects with the middle schoolers.
2018.09s - 2024.09s |  So they're excited and ready to do the work, but we really have to keep them going.
2025.09s - 2034.09s |  Yeah, I think I know like for my daughter, there's this like perception that you can't be like a girly girl, but also be into tech, which just isn't true at all.
2034.09s - 2039.09s |  And she started to feel some of that pressure from her peers, like where they were like, oh, like you do this, you do that.
2039.09s - 2041.09s |  And she's like to her, it was just completely normal.
2042.09s - 2051.09s |  Grew up in a house around it all the time, is a hardcore gamer, like just in her brain, none of this is not normal to just do all the time.
2051.09s - 2057.09s |  But then from her own friends at that same age that you were talking about, and she is a very girly girl.
2057.09s - 2062.09s |  But then was like, oh, well, like her friends would be like, oh, where did you get this like makeup organizer?
2062.09s - 2064.09s |  And she's like, I 3D printed it, right?
2064.09s - 2066.09s |  Like, or where did you get whatever?
2066.09s - 2068.09s |  And they're like, you 3D printed it.
2068.09s - 2070.09s |  And she's like, oh, yeah, you can just make it yourself.
2070.09s - 2072.09s |  Look at all these cool designs, we can make this, we can make this.
2072.09s - 2076.09s |  And they're like, oh, wait, maybe I judged this too quickly.
2076.09s - 2080.09s |  Yeah, I remember when I was in high school, and I was very good at math.
2080.09s - 2082.09s |  And then I went into college.
2082.09s - 2092.09s |  Throughout that whole period, I felt like I had to be a tomboy because that was what if I wanted to be able to enjoy video games and technology, I had to be a tomboy.
2092.09s - 2094.09s |  And finally, I gave up on that.
2094.09s - 2096.09s |  And I said, screw it, like skirts and dresses.
2096.09s - 2108.09s |  So find those ways in which you can bring technology and games and those kinds of things into their space.
2108.09s - 2115.09s |  Yeah, and you have to you have to meet them on their level to you have to say things like, wow, you really got a lot of drip today.
2116.09s - 2118.09s |  I'm really impressed by your riz.
2118.09s - 2122.09s |  And no cap, no cap, for real, for real.
2122.09s - 2127.09s |  But Skibidi Toilet, Skibidi, Skibidi Ohio, Skibidi Riz.
2127.09s - 2129.09s |  Facts, no printer.
2129.09s - 2134.09s |  Whoever has to type this, I feel so sorry.
2134.09s - 2135.09s |  That's right.
2135.09s - 2136.09s |  Oh, that's amazing.
2136.09s - 2140.09s |  Yeah, it's just very mid, you know.
2140.09s - 2142.09s |  Ask us a camp question.
2142.09s - 2143.09s |  Okay.
2143.09s - 2144.09s |  Oh, there's a question.
2144.09s - 2145.09s |  Oh, okay.
2145.09s - 2146.09s |  It's a regular question.
2146.09s - 2147.09s |  Sorry.
2149.09s - 2150.09s |  I pickles.
2150.09s - 2151.09s |  Love it.
2151.09s - 2154.36s |  Welcome.
2154.36s - 2155.36s |  Well,
2189.58s - 2190.58s |  we'll help you.
2190.58s - 2193.58s |  So I'm here specifically for one thing.
2193.58s - 2195.58s |  I didn't tell my story.
2197.58s - 2201.58s |  My story, because I'd like to see today in case I have to stop.
2202.58s - 2203.58s |  Because
2206.58s - 2207.58s |  so
2215.58s - 2217.58s |  I have my questions.
2218.58s - 2221.98s |  Let me just say
2222.98s - 2223.98s |  my stocking story.
2223.98s - 2225.98s |  So if I'm being struck, I'm being hacked.
2225.98s - 2227.98s |  And then I'm being struck, I'm being hacked.
2227.98s - 2228.98s |  And that's just how it goes.
2228.98s - 2229.98s |  It's not how it is.
2229.98s - 2232.98s |  But we're GPS tracking on multiple vehicles.
2232.98s - 2234.98s |  But we're bugging on vehicles.
2234.98s - 2236.98s |  I can literally be hurting a child out of my fart.
2238.98s - 2240.98s |  Computer hacking, intelligent hacking.
2240.98s - 2243.98s |  And we can never stop it.
2243.98s - 2246.98s |  So we call this, it has my name spelled, we're gonna stop it.
2246.98s - 2247.98s |  We're gonna stop it.
2247.98s - 2248.98s |  What is the word for stopping?
2248.98s - 2249.98s |  It's a food stocking.
2249.98s - 2251.98s |  We've got a lot of different food stockings.
2251.98s - 2253.98s |  I'm writing a podcast.
2253.98s - 2255.98s |  I'm writing whatever it takes.
2255.98s - 2256.98s |  But I'm writing a podcast.
2256.98s - 2258.98s |  So if you find me here,
2258.98s - 2259.98s |  just call on me.
2260.98s - 2261.98s |  Step on me.
2261.98s - 2262.98s |  Get this person out of my life.
2262.98s - 2264.98s |  He's been in my life for 20 years.
2264.98s - 2265.98s |  He's an actual employer.
2265.98s - 2267.98s |  I'm not going to introduce him.
2267.98s - 2272.98s |  Is there anyone here who would?
2272.98s - 2278.94s |  We have several different villages.
2278.94s - 2283.94s |  You could try from crypto privacy to the social engineering village.
2283.94s - 2287.94s |  We should definitely maybe connect you with someone after the talk.
2287.94s - 2291.94s |  It sounds like this is a little bit more detailed than a question.
2291.94s - 2294.94s |  And happy to work with you afterwards.
2309.27s - 2310.27s |  Noted.
2310.27s - 2311.27s |  Okay.
2311.27s - 2312.27s |  All right.
2312.27s - 2313.27s |  Thank you.
2313.27s - 2315.27s |  Thank you.
2315.27s - 2319.76s |  Okay.
2319.76s - 2320.76s |  All right.
2320.76s - 2321.76s |  Cool.
2321.76s - 2322.76s |  Thank you.
2323.76s - 2324.76s |  Thanks.
2324.76s - 2327.84s |  What you got?
2327.84s - 2328.84s |  Give me a camp question.
2328.84s - 2329.84s |  Let's go.
2331.84s - 2339.84s |  What is the funniest or most unusual nickname you've ever heard for a camp counselor?
2340.84s - 2341.84s |  What would your nickname?
2341.84s - 2342.84s |  Oh, my gosh.
2342.84s - 2344.84s |  I can tell you, but I'd have to out myself.
2345.84s - 2346.84s |  Do it.
2349.15s - 2351.15s |  This is I'm going to regret this so much, though.
2352.15s - 2353.15s |  You know what?
2353.15s - 2355.15s |  This is this for my boy.
2355.15s - 2356.15s |  Okay.
2356.15s - 2360.15s |  So when I first started, when you started as a goon back in the day, in the early single
2360.15s - 2363.15s |  digit DEF CON days, everybody started as a sock goon.
2363.15s - 2367.15s |  You had to start in security, put your time in, and then you'd go on to something else.
2367.15s - 2369.15s |  So I started out as a security goon.
2369.15s - 2374.15s |  And then Russ was like, hey, I'll bring you into the vendors as soon as you put your time
2374.15s - 2375.15s |  in security.
2375.15s - 2377.15s |  And I was like, yeah, that sounds great.
2377.15s - 2379.15s |  I love hanging out in the vendor area.
2379.15s - 2381.15s |  I was a vendor at the time.
2381.15s - 2383.15s |  Oh, I'm going to say this in public.
2383.15s - 2384.15s |  And then I met I met Romer.
2384.15s - 2386.15s |  So our good friend Romer.
2386.15s - 2392.15s |  So so Russ introduces me to Romer and he says, hey, Romer, this is Grifter.
2392.15s - 2395.15s |  And at the time I was younger and handsome.
2395.15s - 2399.15s |  And so so Romer said no.
2400.15s - 2403.15s |  And he was like, you're too good looking to have a cool handle.
2403.15s - 2406.15s |  Your new handle is Nutsack.
2407.15s - 2413.15s |  And Romer and Russ called me Nutsack and have continued to do so for 20 plus years.
2413.15s - 2414.15s |  And yeah.
2414.15s - 2418.15s |  So what's the nickname for the camp counselor?
2418.15s - 2419.15s |  Nutsack.
2419.15s - 2420.15s |  Nutsack.
2420.15s - 2421.15s |  Nutsack.
2423.15s - 2424.15s |  I have a funny story.
2424.15s - 2425.15s |  You're welcome.
2425.15s - 2426.15s |  You ask the question.
2426.15s - 2428.15s |  But there was someone lining up for a question.
2428.15s - 2436.90s |  Sure.
2439.90s - 2440.90s |  OK.
2440.90s - 2441.90s |  That happens a lot.
2442.90s - 2450.40s |  It's happening.
2450.40s - 2451.40s |  Oh, sorry.
2451.40s - 2455.16s |  What the hell is that?
2455.16s - 2456.16s |  I don't know what.
2456.16s - 2477.42s |  Happy to to direct you to our frequently asked questions on the CFP page where we go through what we're looking for for talks.
2477.42s - 2479.42s |  It seems like Grifter wants to say a few words.
2479.42s - 2480.42s |  So I have.
2480.42s - 2483.42s |  So so I have some advice on that as well.
2483.42s - 2484.42s |  You want chicken?
2485.42s - 2486.42s |  The thing about like so.
2486.42s - 2492.42s |  So I've served on multiple review boards for DEF CON, for Black Hat, other conferences as well.
2492.42s - 2500.42s |  And what is a pattern that I see is that people will do incredible research like they do this incredible research.
2500.42s - 2507.42s |  And then when they go to fill out the CFP submission, they will spend basically the bare minimum amount of time filling it out.
2507.42s - 2510.42s |  Like you've spent a year doing the research.
2510.42s - 2517.42s |  Put the time in to explain what it is you did and why it's important and why other people should hear about it.
2517.42s - 2525.42s |  Often, you know, the abstract will be confusing or the bio of the individual will be longer than the abstract.
2525.42s - 2527.42s |  The outline is not detailed.
2527.42s - 2529.42s |  When we say detailed, we mean detailed.
2529.42s - 2532.42s |  Show us what you're going to talk about at each stage of the talk.
2532.42s - 2537.42s |  If you have a slide for something, I want to see a breakdown of what's going to be on that slide.
2537.42s - 2538.42s |  What are you going to talk about?
2538.42s - 2539.42s |  So really, that's it.
2539.42s - 2549.42s |  If you put the time in to do all that research, take a fraction of that time to fill out the CFP and give us an idea of why it should come to the main stage.
2549.42s - 2554.68s |  Okay.
2554.68s - 2555.68s |  Grifter.
2555.68s - 2557.68s |  Actually, you know what?
2557.68s - 2560.68s |  You've gotten lots of questions.
2560.68s - 2562.68s |  You.
2562.68s - 2564.68s |  Do you have a pet?
2564.68s - 2565.68s |  What kind?
2565.68s - 2567.68s |  What's its name?
2567.68s - 2569.68s |  Its name is Grifter.
2569.68s - 2572.99s |  What's the funniest trick your pet can do?
2572.99s - 2576.99s |  This is a hard question because I don't have a pet other than Grifter.
2576.99s - 2577.99s |  Where did you grow up?
2577.99s - 2580.99s |  What was the street address of where you grew up?
2580.99s - 2582.99s |  Your mother's maiden name?
2582.99s - 2584.99s |  You didn't ask me my social.
2584.99s - 2587.99s |  The last four of your social.
2587.99s - 2590.99s |  I think we have another question.
2590.99s - 2591.99s |  Probably our last one.
2591.99s - 2592.99s |  Yeah.
2592.99s - 2614.86s |  I can't answer that in a minute.
2614.86s - 2616.86s |  Yeah, I definitely can't answer that either.
2616.86s - 2619.86s |  They're all long stories.
2619.86s - 2621.86s |  I like T-Rex fights.
2621.86s - 2622.86s |  T-Rex fights are fun.
2622.86s - 2623.86s |  T-Rex fights are good.
2623.86s - 2624.86s |  I've seen a T-Rex fight before.
2624.86s - 2625.86s |  Naked guy.
2625.86s - 2626.86s |  Naked guy.
2626.86s - 2627.86s |  Naked guy was super weird.
2627.86s - 2632.86s |  I found out recently how he became Naked Guy, so we should talk about that.
2632.86s - 2633.86s |  Yeah, I did too.
2633.86s - 2634.86s |  Trevor Forget.
2634.86s - 2636.86s |  Trevor Forget.
2636.86s - 2638.86s |  The cockroach that we had a whole thing about.
2638.86s - 2642.86s |  So the things we can't talk about, like to set a bar.
2642.86s - 2647.86s |  At DEFCON 11 on the scavenger hunt list, it said streak through Grifter's talk.
2647.86s - 2649.86s |  And there were three.
2649.86s - 2653.86s |  And one of them hugged me on stage.
2653.86s - 2655.86s |  And I'm willing to talk about that.
2655.86s - 2658.86s |  So you can imagine what we're going to talk about after this.
2658.86s - 2660.86s |  I really enjoyed the-
2660.86s - 2661.86s |  I think we'll need the couch.
2661.86s - 2666.86s |  He'll need to lay down and talk about his feelings.
2666.86s - 2671.86s |  I enjoyed that the chairs that we had with the beans in it,
2671.86s - 2673.86s |  that they had to figure out how to get them out.
2673.86s - 2677.86s |  They were like, one of the things you have to do for this contest
2677.86s - 2681.86s |  is figure out how to get the chairs out without anybody stopping you.
2681.86s - 2682.86s |  Yeah.
2682.86s - 2683.86s |  All right.
2683.86s - 2685.86s |  Well, that is it for us.
2685.86s - 2687.86s |  Oh, there's a question.
2687.86s - 2696.71s |  That was amazing.
2696.71s - 2697.71s |  Oh, you know what?
2697.71s - 2698.71s |  So good.
2698.71s - 2699.71s |  Seven seconds.
2699.71s - 2701.71s |  I was wrapping it up, sir.
2701.71s - 2702.71s |  So good.
2702.71s - 2703.71s |  Thank you.
2703.71s - 2706.34s |  Want a chicken?
2706.34s - 2707.34s |  Thanks.


url: https://www.youtube.com/watch?v=krIOAKQhsGY
title: DEF CON 32 - Encrypted newspaper ads in the 19th century - Elonka Dunin, Klaus Schmeh
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=krIOAKQhsGY",
  "title": "DEF CON 32 - Encrypted newspaper ads in the 19th century - Elonka Dunin, Klaus Schmeh",
  "description": "Between 1850 and 1855, the London-based newspaper The Times published over 50 encrypted advertisements apparently intended for the same recipient. As we know today, the ads in that series were meant for the sea captain Richard Collinson, who at the time was on a mission in the Canadian Arctic trying to solve a captivating mystery: What happened to the lost John Franklin expedition? While Collinson never reached his goal, he established a secure worldwide communication system, which was unique for its time.\n\nBefore his departure, Collinson's family was taught how to encrypt brief reports about what was going on at home and to publish these messages as mysterious ads in \u201cThe Times\u201d once a month. The cipher used was a modified version of a system based on a signal-book of the Royal Navy. As the circulation of The Times stretched far beyond the UK, Collinson would have the chance to get his hands on a copy even at the remotest of ports.\n\nOver a century later, the Collinson ads were finally broken in the 1990s. Over the last two years, the lecturers of this talk continued this work, with a goal of decrypting all of the ads and placing them in their appropriate geographic and cultural context.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2655,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 6.24s | This text was transcribed using whisper model: large-v2

 Welcome. So, it's a pleasure to be back at DEF CON. It's been a few years. Today, we're
6.24s - 15.24s |  going to talk about encrypted ads from the 19th century. And my name is Ilan Kadunin.
15.24s - 24.08s |  Hello, and my name is Klaus Schmee. I'm a German computer scientist. I work for a company
24.08s - 33.24s |  named Eviden, a European IT security company. I'm also a crypto and crypto history expert.
33.24s - 38.84s |  And we have written a couple of books together. Most recently, this one came out in September
38.84s - 49.08s |  2023 from No Starch Press. And if you go down to the east vendor hall, number 29, they may
49.08s - 55.88s |  have one copy left. At least, that's what we saw when we checked earlier. So, encrypted
55.88s - 63.22s |  newspaper ads. Just kind of giving you a general idea. This is something that was very popular
63.22s - 69.52s |  in the 19th century. Usually, they were sent back and forth between lovers. Sometimes they
69.52s - 74.92s |  were used for business reasons. And there were a couple of books that were written.
74.92s - 82.60s |  This is one from 2006 by Gene Palmer. It was the pseudonym for Tony Gaffney. And he
82.60s - 89.76s |  lists about 1,000 of these ads. Many of them have been solved. Not all of them. He doesn't
89.76s - 96.56s |  provide solutions for all of them. And here's a couple more. You can see. And the one on
96.56s - 102.64s |  the right we thought was interesting because it had an encrypted section at the top. And
102.64s - 110.48s |  then at the bottom, it said, this will be intelligible if read in connection with my
110.48s - 120.36s |  communication published in this column on the 8th instrument this month. So, we went
120.36s - 128.80s |  back and we checked. And it gave us no clues. It does look like it's a transposition
128.80s - 136.96s |  cipher. But this one remains unsolved. Here are a couple other interesting ones. This one
136.96s - 149.86s |  sort of looks like a Bible code. Also unsolved. And these two clearly related between tissy
149.86s - 159.86s |  and jabber. Also unsolved. And here's a colleague of ours, D.J. Mueller. He decided to look
159.86s - 168.14s |  in the French newspaper, Le Figaro, and he found thousands of encrypted ads in the French
168.14s - 174.06s |  language, at least of the ones he could solve. We actually met him a few weeks ago in
174.06s - 183.10s |  Switzerland. And he has this lovely database. He has found so far, looking at the years
183.10s - 195.37s |  from 1875 to 1896, 3,700 cipher messages. Only 62% have been broken so far. Here are a
195.37s - 210.86s |  couple. And this one was interesting because you can tell if you dig into it, it's a
210.86s - 217.30s |  combination of what we call clear text. And then if you look at the numbers in between, it's
217.30s - 223.66s |  all five digit numbers. And someone into codes will go, aha, well, that looks like a
223.66s - 230.58s |  code book code. But we haven't found which code book. We've looked at the code books from
230.58s - 236.10s |  that time period. There are some in French and some in English. But haven't found
236.10s - 241.54s |  anything that works. It's possible that we haven't found the right code book. It's
241.54s - 247.86s |  possible that there's some sort of super encryption going on. So, you know, take a five
247.86s - 252.66s |  digit code and you add one to it or divide it by two or something like that. But for whatever
252.66s - 262.82s |  reason, we haven't found it. Now, this one is a musical mystery. Ce qu'on ne peut se dire ni
262.82s - 269.82s |  s'écrire, on peut le chanter. Do mi, do mi, do re, re fa, re fa, re mi, et cetera, et
269.82s - 278.70s |  cetera. Vous avez compris? Which in English means that which cannot be said nor written can be
278.70s - 284.42s |  sung. And then we put what we think are the notes there and have you have have you
284.42s - 292.66s |  understood. So, then we also mapped it to a musical staff here. We didn't have any
292.66s - 299.30s |  indication of, you know, what the signature was or the duration of the notes. So, we just kind
299.30s - 312.54s |  of picked something that seemed to fit. And if sound works, we'll play it for you. Makes it
312.54s - 317.94s |  much more clear. I'm going to play it once more so you can kind of map it to the do mi, do mi,
317.94s - 330.74s |  do re. So, there's a couple things that could be going on here. One is that it could be related
330.74s - 337.90s |  to a language called Solresol, which had been invented in France a little earlier by a Frenchman.
337.90s - 344.70s |  It was an artificial language that was based on notes. So, I went and I looked for anyone today
344.70s - 351.18s |  that might know Solresol. I went on Discord. You can find everything on Discord. So, I found a
351.18s - 356.14s |  Solresol community and I asked them if they could read it, if they could understand it. And they
356.14s - 360.06s |  said no. And I said, well, if it means anything, it's probably like, I love you, I miss you, why
360.06s - 365.46s |  haven't you written to me? And they said no. They still couldn't understand it. So, it's also
365.46s - 372.42s |  possible. I have some fans that are into classical music and they said, you know, this sounds like a
372.42s - 379.90s |  practice at the beginning of choir. What the choir, the singers will use to kind of get in shape for
379.90s - 388.58s |  the choir. So, maybe all this means is see you soon at choir practice. We don't know. There's just a
388.58s - 395.78s |  lot of theories on it. So, this one still remains officially unsolved. There are many more encrypted
395.78s - 401.94s |  ads. Again, most of them are from the late 19th century. Most are broken. Some are not. And
401.98s - 404.10s |  there's still a lot of research being done on it.
406.86s - 414.70s |  Okay, let's now look at a series of encrypted newspaper ads from the 19th century. All of these
414.70s - 423.10s |  were published in the Times. There were over 50 of these newspaper ads. Here you see one. It was
423.10s - 433.02s |  published in 1853. If we have a closer look, this one is the same. We clearly see that it is
433.02s - 443.30s |  encrypted. And there's no obvious way to decipher this message. So, it's certainly not clear what it
443.30s - 454.62s |  means. Let's now go ahead for 130 years to the year 1980. In 1980, the Times, so the same
454.66s - 461.18s |  newspaper, published one of these messages again. Apparently, they didn't realize that there was a
461.18s - 467.74s |  whole series of these messages. So, they only found one. And they wondered what it meant. And so,
467.74s - 475.06s |  they published it. And they challenged their readers to solve it. But there was no success. So,
475.06s - 482.34s |  apparently, none of the Times readers in 1980 was able to break this encryption. The only thing
482.34s - 491.70s |  that was found out is that these numbers and letters that are marked here probably referred to latitude
491.70s - 500.02s |  and longitude. And it leads to a place in northern Canada. Well, this is certainly unusual because in
500.02s - 509.94s |  the 1850s, not very many people traveled to northern Canada. So, this is certainly unusual. And one
509.94s - 517.22s |  reader of the Times in 1980 suspected, well, this might have got to do with the Franklin edition. I
517.22s - 524.18s |  don't know if you're familiar with the Franklin edition. Sorry, with the Franklin expedition. But if
524.18s - 527.74s |  you're not, Ilanka is going to tell you what it was.
529.14s - 538.50s |  So, the Franklin expedition. This was one of the great mysteries of the late 1800s. So, there was Lord
538.58s - 547.78s |  John Franklin. And he started an expedition in 1845. It was a British naval expedition. He had
547.78s - 554.18s |  two ships. They were called the Terror and the Erebus. The reason they had these names is because
554.18s - 560.18s |  originally they had been warships. And the theory was is that because they were warships and they
560.18s - 568.42s |  were built very, very strongly, that they would be able to be good icebreakers going into the
568.42s - 577.06s |  ice packs above north of Canada. The goal was to find this northwest passage. So, instead of going
577.06s - 584.98s |  south around South America, was it possible to go north, northwest, and get to Asia that way?
585.54s - 594.58s |  So, this particular expedition, they set off from England from great fanfare. They stopped off in
594.58s - 602.26s |  Greenland to get some supplies and to offload a couple of sailors who had fallen ill. And then
602.26s - 613.36s |  they headed west across the Baffin Bay and vanished. Nothing was heard from them. No one else
613.36s - 622.40s |  saw them. Now, it was a five-year mission. So, it wasn't entirely surprising. But a couple years
622.40s - 631.92s |  went by and then Lady Franklin started beating the drum and, hey, where's my husband? And so,
631.92s - 640.80s |  she was going to the Admiralty and demanding that they set off some search expeditions, find out
640.80s - 651.76s |  what had happened to these two ships. So, nothing was found from them. And it was actually 150 years
651.76s - 662.48s |  later that the ships were finally found, right? 150? Yeah. So, in 2014 and 2016, the ships were located
663.28s - 670.00s |  off of King William Island. The Terror was found in the coincidentally named Terror Bay.
670.64s - 677.76s |  And then south of it was the Erebus. Now, many books have been written about the Franklin
677.76s - 684.56s |  expedition because it was this great mystery of why did they disappear? Had aliens come down
684.56s - 691.92s |  and got them? Or had they, you know, some sort of sea monster had sunk their ships? So, basically,
691.92s - 697.92s |  anyone who wanted could come up with any theory that they wanted. And as I said, there were many
697.92s - 704.16s |  different rescue expeditions that were sent. There was this great reward that was offered. This is
704.16s - 712.72s |  just a few of the expeditions. There were many more. And now, let's come back to that classified ad.
713.36s - 720.64s |  Did it have anything to do with the Franklin expedition? Was there some relationship between
720.64s - 726.24s |  the ad and the Franklin expedition or the ad and one of the rescue expeditions?
728.64s - 737.04s |  Yes. So, let's now come back to this article in the Times in 1980 when the readers were
737.04s - 744.80s |  challenged to break this encrypted advertisement from the 1850s. Well, as I said, in 1980,
744.80s - 751.60s |  nobody was able to solve this mystery. But 12 years later, this article was published by
751.84s - 759.52s |  British encryption expert named John Rapson. He published this article in Cryptoloja, which is
760.80s - 766.48s |  a scientific journal dedicated to crypto history mainly. And in this article, he
768.00s - 775.44s |  introduced the solution of this mystery. So, this is the advertisement he looked at.
776.00s - 783.20s |  And when he analyzed this advertisement, well, he saw it mainly consists of four letter groups
784.48s - 793.28s |  and of some three letter groups. And the letters used here or the lowercase letters all run from
793.28s - 799.92s |  G to Q, excluding the J, which means that there are 10 different lowercase letters used here.
800.00s - 808.08s |  There are also a couple of capital letters running from B to F. And in addition, the S was used.
808.72s - 814.80s |  And there was also some clear text in this message. For example, the signature at the end,
815.76s - 819.84s |  JEDW is clearly not an encryption. It's an abbreviation.
821.60s - 827.04s |  Well, if one is familiar with the encryption systems used in the 19th century,
827.04s - 832.96s |  it's quite obvious that a codebook was used here, or it's at least very likely. Ilanka has
833.68s - 839.04s |  introduced a few, or at least one advertisement that was apparently encrypted with a codebook.
839.76s - 845.76s |  And this is not a new situation for codebreakers because many codebook encrypted messages were
845.76s - 852.40s |  created over the centuries. And the best way to break a codebook encrypted message is usually
852.64s - 861.84s |  to find the codebook that was used. Not very surprising, but this method usually very often
861.84s - 868.40s |  works quite well because there were not too many codebooks in use, at least if you know when a
868.40s - 874.72s |  message was created and who created it. You usually can tell, well, if it was in the military, maybe
874.72s - 881.52s |  it was a military codebook of the time, or if it was some business-related, maybe it was a business
881.52s - 887.92s |  codebook. A codebook can be imagined like a dictionary, so for every word of a language,
887.92s - 897.60s |  there's a number or maybe a sequence of letters. And many ciphertexts have been solved by finding
897.60s - 904.64s |  the codebook that was used. So the question John Rapson asked himself was, well, is there a
904.64s - 911.20s |  codebook or was there a codebook at the time in question that used four letter groups based on
911.20s - 919.44s |  the letters from G to Q? And the answer was no, or at least we and John Rapson didn't know of a
919.44s - 927.04s |  codebook that matched this requirement. But the letters from G to Q, excluding the J, make exactly
927.04s - 934.56s |  ten letters. So maybe the letters were used instead of digits. So maybe the G stands for zero
934.56s - 941.36s |  and the H for one and so on. And in fact, John Rapson found a codebook that was a very good
941.36s - 949.04s |  match. It was the so-called Marriott Signal Code. It was introduced in 1817. There were several
949.04s - 958.72s |  editions and it was quite popular in the 1850s in England. So this looked like a good guess. If
958.72s - 964.96s |  you look into this codebook, you see that it was created for sending a signal or flag signal
964.96s - 971.36s |  messages. This is not relevant here. We are not dealing with flags, but it could also be used for
971.36s - 978.36s |  any other kind of messages as long as such a message could be noted in digits from zero to nine.
978.52s - 986.52s |  Here on the right you see an excerpt from this codebook. So as I said, it's like a dictionary and
986.52s - 992.60s |  this one replaces every word of the English language with a number between zero, zero, zero, zero
992.60s - 1002.60s |  and nine, nine, nine, nine. Okay, so what did Rapson do? Well, he took one of the advertisements and
1002.60s - 1010.60s |  replaced every four-digit word, every letter in a four-digit word with the numbers from zero to
1010.60s - 1018.20s |  nine with the table you can see here, the substitution table you can see here. And then he
1018.20s - 1025.08s |  applied the codebook, the Marriott codebook, and what did he get? Nothing. Or at least nothing that
1025.08s - 1033.88s |  really looked like meaningful text. So maybe the mistake was that the replacement table running
1033.88s - 1043.08s |  from zero to nine was wrong. It was certainly a difficult question what else or which other table
1043.08s - 1051.08s |  could have been used. So John Rapson looked for crypts, for words he could guess in the ciphertext.
1052.04s - 1062.76s |  So here he found one. Here you can see the word IQHL and followed by the word born. So what is
1062.76s - 1070.44s |  born? Of course a child is born, a son is born, a daughter is born. This required some guessing but
1070.44s - 1077.80s |  one of the hypotheses he tested was, well, let's assume that this stands for son and if this is the
1077.80s - 1090.52s |  case IQHL would be replaced by 8196 and maybe this is the correct replacement and if it was the
1090.52s - 1097.16s |  correct replacement this would be how a part of the substitution table looked like. Here's
1097.16s - 1105.16s |  another crypt he found. Here we have the number three followed by the word MIOQ. So what could
1105.64s - 1112.12s |  stand after three? Well, just about anything. Three days, three weeks, three months, three years.
1112.12s - 1120.92s |  Again he guessed and tested several hypotheses and one of these was, well, maybe month was the
1120.92s - 1126.92s |  correct word used here. And again he created a part of a substitution table based on this
1126.92s - 1136.92s |  assumption and, well, the two guesses he had made matched. So this looked quite good. So maybe
1136.92s - 1145.56s |  in addition, the replacement table you see here looks quite plausible. It starts with a zero,
1145.56s - 1155.56s |  then 9, 8, 7, 6, 5, 4, 3, 2, 1. This looks like a good guess. So again he tried to decrypt a
1155.56s - 1165.56s |  message. He took this message, he replaced the letters in every four letter word with the
1165.56s - 1173.56s |  digit according to this table. Then he applied the code from the code book and he got meaningful
1173.56s - 1183.56s |  text. So apparently this was the correct way to decrypt. Yes. So let's give John Rapson an
1183.64s - 1192.20s |  applause because this was a really great piece of cryptanalysis back in 1992. Here we see an
1192.20s - 1199.08s |  example. As mentioned, there were not only these four letter groups but also a couple of
1199.08s - 1204.76s |  uppercase letters and it now became clear what these uppercase letters mean because the code
1204.76s - 1212.68s |  book consists of five parts and one of the parts is divided into subdivisions and apparently each
1213.64s - 1222.92s |  capital letter in the message stands for one of the altogether six parts. And this is exactly
1222.92s - 1231.24s |  how the encryption and the decryption worked. So here we have the E standing for part 4 and
1231.24s - 1237.72s |  this would be part 4 in the code book. Let's now look at the decryption of one of the
1237.72s - 1246.44s |  messages. All are well at Bowdoin and so on. And as it seems, as we see now, this latitude and
1246.44s - 1253.88s |  longitude appears to make sense. We are still not really sure what exactly this means being
1253.88s - 1263.88s |  accurately seen drifts and so on but at least it's plausible. Here's another plain text. You
1264.44s - 1270.28s |  see the original in the upper left corner and this translates to or this decrypts to all are
1270.28s - 1276.28s |  well at home and elsewhere. Margaret had another boy in the evening on Christmas Day and so on.
1276.28s - 1286.28s |  Well, this is family gossip. It's a little disappointing because of course other encrypted
1286.84s - 1294.52s |  messages contain the location of a hidden treasure or politics or important businesses. In this case
1294.52s - 1299.72s |  it's about family news but that's also very interesting because family news from the 19th
1299.72s - 1309.32s |  century, that's not something you encounter every day. So we tried to decrypt this message. It
1309.80s - 1317.64s |  wasn't, it was difficult because some of the words are not, are ambiguous. For example,
1317.64s - 1325.56s |  popularity could also mean population. That's not, both words are possible in the code book. P and
1325.56s - 1333.24s |  M, that might stand for Papa and Mama but that's of course also a guess. And this is also a guess
1333.24s - 1340.36s |  because the words used here are coal and rich so maybe this refers to a person named Coleridge.
1341.24s - 1348.12s |  We don't know but it makes sense in our view. So decryption is difficult, many ambiguities.
1348.92s - 1355.24s |  Here's another plain text. This is especially interesting because it mentions two names that
1355.24s - 1362.68s |  can be identified, Captain Penny and Captain Austin. And as it turned out, both captains were
1362.68s - 1372.28s |  shipmasters who engaged in Franklin rescue expeditions. So we are now back at the Franklin
1373.40s - 1379.56s |  and at Franklin and his rescue expeditions, there appears to be a connection.
1379.88s - 1386.44s |  Here's a list of some of the most important Franklin rescue expeditions which mainly took
1386.44s - 1396.12s |  place or which took place after 1850 when Franklin's wife was calling for help. And if we look
1396.12s - 1403.88s |  at the ads, all of them were published between 1850 and 1855 and this matches exactly with the
1403.88s - 1413.08s |  rescue expedition of Richard Collinson. So was it really Richard Collinson who wrote or received
1413.08s - 1421.16s |  all these encrypted messages? Well, we'll see. Richard Collinson, here you see a picture of him
1421.16s - 1429.56s |  and let's now look at the rescue expedition of Richard Collinson. So Richard Collinson set out
1430.36s - 1440.04s |  on a rescue expedition with two ships, one of them being the Enterprise, on a five-year mission
1441.88s - 1448.84s |  to go and try to find Franklin's expedition. All right, they did not have any success.
1449.40s - 1457.24s |  What they were trying to do is to come around from England, go around and come in
1457.24s - 1464.20s |  from the western side to see if they could find him from that direction. No luck.
1466.12s - 1474.12s |  There's many books written about his expedition, in part because his brother
1475.24s - 1483.80s |  went through his logbooks and wrote another book about Collinson's expedition. And this is one page
1483.80s - 1493.59s |  from that where they talk about cipher notices in the times that use the signal book of the
1493.59s - 1504.82s |  Royal Navy and that this advertisement was regularly published. So now we know the mystery
1504.82s - 1514.10s |  or the purpose of the messages was sought. So we call this the first known secure global
1514.10s - 1520.58s |  communication system. His family published encrypted ads in the times. The times was
1520.58s - 1527.70s |  available in every major port in the world and he could receive messages from his family during his
1527.70s - 1537.78s |  journey. So did the system work? Well, to our knowledge, only in 1855, on his way home, Collinson
1537.78s - 1546.82s |  got access to the times in this port in Indonesia called Banguwangi or Banguwangi. And one thing I've
1546.82s - 1553.46s |  learned from my research is there are many ways to spell Banguwangi. I have found probably 10
1553.46s - 1560.42s |  different ways. And in that page from Collinson's journal, there was a mention of Banguwangi.
1561.14s - 1569.54s |  And I was just at the Royal Museum at Greenwich a couple weeks ago going through the logbooks
1569.54s - 1580.98s |  of Collinson and found this entry from December 12th, 1854, saying that at 2 p.m. he anchored
1580.98s - 1588.58s |  four miles off of Banguwangi at the time. So again, we had that link. Here's the only really
1588.58s - 1595.06s |  good picture we've been able to find of Banguwangi. This is when there was an undersea cable that was
1595.06s - 1604.18s |  being built and this is from 1871. So when he was in Banguwangi, Collinson was able to get four
1604.18s - 1616.62s |  copies of the times and was able to get some news from home that way. Okay, let's now look at the
1616.62s - 1625.02s |  situation half a year ago at the beginning of 2024. As I mentioned, the encryption system that
1625.02s - 1632.14s |  was used for these advertisements was broken. But while breaking a system and decrypting all the
1632.14s - 1638.54s |  messages is of course two different things. In this case, there were 55 messages and not very
1638.54s - 1646.14s |  many of them had been really decrypted. And up to that point, no scholar or no expert of the Franklin
1646.94s - 1657.58s |  Expedition had read the messages. So what we did, Ilonka and I, we started a decryption project. We
1657.58s - 1666.14s |  introduced our concept at the American Cryptogram Association, ACA, and we were joined by Taylor
1666.14s - 1674.22s |  Leach, who is a member of this organization and who took part or who is now taking part in the
1674.22s - 1680.86s |  project. And there were other members from the ACA supporting us. We had a virtual meeting at an
1680.86s - 1690.06s |  ACA convention in 2023 and a couple of Zoom calls and our goal was to decrypt all the Collinson
1690.06s - 1699.26s |  advertisements and this project is still ongoing. Here's a list of all the messages. There are over
1699.26s - 1706.78s |  50. There was one published every month and as you see here, there are gaps. So there were months
1706.78s - 1713.82s |  where no message was published and we don't know why. Maybe there were messages but we haven't
1713.82s - 1721.82s |  found them. Maybe they were published on the wrong day or maybe the newspaper didn't publish them for
1721.82s - 1731.26s |  some reason or there was nothing placed in the newspaper. We simply don't know. Taylor, he wrote a
1731.26s - 1739.90s |  decryption tool based on JavaScript and this decryption tool is available online so if you want to
1739.90s - 1749.10s |  try your luck yourself, here's the URL. So Taylor's decryption tool, it contains a code table taken
1749.10s - 1756.94s |  from the code book and it includes a section to ignore clear text which appears in messages or in
1756.94s - 1766.94s |  many messages such as in or at, so frequent words. And we found out, as already mentioned, this
1766.94s - 1773.02s |  decryption work isn't trivial because there are ambiguities so it's not possible to do everything
1773.10s - 1782.06s |  with a tool. It always requires some manual cleanup afterwards. Here we have a list of all the
1782.06s - 1789.10s |  ciphertext on the left side, all the decryptions of the decryption tool on the right side and in the
1789.10s - 1796.06s |  middle the cleaned up versions. So it's of course a lot of work to do all this description work but
1796.14s - 1804.14s |  it's very fascinating because as I said this is all about family activities in the 1850s. It's
1804.14s - 1815.58s |  a first hand information from what happened in a certain family and well it's a fascinating look
1815.58s - 1822.94s |  into history. One important question is well who actually published the ads or who wrote these
1822.94s - 1831.66s |  messages? It obviously was somebody from the family or maybe a close friend. Some of the ads
1831.66s - 1839.66s |  are signed J.D.W. This is clearly Julia de Winton, the sister of Collinson and some of the
1839.66s - 1847.66s |  messages are signed A.C. We are not sure what this means, which person signed A.C. It might be
1848.22s - 1856.22s |  another sister of Collinson but we are not sure. Well Julia de Winton who created many of these
1856.22s - 1863.74s |  messages was also a novelist in the Victorian era so very interesting. Well honestly I haven't
1863.74s - 1869.90s |  ever read any of these books but it's of course interesting to see that a novelist also wrote
1869.90s - 1878.30s |  encrypted messages to her brother being on an expedition in northern Canada or wherever in the world.
1882.76s - 1890.60s |  So while we were doing research at the Maritime Library we did find several letters. It's a
1890.60s - 1896.52s |  little difficult because they're not entirely in context so there'll be a folder that says
1897.32s - 1903.08s |  Collinson letters and just a big stack of letters and so we're kind of going through them and
1903.08s - 1910.44s |  we found that some of these were letters from Collinson's other relatives like
1910.44s - 1919.16s |  Sophia and Amelia. The addresses were often very creative. For example, so we have somewhere near
1919.16s - 1929.96s |  the North Pole and here was another one that said Hong Kong or Arctic Expedition Pacific and so
1929.96s - 1934.44s |  they would kind of send it out and hope that it would be passed from ship to ship and hopefully
1934.44s - 1940.44s |  end up with their brother ship. So we know now that there were at least two ways of communication.
1940.44s - 1947.80s |  We had the newspaper advertisements from Julia and A.C. and letters from Amelia and Sophia.
1950.98s - 1957.38s |  And now let's look at the content or at the plaintext of the ads. Many of the ads
1957.94s - 1964.74s |  mention places mainly in Great Britain which is not very surprising. Apparently Collinson's family
1964.74s - 1971.86s |  or many of the family members lived in the Newcastle area so Newcastle and the surrounding
1971.94s - 1980.26s |  is mentioned many times in the messages but they're also relatives apparently in London
1980.26s - 1987.38s |  and Portsmouth, Southampton and elsewhere. And no surprise is that places in northern
1987.38s - 1994.74s |  Canada were mentioned a couple of times because this was actually the destination of Franklin's
1994.74s - 2000.34s |  expedition and of course also of Collinson's expedition. And it's also interesting to look at
2000.34s - 2009.38s |  a few events that are mentioned in these ads. Here we have an ad from 1850. It mentions
2010.02s - 2018.66s |  windows, a window is in church. We found out that the family of Collinson or of his sister donated
2018.66s - 2027.78s |  a couple of windows in churches in Wales and this is here you can see pictures of these and this is
2027.78s - 2037.22s |  a drawing we found in the archive. So apparently here on the left side we see the small gentle
2037.22s - 2045.46s |  window as it was and on the right side as it is now so after the renovation. And here we have
2045.46s - 2054.26s |  another mentioning of windows, three new windows. Well we found a drawing of these three new windows
2054.26s - 2061.54s |  in the archive. In this case the old version is on the right and the new version of the
2061.54s - 2070.58s |  windows is on the left. So this is clearly what this message refers to. Here we read
2071.22s - 2078.82s |  Queen opening Newcastle station late in August. Well in fact on August 29th 1850
2079.38s - 2084.18s |  Queen Victoria opened the train station of Newcastle.
2086.58s - 2095.06s |  And here we read Bernard has been made engineer of the Great Exhibition. This refers to the Great
2095.06s - 2105.54s |  Exhibition at Crystal Palace which is also known as the World's Fair in 1851. Okay so this is what
2105.54s - 2113.22s |  we found in the messages and well let's now draw a conclusion. All right so we know that
2113.22s - 2120.66s |  Collinson's family sent messages during his journey and it was via encrypted ads, one per month. They
2120.66s - 2128.50s |  also sent letters. We have a project where we are trying to decipher all 50 of these ads and put
2128.50s - 2134.10s |  them in the right context. Hopefully we'll be done by the end of the year and then we'll be
2134.10s - 2140.10s |  publishing a paper in Cryptologia. If anyone wants to help we're always up for more help.
2140.90s - 2155.29s |  And other than that thank you. We have about seven minutes for questions.
2166.50s - 2173.46s |  Yes the question was why were these messages encrypted? Well probably to keep these family
2173.46s - 2180.74s |  stories private. That's probably the main reason. So I think these messages contain nothing
2180.74s - 2187.30s |  absolutely secret but apparently the family members didn't want to read their family gossip
2187.30s - 2194.18s |  in the times where everybody could see it. Another reason is that when you're encrypting something you
2194.18s - 2200.82s |  can often put more information into it than when it's clear text. For example with telegrams where
2200.82s - 2206.90s |  people would have to pay by the word and so there were rapidly code books coming up where you could
2206.90s - 2216.15s |  put a small amount of text to mean a lot a much larger phrase. How hard is it to source the code
2216.15s - 2222.47s |  books? How hard is it to source the code books? I imagine they don't pop up on ebay very often.
2222.47s - 2228.07s |  Yeah as a matter of fact if you look in a hacker tracker we have some links to the code books. Oh
2228.07s - 2234.23s |  nice. Yeah well I mean like with different code books that you may not have. Oh to find other
2234.23s - 2241.67s |  code books? Yeah. It is a constant quest. Uh and anytime someone finds a new code book then
2241.67s - 2249.11s |  there's a race to see does this code book help us crack any of the unsolved messages from many
2249.11s - 2255.67s |  sources. Uh or sometimes we'll try to derive a code book from what we can read. Like if you heard
2255.67s - 2268.06s |  about uh the Mary Queen of Scots uh story they derived things from that. I love it. So was the
2268.06s - 2273.34s |  use of this type of system I mean outside of you know military people maybe you know ship captain
2273.34s - 2279.82s |  or military folks like you know lovers. Was this really I mean did you come across information
2279.82s - 2285.74s |  about people talking about this socially? You know um that that's essentially my question.
2285.82s - 2293.74s |  Well um most of the of the ads were clearly published by lovers. There might be more
2293.74s - 2299.18s |  business related messages but probably these are the ones that are not broken yet because
2299.18s - 2305.10s |  they use the stronger encryption. So apart from this well this story is something special because
2305.10s - 2312.06s |  it's not about lovers communicating with each other. Um did you find anything else that's not
2312.06s - 2318.46s |  really? Well we know of at least one private detective who would send messages to his clients
2319.02s - 2324.70s |  by putting encrypted ads in the newspaper in London. Uh and he may have actually been the
2324.70s - 2329.90s |  origin of the Sherlock Holmes story. Was there like discussion of this you know socially in the
2329.90s - 2335.18s |  media you know contemporaneously in this you know 1850s to 1890s you know is there any kind of
2335.18s - 2343.90s |  mention of yes yes and especially this was a very high status family and we have found many
2343.90s - 2350.46s |  mentions that it was the buzz uh when people would get together and like oh there's these
2350.46s - 2358.22s |  classified ads in the times and who's making them and why are they making them and I I think uh it
2358.22s - 2365.02s |  did come out that Jada W was Julia DeWinton because that was published somewhere but the
2365.02s - 2373.02s |  actual system was never published and there's a a short story from about that time period where
2373.02s - 2379.90s |  someone is writing about these ads and they made up their own system because they knew no one else
2379.90s - 2384.70s |  could solve it so why don't they just make up their own system uh and then they wrote a story
2384.70s - 2393.90s |  about it. I'm a long time fan from the AP days so. Thank you. Do you know how often the times was
2393.90s - 2399.26s |  published? Was it published daily or or was it published monthly in the 1850s? It was published
2399.26s - 2405.90s |  daily but I don't know if there were two uh if there was an edition on Sunday that there might
2405.90s - 2411.02s |  have been a Saturday edition that also covered the Sunday but apart from that it was published
2411.02s - 2414.78s |  every day. Yeah. Do you have an idea of how expensive it would have been to publish and
2414.78s - 2420.22s |  advertise? Um we. I'm sorry you couldn't hear the question. Uh the question was how expensive it was
2421.10s - 2427.98s |  I I think we have no information how much it costs in England but in uh France uh we have
2427.98s - 2435.18s |  this information of course it's always difficult to say uh how much um 10 francs were in in 1850
2435.18s - 2442.70s |  but I think compared to the gold price the the price for um an encrypted or for an advertisement
2442.70s - 2457.64s |  was roughly 20 dollars or so in today's world. It wasn't cheap. Thank you. Hello uh how much has LLMs
2457.64s - 2462.92s |  and OpenAI affected your work in the past three years that you just dump them in there and see
2462.92s - 2470.44s |  what comes out? Oh sorry a little closer uh how has LLMs and like OpenAI technology affected your
2470.44s - 2481.00s |  work? You mean uh artificial if uh yes artificial artificial intelligence. LGBT yeah. Yes or in
2481.00s - 2488.20s |  general um so far artificial intelligence hasn't been used very much in breaking old ciphers but
2488.20s - 2494.68s |  it's changing. I I can imagine that it's very helpful especially if you have an encrypted text
2494.68s - 2499.80s |  and you you don't know what it is about. So there are certain algorithms where you can tell well
2499.80s - 2505.24s |  this might be an encryption of this kind or that kind and it requires some experience and I'm
2505.24s - 2512.36s |  pretty sure that artificial intelligence can help a lot uh doing this and I know of research projects
2513.16s - 2520.76s |  that examine this kind of analysis but so far it it hasn't been applied very often. Do you know
2521.16s - 2531.24s |  anything else? I've done quite a bit with LLMs involving another code cryptos and no they they
2531.24s - 2538.20s |  can translate from one language to another but they can't count. Like if you ask for a sentence
2538.20s - 2561.08s |  it's 97 letters long total fail total fail yeah. Did Collinson survive? Yes uh yeah well uh we know
2561.08s - 2567.08s |  of four he really received well first of all Collinson survived but I think it was his last
2567.08s - 2573.24s |  expedition so as far as I know the government was not very content with the way he led this
2573.24s - 2580.04s |  exhibition expedition so it was his last one and I think he retired afterwards and as far as we know
2580.04s - 2585.56s |  four of the messages or he received four of the messages in Banyuwangi that was probably
2585.56s - 2591.88s |  all so apparently the system worked but not very well. I'm sure he saw the other messages once he
2591.88s - 2599.08s |  got home uh yeah that that his sister had them but but as Klaus said um there was a lot of uh
2599.08s - 2605.72s |  unrest on the ship and Collinson was very much blamed for that and uh has nothing to do with
2605.72s - 2611.80s |  codes but yeah. You mentioned a couple of the other um family member names do you have a reason
2611.80s - 2617.72s |  to believe or do you have a reason why you think uh Amelia is not AC um and given the fact that you
2617.72s - 2621.48s |  have other letters and other documents from the family do you think you're going to be able to
2621.48s - 2629.00s |  look at? Yes uh Amelia Collinson or AC might be Amelia Collinson that's correct uh would be a good
2629.00s - 2635.48s |  hypothesis. They tended to use their married name at that point uh it could well be but we've we've
2635.48s - 2640.76s |  just never found any confirmation that it was Amelia with Julia we have written confirmation
2640.76s - 2654.52s |  that yes it was Julia but it might be okay all right thank you. Thank you.


url: https://www.youtube.com/watch?v=_1DTkkaNqfM
title: DEF CON 32 - Clash, Burn, and Exploit Manipulate Filters to Pwn kernelCTF - HexRabbit Chen
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=_1DTkkaNqfM",
  "title": "DEF CON 32 - Clash, Burn, and Exploit  Manipulate Filters to Pwn kernelCTF - HexRabbit Chen",
  "description": "As the successor to the iptables, nftables stands as a crucial network component within the Linux kernel, managing packet filtering and other network-related functionalities. With continuous development and changes, features designed to increase its efficiency, such as batch commit, anonymous chains/sets, and asynchronous garbage collection, have been implemented, which in turn has significantly increased its complexity and made it an attractive target for attackers in recent years.\n\nSince the announcement of the kernelCTF bug bounty, multiple nftables 0-day vulnerabilities have been reported and patched to enhance its security. However, if not careful enough, the security patch may not only mitigate the bug but also introduce new security issues unintentionally. By researching the structural changes in the nftables codebase, we successfully uncover new vulnerabilities despite the intense competition in kernelCTF. Also, we managed to speedrun the exploitation just before Google removed nftables from LTS instance, becoming the last LTS nftables exploitation.\n\nIn this presentation, we will share three nftables vulnerabilities we discovered in a storytelling fashion. We start with a brief introduction on how nftables works under the hood to familiarize attendees with the basics. After that, we dive into nftables internals and dissect three vulnerabilities discovered during our journey, two of which involved utilizing hard-to-exploit race conditions to pwn the flag. Alongside details of the exploitation, we will also share the roller-coaster story of kernelCTF experiences, filled with dramatic highs and lows, making it a tense and exhilarating journey.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2260,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.02s - 8.42s | This text was transcribed using whisper model: large-v2

 And with no further ado, please continue.
8.42s - 12.14s |  Hello everyone and welcome to my talk,
12.14s - 13.82s |  Clash, Burn and Exploit,
13.82s - 16.26s |  Manipulate Filters to Pwn Kernel CTF.
17.74s - 19.58s |  I'm HexRabbit from Taiwan,
19.58s - 23.14s |  currently working as a security researcher at DefCon.
23.14s - 25.22s |  I specialize in binary exploit,
25.22s - 27.86s |  especially in Linux kernel exploitation.
27.86s - 30.98s |  I found some vulnerabilities in Linux kernel component
30.98s - 34.70s |  like Error Ring, KSMBD, NSTables and others.
36.46s - 39.66s |  Today, I will start from introducing kernel CTF
39.66s - 41.22s |  and NSTables.
41.22s - 44.58s |  After that, we will dive into the NSTable internals
44.58s - 46.18s |  and talk about three vulnerabilities
46.18s - 48.62s |  we discovered in NSTables.
49.58s - 52.30s |  And in between these three vulnerabilities,
52.30s - 55.46s |  I will also share some story behind the scene
55.46s - 58.95s |  during my kernel CTF journey.
58.95s - 62.55s |  So let's talk about, first talk about the kernel CTF.
62.55s - 64.99s |  Kernel CTF is part of Google VRP
64.99s - 68.99s |  and the way it works is quite similar to a CTF challenge.
68.99s - 70.55s |  For about every two weeks,
70.55s - 72.71s |  there'll be new kernel version release
72.71s - 75.95s |  and attendee will be given an unprivileged show
75.95s - 78.19s |  and you will need to exploit it,
78.19s - 81.15s |  exploit the Linux kernel to get flag
81.15s - 84.07s |  and submit it to Google to earn the bounty.
84.07s - 86.23s |  There are three instances can be pawned.
86.23s - 90.51s |  LTS and CLS both use newer and quite similar kernel config
90.51s - 93.91s |  while the mitigation one use an older kernel config
93.91s - 98.63s |  with custom security patch to accept more one day exploit.
98.63s - 100.95s |  But the most important thing is,
100.95s - 103.43s |  Google offers pretty big bounty reward.
105.15s - 107.91s |  With some simple math calculation,
107.91s - 110.75s |  we can quickly find for zero day LTS exploit,
110.75s - 114.19s |  the bounty can easily surpass 50,000 US dollar.
114.19s - 115.83s |  And with the same vulnerability,
116.63s - 119.31s |  you can earn both 21,000 max,
119.31s - 123.47s |  maximum in both mitigation and CLS instance,
123.47s - 127.03s |  which is quite appealing for the bounty hunter like me.
128.67s - 131.07s |  So why am I targeting nftables?
131.07s - 134.87s |  First, nftable config is enabled in kernel CTF.
134.87s - 136.39s |  And as you can see on the right,
136.39s - 138.51s |  there are multiple vulnerabilities discovered
138.51s - 140.67s |  just after kernel CTF is announced.
140.67s - 143.51s |  So for kernel CTF newbie like me,
143.51s - 145.39s |  I think it's the right place to start.
146.83s - 153.34s |  Okay, so first we take a brief intro to nftables.
153.42s - 155.50s |  What exactly is nftables?
155.50s - 157.58s |  Nftable is a package filtering framework
157.58s - 159.02s |  inside Linux kernel.
159.02s - 162.94s |  It's used to replace the legacy IP, ARP, EB tables,
162.94s - 165.46s |  merge them into a single entry point.
165.46s - 170.46s |  It use a simple VM design to implement its functionality
170.78s - 173.58s |  and support new syntax for CY interface.
173.58s - 174.82s |  As you can see on the right,
174.82s - 176.86s |  instead of doing thing one by one,
177.02s - 181.46s |  new syntax can now allow config multiple things at once.
181.46s - 184.38s |  And this capabilities come from its design,
184.38s - 188.80s |  which we will revisit later.
188.80s - 191.88s |  Nftable is constructed by a tree-like structure.
191.88s - 193.76s |  It contains five core modules,
193.76s - 197.12s |  table, chain, rule, expression, and set.
198.68s - 202.08s |  Table is the top level container for the below structures.
202.08s - 204.04s |  It's used for the measurement purpose.
204.76s - 208.96s |  Each table will only belong to a specific neural family,
208.96s - 211.40s |  and any object contained by the table
211.40s - 212.80s |  will follow the same family.
214.36s - 218.28s |  Chain in nftables will hook at predefined hooking point
218.28s - 220.88s |  provided by net filter infrastructure
220.88s - 223.00s |  to do the packet filtering.
223.00s - 226.56s |  When any packet flows through the hooking point,
226.56s - 229.00s |  the chain will execute the expressions in the row
229.00s - 231.48s |  it managed to accept, or to block,
231.48s - 233.32s |  or to modify the packets.
234.12s - 236.64s |  What is the rule, and what is the expression?
238.73s - 240.61s |  As I mentioned earlier,
240.61s - 243.25s |  nftable implements its functionality
243.25s - 245.29s |  by a simple virtual machine.
245.29s - 248.13s |  You can think a rule as a small function.
248.13s - 250.05s |  They can contain multiple expressions,
250.05s - 253.73s |  and the expression is the instruction for nftables.
254.85s - 257.33s |  There are different types of expressions.
257.33s - 260.49s |  Some can be used to manipulate VN registers,
260.49s - 262.45s |  and the others can be used to load,
263.09s - 267.28s |  to read, or write data within packets.
267.28s - 270.56s |  And thus, set is used to store a group of some type,
270.56s - 275.08s |  like IP address, or port, or any binary data.
275.08s - 277.24s |  It can also be used as a map
277.24s - 280.04s |  to map some type A to another type B.
280.04s - 282.12s |  And these data stored in the set
282.12s - 287.71s |  can be queried by expressions during packet filtering.
287.71s - 291.83s |  Okay, so after having some basic understanding of nftables,
291.83s - 294.79s |  I will now introduce the first vulnerability I discovered.
296.11s - 299.27s |  At the time, I'm not so familiar with nftables.
299.27s - 302.95s |  However, I spotted something weird in the code base.
302.95s - 304.47s |  These three functions are all used
304.47s - 307.39s |  to delete objects in nftables.
307.39s - 309.91s |  The nftable.deleteRuleDeactivate
309.91s - 311.71s |  will be called during rule deletion,
312.67s - 315.59s |  nft.flush will be called during full config flush,
316.99s - 320.07s |  and nft.setElementCacheAllDeactivate
320.07s - 322.75s |  will be called during set element deletion.
323.75s - 326.23s |  However, the pattern here is a bit different.
327.79s - 331.95s |  The first two use nft.isActiveNext
331.95s - 334.43s |  to check if the object is active.
335.35s - 338.99s |  But the last one, nft.setElementCacheAllDeactivate
338.99s - 341.03s |  use nft.isActive to check.
341.03s - 343.19s |  So, what's the difference?
344.91s - 346.99s |  Actually, these two functions
346.99s - 351.67s |  is used for object lifetime management in nftables.
352.27s - 354.07s |  In order to understand how it works,
354.99s - 356.95s |  we will need to first talk
356.95s - 362.43s |  about the batch request mechanism.
362.43s - 364.71s |  For a query request,
364.71s - 367.23s |  for example, the getRule operation above,
367.23s - 370.83s |  Netlink API will internally use netlink.receiveXKB
370.83s - 373.43s |  to get the raw information loglessly.
374.55s - 377.07s |  However, if it's some operation
377.07s - 378.63s |  that will modify the control plan,
378.63s - 382.07s |  like new table or delete chain,
382.11s - 384.91s |  nftables will use nfnetlink.receiveBatch
384.91s - 387.83s |  instead of the logless one to serve the request.
387.83s - 389.19s |  The difference between them
389.19s - 392.15s |  is that batch one can process a request
392.15s - 394.35s |  which contains multiple operations,
394.35s - 396.87s |  and they will be processed sequentially.
397.87s - 400.19s |  And also because of this design,
400.19s - 403.99s |  the COI interface can copy multiple things at once.
405.27s - 407.55s |  So, it sounds great,
407.55s - 410.63s |  but the thing become more complicated
410.63s - 414.63s |  when any operation fail in the middle of a batch request.
415.59s - 419.39s |  And what nftables do is to split batch request
419.39s - 423.91s |  handling into multiple phases.
423.91s - 425.83s |  There are three phases during the handling
425.83s - 427.83s |  of the batch request,
427.83s - 431.83s |  prepare phase, commit phase, and abort phase.
431.83s - 433.15s |  During the prepare phase,
433.15s - 435.59s |  if every operation finished successfully
435.59s - 437.03s |  in the batch request,
437.03s - 440.15s |  it will go to the commit phase and commit the changes.
441.15s - 443.39s |  However, if something went wrong,
443.39s - 445.47s |  after every operation is processed,
445.47s - 448.35s |  it will go to abort phase and revert all the changes.
449.39s - 451.99s |  Here's the lifetime management's concern.
451.99s - 457.49s |  Any object in nftable has two state variable,
457.49s - 460.45s |  current generation and next generation.
460.45s - 463.69s |  Only object activated in current generation
463.69s - 466.45s |  can affect the runtime behavior.
466.45s - 467.89s |  And you can think the next generation
467.89s - 470.57s |  as a temporary state for the prepare phase.
472.53s - 474.57s |  Every operation modify the control plan,
474.57s - 477.13s |  like new or delete operations,
477.13s - 480.05s |  will only make changes on the next generation state
480.05s - 481.61s |  in the prepare phase.
481.61s - 484.45s |  So, without affecting the current generation state.
485.93s - 488.41s |  Then, during the commit phase,
488.41s - 490.81s |  it will commit the modification.
490.81s - 494.41s |  So, the current generation will finally be set
494.41s - 496.25s |  as the next generation,
496.25s - 497.77s |  and the next generation state
497.77s - 499.53s |  will be reset to a clean state.
500.49s - 503.01s |  But in the case, if something went wrong
503.01s - 504.57s |  during the abort phase,
504.57s - 507.77s |  it only needs to clean the next generation state.
508.97s - 513.65s |  Let's go through some examples to know how it works.
513.65s - 516.01s |  After a batch request is received,
516.01s - 517.77s |  it goes into the prepare phase.
519.09s - 522.05s |  The first operation is delete set C.
522.05s - 525.37s |  Okay, so the set C's next generation state
525.37s - 529.27s |  will be set to deactivated.
529.47s - 534.19s |  Next, it continues to process a set D operation.
535.47s - 537.99s |  So, the set D will be added into hash table
537.99s - 543.17s |  with next generation in activated state.
543.17s - 546.61s |  If nothing went wrong, we'll go to the commit phase.
546.61s - 549.13s |  And at this phase, current generation
549.13s - 552.45s |  will be set as the next generation.
552.45s - 554.49s |  So, the set D will be available
554.49s - 557.29s |  in both runtime and query operations.
557.29s - 562.34s |  And also, the set C will be free.
562.34s - 566.38s |  If something went wrong, we will enter the abort phase.
566.38s - 569.66s |  And at this phase, all operation that's done
569.66s - 573.34s |  in the prepare phase will be reverted in a reverse order.
573.34s - 576.54s |  So, the add set D will be undue,
576.54s - 582.68s |  and also the delete set C will be undue.
582.68s - 584.88s |  So, okay, back to the check.
584.88s - 587.12s |  So, what's the problem here?
587.12s - 589.60s |  As we can see, during the NFT set element
589.60s - 592.96s |  catch all deactivate, it used NFT is active
592.96s - 596.08s |  to check if the element is still alive.
596.08s - 600.00s |  However, NFT is active checks current generation,
600.00s - 603.28s |  but the function actually runs in the prepare state,
603.28s - 606.20s |  which will only modify the next generation state
606.20s - 608.60s |  of an object.
608.60s - 612.72s |  So, the check here will always pass.
612.72s - 615.52s |  And by request multiple delete operations,
615.52s - 620.64s |  we can free the element multiple times in the commit phase.
620.64s - 622.60s |  So, the batch request to trigger double free
622.60s - 623.80s |  will look like this.
623.80s - 626.32s |  Since the lifetime check will always pass
626.32s - 629.36s |  if the element exists during the prepare phase,
629.36s - 632.04s |  two delete set element of operation
632.04s - 634.44s |  will both execute successfully.
634.44s - 637.40s |  And so, when you get to the commit phase,
637.40s - 639.68s |  the send element will be free twice,
639.68s - 644.56s |  and we get a set catch all element double free.
644.56s - 649.72s |  Great. So, I found my first bug for current CTF.
649.72s - 654.56s |  But the next day, I found the maintainer
654.56s - 656.28s |  also find the same bug
656.28s - 659.00s |  and send a patch to kernel mailing list.
659.00s - 661.00s |  I mean, why?
661.00s - 664.00s |  So, okay, this means my zero days
664.00s - 666.12s |  officially turns into a one day.
666.12s - 669.36s |  And according to kernel CTF rules,
669.36s - 673.44s |  my bounty will decrease by 20,000 US dollar.
673.44s - 676.00s |  Ouch.
676.00s - 678.64s |  Also, one day vulnerability means
678.64s - 681.44s |  that everyone will know how to trigger the vulnerability,
681.44s - 684.48s |  and they may also come up with some exploit.
684.48s - 686.56s |  So, I definitely need to exploit it
686.56s - 692.44s |  before next kernel CTF slot opens.
692.44s - 694.76s |  So, after we get the double free primitive,
694.76s - 699.88s |  we reuse the exploit method for CVE-2023-4004
699.88s - 702.28s |  to overlap the empty table data
702.28s - 706.16s |  and empty object to leak address and control IP.
706.16s - 707.76s |  Due to a time limit of this talk,
707.76s - 709.52s |  I won't expand the detail of it,
709.52s - 713.68s |  but kudos to LonelyOnCom who discovered this technique
713.68s - 717.68s |  and shared it on kernel CTF repository.
717.68s - 720.68s |  So, now we develop the exploits
720.68s - 725.17s |  and wait for the slot to reopen.
725.17s - 728.61s |  Fast forward to two hours before the competition starts.
728.61s - 731.45s |  I nervously check if there's any kernel updates
731.45s - 734.29s |  related to NF tables.
734.29s - 736.81s |  And guess what?
736.81s - 739.01s |  The patch previously posted on the mailing list
739.05s - 741.33s |  has been merged into the kernel.
741.33s - 744.37s |  And it added one line on it.
744.37s - 748.09s |  It says, reported by LonelyOnCom,
748.09s - 750.73s |  which this means is the patch may actually come
750.73s - 753.37s |  from a zero-day kernel CTF submission.
753.37s - 755.73s |  And since the reporter is LonelyOnCom,
755.73s - 760.29s |  whose exploit I just used, this is indeed the case.
760.29s - 763.41s |  So, just before I have the chance to exploit
763.41s - 768.13s |  an official instance, I found it's a collision.
768.13s - 772.57s |  So, yes, I still found the instance and report the flag.
772.57s - 775.57s |  But too bad for me, the first bug
775.57s - 780.05s |  do collide with an old kernel CTF submission.
780.05s - 785.32s |  That's how I look after the competition.
785.32s - 788.08s |  Okay, so I take some break.
788.08s - 794.55s |  And after three weeks later, I found the second bug.
794.55s - 798.39s |  During the research, I came across an interesting commit.
798.39s - 803.55s |  NF table validate family when identifying table by handle.
803.55s - 806.51s |  The commit is added after the mitigation instance kernel
806.51s - 809.67s |  version, so it can be used upon the mitigation instance
809.67s - 811.63s |  as a one-day.
811.63s - 816.75s |  It added a check on NFT table lookup by handle function,
816.75s - 819.59s |  which is used for searching a register table
819.59s - 821.99s |  by the provided handle.
821.99s - 824.51s |  Without the commit, during the table lookup,
824.51s - 826.71s |  we can provide a family different from the one
826.71s - 828.59s |  which table belongs to.
828.59s - 834.47s |  But what can we do with this inconsistency?
834.47s - 837.83s |  Let's trace where the family parameter comes from
837.83s - 839.75s |  and where it goes.
839.75s - 842.51s |  NF table lookup by handle is only called
842.51s - 844.91s |  from NF table delete table.
844.91s - 848.35s |  And this function is used to delete user-specified table
848.35s - 850.11s |  from NF tables.
850.11s - 856.51s |  The family variable is directly get from user-provided input.
856.55s - 858.99s |  And it's saved into context family
858.99s - 864.28s |  and passed to NFT flush table function.
864.28s - 867.48s |  In NFT flush table, context argument
867.48s - 870.88s |  is passed into every function handling object deletion.
870.88s - 874.60s |  For me, trace which function use the context family
874.60s - 875.92s |  is quite annoying.
875.92s - 880.68s |  So instead of just tracing into each function,
880.68s - 885.72s |  I take the shortcut to trace where it is used.
885.76s - 888.00s |  So I just grab the whole code base
888.00s - 892.72s |  to find where the context family is used.
892.72s - 896.32s |  Grabbing context family gives us a lot of result,
896.32s - 899.28s |  most of which comes from the NF table expressions
899.28s - 904.04s |  like count limit, net, T proxy, and et cetera.
904.04s - 908.68s |  However, most of them cannot be used for the exploit.
908.68s - 912.36s |  But I finally found one that can be exploited.
912.36s - 917.26s |  It is in the NFT log expression.
917.26s - 920.78s |  The trigger path I found starts from the NFT log destroy.
920.78s - 923.46s |  This function takes context family as an argument
923.46s - 927.14s |  and call to NF log output.
927.14s - 929.86s |  Now it's becoming the PF argument
929.86s - 934.50s |  and used as an index to de-reference the loggers array.
934.50s - 937.10s |  The value range of our input context family
937.10s - 941.06s |  and also the PF here is 0 to 255.
941.06s - 945.54s |  But if we check the size of loggers array,
945.54s - 949.46s |  we can find it only have 13 elements in the first dimension.
949.46s - 954.54s |  So we get the global array out of bound access here.
954.54s - 958.65s |  But what can we do with it?
958.65s - 962.21s |  After taking the logger out, it de-reference the me field
962.21s - 966.09s |  and feed it into the module put.
966.09s - 968.17s |  The module put will again de-reference
968.17s - 972.29s |  and decrease the refcon value in the module object.
972.29s - 974.05s |  With this vulnerability,
974.05s - 978.13s |  a logger can be any pointer store adjacent to a loggers array.
978.13s - 980.81s |  So we may cause some type of confusion here
980.81s - 983.53s |  and decrease some variable by one.
983.53s - 987.73s |  However, we are dealing with an awkward situation here.
987.73s - 990.09s |  In order to utilize this bug,
990.09s - 992.81s |  we have to find a pointer store on global
992.81s - 996.05s |  and can be de-referenced twice.
996.05s - 998.69s |  The first is to take our logger me
998.69s - 1004.23s |  and the second is to take our module refcon.
1004.23s - 1007.15s |  To sum up what we have by now,
1007.15s - 1012.79s |  first, the maximum value of pfValue we can control is 255.
1012.79s - 1017.39s |  And we can trigger an out of bound refcon decrement
1017.39s - 1021.27s |  by using a pfValue larger than 12,
1021.27s - 1024.39s |  which will execute like the code here.
1024.39s - 1026.99s |  To exploit this, the first thing we need to do
1026.99s - 1032.59s |  is to find a global pointer placed near the loggers array.
1032.59s - 1035.03s |  So what do we have on the global?
1035.03s - 1037.51s |  By inspect the marrying GDB,
1037.51s - 1040.95s |  we quickly find there's an NFCT expect hash
1040.95s - 1044.23s |  placed near the loggers array.
1044.23s - 1045.95s |  And it's a hash table.
1045.95s - 1049.15s |  So in this case, it seems to be a good target
1049.15s - 1053.55s |  since the pointer point to an array of pointers.
1053.55s - 1058.66s |  Therefore, it can be de-referenced twice.
1058.66s - 1062.86s |  So let's check how the code normally works.
1062.86s - 1067.26s |  First, it gets the me field at offset 1x
1067.26s - 1073.46s |  and then get the refcon at offset 340x.
1073.46s - 1076.42s |  Now let's check the out of bound access case.
1076.42s - 1079.22s |  First, we set pf to 19 to get a hash table
1079.22s - 1082.50s |  pointer NFCT expect hash.
1082.50s - 1085.94s |  The first de-reference we got is the index tree entry
1085.94s - 1088.10s |  of the hash table.
1088.10s - 1090.58s |  The entry points to the HNO field
1090.58s - 1093.70s |  of an NFCT expect object.
1093.70s - 1095.38s |  So after one more de-reference, it
1095.38s - 1100.38s |  will access offset 340x down below the expect object.
1100.38s - 1104.50s |  But since the expect object only have a d at size,
1104.50s - 1107.26s |  it will access out of bounds.
1107.26s - 1111.22s |  Fortunately, all NFCT expect object
1111.22s - 1114.98s |  allocated in a dedicated Cayman cache.
1114.98s - 1117.02s |  So the memory space below will also
1117.02s - 1121.42s |  contain NFCT expect objects.
1121.42s - 1123.82s |  So it will access to an RCU field
1123.82s - 1127.54s |  and decrease the next pointer in the structure.
1127.54s - 1132.71s |  But what does this next pointer useful?
1132.71s - 1135.75s |  As we know, after RCU objects free,
1135.75s - 1138.71s |  Linux kernel will not instantly free the object.
1138.71s - 1142.19s |  Instead, it will hold the object for a grace period
1142.19s - 1145.55s |  to wait for all other RCU readers to finish.
1145.55s - 1148.27s |  So the next pointer in the RCU hash structure
1148.27s - 1150.43s |  is used for temporary story name
1150.43s - 1156.25s |  and waiting for the RCU thread to process to free them.
1156.25s - 1158.89s |  So after the contract expect object are free,
1158.89s - 1164.69s |  they will be like this, chained by the next pointer.
1164.69s - 1168.09s |  And since we can decrease the next pointer in RCU head,
1168.09s - 1169.93s |  we can make it point to another field
1169.93s - 1173.33s |  inside the contract expect object.
1173.33s - 1175.73s |  And to exploit it, we choose to land it
1175.73s - 1177.61s |  on a user-controllable field, which
1177.61s - 1181.59s |  contains a union of IPv4 and IPv6 address.
1181.59s - 1185.03s |  So when RCU callback triggered, it
1185.03s - 1187.27s |  will read the fake function pointer we set,
1187.27s - 1190.76s |  and we can control the IP.
1190.76s - 1193.68s |  However, to actually exploit the vulnerability,
1193.68s - 1195.92s |  we came across some roadblocks.
1195.92s - 1199.52s |  First, we need the index tree of the hash table
1199.52s - 1201.28s |  point to some expect object.
1201.28s - 1204.88s |  So we can use it to do the out-of-bound write.
1204.88s - 1211.12s |  But unfortunately, the hash value is unpredictable.
1211.12s - 1214.76s |  Next, the out-of-bound written expect object
1214.76s - 1217.44s |  need to be in the grace period, so we
1217.44s - 1220.80s |  can decrease its next pointer.
1220.80s - 1223.64s |  But the next period is a small time window
1223.64s - 1225.80s |  and hard to control when the kernel actually
1225.80s - 1228.64s |  frees the object.
1228.64s - 1231.52s |  Well, so long story short, we eventually
1231.52s - 1236.60s |  found a way to exploit it by brute force and race.
1236.60s - 1239.72s |  To exploit this, first, we use a tight loop
1239.72s - 1242.70s |  to create a lot of expect objects.
1242.70s - 1245.34s |  And at some point, the expect count
1245.34s - 1249.74s |  exceeded the value max expected and start
1249.74s - 1254.24s |  to evict the oldest expect object.
1254.24s - 1259.16s |  So the oldest expect object will be placed into the RCU free list.
1259.16s - 1262.32s |  And so on, and so on.
1262.32s - 1266.12s |  And at some point, RCU thread gets scheduled by the kernel
1266.12s - 1271.70s |  and starting to process objects.
1271.70s - 1273.62s |  At this point, we add another thread
1273.62s - 1277.26s |  to trigger out-of-bound decrement in a batch request.
1277.94s - 1283.09s |  And keep this system running for a bit.
1283.09s - 1287.97s |  So we hope for a race scenario like this to emerge.
1287.97s - 1290.33s |  First, the expect object allocated
1290.33s - 1293.05s |  into index tree of the hash table.
1293.05s - 1296.13s |  And then the expect object you want to out-of-bound write
1296.13s - 1299.45s |  is freed into the RCU free list.
1299.45s - 1304.61s |  Then it continues to free another expect object.
1304.61s - 1307.89s |  After that, we trigger the vulnerability 28 times
1307.89s - 1310.93s |  in a batch request to make the next pointer point
1310.93s - 1314.09s |  to a user-controllable value.
1314.09s - 1317.89s |  And finally, the RCU starts to process these three objects
1317.89s - 1322.28s |  and runs our set callback function.
1322.28s - 1323.12s |  Great.
1323.12s - 1325.12s |  Let's try it on local build.
1325.12s - 1332.78s |  And we successfully control the IP to 414441.
1332.78s - 1337.00s |  So what about remote?
1337.00s - 1337.92s |  Let's try.
1337.92s - 1340.80s |  And we got an error message while trying
1340.80s - 1343.56s |  to add the log expression.
1343.56s - 1345.24s |  Since I have no idea what happens
1345.24s - 1347.48s |  on the remote environment, I decided
1347.48s - 1352.92s |  to download the official busy image to debug it locally.
1352.92s - 1357.68s |  So I open the GDB and set some breakpoint on the functions.
1357.68s - 1361.36s |  But when I set the break on n of t log destroy function,
1361.36s - 1364.76s |  GDB complained that it was not defined.
1364.76s - 1368.82s |  What's wrong here?
1368.82s - 1372.26s |  I later found that it's because the kernel config I used
1372.26s - 1376.94s |  is different from the one used in the official environment.
1376.94s - 1380.46s |  So the log expression I used to exploit the vulnerability
1380.46s - 1384.02s |  not even compiled into the official image.
1384.02s - 1387.70s |  But I'm using the official build script
1387.70s - 1389.78s |  to view the local test image.
1389.78s - 1394.59s |  Why else there can be any difference?
1394.59s - 1395.91s |  I mean, why?
1399.91s - 1404.35s |  Eventually, I found it is caused by the official build script.
1404.35s - 1408.19s |  The mitigation instance is built by CoS kernel config
1408.19s - 1412.67s |  plus the Google custom security patch.
1412.67s - 1415.07s |  And the official mitigation instance
1415.07s - 1419.75s |  used CoS config 6.1.55.
1419.75s - 1424.79s |  The NF table expression are enabled in CoS config
1424.79s - 1428.59s |  after the version 6.1.64.
1428.59s - 1432.47s |  However, the build script will always fetch the latest CoS
1432.47s - 1435.43s |  config, so the mitigation kernel I built
1435.43s - 1438.35s |  has the NF table expression enabled.
1438.35s - 1443.90s |  But in the official image, they're actually disabled.
1443.90s - 1447.78s |  So well, I think next time I should definitely
1447.78s - 1454.25s |  check out the config first.
1454.25s - 1460.85s |  OK, so after my second failure, I revisit some old patch
1460.85s - 1465.50s |  and I found a new bug.
1465.50s - 1468.54s |  The patch I was looking at is the patch
1468.54s - 1470.78s |  which introduced the first bug.
1470.78s - 1475.46s |  The title says, NF table adapt set backend
1475.46s - 1478.26s |  to use GC transaction API.
1478.26s - 1481.62s |  So what does the GC mean?
1481.62s - 1485.18s |  Here it means the set garbage collection.
1485.18s - 1487.46s |  There are some set implementation support user
1487.46s - 1491.94s |  to set a timeout on any set element.
1491.94s - 1497.30s |  And there are two types of GC to clean the expired element.
1497.30s - 1500.94s |  The first one, the synchronous one,
1500.94s - 1503.22s |  will be called in the commit phase.
1503.22s - 1506.74s |  And a synchronous one will be triggered periodically
1506.74s - 1508.74s |  in the background.
1508.74s - 1513.50s |  But here, we only focus on the synchronous one.
1513.50s - 1516.58s |  So back to the patch.
1516.58s - 1520.74s |  In the commit message, it says, use GC transaction API
1520.74s - 1524.86s |  to replace the old and buggy GC API and the busy mark
1524.86s - 1526.54s |  approach.
1526.54s - 1529.30s |  So what is the difference between the new and the old
1529.30s - 1530.58s |  one?
1530.58s - 1535.70s |  Let's take a look of the old GC design.
1535.70s - 1538.14s |  In the old design, the synchronous GC
1538.14s - 1542.66s |  will run loglessly and can be triggered at any time.
1542.66s - 1544.38s |  So in order to protect GC threads
1544.38s - 1547.98s |  from raising with the landing API, both of them
1547.98s - 1551.38s |  will check against busy mark set on the element
1551.38s - 1556.66s |  before delete it to prevent double free.
1556.70s - 1559.66s |  But sometimes, the developer might
1559.66s - 1561.90s |  forget to check against it.
1561.90s - 1564.50s |  In this case, there's a new function
1564.50s - 1569.30s |  called nftMapDeactivate forgot to check a busy mark.
1569.30s - 1573.94s |  And this leads to a double free vulnerability.
1573.94s - 1576.58s |  So in order to avoid this kind of issues,
1576.58s - 1582.86s |  nftable developer decided to replace it with a new design.
1582.86s - 1587.14s |  In the new GC design, it introduced the GC sequence.
1587.14s - 1589.70s |  The GC sequence is a per net variable.
1589.70s - 1594.66s |  And it will be increased before and after any modification
1594.66s - 1596.54s |  to the control plan.
1596.54s - 1599.02s |  So it will increase at the beginning
1599.02s - 1604.94s |  and at the end of both the commit and the abort phase.
1604.94s - 1608.34s |  During a GC procedure, GC thread will record and check
1608.34s - 1610.34s |  it to prevent raise.
1610.34s - 1613.58s |  Even though the GC thread still run loglessly,
1613.58s - 1621.34s |  during the check, it will now acquire the commit mutex lock.
1621.34s - 1625.26s |  The new GC design look like this.
1625.26s - 1628.02s |  During batch request handling, GC sequence
1628.02s - 1631.38s |  will increase both before and after the commit and abort
1631.38s - 1632.50s |  phase.
1632.50s - 1637.14s |  And in the GC thread, it will first run loglessly
1637.14s - 1639.42s |  to store the GC sequence and collect
1639.42s - 1641.58s |  all the expired elements.
1641.58s - 1644.22s |  After that, it will acquire the lock
1644.22s - 1648.46s |  and check if the current GC sequence match the safe one.
1648.46s - 1653.74s |  If they are the same, then the elements will be released.
1653.74s - 1656.62s |  For this normal case, since GC thread does not
1656.62s - 1659.38s |  raise with the batch request, the GC sequence
1659.38s - 1661.34s |  will be the same.
1661.34s - 1668.35s |  And the element can be freed by the GC thread.
1668.35s - 1672.39s |  Next, we check if it still works in the race case.
1672.39s - 1674.59s |  If during the prepare phase, GC thread
1674.59s - 1680.71s |  trigger and store the global GC sequence into transfer object,
1680.71s - 1683.23s |  it will continue to run loglessly
1683.23s - 1693.04s |  to find all the expired element and wait for the mutex lock.
1693.04s - 1694.68s |  At the same time, the main thread
1694.68s - 1696.60s |  step into the commit phase.
1696.60s - 1699.16s |  And some of the elements in the set
1699.16s - 1702.68s |  can be released in this phase.
1702.68s - 1706.16s |  The GC thread will need to wait until the main thread release
1706.16s - 1710.72s |  the mutex lock so it can finally check the safe GC sequence
1710.72s - 1713.88s |  and delete the element.
1713.88s - 1716.48s |  But in this case, since GC sequence
1716.48s - 1719.88s |  is recorded in the prepare phase and we check it
1719.88s - 1723.20s |  after the batch request is done, the GC sequence
1723.20s - 1725.04s |  will be different.
1725.04s - 1729.44s |  So the element deletion will be skipped to avoid double free.
1729.44s - 1732.28s |  Next, let's check the case if GC sequence is
1732.28s - 1736.32s |  recorded in the commit phase.
1736.32s - 1738.88s |  In this case, since GC sequence increase
1738.88s - 1745.56s |  after the commit phase, and the GC thread
1745.56s - 1754.56s |  can only check GC sequence after the commit mutex are locked,
1754.56s - 1758.62s |  this race will also be detected.
1758.62s - 1764.50s |  So to sum up, the new GC design require both the batch request
1764.50s - 1767.78s |  and the GC sequence check to hold the lock.
1767.78s - 1770.98s |  This ensures that even there's a race while collecting
1770.98s - 1774.14s |  the expired element, the check will always
1774.14s - 1780.74s |  happen after the GC sequence has increased.
1780.74s - 1784.50s |  But does the batch request always lock
1784.50s - 1786.66s |  means there's no race?
1786.66s - 1791.98s |  Actually, if you look closely, we will find,
1791.98s - 1798.44s |  well, it's not always locked.
1798.44s - 1800.56s |  To find where it released the lock,
1800.56s - 1804.16s |  let's first talk about the module autoload.
1804.16s - 1805.88s |  During the prepare phase, if there
1805.88s - 1808.00s |  is some expression type in the request
1808.00s - 1811.88s |  is not found during the type resolution,
1811.88s - 1817.00s |  it will instantly abort and try to load the correspondent type
1817.00s - 1821.32s |  module during the end of the abort phase.
1821.32s - 1828.25s |  After that, it will retry the whole batch request again.
1828.25s - 1831.41s |  However, maybe there is some efficiency consideration
1831.41s - 1835.37s |  or to just only prevent that lock before the function
1835.37s - 1839.21s |  try to load the request module.
1839.21s - 1842.69s |  The mutex lock will be released.
1842.69s - 1847.50s |  But could it cause any problem?
1847.50s - 1848.90s |  Back to the diagram.
1848.90s - 1852.10s |  Now there's a little time window in the abort phase
1852.10s - 1854.94s |  that it will not hold the mutex lock.
1854.94s - 1858.58s |  So there's a chance during the abort phase
1858.58s - 1862.38s |  the GC thread kicks in, records the expired elements,
1862.38s - 1864.90s |  and do a GC sequence check.
1864.90s - 1868.78s |  In this case, however, the check will be bypassed.
1868.78s - 1876.94s |  And the GC thread can delete arbitrary expired elements.
1876.94s - 1880.30s |  OK, so now the question is, how do we actually
1880.30s - 1883.62s |  exploit the race?
1883.62s - 1887.38s |  Our exploit plan is, first, we add a set element
1887.38s - 1889.26s |  with a short timeout.
1889.26s - 1891.18s |  And then we trigger module autoload
1891.18s - 1893.70s |  to force it to revert the commit and free
1893.70s - 1895.94s |  the element we just added.
1895.94s - 1904.34s |  And at the same time, we trigger GC to collect that element.
1904.34s - 1907.98s |  Next, module autoload will release the mutex.
1907.98s - 1911.18s |  And we hope that the GC thread will grab it and bypass
1911.18s - 1913.06s |  the check.
1913.06s - 1919.60s |  So as a result, the element we just added will be double free.
1919.60s - 1922.44s |  But in order to trigger double free,
1922.44s - 1926.60s |  there are two time windows we need to enlarge.
1926.60s - 1929.64s |  The first time window is from the abort phase start
1929.64s - 1931.92s |  to the set element released.
1931.92s - 1934.92s |  So the GC thread can recall the expired element
1934.92s - 1939.84s |  before they get a link by the revert procedure.
1939.84s - 1944.44s |  The second time window is from the load module to its end.
1944.44s - 1952.00s |  So the GC thread can grab the lock and bypass the check.
1952.00s - 1954.28s |  For the first one, since the abort phase
1954.28s - 1957.22s |  will revert the operations in a reverse order,
1957.22s - 1960.54s |  we add a bunch of requests after the add set element
1960.54s - 1965.44s |  request to delay the unlink operation.
1965.44s - 1968.84s |  For the second one, we just request multiple unknown type
1968.84s - 1974.58s |  to make module autoload runs longer.
1974.58s - 1978.44s |  And here's the demo.
1978.44s - 1984.99s |  OK, so first we boot our machine and check
1984.99s - 1986.95s |  that URD is a normal user.
1986.95s - 1989.19s |  And then we run the exploit.
1989.19s - 1992.35s |  So here, we will first measure the execution time
1992.35s - 1996.03s |  to set up timing parameter for the race.
1996.03s - 1998.27s |  And after that, we set up the environment
1998.27s - 2002.80s |  to enlarge the race time windows.
2002.80s - 2009.20s |  Then we trigger double free to leak address and control IP.
2009.20s - 2017.77s |  And we got the root shell.
2017.77s - 2021.35s |  Thank you, guys.
2021.35s - 2022.39s |  Great.
2022.39s - 2028.15s |  So now I write the exploit and submit it to Kernel CTF.
2028.15s - 2031.35s |  And this is my Kernel CTF submission.
2031.35s - 2035.99s |  I exploited the LTS instance on Kernel version 6.1.81.
2036.03s - 2040.79s |  But as you can see, it is marked with a dupe in that line.
2040.79s - 2042.95s |  It is because for every LTS slot,
2042.95s - 2047.03s |  only the first zero day or one day exploit will be accepted.
2047.03s - 2049.91s |  And there's someone who also submit
2049.91s - 2056.63s |  a LTS exploit, which beats me by nine seconds.
2056.63s - 2058.91s |  That's too bad.
2058.91s - 2064.17s |  So we have to wait for the slot to reopen.
2064.17s - 2067.73s |  So yes, just wait for about two weeks,
2067.73s - 2070.45s |  and the slot will reopen.
2070.45s - 2073.41s |  Right?
2073.41s - 2075.89s |  Wait until it starts to reopen?
2075.89s - 2077.13s |  Yep.
2077.13s - 2081.89s |  But do you know the nftable will be disabled from April 1st?
2081.89s - 2086.35s |  What?
2086.35s - 2087.95s |  Actually, there's an announcement
2087.95s - 2089.51s |  on Kernel CTF Discord.
2089.51s - 2091.95s |  It says they are going to disable nftables,
2091.95s - 2095.95s |  along with the switch to Kernel version 6.6.
2095.95s - 2099.15s |  It starts from March 15th, but actually, they
2099.15s - 2100.39s |  delay the switch.
2100.39s - 2103.51s |  So it's from April 1st.
2103.51s - 2107.63s |  OK, so what's the date today?
2107.63s - 2109.23s |  It's actually March 22nd.
2112.27s - 2115.15s |  The Kernel CTF slot opens about every two weeks
2115.15s - 2117.07s |  on average, which means I won't be
2117.07s - 2122.35s |  able to exploit it before they disable the nftables.
2122.35s - 2125.55s |  So on my third Kernel CTF attempt,
2125.63s - 2131.32s |  I still could not get a bounty, which is pretty sad.
2131.32s - 2135.40s |  To sum up my journey, first, I have hope.
2135.40s - 2139.52s |  And then I found bug one, a lifetime issue.
2139.52s - 2142.80s |  And it collides with another submission.
2142.80s - 2146.92s |  Then I found the bug two, a how-to-use-one-day.
2146.92s - 2151.88s |  But I used the wrong config, so it's unusable.
2151.88s - 2156.64s |  Then I found the bug three, a locking issue.
2156.66s - 2161.04s |  But I lose the submission race, and nftable will be disabled.
2161.04s - 2163.36s |  So it's killed.
2163.36s - 2165.80s |  However, there's a final plot twist.
2170.84s - 2175.16s |  A few days after, I found there are some changes
2175.16s - 2178.28s |  in the Kernel CTF spreadsheet.
2178.28s - 2181.48s |  The person who previously got ahead of me
2181.48s - 2186.12s |  is disqualified due to a bug collision.
2186.52s - 2189.72s |  So this time, I finally take over the slot
2189.72s - 2194.82s |  and report it to Google.
2194.82s - 2197.30s |  And this month, I got my Kernel CTF bounty
2197.30s - 2201.46s |  from Google, which is my first Google VIP bounty.
2201.46s - 2210.84s |  I'm so proud of myself.
2210.84s - 2211.88s |  Thanks.
2211.88s - 2216.40s |  So well, I think this concludes my Kernel CTF journey.
2216.40s - 2225.53s |  And thank you, guys.
2225.53s - 2226.91s |  Is there any questions?
2226.91s - 2235.80s |  Yeah.
2235.80s - 2237.72s |  If there's any questions, you can come up here
2237.72s - 2238.60s |  to this microphone.
2238.60s - 2257.95s |  Thank you.
2257.95s - 2259.79s |  Thank you.


url: https://www.youtube.com/watch?v=bRj4ipIEmg0
title: DEF CON 32 - Prime Cuts from Hacker History :40 Years of 31337 - Cult of the Dead Cow and Friends
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=bRj4ipIEmg0",
  "title": "DEF CON 32 - Prime Cuts from Hacker History :40 Years of 31337 - Cult of the Dead Cow and Friends",
  "description": "The year is 1984\u2026 Ronald Reagan is President, it is a \u201cNew Mourning in America.\u201d In Texas, a small cabal of malcontents meet in an abandoned slaughterhouse, decorated with heavy metal band posters, satanic iconography, and, most ominously, the skull of a DEAD COW\u2026 As pirated copies of speedmetal and punk music play in the background, these erstwhile revolutionaries speak of their disillusion with The Way Things Are, and their obsession with their new computers. All over America, teens were waking to not just the typical dissatisfaction of adolescence, but the awareness that via these new modes of communication and interaction, they could meet like-minded others, have some illicit fun, and maybe, just maybe, change the goddamn world.\n\n1984 wasn\u2019t the beginning of hacking, but brought perhaps the first real blossoming of the culture. The spread of the personal computer, and the modem, brought the birth of not just cDc, but the Legion of Doom, and 2600 Magazine. 1985 would bring Phrack Magazine, and a true explosion in the written culture, with t-files becoming the currency of the Truly Elite. In this session, members of cDc, 2600, LoD, MoD, and r00t will talk about what made them hackers and phreaks, swap stories, and answer questions posed by Prof. Walter Scheirer of the University of Notre Dame and audience Q&A.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 6899,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.27s - 5.43s | This text was transcribed using whisper model: large-v2

 Um, so, some of you may know me, some of you might not, uh, my name's Death Veggie, I'm
5.43s - 9.51s |  the Minister of Propaganda for the Cult of the Dead Cow, uh, this is my, I don't know
9.51s - 12.55s |  how many DEF CONs, but the first one was DEF CON 3, so we've been around for a little bit
12.55s - 20.19s |  for that, so, uh, the reason I, I proposed this panel is, uh, 2024 is the 40th anniversary
20.19s - 24.19s |  of a lot of sort of like benchmarks in the computer underground and the hacking thing,
24.19s - 28.91s |  so it's, it's, 1984 is when Cult of the Dead Cow was founded, it's when 2600 Magazine
28.91s - 34.83s |  was founded, it's when the Legion of Doom was founded, um, as well as I think, uh, Chaos
34.83s - 40.51s |  Computer Club was founded, um, so, you want to do something to kind of talk about that
40.51s - 45.43s |  early hacker history, so, you know, this panel is really gonna kind of focus on the 80s and
45.43s - 49.71s |  early 90s, cause that's when we are from, and I think it's kind of something that the
49.71s - 55.23s |  stories are, are sort of underrepresented in the history just cause, you know, that,
55.23s - 59.71s |  this is a time when it really was underground and, and sort of, it's not, you know, at that
59.71s - 65.23s |  time sort of, um, hacker was a dirty word, it was, you know, synonymous with, with criminal in
65.23s - 69.55s |  the, uh, in, in the press, et cetera. So I've tried to get together, uh, a group of people
69.55s - 74.55s |  from, um, various different groups including, uh, CDC and LOD, Eric, uh, Emanuel Goldstein of
77.59s - 84.33s |  2600, um, uh, MOD, which, you know, it's, it's pretty, pretty exciting to get, to get, to get
84.33s - 87.73s |  John Thread in here, as well as Tommy D. Catt, who's been around, and the panel will be
87.73s - 92.73s |  moderated by Professor, uh, Shire from Notre Dame, who, uh, wrote a book, uh, A History of
95.11s - 99.07s |  Fake Things on the Internet, available at fine bookstores everywhere, um, that came out in
99.07s - 104.65s |  December. Um, so I'm gonna let him take the, take the mic and do the, the proper
104.65s - 105.45s |  introductions, I guess.
105.45s - 106.51s |  Let's get, let's get everybody on stage.
106.51s - 109.61s |  Go get, come up and, take, take your seats.
109.61s - 114.61s |  They're hiding in the back, I don't know what's going on here. Woo! Let's give it up for the
116.45s - 117.75s |  old school hackers!
117.75s - 128.80s |  One more seat here, and we got, there, we got three here and three there, so there's, oh, you
130.24s - 137.38s |  have seven people, I was thinking, yeah, I, I can count, counting, math.
137.38s - 143.12s |  Alright, let's jump into this. Um, welcome everybody, I think DeathVeggie did a phenomenal
143.14s - 149.78s |  job introducing what this panel is all about, uh, I'm sorry to interrupt, so your talk is not
149.78s - 150.48s |  on the monitor.
150.48s - 150.92s |  Uh oh.
150.92s - 151.62s |  Oh no.
151.62s - 152.82s |  And we wanna fix that.
152.82s - 153.62s |  Okay.
153.62s - 157.06s |  The tech, the tech support crew is gonna pause us.
157.06s - 158.26s |  Talk amongst yourselves.
158.26s - 159.22s |  Yeah.
159.22s - 160.46s |  I can give you a topic.
160.46s - 161.80s |  Take a break.
161.80s - 166.94s |  You know, the, the late Byzantine Empire, how, how much of the, you know, the late Roman
166.94s - 170.10s |  Empire did it carry over and how, versus how much of the Greek, so, so please, you know,
170.10s - 176.12s |  speak amongst yourselves.
176.14s - 177.58s |  It's like a commercial break.
177.58s - 178.74s |  A commercial break, yeah.
178.74s - 179.74s |  What are we advertising?
179.74s - 181.58s |  I don't know, network didn't tell us.
181.58s - 183.28s |  Probably ham.
183.28s - 188.29s |  Just delicious ham, it's made of pigs.
188.29s - 191.43s |  Spam, spam, spam.
191.43s - 194.53s |  I'm gonna tell them you, the real AV techs might be on the stage.
194.53s - 196.93s |  Uh, we're still, they're still sorting out the AV stuff.
196.93s - 198.43s |  What do you mean the real AV techs?
198.43s - 204.57s |  Uh, they're antivirus techs, they come from CrowdStrike.
204.65s - 210.53s |  A question, um, how vetted are these people?
210.53s - 219.24s |  There's a reason that we didn't bring our laptops.
219.24s - 224.28s |  I mean, we could do, well, I guess there's, there's, there's, uh, media to go around with
224.28s - 225.28s |  our introductions.
225.28s - 226.28s |  Um.
226.28s - 228.16s |  Is this going to be on the blooper reel or is this going to be on the.
228.16s - 229.16s |  I don't know.
229.16s - 231.00s |  I mean, maybe we should jump into the other stuff while they're still sorting that out
231.00s - 232.76s |  just because we've only got a limited amount of time.
232.76s - 233.76s |  Yeah, yeah.
233.76s - 235.40s |  We don't want to, yeah, let's, let's get into this.
235.40s - 236.40s |  Woo.
236.40s - 237.40s |  Let's do it.
237.40s - 238.40s |  Okay.
238.60s - 239.60s |  Yeah.
239.60s - 240.60s |  Yeah.
240.60s - 241.60s |  The stimulating conversations about the Byzantine Empire.
241.60s - 242.60s |  You can take that.
242.60s - 243.60s |  Maybe there's going to be a breakout room afterwards.
243.60s - 244.60s |  All right.
244.60s - 245.60s |  Hello everybody.
245.60s - 250.44s |  I am Walter Shire, a professor at the University of Notre Dame, um, and I have a really fun
250.44s - 254.08s |  job because I get to hang out with hackers.
254.08s - 258.96s |  I get to study the history of hacking, which is a fascinating topic and I think we're all
258.96s - 261.92s |  here because we want to learn something about it.
261.92s - 262.92s |  Yes.
262.92s - 263.92s |  There we go.
263.92s - 264.92s |  Got it.
264.92s - 265.92s |  Woo.
265.92s - 266.92s |  We got the AV working right here.
266.92s - 267.92s |  Yeah.
268.44s - 269.44s |  No, no.
269.44s - 270.44s |  It's just on.
270.44s - 271.44s |  I know.
271.44s - 272.44s |  It's on his screen.
272.44s - 273.44s |  Woo.
273.44s - 274.44s |  Okay.
274.44s - 275.44s |  Everybody brought their opera glasses, right?
275.44s - 276.44s |  All right.
276.44s - 277.44s |  Wow.
277.44s - 278.44s |  All right.
278.44s - 279.44s |  We're just going to keep going because this could take the rest of the panel, uh, to debug.
279.44s - 286.28s |  Um, a big part of my life as a technologist has been inspired by the six folks who are
286.28s - 292.16s |  up on this stage, uh, and I thought it would be really fun to just be in conversation with
292.16s - 297.20s |  them, uh, to try to understand where all this came from, how it has brought us here to this
297.20s - 302.72s |  moment at Defcon and probably our private lives, our professional careers, social lives,
302.72s - 303.72s |  right?
303.72s - 304.72s |  Is, is all wrapped up in hacking, right?
304.72s - 305.84s |  We'd love this stuff.
305.84s - 307.20s |  And where is it all going?
307.20s - 312.76s |  Can the past really help us understand where technology is going and perhaps fix a lot
312.76s - 317.56s |  of the annoying problems out there on the internet, uh, that we're all sort of concerned
317.56s - 318.56s |  about.
318.56s - 322.72s |  So I think it's gonna be a really fun panel and to begin, let's just jump in and do our
322.72s - 323.72s |  introduction.
323.72s - 326.76s |  So I'm going to start all the way here on my left with X.
326.84s - 329.96s |  So everybody, just, I want to know your origin story, right?
329.96s - 334.36s |  Let the audience know how you got into this, um, and where is it gone in your own life?
334.36s - 336.04s |  Is the mic good?
336.04s - 337.04s |  Yeah.
337.04s - 338.04s |  Alright.
338.04s - 344.00s |  Um, so I was from, I'm from Oak Ridge, Tennessee, uh, in East Tennessee that's, there was a
344.00s - 349.36s |  city created to basically do the nuclear testing that, to build the atomic bomb.
349.36s - 354.44s |  So the city was created, there was three or four, there's a national lab, uh, three or
354.44s - 361.76s |  four other labs and my father was a, uh, computer technician at one of the national
361.76s - 363.72s |  security complexes.
363.72s - 369.08s |  So most of the city, uh, everybody I grew up with, their, their parents were in, in
369.08s - 370.08s |  the government.
370.08s - 371.08s |  Got it.
371.08s - 372.08s |  Got it.
372.08s - 373.08s |  Yes.
373.08s - 374.08s |  Excellent.
374.08s - 375.08s |  Woo.
375.08s - 376.08s |  Thank you.
376.08s - 377.08s |  Thank you very much.
377.08s - 378.08s |  I don't know what's on the screen.
378.08s - 379.08s |  To everybody who's endeavored.
379.08s - 380.08s |  Yeah.
380.08s - 383.00s |  So everybody I grew up with, their, their parents were working for the national security
383.00s - 385.80s |  complexes, um, the national lab.
385.80s - 389.72s |  So everybody, there was a lot of smart people that I grew up with in high school.
389.72s - 393.40s |  So, um, my dad brought home a computer in 1985.
393.40s - 394.40s |  It was a compact luggable.
394.40s - 399.16s |  It was about 30 pounds with the, the tiny little seven inch screen and the fold out
399.16s - 400.16s |  keyboard.
400.16s - 401.16s |  I still have it in my attic.
401.16s - 402.16s |  Uh, it does not work.
402.16s - 406.96s |  It needs a new power supply, um, two floppy disks, no hard drive.
406.96s - 413.36s |  Um, so my dad brought it home with a Hayes 1200 bod smart mode and maybe so he could
413.36s - 418.56s |  do non non-security work at home, non non-confidential work at home.
418.56s - 421.28s |  Um, so he, he did give me access to it.
421.28s - 424.44s |  I, I didn't know what to do with the modem.
424.44s - 429.08s |  You know, he taught me basic, uh, so I would play games and, you know, control break out
429.08s - 430.52s |  of the finest language.
430.52s - 431.52s |  Yeah.
431.52s - 435.80s |  You can control break out of games to see what the code is doing.
435.80s - 441.48s |  Um, that's almost the extent of my programming, uh, ability.
441.48s - 447.48s |  But um, so before I was old enough to drive, I used to ride my bike down to radio shack,
447.48s - 451.84s |  which was a couple of blocks away and just hang out at radio shack with a couple of older
451.84s - 456.24s |  guys who were computer guys into the bulletin board scene and stuff.
456.24s - 459.36s |  And so they finally probably got annoyed with me being there.
459.52s - 461.80s |  Um, they gave, they gave me a number to call.
461.80s - 464.80s |  I called and got into the bulletin board scene.
464.80s - 468.96s |  Um, I was in love with the idea of being a hacker after seeing war games.
468.96s - 472.96s |  Um, but I, I had no, no, no way to get there.
472.96s - 476.32s |  Um, I'll make it a little bit shorter.
476.32s - 481.40s |  I finally found a bulletin board where I was on enough that somebody gave me access to
481.40s - 485.48s |  the secret section codes and wares, uh, mostly wares.
485.48s - 488.96s |  But um, there were frack magazine copies in there.
488.96s - 493.16s |  And once I started reading those, I was, I was in love with the idea of, I wanted to
493.16s - 494.16s |  be this.
494.16s - 495.16s |  I wanted to be a hacker.
495.16s - 499.60s |  I wanted to, uh, to, to learn what they were talking about.
499.60s - 503.60s |  Um, how much time are we getting for the introductions?
503.60s - 504.60s |  Keep going.
504.60s - 505.60s |  Keep going.
505.60s - 506.60s |  Okay.
506.60s - 512.20s |  So, uh, then, you know, graduated high school, I, uh, started college at the university of
512.20s - 515.96s |  Tennessee in Chattanooga where I got my first Unix account.
515.96s - 521.80s |  They gave all the students Unix accounts, um, for email.
521.80s - 527.16s |  Um, and from reading and seeing what people were doing, I saw that several people were
527.16s - 528.52s |  using IRC.
528.52s - 533.84s |  I got on IRC, I joined pound wares because I was, I was in, I wanted to play games for
533.84s - 534.84s |  free basically.
534.84s - 538.44s |  I, Tommy D. Cat was on there.
538.44s - 541.04s |  Um, uh, uh, who is of him?
541.04s - 546.44s |  He was on pound hack, joined pound hack and met, uh, some of the best friends I've had
546.44s - 547.44s |  in my life.
547.44s - 548.44s |  Thanks.
548.44s - 557.35s |  Before you go, I want to ask, like, uh, I would like to take a picture of the crowd.
557.35s - 558.35s |  So I'm going to do that.
558.35s - 563.79s |  And anybody who doesn't, you know, who doesn't wear your face, like blur your face just live.
563.79s - 564.79s |  So thank you very much.
564.79s - 570.07s |  I'm going to take one from this side and one from that side.
570.07s - 571.07s |  Thank you.
571.07s - 572.07s |  All right.
573.07s - 574.07s |  All right.
574.07s - 576.07s |  Manuel, you're up next.
576.07s - 584.43s |  Hey, um, well, I'm a manual Goldstein, um, a pen name that I coined 40 years ago, 1984,
584.43s - 586.87s |  a name that's from the book, 1984.
586.87s - 590.71s |  There's a lot of synchronicity here that kind of scares me actually, because I don't understand
590.71s - 591.71s |  how it all happened.
591.71s - 598.63s |  So, so, um, um, in, in tune, um, but yeah, 1984 was when a manual Goldstein technically
598.63s - 600.95s |  was born as a handle.
600.95s - 606.07s |  Um, but my, um, interest in technology started, I, well, I mean, I've always been interested
606.07s - 611.83s |  in technology, however limited I had access to grew up in a one parent household.
611.83s - 616.59s |  We never had much, but you know, we had a phone and I would play around with the phone
616.59s - 617.59s |  all the time.
617.59s - 619.39s |  Rotary dial phone.
619.39s - 620.71s |  People know what rotary dial phones are.
620.71s - 621.71s |  Okay.
621.71s - 622.71s |  Good.
622.71s - 623.71s |  Okay.
623.71s - 624.71s |  Sometimes I talk to crowds and they have no idea what I'm talking about.
624.71s - 629.31s |  Um, if you ever want to have some fun, get some teenagers, tell them to dial a number
629.31s - 630.31s |  on a rotary phone.
630.67s - 634.07s |  They don't, they don't know how to, how far they supposed to go with their finger.
634.07s - 636.63s |  They don't know if they're supposed to push it, they don't know if it's supposed to lift
636.63s - 637.63s |  up the receiver.
637.63s - 638.87s |  It's, it's a lot of fun.
638.87s - 646.39s |  Um, but yeah, so that was my, um, the extent of my, um, uh, access to technology until
646.39s - 652.11s |  my senior year of high school, when I heard this, this sound coming from this room, uh,
652.11s - 657.87s |  that had computer class in it, um, somebody was strangling a dolphin.
657.95s - 661.27s |  Well, it was just a weird, like kind of high pitched noise.
661.27s - 667.67s |  Turned out it was, um, uh, deck riders, uh, 300 bar deck riders, high speed deck riders.
667.67s - 673.07s |  Um, they were connected to, um, uh, a computer system that the entire school district was
673.07s - 674.59s |  connected to far away.
674.59s - 678.23s |  Uh, and all these people were typing away and I was fascinated by it, you know, that
678.23s - 680.87s |  you could type something and something would type back at you.
680.87s - 681.99s |  Uh, that was new.
681.99s - 683.99s |  That was, that was alien.
683.99s - 689.27s |  And, uh, my high school, Ward Melville High School in Setauket, New York, um, we had these
689.27s - 691.27s |  deck riders that other school districts didn't have.
691.27s - 694.19s |  They had shitty 110 baud connections.
694.19s - 695.83s |  We had the 300 baud connection.
695.83s - 699.95s |  Um, and so, you know, I just got more and more interested in that and, uh, started playing
699.95s - 700.95s |  around and never took a course.
700.95s - 705.47s |  To this day, I still have never taken a computer course, um, and which is weird.
705.47s - 710.35s |  Um, but, um, basically, uh, I'd stay after school and that's when the games would open
710.35s - 711.35s |  up.
711.35s - 714.47s |  You know, Star Trek and One Piece and all kinds of fun things like that.
714.47s - 719.15s |  Um, and, uh, basically that led to my interest in college.
719.15s - 723.67s |  Went to the State University of New York at Stony Brook, uh, and, um, well, I can tell
723.67s - 727.67s |  the story later about how I got the FBI to raid them, but that's, that's, that's gonna
727.67s - 729.39s |  take longer than a couple of minutes.
729.39s - 734.19s |  But basically, um, uh, Stony Brook was a place where I was able to, um, uh, meet like-minded
734.19s - 739.51s |  people, uh, expand, uh, my mind in, in many ways.
739.67s - 744.75s |  Uh, but mostly in, in just learning and being exposed to different, uh, perspectives.
744.75s - 749.03s |  Um, and I was an English major in a school that's mostly known for engineering.
749.03s - 751.51s |  Uh, so that kind of set me apart.
751.51s - 756.63s |  I like to write, I like to, um, uh, collate, worked for the, uh, campus, two campus newspapers.
756.63s - 763.35s |  Um, but it was the BBS scene, um, when, um, I had access to a modem.
763.35s - 765.91s |  Um, well, I should, I should explain.
765.91s - 767.47s |  I worked for the campus radio station.
767.47s - 774.15s |  Our chief engineer bought an H89, Heathcote H89, uh, and, um, we used that to connect
774.15s - 775.39s |  to BBSs.
775.39s - 780.43s |  And I found those to be fascinating, uh, bulletin board systems where these, these methods of
780.43s - 785.87s |  just connecting to people all throughout the country, uh, you could only have one person
785.87s - 786.87s |  on at a time.
786.87s - 790.95s |  So most of the time it was dealing with busy signals and waiting for them to go away so
790.95s - 791.95s |  you could connect.
791.95s - 794.35s |  And I think we were up to 1,200 bought at that time.
794.35s - 798.43s |  Uh, and by connecting to all these different bulletin boards, I was able to make friends
798.43s - 799.67s |  all over the place.
799.67s - 804.07s |  Um, how I was able to connect to long distance ones is also a different story.
804.07s - 809.47s |  Um, but basically I, the, the hacker and, and, and freak, phone freak bulletin boards
809.47s - 812.67s |  had these great stories, amazing stories.
812.67s - 814.63s |  Um, and I wanted to share those stories.
814.63s - 818.83s |  I wanted other people to read them because they were just so amazing about people going
818.83s - 824.11s |  to their central office to trash and get printouts and log in to the Cosmos system
824.11s - 830.63s |  and, and, and just all kinds of hacker adventures that I just knew the public would appreciate
830.63s - 832.79s |  if presented in, in the right manner.
832.79s - 837.51s |  Because believe it or not, back then in the early to mid eighties, hackers were being
837.51s - 838.51s |  demonized.
838.51s - 839.51s |  Yeah.
839.51s - 840.51s |  Imagine that.
840.51s - 846.99s |  Um, so people had a, a misconception and I figured all they had to do was hear some stories
847.15s - 850.67s |  and maybe they would, they would see another, um, uh, aspect to them.
850.67s - 854.87s |  Well, obviously that didn't happen, uh, but we did get a whole lot more hackers, a whole
854.87s - 858.39s |  lot more people that wanted in on this, on this magical world.
858.39s - 861.99s |  Uh, that's basically how the idea for 2600 got started.
861.99s - 866.19s |  Uh, what if we print this out and, and, and mail it to people?
866.19s - 867.59s |  Let's see if that works.
867.59s - 875.19s |  And basically, uh, we posted some, some, um, um, uh, I guess, uh, files, uh, G files or,
875.39s - 880.39s |  um, announcements on bulletin boards, um, send us an envelope and we'll send you an,
880.39s - 883.99s |  uh, an issue of a magazine in January of 1984.
883.99s - 888.39s |  And that's how the first issue went out to a bunch of people that just sent us an envelope.
888.39s - 901.44s |  Uh, and, um, uh, the rest is pretty much history, but that's how it started.
901.44s - 905.88s |  I think, uh, you know, I started out, um, kind of similar to, to X in some ways, but
905.88s - 909.24s |  although earlier, uh, you know, I had a dad that had worked at the computer industry,
909.44s - 912.72s |  uh, and a mom who had been, you know, working in a computer lab in the seventies.
912.72s - 915.92s |  And as a kid, I remember, you know, going and playing at the computer lab and with the,
915.92s - 917.00s |  with the punch cards and stuff.
917.00s - 920.88s |  But, you know, we got a computer in 1980, like a, uh, my dad built one from a kit, a
920.88s - 926.40s |  Sinclair ZX 80 and similar to X, like, you know, I was, uh, working in basic typing and
926.40s - 930.52s |  stuff like that anyway, fast forward to like kind of the mid eighties, my dad brought home
930.52s - 933.84s |  a modem, you know, I wasn't really doing anything with it at that time.
933.84s - 937.32s |  Maybe calling a couple, you know, uh, my friend's local board.
937.80s - 944.72s |  Um, in 1986, uh, my family went on a vacation to, uh, California to, I grew up outside of
944.72s - 950.40s |  Boston, um, and, uh, to visit my cousins who were in Silicon Valley.
950.68s - 954.00s |  And they, they sent me home with a, with a floppy disk that was full of text files.
954.00s - 955.00s |  So it's 1986.
955.00s - 958.92s |  This, this, uh, disk had cult of the dead cow files on it.
958.92s - 961.36s |  It had frack magazine, number three.
961.60s - 965.24s |  It had files from a group called, um, anarchy Inc.
965.32s - 969.68s |  It had, um, I think, uh, one of the LOD technical journals, et cetera.
970.08s - 973.52s |  And it sort of was like, Oh man, there's this, all this other cool stuff going out
973.52s - 973.64s |  there.
973.64s - 975.32s |  And I started to call other BBSs.
975.84s - 978.08s |  Um, you know, they would have a list of numbers at the bottom.
978.08s - 981.40s |  So I'd start calling BBSs in other parts of the country, talking to people.
981.76s - 986.12s |  And I realized that, you know, I had, I was growing up in like this, like a relatively
986.12s - 991.12s |  small, relatively conservative town in the outskirts of Boston where I was the weird
991.12s - 991.44s |  kid.
991.88s - 995.00s |  And like, so being on BBS is like, Oh, holy shit.
995.00s - 996.60s |  There are other people like me out there.
997.00s - 1000.28s |  And it's what, you know, my grandmother used to affectionately refer to as smarty
1000.28s - 1000.80s |  weirdos.
1000.84s - 1002.72s |  She's like, you and your friends are smarty weirdos.
1003.12s - 1004.92s |  It's like, which I think is fair.
1004.92s - 1012.44s |  You know, she didn't have the language for neuro atypical, but, um, so, uh, you
1012.44s - 1015.12s |  know, I called these things, meeting people all over and learning stuff.
1015.12s - 1018.48s |  And then there was the day that my parents got a $600 phone bill.
1019.08s - 1024.00s |  And, um, yeah, they sat me down and my dad was like, this will not happen again.
1024.32s - 1027.68s |  I was like, okay, well, I'm not going to stop talking to my friends in Sweden.
1028.00s - 1030.08s |  So, uh, how do I do this for free?
1030.12s - 1033.12s |  And, you know, so that led into like learning how to make, you know, phone,
1033.16s - 1037.20s |  phone calls for free, either, you know, uh, war dialing, uh, sorry, codes or
1037.20s - 1038.68s |  wardrobe dialing locally.
1039.08s - 1042.80s |  And I love to find what we call the global out dial modems, which was basically
1042.80s - 1046.24s |  businesses for their own people would have like, okay, you dial in a local number.
1046.48s - 1048.52s |  Then there's just a modem that will allow you to call anywhere.
1048.76s - 1051.08s |  And a lot of times he's had no security on them at all.
1051.08s - 1055.04s |  Cause there wasn't really a concept of that at the time, or it was just like a
1055.04s - 1056.32s |  default password or something like that.
1056.32s - 1058.96s |  So then I could call whatever I want with no, never get a bill.
1059.44s - 1064.28s |  Um, In the, you know, I also started working with, uh, you know, talking to
1064.28s - 1067.60s |  other people like into the culture that had cow, I was eventually invited in
1067.60s - 1071.88s |  cause I was, uh, um, setting up, uh, Alliance teleconferences, which were.
1072.88s - 1077.16s |  Just, it was teleconferencing, but at that time teleconferencing cost
1077.16s - 1078.68s |  like multiple dollars a minute.
1078.80s - 1081.88s |  Like, and so, so I was just setting these up for free on hacked accounts.
1081.96s - 1082.28s |  Sorry.
1082.28s - 1085.60s |  I mean, allegedly setting these up for free on allegedly hacked
1085.60s - 1086.60s |  account in 40 years, man.
1088.32s - 1095.84s |  Um, and, uh, eventually they, uh, invited me to join and I guess, you know, somehow
1095.84s - 1097.52s |  that was over 30 years ago.
1097.72s - 1099.00s |  Time is fucking weird.
1099.56s - 1101.08s |  Um, but yeah, I don't know.
1101.20s - 1108.78s |  So Patrick,
1111.86s - 1118.46s |  my, uh, my, my introduction to computers sort of happened in the late seventies.
1118.46s - 1122.82s |  My father was a physicist who was working at the national center for atmospheric
1122.82s - 1127.42s |  research, and they had one of the first craze super computers.
1127.42s - 1130.70s |  And, uh, back then it was really exciting.
1130.70s - 1133.98s |  It had its own room, this cooling system all around it.
1134.74s - 1137.74s |  Kind of like an orange hexagon shaped tower.
1137.74s - 1142.70s |  And, uh, my, my father, uh, taught me to program this incredible language
1142.70s - 1152.62s |  called Fortran 77 that you'd feed it on punch cards and, uh, that, that led
1152.62s - 1158.30s |  subsequently to, to me getting an Apple two, no plus, and you could get the 16
1158.30s - 1161.82s |  K Ram card and get, you know, solder in a shift key mod.
1161.82s - 1163.46s |  So you had lowercase on it.
1163.50s - 1166.82s |  And, uh, you know, it was amazing stuff.
1166.82s - 1172.30s |  And then, uh, after that was, I think came out with a 5.25 inch disk drive.
1172.30s - 1175.38s |  So you didn't have to use cassette tape anymore to sort of things.
1176.18s - 1181.06s |  And in the very beginning, uh, there were like these different gatherings
1181.10s - 1190.46s |  of Norway, typical individuals who had gathered together to play with computers.
1190.46s - 1196.06s |  And, uh, it was in person and that eventually led to, uh, being online and
1196.06s - 1197.94s |  coming in contact with more people.
1197.94s - 1203.46s |  And there was the piracy scene of getting software because it's like, well, I'm,
1203.50s - 1207.90s |  I'm a kid, I don't have like all this crazy money to buy this software.
1207.90s - 1209.10s |  I'm not really going to use.
1209.86s - 1216.62s |  And what it turned into was the most interesting thing about 99% of all
1216.66s - 1218.90s |  software other than collecting it.
1218.90s - 1224.06s |  Cause she got them all is very important, especially if they're zero day old wares.
1224.82s - 1228.94s |  Um, but it was just like the protection scheme.
1228.98s - 1233.50s |  What did you guys do and pour into this to try to prevent people from copying it?
1233.54s - 1239.54s |  And then all of that went online with modems at the lightning fast speed of
1239.54s - 1245.38s |  like 300 Baud, which, uh, you know, increased exponentially and as has been
1245.38s - 1252.10s |  mentioned, I got like, my mom got her first like $2,000 phone bill and it's
1252.10s - 1258.70s |  just put the fuck is this like, well, I'm not going to stop calling my
1258.70s - 1260.50s |  friends all over the world.
1260.86s - 1264.06s |  So how does the phone system work exactly?
1264.06s - 1266.06s |  And how are all these things connected?
1266.06s - 1269.18s |  Which led to an interest in, in freaking.
1269.18s - 1273.62s |  And by that time, uh, I was living in New York city, hanging out in the Lower East
1273.62s - 1274.14s |  side.
1274.14s - 1278.78s |  And, uh, there was this thing called youth international party lines, which was
1278.78s - 1282.58s |  actually started by, uh, you know, one of the people was Abby Hoffman.
1282.58s - 1284.90s |  It was the whole countercultural movement.
1284.90s - 1286.94s |  It was left of the left back then.
1287.42s - 1292.02s |  And, uh, it metamorphosed into tap and there were the tap meetings on the Lower
1292.02s - 1292.74s |  East side.
1293.26s - 1299.38s |  And, uh, we got together and do a lot of interesting things with, uh, the phone
1299.38s - 1303.50s |  company computers because they really had a fascinating network.
1303.50s - 1307.58s |  I mean, cosmos is, you know, Unix and uppercase, and it has a lot of
1307.58s - 1310.66s |  undocumented commands that you're not supposed to know about.
1311.62s - 1317.82s |  And, uh, that whole culture of being online and connecting with people, uh,
1317.82s - 1321.62s |  sort of led to the formation of these groups who would work together.
1322.10s - 1327.74s |  And that, that was the beginning of, uh, well, LOD, uh, there was a previous
1327.74s - 1333.10s |  group called nights of shadow that kind of self-destructed and, uh, there,
1333.10s - 1337.78s |  there's this person who may even be here somewhere at this conference.
1337.78s - 1341.22s |  I don't know who, who, who's the founder of the legion of doom.
1341.82s - 1351.26s |  And, uh, we, we, we basically, we basically, you got together people who
1351.26s - 1353.34s |  were good at different skill sets.
1353.34s - 1356.66s |  There was the people who were good with the phone systems, people who are good
1356.66s - 1361.42s |  at hacking and actual coding and programming and the social engineers.
1361.74s - 1366.66s |  And together you would all pull your talents together to cause greater
1366.66s - 1368.62s |  chaos than you could buy yourself.
1371.14s - 1379.06s |  So that, that was, uh, you know, the eighties into the very early nineties
1379.06s - 1385.18s |  where, uh, my, my friend and, uh, another person from LOD, uh, Bruce
1385.18s - 1391.30s |  Fancher and I started Mindvox and Mindvox was the first internet
1391.30s - 1393.54s |  access provider in New York city.
1394.02s - 1397.62s |  This was, uh, we started the company in 1991.
1397.66s - 1403.90s |  We went live in 1992 and suddenly everybody on earth had to get on
1403.90s - 1405.46s |  this thing called the internet.
1406.70s - 1410.42s |  That was, uh, it was a tremendous amount of fun.
1410.46s - 1412.34s |  It was complete chaos.
1412.42s - 1418.86s |  And I'm very grateful to have, uh, lived through, uh, this timeline that most of
1418.86s - 1420.74s |  us sitting here right now share.
1421.14s - 1422.34s |  Thank you very much.
1428.62s - 1430.30s |  Tommy DeCatt, you are up next.
1430.54s - 1430.90s |  Yeah.
1431.14s - 1432.26s |  Hello, Defcon.
1432.86s - 1436.26s |  Hey, been coming here for a while.
1436.30s - 1438.42s |  Uh, let me, uh, give you a little background.
1438.42s - 1442.58s |  Does it, uh, it's not too different from a couple of the, the people over there.
1442.58s - 1447.34s |  I guess, uh, Walter, he kind of described us as the new wave coming into the scene.
1447.78s - 1455.30s |  Um, 1983, I was 13 years old and, uh, I had a Commodore 64 at that time.
1455.30s - 1458.26s |  I kind of liked games, uh, and my dad got a modem.
1458.82s - 1462.42s |  So the problem was that modem wasn't for a Commodore 64.
1462.46s - 1464.46s |  It was for a CPM based system.
1464.46s - 1471.42s |  So basically I needed to, to learn how to control that modem in a, in, in, in
1472.18s - 1476.42s |  basically on the CDN CPN system, I had to reverse engineer the drivers on
1476.46s - 1478.46s |  that to, to write my own bulletin board software.
1478.46s - 1481.42s |  So I could get people to call me to get me where it's right.
1481.86s - 1485.74s |  Um, eventually I did get, get a modem for that Commodore 64.
1486.02s - 1489.58s |  Um, but also, you know, I wanted more games for that.
1489.58s - 1494.98s |  So what I found the, the, the currency for getting games, uh, you could get codes too.
1494.98s - 1498.30s |  You could, uh, you could call long distance for free.
1498.30s - 1500.22s |  There's all kinds of neat things you could get to.
1500.22s - 1505.66s |  So I kind of discovered the world of, uh, freaking, I guess, uh, you could
1505.66s - 1512.78s |  call me a co kitty at that point for, uh, whatnot, but, uh, you know, as, as I
1512.78s - 1517.62s |  started learning about, uh, access to things, you know, that, that became kind
1517.62s - 1522.98s |  of addicting, uh, there were toys out there that I wanted to get into, there
1522.98s - 1527.18s |  were games out there, but mostly I started learning about other computers,
1527.18s - 1532.42s |  other systems, and it just kind of started, uh, creating a bit of a thirst
1532.42s - 1533.02s |  for knowledge.
1533.02s - 1539.66s |  So, uh, a lot of the things we did back in the day, I would say is, is, uh,
1539.66s - 1541.78s |  Gear Dad getting access to these things.
1541.78s - 1545.02s |  I mean, I'm wearing this little thing that, uh, you know, emulates a system
1545.02s - 1549.70s |  that came out in 2001 that plays games so much cooler than, you know, all the,
1549.70s - 1553.58s |  the hoops I, I jumped through to get the games for the system I had at that time.
1554.02s - 1559.46s |  But, uh, as, as, you know, reaching out and, and, uh, finding people out there
1559.50s - 1563.58s |  kind of similar to me, I discovered there were communities or, you know, you
1563.58s - 1565.10s |  didn't have to go at this alone.
1565.50s - 1570.90s |  So, uh, reaching out to the, the bulletin board systems in the area, uh, I
1570.90s - 1575.38s |  discovered, I think it was a metal shop, uh, was one of the first metal shop AE.
1575.38s - 1575.58s |  Yeah.
1575.58s - 1579.14s |  One of the first, uh, big boards I got into and started learning about the scene
1579.14s - 1583.22s |  and that's where I learned, uh, a lot of those, uh, kids met up, uh, at this
1583.22s - 1583.62s |  place.
1583.62s - 1589.22s |  Uh, I, I lived in Midwest at the time and there's a, a Galleria mall in St.
1589.22s - 1592.46s |  Louis that they had what they call 2,600 meetings.
1592.46s - 1597.10s |  So I started showing up there, met some like-minded folks, traded games and
1597.10s - 1600.06s |  whatnot, and they started telling me, well, you know, this is actually about
1600.06s - 1600.82s |  this magazine.
1601.22s - 1606.54s |  So that's kind of where I saw, uh, Emmanuel's work, uh, come in, in there
1606.54s - 1611.30s |  and that, that started lighting a path, you know, so it's all about the access.
1611.30s - 1614.78s |  And I started reading about other people who did things, you know, maybe it's not
1614.78s - 1620.98s |  the most exquisite stuff, uh, or hacks, but people are showing that they're
1621.74s - 1623.02s |  curious about things.
1623.54s - 1626.18s |  So that really engaged my interest.
1626.22s - 1632.86s |  Uh, I started, uh, talking to, uh, there's a, a guy Sigmund, uh, who had,
1632.86s - 1635.30s |  uh, Rosetta news was a bookstore.
1635.30s - 1638.22s |  And he said, you know, if you like that magazine, maybe you'll want to take a
1638.22s - 1642.38s |  look, look at this, uh, 411 blacklisted, take a look at those things.
1642.42s - 1646.38s |  And it started, you know, expanding my mind, reaching out to other things.
1646.38s - 1649.02s |  And there are other communities out there too.
1649.34s - 1655.34s |  Um, where the, the BBS scene is, uh, uh, originally like the, the, the
1655.34s - 1660.18s |  wares and, uh, whatnot, people were really private, but there's some other
1660.18s - 1663.82s |  groups that really started reaching out socially and connecting.
1664.22s - 1670.26s |  Um, I saw, uh, I guess, uh, you know, talking about links you find on a
1670.26s - 1674.50s |  bulletin boards to other boards around the system, requiring access to get out
1674.50s - 1678.62s |  their codes, uh, figuring out how to freak blue boxing, whatever techniques
1678.62s - 1680.42s |  you need to, to, to reach out there.
1680.70s - 1683.70s |  But their, their communities are building around that time in the mid
1683.70s - 1685.34s |  eighties, uh, early eighties.
1685.62s - 1688.62s |  Uh, there's mind mocks there, there's the well and whatnot.
1688.90s - 1692.50s |  Uh, there's a system called the versatile, uh, where somebody take an
1692.50s - 1695.54s |  Apple to computer and just load it up with modems, but those people
1695.54s - 1696.74s |  could talk to each other.
1697.18s - 1703.30s |  Uh, that started building up into, to other, uh, interconnected systems.
1703.58s - 1709.70s |  I think bitnets, uh, was the, the first real major interconnected network, uh,
1709.70s - 1713.42s |  other than, you know, like, uh, telling it or whatever that was for a research
1713.42s - 1718.50s |  purpose, but they had a, a, a chat program on there where if you had an
1718.50s - 1724.06s |  account on a bitnet computer, you could tell relay at like CUNY VM or some
1724.06s - 1728.42s |  other, uh, system that had a relay host on it and it would connect you with
1728.42s - 1730.34s |  other people that were trying to talk to relay.
1730.38s - 1735.30s |  That was the first real chat system I saw on a, on a network system.
1735.86s - 1741.82s |  And then in 1989, Yarkel or can there, or, or I can't pronounce the name.
1741.82s - 1742.26s |  I'm sorry.
1742.50s - 1748.26s |  Um, invented IRC and that was internet relay chat.
1748.26s - 1752.38s |  That was based on the, the bitnet, uh, client that came before that.
1752.38s - 1755.18s |  So I, I found that really interesting.
1755.98s - 1762.50s |  Um, reaching out, talking to people, uh, first joined up plus wares, I believe,
1762.54s - 1769.10s |  uh, in 1989 and, uh, the channels at that time had a plus, not a pound symbol
1769.10s - 1771.62s |  in front of them for, you know, whatever reason there, there've been
1771.62s - 1773.38s |  iterations over, uh, the years.
1773.82s - 1780.94s |  But, uh, yeah, the first person I, I saw on IRC in November, 1989, I think was
1780.94s - 1786.02s |  guns, uh, guns was a girl from the university of Illinois, uh, Champaign
1786.02s - 1790.38s |  Urbana, and just a, a, a little shout out for that.
1790.66s - 1794.90s |  Um, shortly after that, so yeah, I met a girl first thing on it.
1797.90s - 1798.22s |  Yeah.
1798.38s - 1802.74s |  Shortly after that, you know, look at plus hack, uh, saw some people on there,
1802.74s - 1806.46s |  but, uh, mostly with IRC, I saw there's a opportunity to kind of
1806.46s - 1808.02s |  rebrand myself a little bit too.
1808.50s - 1812.10s |  If you put in a nickname, you're limited to nine characters and that didn't
1812.10s - 1815.58s |  really fit the, the nicknames that are, you know, still undisclosed to this
1815.58s - 1818.22s |  day of, of what I used before that point.
1818.22s - 1820.02s |  But, you know, I kind of rebranded myself.
1820.02s - 1822.94s |  He was like, I'm not necessarily a wares dude anymore.
1823.14s - 1824.10s |  I'm just a script kiddie.
1824.10s - 1824.82s |  That's a lot better.
1825.18s - 1831.34s |  Um, but what I, I saw is there's a currency, uh, between wares and hack.
1831.66s - 1832.78s |  You could take those codes.
1832.78s - 1836.58s |  You could take those wares, take those techniques to get into systems and
1836.62s - 1839.54s |  you could kind of enable the communities between.
1839.54s - 1844.02s |  So, uh, one of the things I did in the early nineties, I guess, is kind of
1844.34s - 1847.02s |  start creating that bridge between communities.
1847.42s - 1854.54s |  Um, and I did that by, uh, creating a couple of bots that set on those channels.
1854.90s - 1856.86s |  Uh, there's hat cat and where's cat.
1857.70s - 1861.42s |  And basically they maintain the peace through, uh, violence.
1861.70s - 1869.22s |  So, um, the, but the, what that did is it set me in a position where, uh, IRC
1869.22s - 1871.50s |  was kind of where everybody was popping up.
1871.50s - 1875.50s |  Anybody was, anybody would try to pop up in that area and I would see them come up.
1875.50s - 1880.22s |  So what was interesting is I saw a lot of people, you know, both on the stage
1880.22s - 1884.46s |  and in this room, you know, literally grow up through, through IRC.
1884.46s - 1886.14s |  And that was, that was kind of special.
1886.14s - 1890.98s |  And this community is really built in a way that back then I didn't really expect.
1894.22s - 1896.78s |  It's just, I look out here, it's just amazing.
1898.34s - 1898.86s |  All right.
1898.90s - 1902.10s |  And last but not least, the one and only John Threat.
1902.50s - 1903.30s |  Yo, what's up?
1904.06s - 1904.42s |  I am.
1907.14s - 1907.86s |  That's kind of you.
1907.90s - 1912.78s |  Uh, one question I have is that first of all, just before I get started, uh, yo,
1912.78s - 1916.14s |  you guys sure you weren't calling sex lines to run up those bills, man?
1916.58s - 1917.66s |  You could tell me, bro.
1919.90s - 1922.06s |  So where should I start?
1922.10s - 1922.42s |  All right.
1922.82s - 1923.62s |  What was the question?
1924.54s - 1925.98s |  What is your origin story?
1926.94s - 1928.02s |  How did you become a hacker?
1928.90s - 1929.30s |  All right.
1929.30s - 1931.02s |  So, uh, yeah.
1931.02s - 1932.90s |  So I'm from Brooklyn, Brownsville.
1932.90s - 1934.70s |  Anybody here from Brooklyn, Brownsville?
1935.98s - 1936.62s |  Oh, really?
1936.66s - 1937.54s |  It's fucking quiet.
1937.74s - 1938.10s |  All right.
1940.10s - 1941.22s |  Before we get started.
1941.50s - 1941.82s |  All right.
1941.82s - 1942.46s |  Raise your hand.
1942.46s - 1947.02s |  If you, uh, have broken into a computer before, who, yo, what's up?
1947.06s - 1947.78s |  Come on, do it.
1948.50s - 1948.94s |  Nice.
1948.94s - 1949.62s |  This is good.
1949.70s - 1951.06s |  That makes me feel at home.
1951.82s - 1952.22s |  I'm home.
1952.70s - 1953.02s |  All right.
1953.02s - 1954.90s |  So for me, I'm from Brownsville, Brooklyn.
1955.50s - 1961.42s |  Um, my mother worked at a school, uh, then, uh, yeah, they had computers there
1961.46s - 1963.26s |  and it wasn't any games or anything.
1963.26s - 1964.54s |  So I was just fucking with it.
1964.54s - 1964.90s |  Right.
1965.22s - 1967.38s |  There was like a Apple two or something.
1967.98s - 1970.06s |  And yeah, so I'll fucking with this thing.
1970.06s - 1974.78s |  And then there was a, there was this lovely woman, uh, Sheila.
1975.30s - 1980.02s |  Um, um, she lived in park slope and her and her partner, she was very cool.
1980.02s - 1983.26s |  She had like a Mohawk and said, and she was like, yo, I want you to
1983.26s - 1984.70s |  come to my house and just cold.
1985.50s - 1988.58s |  And then boom, I'd be there and she'd be like, no games, just cold.
1988.90s - 1991.74s |  And I just be there and I'd be like, I don't know if this is fun anymore,
1991.74s - 1994.82s |  but that's all I can fucking code.
1994.82s - 1995.10s |  Right.
1995.58s - 1999.66s |  So in a lot of ways, that's like the crucible for me, I was just
1999.66s - 2002.38s |  fucking coding and shit, all that shit didn't even matter.
2002.58s - 2007.54s |  So then, uh, uh, eventually I did get a computer and then I did get a modem.
2007.66s - 2011.90s |  I, you know, I, yeah, I'm not going to say how I got that motor, but yeah,
2011.94s - 2018.46s |  trust me, my mom didn't buy that modem for the Commodore 64, but for me, I
2018.46s - 2020.90s |  only know breaking into systems.
2020.90s - 2021.78s |  That's my shit.
2022.18s - 2024.50s |  That's what I do as a hacker.
2024.54s - 2027.42s |  That's like the starting point for me.
2027.58s - 2031.74s |  So initially, yo, that was all I did was just breaking computers.
2031.74s - 2034.70s |  The time I saw a pound hack, I was already breaking into computers.
2034.70s - 2036.22s |  I was like, I don't need this chat shit.
2037.86s - 2038.62s |  Just break in.
2047.10s - 2051.46s |  Uh, yeah, no, for a long time, actually on, uh, the instructions for IRG, it
2051.46s - 2053.82s |  was like how to do a, uh, a band.
2053.82s - 2055.14s |  Permaban was Netwiz.
2055.14s - 2057.42s |  That was my hacker handle at that time.
2057.46s - 2058.34s |  You were the example.
2059.50s - 2060.58s |  I mean, I tore that shit up.
2060.58s - 2063.54s |  So anyway, the, I mean, I was really bad.
2063.54s - 2068.54s |  So, um, but I think that like, for me, that was like the start.
2068.54s - 2073.10s |  I feel like I was, uh, uh, in a lot of ways, like hacking is magical.
2073.10s - 2075.82s |  One of the reasons I asked you to raise your hands is because if you've ever
2075.82s - 2080.82s |  broken into a system there, yo, to be honest, that shit is like an orgasm.
2081.26s - 2082.98s |  It's like a tingle goes up your spine.
2083.66s - 2084.90s |  It's unbelievable.
2085.34s - 2090.18s |  The feeling it's also such a creative exercise that a lot
2090.18s - 2091.22s |  of people don't realize it.
2091.22s - 2093.02s |  Now there's different ways to relate to it.
2093.18s - 2096.54s |  Some people relate to it in a technical sense and that's fine, but
2096.54s - 2098.06s |  there's also like an art to it.
2098.54s - 2102.86s |  And a beauty to it, into exploring and using your imagination as ways
2102.86s - 2104.78s |  to get around in different systems.
2105.06s - 2107.14s |  And a lot of times people don't really think about that.
2107.14s - 2109.50s |  Like for me, and maybe I'm going too far.
2109.50s - 2112.26s |  We can talk about this later, but it's the idea that actually sometimes
2112.26s - 2116.38s |  reflects in security too much where it's like, okay, efficiency, here's
2116.38s - 2121.86s |  a checklist, but the beauty of the attacker or the hacker or whatever
2121.86s - 2126.14s |  you want to call it is using your imagination in a pure form to get
2126.18s - 2129.74s |  around and look at data and not let the world restrict you.
2129.74s - 2131.02s |  You don't think about that.
2131.30s - 2135.34s |  And that was allowing me to have access to computers around the world
2135.54s - 2139.22s |  and look at data that I wasn't going to get at the public, at the public
2139.22s - 2141.74s |  library or on fucking, I don't know.
2141.74s - 2142.22s |  What do you got?
2142.22s - 2144.14s |  You guys watch those TV news things.
2144.30s - 2145.06s |  Is that what you guys do?
2145.50s - 2146.58s |  Anybody watch TV news?
2146.58s - 2147.46s |  Yo, don't watch that shit.
2147.46s - 2148.18s |  It's terrible.
2149.14s - 2151.82s |  So my point is, yo, they're going to just tell you whatever.
2151.82s - 2154.26s |  And I don't mean to make a, I could make a long comment on that, but my
2154.26s - 2157.62s |  main thing is that that was like part of the freedom of the hackers.
2157.62s - 2162.22s |  Like, yo, just pure information, contextualizing it for yourself.
2162.50s - 2165.94s |  And that's like also that rebel spirit that really defines
2165.94s - 2168.02s |  the mythology of the hacker.
2168.26s - 2169.30s |  All right, I'm gonna stop there.
2169.34s - 2169.70s |  Peace.
2175.88s - 2176.28s |  All right.
2176.92s - 2179.36s |  There are a couple of threads that came out of all these origin
2179.36s - 2181.20s |  stories that I want to pick up on the first one.
2181.20s - 2186.08s |  Let's just take a hook from what John was telling us about hacking.
2186.08s - 2187.44s |  What were the early techniques?
2187.44s - 2192.44s |  Like, what were you guys doing to make free calls and explore these
2192.44s - 2196.64s |  new communications channels or just let your imagination run wild
2196.64s - 2198.36s |  all over the information space?
2198.56s - 2200.56s |  So I, if I, I'll start out.
2201.80s - 2206.16s |  So I assume most people here have seen the movie war games, right?
2206.20s - 2208.76s |  You know, raise your hand if you haven't seen war games.
2209.84s - 2211.96s |  Oh yeah, there you go.
2211.96s - 2212.88s |  Now you've got some hope.
2212.92s - 2213.84s |  You got some homework.
2214.20s - 2221.28s |  Um, so most of this, most stuff in war games, you know, was not real,
2221.28s - 2225.20s |  but there were some, both kernels of, of actual practice and technology.
2225.40s - 2228.44s |  So, you know, there's a, you know, one of the plot points is Matthew
2228.44s - 2232.28s |  Broderick's character, um, just sets his computer to call every phone
2232.28s - 2233.56s |  number in an entire area code.
2233.56s - 2234.72s |  Cause he wants to find a system.
2235.04s - 2236.64s |  That is what we would do.
2236.68s - 2240.12s |  I mean, we actually called it war dialing after war, after, uh, after war
2240.12s - 2243.40s |  games, cause you set your computer call every phone number in, you know,
2243.40s - 2245.72s |  six, one, seven overnight, you wake up in the morning and you got a
2245.72s - 2247.12s |  list of where a computer answered.
2247.40s - 2250.48s |  It doesn't keep a list of how many people you woke up and swore into the phone.
2251.08s - 2254.12s |  But, um, and then you just call each one of these things to see
2254.12s - 2255.00s |  what answered at the other.
2255.00s - 2256.28s |  And some might be fax machines.
2256.28s - 2259.60s |  Some might, you know, you don't have nothing kind of really responds, but
2259.60s - 2262.84s |  some do, and then you figure out like, what is what, um, so that was like one
2262.84s - 2264.44s |  way we found systems before the internet.
2264.84s - 2267.88s |  Um, oh, yours is off.
2268.76s - 2272.04s |  No, no caller ID.
2272.20s - 2272.80s |  No caller ID.
2272.80s - 2275.44s |  So we could do this all night long and not worry.
2275.48s - 2275.98s |  Yeah.
2276.48s - 2281.04s |  And, uh, then also same with like to get, uh, phone codes.
2281.04s - 2283.12s |  Cause you know, calling cards, cause long distance calling was
2283.12s - 2284.16s |  really fucking expensive.
2284.16s - 2285.44s |  You know, dollars a minute kind of thing.
2285.84s - 2290.56s |  Um, as our parents found out, but, um, the, uh, so you'd set it, you'd
2290.56s - 2295.28s |  like find a local, uh, you know, the number for like a, uh, MCI credit
2295.28s - 2297.64s |  card or something, and you'd set your computer, just call it and basically
2297.76s - 2301.44s |  we were brute forcing and originally like these calling card codes were like
2301.44s - 2306.28s |  six digits, um, you know, and so you would, you would get them really quickly.
2306.52s - 2311.04s |  And again, like, it's actually like in hindsight, it's kind of surprising
2311.04s - 2314.04s |  that more of us didn't get in trouble for that, but like, I guess they just
2314.04s - 2318.72s |  weren't, it's so funny because that's what I was always worried I would get
2318.72s - 2321.84s |  in trouble for, and that's the one thing the feds didn't care about were free
2321.84s - 2326.84s |  phone calls, but the way that we would find things very similar, we just, uh,
2326.88s - 2333.00s |  800 number scan, I would go to pay phones and just dial manually and listen
2333.00s - 2336.96s |  for weird things picking up again, no caller ID, uh, you wouldn't
2336.96s - 2338.24s |  be traced on an 800 number.
2338.68s - 2342.88s |  Uh, and I remember we found something once called, um, and it'd be wild.
2342.88s - 2346.52s |  If anybody remembers this, it was called travel net run by general motors.
2346.64s - 2349.28s |  Anybody have any memory of this?
2349.32s - 2349.68s |  Okay.
2350.20s - 2351.56s |  Uh, one, one person.
2351.56s - 2351.88s |  Okay.
2352.20s - 2356.36s |  Uh, it was just some weird system that was actually voice activated.
2356.36s - 2362.28s |  You would speak the codes and it was, it was two sequences of four numbers.
2362.80s - 2365.76s |  Um, and we realized after, after getting a whole bunch of these codes that
2365.76s - 2367.20s |  they all added up to the same number.
2367.20s - 2370.44s |  I don't know why that was never figured that out, but the way we got our first
2370.44s - 2375.24s |  code was by social engineering, by calling general motors asking, uh, yeah,
2375.24s - 2376.52s |  you know, I'm over in accounting.
2376.52s - 2378.12s |  I need more info on the travel net system.
2378.36s - 2382.48s |  They directed us to a recording that showed people how to use
2382.48s - 2384.68s |  it and they used a demo code.
2385.48s - 2387.72s |  And I tried to demo code and it fucking worked.
2390.76s - 2391.60s |  I couldn't believe it.
2391.92s - 2395.04s |  And from there, you know, I just mixed the numbers around
2395.04s - 2396.64s |  a little bit and got more codes.
2396.64s - 2400.52s |  Before you knew it, we had a hundred codes and we could call all over the
2400.52s - 2404.84s |  place with that, without any fear of, of being, um, traced or caught.
2405.16s - 2408.60s |  Uh, the only problem was it would have a beep every now and then, uh, every
2408.60s - 2411.52s |  couple of minutes it would beep to indicate, I don't know what, uh, time
2411.52s - 2414.64s |  passing by, but that's hard if you're on a modem when that happens.
2414.64s - 2418.00s |  So that was the only disadvantage, but it sure was a gateway.
2418.16s - 2420.24s |  I think you like, you touched on a, on a good thing when you
2420.24s - 2421.24s |  mentioned social engineering.
2421.24s - 2425.36s |  Cause like as, as today back then, like I, the, what I always say is
2425.36s - 2428.40s |  that like the weakest link in any security chain is the human one.
2428.40s - 2431.12s |  And so, you know, it would be a matter of like, you know, finding people
2431.12s - 2433.64s |  and convincing people like, yeah, you know, I'm calling, you know, at the
2433.64s - 2436.56s |  time it wasn't it, but it was like, you know, I'm calling from the phone
2436.56s - 2437.88s |  company or I'm calling from this.
2437.88s - 2439.24s |  I'm calling from that, like that.
2439.24s - 2442.68s |  And dumpster diving to find like phone numbers, to find login information,
2442.68s - 2445.64s |  to find, you know, all kinds of like manuals, all kinds of stuff.
2445.64s - 2447.36s |  I mean, that's how, you know, you would learn stuff.
2447.36s - 2451.04s |  And then a lot of times if, if either you would type it up into a text
2451.04s - 2453.32s |  file to share with other people, or if you were lucky, other people
2453.32s - 2455.56s |  had already found this and that's what you were learning, learned from
2455.56s - 2458.60s |  is like, you know, I learned about Cosmos from like manuals that other
2458.60s - 2462.36s |  people at Cosmos was like a, a phone, like the phone company, AT&T is
2462.36s - 2464.92s |  basically phone database where they would set things up, et cetera.
2465.20s - 2466.92s |  And I learned about that from a text file.
2466.92s - 2470.28s |  It might've been an LOD technical journal that had like a Cosmos manual,
2470.28s - 2472.72s |  but yeah, I mean, that's kind of the way we were learning.
2472.80s - 2476.84s |  Just a quick work around though, with the, you know, yeah, all that stuff
2476.84s - 2480.84s |  with like caller ID and everything like that, yo, to work around with
2480.84s - 2484.72s |  that, when that came out, was it just, yo, you just hack a system and
2484.72s - 2487.28s |  he used a modem on a system that global out tile.
2487.76s - 2488.04s |  Yeah.
2488.28s - 2491.80s |  So a lot of times you would use like a proxy, which of course is nowadays.
2492.60s - 2496.36s |  That's the bread and butter of, you know, international hacking attacks
2496.36s - 2499.96s |  is to make sure that you have sort of like a proxy, but that was the
2499.96s - 2504.64s |  same thing back then, like early use of like proxies and out dials to mask
2504.68s - 2508.72s |  where you're making the call from and fuck them up the best is actually
2508.72s - 2510.52s |  when you hack from their computer.
2510.52s - 2514.64s |  And then it's kind of like a Mobius loop a little bit.
2515.00s - 2518.28s |  Another great method we used was something known as extenders.
2518.36s - 2520.08s |  You ever use extenders?
2520.36s - 2525.88s |  Basically, um, uh, you would call, say a plumber, uh, after hours and the
2525.88s - 2530.72s |  phone would, uh, forward, uh, using very crude forwarding method to an
2530.72s - 2534.12s |  answering service, the answering service would pick up wanting to take a message
2534.12s - 2535.84s |  for, for Joe, the plumber or whatever.
2536.28s - 2538.24s |  And you would, uh, wait for them.
2538.28s - 2539.08s |  You wouldn't say anything.
2539.08s - 2541.96s |  They'd eventually hang up and it would trip down to a dial tone, except
2541.96s - 2543.68s |  it was his dial tone, not yours.
2544.04s - 2547.80s |  So then you could make phone calls from the plumber's phone line.
2548.16s - 2552.04s |  I don't know why I'm picking on this plumber, but you know, any say a used
2552.04s - 2555.76s |  car dealer, anyone who forwarded their number after hours.
2556.04s - 2558.92s |  Oftentimes it would trip down to an unrestricted dial tone.
2559.00s - 2562.44s |  And, um, yeah, you would never be traced on that.
2562.56s - 2563.24s |  Also time.
2563.24s - 2564.76s |  Has it been kind to that term?
2564.76s - 2567.00s |  Cause now it sounds like a product at a gas station.
2569.36s - 2572.52s |  Another thing that we do is like, you know, um, for at least to make
2572.52s - 2578.32s |  free voice phone calls, um, was, uh, you know, you use actual piece of hardware.
2578.32s - 2582.96s |  I either you'd make one yourself, like a beige box, or you'd acquire
2582.96s - 2585.04s |  something completely legally.
2585.52s - 2588.64s |  Um, and not off of the back of a phone truck called alignment's
2588.64s - 2592.12s |  handset or lines, but set, um, which is basically, you know, some people
2592.12s - 2594.64s |  are some, actually somebody yesterday came up and gave me one for free,
2594.64s - 2598.32s |  which is amazing because my older one, an ex left with her.
2598.48s - 2600.32s |  So I was, I'm really excited to have it.
2600.48s - 2603.72s |  So it's basically, you know, like a little like phone, phone thing
2603.72s - 2608.24s |  with originally a dial and then later tile and just two clips for, uh,
2608.24s - 2609.48s |  you know, the two phone lines.
2609.48s - 2613.36s |  And you'd go outside a business, or I guess you could do somebody's house
2613.36s - 2617.12s |  or even like a big, like foam junction box and just clip on and you'd find
2617.12s - 2619.24s |  a live line, a live phone number.
2619.24s - 2620.44s |  And then you could just dial for free.
2620.48s - 2623.76s |  And so for instance, back at the loft, like the, the original, original
2623.76s - 2627.36s |  loft, like, which was a big industrial building, that's how we would make
2627.36s - 2630.16s |  free phone calls is we'd go back into like into the phone closet and just
2630.16s - 2633.28s |  clip on and just think, call other people, call you, call, you know, our
2633.28s - 2636.72s |  friends and other parts and, you know, then whatever business would get the
2636.72s - 2637.00s |  bill.
2637.00s - 2639.96s |  And, and, you know, we're punk kids.
2639.96s - 2641.24s |  We didn't give a shit.
2641.28s - 2644.56s |  We would get, we would get on our answering machine, um, an hour
2644.56s - 2650.84s |  long, uh, teleconference recording of 40 people just all talking at once.
2650.84s - 2653.16s |  And why not call 2,600 answering machine?
2653.16s - 2657.12s |  And, and then I, we'd, we'd have to wade through all this.
2657.44s - 2659.72s |  Uh, and then a few weeks later, we'd get a call from Alliance
2659.72s - 2662.24s |  telecom and said, do you know anybody who might've been calling
2662.24s - 2663.28s |  at this particular time?
2664.24s - 2669.80s |  What was really cool, what Eric was just mentioning, um, was, uh, Alliance
2669.80s - 2672.36s |  teleconferences, those are very popular.
2672.36s - 2677.52s |  And just, there were like voice chats for groups of, uh, neuro atypical
2677.52s - 2678.92s |  individuals who found them.
2679.20s - 2684.24s |  Um, but in, in terms of in-person cons, we had in-person conversations.
2684.48s - 2686.40s |  Yeah, very much so.
2686.68s - 2691.76s |  Um, but, uh, in, in terms of just like making calls, uh, the codes were
2691.76s - 2696.08s |  super helpful because you could, you know, set up something to scan them
2696.08s - 2699.72s |  and, you know, come back in the morning and you got a thousand of them.
2699.72s - 2701.92s |  You could just use them disposably.
2701.92s - 2705.72s |  You can call all over planet earth because back then that was
2705.72s - 2708.40s |  a significant barrier to entry.
2708.40s - 2710.36s |  I mean, now everything's free back then.
2710.36s - 2714.28s |  It's, you know, as has been mentioned, it's dollars per minute.
2714.92s - 2719.12s |  And, uh, then, then you discover, oh, Hey, I can just actually get into
2719.12s - 2722.68s |  their computer system and download all of their codes, which is
2722.68s - 2725.04s |  a lot more elegant and efficient.
2725.60s - 2731.28s |  And the really cool, uh, kind of collision of old and new technology
2731.28s - 2735.16s |  happened, uh, for me anyway, in, in New York city, because I had two
2735.16s - 2740.28s |  phone lines and one was, uh, an ESS, which is electronic switching.
2740.68s - 2745.00s |  That was brand new because they use out of, out of band signaling.
2745.00s - 2746.84s |  Everything was digital.
2747.08s - 2751.12s |  My other phone line was a crossbar five, which is a mechanical switch.
2751.16s - 2753.12s |  Everything is in band.
2753.12s - 2757.32s |  So that means you can trunk lines using 2,600 Hertz.
2757.88s - 2761.52s |  And, uh, there's software that was available for computers that
2761.52s - 2762.76s |  would let you generate that.
2762.76s - 2767.08s |  It would pop up a keypad and, uh, uh, it has a couple of extra keys.
2767.08s - 2771.40s |  There's like KPST, which is key pulse forward start.
2771.96s - 2776.92s |  Uh, and you know, essentially you're a TSPS operator, which is transit
2776.92s - 2781.28s |  service position switch, if I'm remembering it correctly across decades
2781.28s - 2785.92s |  of time, and you're basically an operator and you're invisible and
2785.92s - 2789.64s |  you're inside their network and you can do whatever you want, it's like
2789.68s - 2793.52s |  John mentioned, uh, it's one hell of a dopamine rush.
2793.52s - 2796.96s |  You just killed the final boss on that level.
2797.60s - 2797.84s |  Yeah.
2797.84s - 2801.16s |  Instead of working in the system of numbers, you're attacking
2801.16s - 2801.80s |  the system there.
2801.80s - 2804.48s |  You're working around it with the blue boxes and all the
2804.48s - 2806.24s |  various colored boxes back then.
2806.84s - 2809.20s |  I was going to, you know, when you're talking about codes, like, you
2809.20s - 2811.44s |  know, you'd get these things and they were, they're basically like
2811.72s - 2813.36s |  currency in the, in the hacker world.
2813.36s - 2814.20s |  Like you would trade them.
2814.20s - 2817.16s |  You, and so first of all, it was currency in terms of like, okay, I've
2817.16s - 2820.32s |  got this, what have you got, but also it was cred, like you would be like,
2820.32s - 2823.32s |  Hey, you know, you know, you call this BBS and it has all the, you
2823.32s - 2825.96s |  know, all, you know, good codes, you know, basically.
2825.96s - 2828.36s |  And this is like, a lot of this is like where the term zero day,
2828.36s - 2829.24s |  that's user exploits.
2829.24s - 2832.40s |  Now zero day originally was like, where's like freshly cracked
2832.40s - 2833.44s |  things and zero day codes.
2833.44s - 2834.60s |  Like they had just been cracked.
2834.60s - 2836.00s |  So, you know, you know, it's going to be good.
2836.00s - 2838.24s |  So somebody would have all the good, the good codes.
2838.24s - 2839.36s |  Then they were, you know, elite.
2839.92s - 2840.08s |  Yeah.
2840.08s - 2844.88s |  Or like a rad, not like anybody would reuse or retrade codes, right?
2844.92s - 2845.32s |  Well, no, no.
2845.32s - 2846.96s |  I mean, they would, but that's like, it's currency, you know,
2846.96s - 2848.20s |  like it gets passed around.
2848.24s - 2848.40s |  Yeah.
2848.40s - 2850.36s |  So I'm curious, how did all this evolve?
2850.36s - 2850.52s |  Right.
2850.52s - 2853.44s |  I mean, if you go back to these old text files, it's like, here's the
2853.44s - 2856.36s |  list of the default passwords for unit.
2856.36s - 2859.44s |  And like, obviously that, you know, stopped working after a certain point.
2859.84s - 2862.00s |  Um, what, what happened next?
2862.00s - 2862.12s |  Right.
2862.12s - 2865.20s |  You get into the nineties, security starts to become a thing.
2865.32s - 2869.24s |  You'd think it would stop working after a certain point, but in actuality,
2869.24s - 2870.96s |  it, it kept on for a long, long time.
2871.00s - 2873.40s |  How many things do you hear about still that it's like, oh, there's a default
2873.40s - 2874.84s |  password that's hard coded somewhere.
2874.84s - 2876.08s |  It's just like that still happens.
2876.08s - 2877.64s |  Like we have not, hence again.
2877.64s - 2878.12s |  There you go.
2878.12s - 2879.96s |  The old human file is still useful.
2880.72s - 2881.48s |  Admin admin.
2883.78s - 2884.26s |  That's true.
2884.26s - 2887.30s |  That, uh, default passwords still work today.
2887.46s - 2888.50s |  It's very nice.
2889.02s - 2889.78s |  Um, thank you.
2890.18s - 2894.82s |  I think that, uh, but in addition to that, one thing I think, you know, I, you
2894.82s - 2899.34s |  know, that I probably could speak to is that in the evolution of hacking, one of
2899.34s - 2905.14s |  the things that, you know, that I particularly practiced, um, is the idea
2905.14s - 2911.34s |  that in a way, you know, the password is the first entrance, but that's
2911.34s - 2913.18s |  like sucking on a baby bottle.
2913.62s - 2916.10s |  You want to graduate to drinking liquor.
2916.34s - 2921.02s |  And the way you do that is you say, yo, I don't need just one password.
2921.06s - 2924.74s |  I'm going to just take the whole password file and you start there.
2925.18s - 2929.90s |  Then that graduates to, yo, I just going to fucking take the whole network.
2930.14s - 2936.34s |  And that idea of like, sort of like bringing the lens back to like the
2936.34s - 2942.42s |  larger picture made it very easy to sort of like scale up the hacking
2942.82s - 2947.50s |  because once you see it as this thing, like some people will go like, yo, we
2947.50s - 2949.98s |  need ideas out the box, right?
2949.98s - 2952.78s |  Then there's some, some other person and they think they're even smarter.
2952.78s - 2954.62s |  They're like, but there is no box.
2954.78s - 2959.62s |  But to be honest, it's really a rhizomatic.
2959.66s - 2965.30s |  Like it's not, it's entire fucking surface of multiple domains.
2965.34s - 2972.02s |  And that idea was, that's, you know, what was able to allow, you know, uh, people
2972.02s - 2976.18s |  that I, you know, interacted with in the hacking sphere to be able to break into
2976.18s - 2977.38s |  so many computers.
2977.74s - 2981.26s |  And that once again, is that that's sort of like the evolution.
2981.26s - 2985.38s |  It went from those ideas of default passwords, getting in, learning it, but
2985.38s - 2989.70s |  then learning to the point where, like I said, it, yo, that the password just
2989.70s - 2990.58s |  became invisible.
2990.58s - 2992.98s |  That's just an individual user.
2992.98s - 2997.46s |  If you could see the whole system and take the system, everything's yours.
3001.88s - 3004.92s |  You know, John, you might be able to talk a little bit more about this.
3004.92s - 3009.00s |  Cause this is, you know, I think you have more personal experience, uh, than, than
3009.00s - 3012.72s |  many of us, you and other people in MOD about like, I mean, you own the phone
3012.72s - 3016.48s |  system and you could, you could do things with that, that like are still like kind
3016.48s - 3019.32s |  of mythical, like, you know, turning people's home phones into pay phones and
3019.32s - 3019.92s |  stuff like that.
3019.96s - 3020.84s |  Sorry, allegedly.
3021.20s - 3024.32s |  So maybe you can talk a little bit more like owning the system and like what that
3024.32s - 3029.48s |  was like and like, you know, both from a, an experiential and like, I don't know,
3029.80s - 3030.40s |  talk around that.
3031.00s - 3033.36s |  I mean, one of the things, thank you, first of all, thank you for that.
3033.64s - 3038.04s |  Um, I probably wasn't going to talk about the magic of, of, uh, phone hacking.
3038.04s - 3044.04s |  What's interesting is that, that yo, it is like this hidden network that controls
3044.04s - 3044.92s |  everything right now.
3044.92s - 3050.04s |  A lot of it has shifted to the idea about mobile, but yo, the original phone system
3050.04s - 3053.48s |  that still works is, it's amazing.
3053.48s - 3054.64s |  And it's complexity.
3054.92s - 3061.04s |  So many things came out of those initial, uh, engineers who design a system, but
3061.12s - 3062.16s |  how robust it is.
3062.16s - 3065.28s |  I mean, like it was literally built to survive nuclear attack.
3065.28s - 3069.44s |  Like you, you look around your town of any size and there is going to be like a
3069.44s - 3070.52s |  hardened building.
3070.52s - 3072.36s |  That's, that's the old phone switching office.
3072.52s - 3073.04s |  That's right.
3073.04s - 3078.68s |  And then system, system five actually paved the way for like what everyone uses
3078.68s - 3079.16s |  today.
3079.20s - 3083.88s |  So that idea about the phone system, yo, you could control everything.
3084.24s - 3086.44s |  There was like, you know, you can make service orders.
3086.44s - 3087.36s |  You could change things.
3087.36s - 3088.32s |  Yes, I did.
3088.40s - 3092.12s |  Uh, I love changing people's, uh, uh, you want to, you know,
3092.12s - 3093.64s |  yeah, you could turn it into a pay phone.
3093.92s - 3097.68s |  You could, uh, remember, I don't even remember if people don't know, maybe don't
3097.68s - 3098.92s |  know what a pay phone is, whatever it means.
3098.92s - 3103.72s |  Like you, you would pick up your phone at home and try to make a call and it would
3103.72s - 3105.52s |  be, please, please insert 25 cents.
3105.52s - 3106.68s |  It's like, what?
3107.32s - 3108.76s |  Yeah, I missed that.
3108.76s - 3116.28s |  So then, um, but yeah, no, I mean, effectively it's amazing that, yo, there's
3116.28s - 3120.68s |  so many things that we don't think about is control, you know, data passing through
3120.68s - 3123.04s |  these phone systems, both voice and data.
3123.28s - 3126.48s |  So yeah, it was unbelievable in that regard.
3126.48s - 3131.00s |  And then it was always like the, the, maybe the, that is the part that is maybe
3131.00s - 3135.88s |  mythical, but actually already written about is that, uh, you know, the DMS 100
3136.24s - 3142.40s |  had the famed, um, remote headset, um, um, which, yeah, you could listen in the
3142.40s - 3145.52s |  phone lines, like obviously like cross bar and the older ones, you had to have a
3145.52s - 3150.12s |  physical tap on the line, but then they were like, Oh shit, let's put remote
3150.32s - 3153.28s |  ability to listen in and yo, that shit.
3153.52s - 3153.92s |  Yeah.
3154.00s - 3155.12s |  Probably shouldn't touch that.
3155.16s - 3158.28s |  But anyway, it never existed, John.
3158.28s - 3160.04s |  It was an undocumented feature.
3160.12s - 3160.48s |  Yeah.
3160.48s - 3160.76s |  Yeah.
3160.80s - 3163.04s |  I love undocumented features.
3163.80s - 3164.16s |  Yeah.
3164.72s - 3168.84s |  To this day, even something dumb, I see a binary, I'll just hit like string on it
3168.84s - 3171.40s |  and just be like, what the fuck's in this motherfucker just in case.
3171.92s - 3176.08s |  But yeah, I think, um, you know, but just to, to, to close that out, the phone
3176.12s - 3180.60s |  system, I think it's interesting because so many, so many people have forgotten
3180.64s - 3184.92s |  about that aspect that, that was like this whole domain that still really does
3184.92s - 3185.40s |  exist.
3185.40s - 3190.28s |  And that includes like the, the complex, uh, signaling system seven, which
3190.28s - 3195.88s |  probably I shouldn't mention, but if you do know about it, whoa, there's multiple
3195.88s - 3198.60s |  stratas that control the data in this network.
3198.60s - 3202.96s |  And yeah, uh, probably no one's gonna mention it, but me and I'm done with it.
3202.96s - 3203.60s |  So, all right.
3204.44s - 3206.08s |  They being HLRs.
3206.68s - 3208.48s |  Patrick mentioned something really interesting.
3208.48s - 3210.48s |  He said a lot of this stuff is free today.
3211.00s - 3215.92s |  And I just want people to realize that that's all we wanted back then was to
3215.92s - 3217.36s |  make communications free.
3217.36s - 3224.37s |  We fucking won and we don't seem to realize we've, I mean, that was part of
3224.37s - 3224.61s |  the thing.
3224.61s - 3226.73s |  I said, be like, Oh, how can you steal from the phone company?
3226.73s - 3228.41s |  And it's like, you're not fucking stealing.
3228.41s - 3229.89s |  Cause you're not taking anything away.
3230.13s - 3230.25s |  Yeah.
3230.25s - 3232.09s |  If you're building it back to the phone, exactly.
3232.09s - 3232.33s |  Yeah.
3232.45s - 3236.33s |  And their, and their profits were first of all, untaxed, like my bell and just,
3236.33s - 3237.53s |  you know, tens of billions.
3237.85s - 3242.77s |  And, um, so, and it, we knew like it costs them nothing for a long distance
3242.77s - 3243.09s |  phone call.
3243.09s - 3244.69s |  It costs, you know, pennies, pennies, and they were charging.
3244.69s - 3246.09s |  And so it's like, you know, fuck you.
3246.09s - 3250.57s |  Like we're going to take it for free, all the spring codes, MCI codes, uh,
3250.57s - 3251.65s |  travel net, whatever.
3251.65s - 3254.65s |  It was all so that we could connect and talk to each other.
3254.81s - 3256.49s |  Something we all take for granted now.
3257.29s - 3257.49s |  Yeah.
3257.49s - 3262.45s |  And, and, um, computer access, you know, we all have Linux, you know, on, on our,
3262.45s - 3263.25s |  our laptops.
3263.25s - 3267.05s |  And back then, the only way you can on our televisions, on our light everywhere,
3267.85s - 3269.81s |  everywhere, all have access to something.
3269.81s - 3273.09s |  But back then the only way to get access to a Unix system was to either work for
3273.09s - 3276.61s |  the phone company or have an accredited account at a university, which many of us
3276.61s - 3277.09s |  did not have.
3277.09s - 3279.17s |  So breaking in was the only way to learn.
3279.29s - 3279.57s |  Yeah.
3279.61s - 3282.45s |  That, I mean, for me, that was like, you know, who's going to get a, you know, a
3282.45s - 3287.33s |  13 year old kid access to, you know, a Unix system in, in, you know, 1986.
3288.17s - 3289.09s |  Hey, you got any wares?
3289.25s - 3289.61s |  Sorry?
3290.05s - 3290.89s |  You got any wares?
3290.93s - 3291.73s |  Oh, you got any wares?
3292.29s - 3292.85s |  Hot wares.
3293.13s - 3293.33s |  Yeah.
3293.33s - 3296.73s |  Like, uh, um, and so it was really, you know, again, I grew up outside of Boston
3296.73s - 3300.61s |  where there's a lot of academia, a lot of, a lot of, uh, you know, tech companies
3301.05s - 3304.09s |  at the time, a lot of defense, you know, probably still a lot of defense industry
3304.09s - 3304.29s |  stuff.
3304.29s - 3308.09s |  So I'm kind of lucky I was doing this in the eighties and not, you know, 10 or 20
3308.09s - 3308.57s |  years later.
3308.97s - 3314.49s |  Um, but, uh, you know, if I wanted to learn about a new computer system, I had
3314.49s - 3317.57s |  to, you know, break into it and get access to it to like figure out, you know, to
3317.57s - 3317.93s |  learn about it.
3317.93s - 3318.77s |  And that's what I wanted to do.
3318.81s - 3324.37s |  So Emanuel brings up a good point about, you know, illustrating the fact that like
3324.37s - 3326.73s |  hacker culture changed so much.
3326.73s - 3331.37s |  It's, it spawned a trillion dollar industry, but it's more than that.
3331.37s - 3334.17s |  Even as you, I look around here, look at this community.
3334.65s - 3336.17s |  There is a special thing.
3336.17s - 3341.45s |  Like I still speak to hackers I know around the world from every country.
3341.81s - 3345.69s |  Um, sometime they don't like me cause maybe I hacked their country.
3345.93s - 3349.17s |  Yo, that's how understanding comes together.
3349.17s - 3351.25s |  But the main thing, hacker culture, it's incredible.
3351.25s - 3356.89s |  So just, can I just tie it into like the nineties, that eighties and nineties cruxable.
3357.05s - 3359.05s |  So now there were hackers that predated us, right?
3359.05s - 3360.01s |  Tap, blah, blah, blah.
3360.01s - 3363.65s |  I don't know what they listened to Grateful Dead or Arlo Guthrie.
3363.77s - 3365.13s |  There's nothing wrong with that.
3366.21s - 3367.65s |  I like a good, you know what I mean?
3367.65s - 3368.85s |  Choctaw Ridge or something.
3368.89s - 3374.01s |  But my point being that eighties and nineties was super special for the
3374.01s - 3378.01s |  acceleration of hacker culture and how much it changed everything.
3378.01s - 3383.33s |  And in that, in that is like, yo, there was like skateboarding running parallel to that.
3383.33s - 3388.13s |  There was expansion of hip hop that went from street music to like the number one
3388.13s - 3393.21s |  music in the entire planet, fucking punk music, fucking, and the overlap between
3393.21s - 3396.61s |  punk and hip hop that, that happened in New York.
3396.73s - 3402.21s |  All these amazing cultures that are part of the tapestry of our life all coincided
3402.21s - 3407.25s |  with the rise of hacking, all these communities, all these people who develop
3407.25s - 3410.05s |  like rich digital identities to this day.
3410.05s - 3414.25s |  Like I'm sure everybody here, like even the goons, everybody has these alternative
3414.25s - 3415.81s |  names that represents that.
3415.81s - 3421.33s |  But all of that kind of started with the anonymous names and additional pieces.
3421.33s - 3425.49s |  And like I said, the things that Manuel mentioned that, you know, in a lot of ways
3425.49s - 3428.25s |  that caused like conversations about free phones.
3428.25s - 3431.37s |  If that's what the consumers want, that's what we're going to give them.
3431.37s - 3435.53s |  And it's so many examples of how hacker culture has done that.
3435.53s - 3439.97s |  And even to today, pushing things like, you know, right of repair or like, you know,
3439.97s - 3444.93s |  or even the GitHub, that nature of like, yo, you know, like I, like I have a car
3444.93s - 3446.81s |  thing, for instance, you know what I mean?
3446.81s - 3448.93s |  And they shut it down, but like, it doesn't matter.
3448.93s - 3451.73s |  Yo, the community is going to come together, recode that shit.
3451.73s - 3452.45s |  And you know what I mean?
3452.45s - 3455.01s |  I'm going to turn it into like a toilet flusher with music.
3455.01s - 3456.33s |  But that's not the point.
3456.33s - 3461.81s |  The point is that that is an outgrowth of all that hacker culture that is embodied
3461.81s - 3463.05s |  here in this room today.
3463.05s - 3464.13s |  So just wanted to mention that.
3464.13s - 3465.41s |  I think that's a really good point.
3465.41s - 3471.65s |  Like, especially you mentioned GitHub and I never thought about it this way, but it
3471.65s - 3475.21s |  is, it is like, you know, the really the embodiment of the old, the hacker ethic of
3475.21s - 3478.13s |  like, you know, you, you, you share information, like you, you, you learn
3478.13s - 3481.05s |  something new and now you, or you write something new and you share it.
3481.05s - 3484.61s |  And that's like what a public repo is to a lot of degree or like, or open source,
3484.61s - 3486.85s |  you know, it's this like, Hey, I figured out this cool thing.
3486.85s - 3487.61s |  I've made this cool thing.
3487.73s - 3489.13s |  Now you can also use it.
3489.13s - 3491.53s |  Or, and you can also, you know, change it and make your own thing.
3491.65s - 3491.81s |  Yeah.
3491.81s - 3493.21s |  Let's stay, let's stick with this thread.
3493.21s - 3496.41s |  So everyone here is mentioning community, right?
3496.41s - 3497.53s |  This is a key thing.
3497.69s - 3501.69s |  You know, there's this profound development of this new information network, the phone
3501.69s - 3502.85s |  system, it's popular.
3502.85s - 3503.25s |  Why?
3503.45s - 3505.09s |  We can talk to each other, right?
3505.09s - 3507.65s |  And people are finding community, especially hackers.
3507.81s - 3509.61s |  So what happens when all this evolves, right?
3509.61s - 3513.81s |  How do we end up at this mega conference with what, like 30,000 people?
3514.49s - 3515.77s |  How did all, how did all that start?
3515.85s - 3519.53s |  Well, I think it probably started at the very, for early, you know, hacker cons,
3519.53s - 3523.49s |  which like, like party con summer con, like in the very late eighties.
3523.89s - 3526.81s |  Um, I think 90 or something like that.
3526.81s - 3529.65s |  Oh, even before that, I think Tommy, you were at like, weren't you at like one
3529.65s - 3530.61s |  of the first summer cons?
3530.61s - 3532.41s |  I said 91 to 92.
3532.41s - 3533.81s |  I grew up in the area.
3533.81s - 3535.41s |  So I had access.
3535.57s - 3538.97s |  So like we had summer cons that were put on at that point, it was like, you know,
3538.97s - 3541.53s |  maybe people would share a little bit of information, but it was informal.
3541.53s - 3543.65s |  It was basically like, you're meeting the face behind the monitor.
3543.65s - 3546.77s |  You go and like, you know, you go show up at this like motel in St.
3546.77s - 3549.81s |  Louis and there's like 20 other, you know, hacker people.
3549.81s - 3551.61s |  And one of them is agents deal.
3551.61s - 3557.49s |  Who's a fed, but, um, like, uh, or to be fair, actually not, uh, not actually fed
3557.49s - 3558.37s |  just an informant.
3558.85s - 3560.37s |  Uh, how did you guys not know that?
3561.09s - 3564.01s |  I mean, well, I mean, he did a lot of legitimate stuff.
3564.05s - 3568.13s |  It like he, so the agents deal was this guy, Justin Tanner Peterson, um, who
3568.13s - 3573.93s |  basically, uh, he legitimately was a phone freak who had owned, uh, the phone
3573.93s - 3577.81s |  company to the extent that he had basically could be caller number, whatever
3577.81s - 3578.69s |  for a radio station.
3578.69s - 3580.05s |  So he was winning vacations.
3580.05s - 3581.13s |  He was winning cars.
3581.13s - 3584.17s |  He was winning, you know, he was always like he was over always caller 99 or
3584.17s - 3584.49s |  whatever.
3584.85s - 3586.29s |  He eventually got busted for that.
3586.29s - 3588.93s |  So they turned state evidence, state's evidence, and would show up to these
3588.93s - 3591.61s |  cons and be, and ask like leading questions like, Oh yeah.
3591.61s - 3592.89s |  So what are you been up to recently?
3592.89s - 3595.01s |  Tell me about the new hacks and stuff.
3595.33s - 3599.13s |  Unfortunately he also, well, fortunately or unfortunately he couldn't stop, you
3599.13s - 3601.57s |  know, uh, fucking with shit himself.
3601.73s - 3602.97s |  So he got busted again.
3603.25s - 3607.41s |  And, and one of my favorite stories is that, so, so Justin, Justin had, he had
3607.41s - 3607.89s |  one leg.
3608.33s - 3612.13s |  Um, and when he was, when he was busted, the news, I remember the news article
3612.13s - 3614.33s |  was like, Oh, he was apprehended after a brief foot chase.
3614.33s - 3617.65s |  And I was like, I would hope it would be brief.
3619.89s - 3621.81s |  Well, these days he'd really get away.
3621.93s - 3622.41s |  Yeah.
3622.45s - 3623.41s |  What technology has done.
3626.01s - 3628.81s |  Oh, so I, I got distracted.
3629.41s - 3631.25s |  We ended up from cons to a fake leg.
3631.25s - 3631.41s |  Yeah.
3632.65s - 3633.25s |  Um, yeah.
3633.25s - 3636.65s |  So, so I think, you know, we started out with like these, these sort of very
3636.65s - 3639.49s |  informal just meeting up and then eventually like a kind of more formal,
3639.49s - 3640.89s |  like, okay, we're going to share information.
3641.17s - 3645.09s |  Cult of the dead cow in the, in the early nineties had the first, you know,
3645.33s - 3649.41s |  founded the first, um, hacker con where we actually invited journalists and
3649.41s - 3653.17s |  invited like even law enforcement to talk and to come and like meet hackers.
3653.53s - 3657.05s |  Cause there was this understanding that like, there was like, we saw that there
3657.05s - 3660.73s |  was a lack of understanding in law enforcement and judicial communities,
3660.73s - 3664.61s |  like as, as sort of Emmanuel alluded to earlier, this demonization of hackers,
3664.81s - 3668.05s |  where it's like hacker was synonymous with criminal and not like, not like a
3668.05s - 3671.25s |  cool criminal kind of necessarily, but like, you know, they were like, okay,
3671.25s - 3674.81s |  you know, you, you are, you know, almost like mobster or kind of, kind of thing.
3675.25s - 3681.45s |  Um, but, uh, so, you know, we wanted to, to meet these people and sort of, uh, uh,
3681.45s - 3684.33s |  have, be able to have conversations and, and it's, you know, it's harder to
3684.33s - 3687.05s |  demonize somebody once you've met them, you know, once you, once you interact
3687.05s - 3692.81s |  with them and so, um, you know, and then that, that DEF CON was founded by Jeff
3692.81s - 3696.41s |  Moss and he, he kind of carried on that idea with the whole, like bringing in,
3696.49s - 3699.69s |  uh, explicitly like feds to talk and things like that.
3699.69s - 3703.21s |  And they had, you know, the spot, the fed contest, et cetera, um, to sort
3703.21s - 3707.01s |  of like make it a game, but yeah, I mean, it's, if I can jump in for one
3707.17s - 3711.49s |  sec, what you're saying right there was really interesting because Mindvox had,
3711.49s - 3718.13s |  uh, a forum that was actually moderated by, uh, Kim Clancy, who at the time was
3718.13s - 3720.21s |  a active secret service agent.
3720.77s - 3724.73s |  And the participants were many of the people, the secret service had just
3724.73s - 3730.49s |  raided an operation Sun Devil, including legion of doom members and a collection
3730.49s - 3732.53s |  of other very colorful people.
3733.25s - 3740.33s |  So it was a conversation and sometimes it's slightly psychotic and angry and
3740.33s - 3743.77s |  stuff, but communication was taking place.
3743.81s - 3751.21s |  And the people who had arrested in some cases, prosecuted the individuals were
3751.21s - 3756.09s |  able to sit there and interact with them, talk with them after all this was over
3756.09s - 3761.69s |  and done with, and try to come to some sort of understanding regarding why this
3761.73s - 3763.05s |  occurred, what had happened.
3763.05s - 3766.57s |  And it was just like super cool because it's like, Hey, you're a secret service
3766.57s - 3766.93s |  agent.
3766.93s - 3770.89s |  You want to talk to people and understand the whole culture.
3770.89s - 3771.89s |  It was really awesome.
3772.33s - 3774.69s |  I wonder, John, do you, do you have like any, any views on this?
3774.69s - 3779.41s |  Cause I know like you come out of a much more, you know, you, you guys were in the
3779.41s - 3783.57s |  shit and like, you know, and, and, you know, paid the price to some extent for,
3783.61s - 3787.29s |  you know, from these feds that we're talking like all like, oh yeah, you know,
3787.29s - 3789.97s |  we're meeting, we're, we're getting like, you know, we're being all friendly with
3789.97s - 3793.29s |  and, and you had, you know, had a bit of a different friends though.
3793.33s - 3795.17s |  I mean, I didn't really go to cons.
3795.21s - 3799.25s |  I mean, part of it is like, yeah, you know, I just like breaking a computer that I
3799.25s - 3806.93s |  need to go like to a con, but I think, you know, I, yeah, I think, um, I, I, all
3806.93s - 3809.49s |  right, could I, I got two things thinking about that though.
3809.81s - 3814.09s |  I don't want to take it too far off track, but one thing is interesting in talking
3814.09s - 3819.93s |  about that is for instance, um, yo, is there, uh, uh, how many people,
3819.93s - 3822.45s |  go to ethical hacker con?
3824.41s - 3825.37s |  Like one, right?
3825.37s - 3826.37s |  Two, three, no one.
3826.37s - 3827.97s |  Oh, I thought you meant just a ethical hacker con.
3827.97s - 3833.57s |  So my point being is like, yo, the mythology really lies with the, the idea
3833.61s - 3837.05s |  of the hacker that breaks into stuff and explores things.
3837.05s - 3841.53s |  I think it's funny that they have all these terms, ethical hacker, blah, blah,
3841.53s - 3845.29s |  blah, the white hat, black hat, divided, god I hate that term, you know what I mean?
3845.29s - 3849.09s |  Like, what the fuck that, you know, me, I like non-binary hats.
3849.25s - 3852.21s |  I don't, that shit's ridiculous when you put things in a box like that.
3852.57s - 3857.93s |  But my point being is that that is, it's, it, it, it goes to like talking about
3857.93s - 3862.25s |  how the other thing that I wanted to mention about cons is I also didn't go
3862.25s - 3867.37s |  to them because in a lot of ways it represents, like, for instance, and I,
3867.37s - 3868.77s |  and I don't mean to cause trouble.
3868.77s - 3870.65s |  I just want to have a conversation about it.
3870.85s - 3874.61s |  Like, for instance, like a, like a woman didn't wind up on, on this
3874.61s - 3875.85s |  panel, for instance, right.
3876.21s - 3878.61s |  And I have no problem talking about that.
3878.61s - 3881.09s |  I think it's good to have conversations about these things
3881.37s - 3882.97s |  because there were women around.
3882.97s - 3887.53s |  I think I even mentioned that Sheila Averbach taught me computers.
3887.85s - 3890.05s |  So Susan Thunder was also around.
3890.05s - 3893.17s |  Susan Thunder, like, I think it was mad people, but like at the same, but
3893.17s - 3894.45s |  she wouldn't come to the panel.
3894.45s - 3895.89s |  She's not her jam.
3895.93s - 3899.85s |  Um, but, but I think it's, I thought, I thought I would just have that just
3899.85s - 3904.17s |  as a part of partial part of the dialogue because, you know, women were
3904.17s - 3906.61s |  around during all those periods.
3906.61s - 3911.93s |  But like, in a lot of ways, you know, them not being represented on a one
3911.97s - 3916.69s |  person that out of all the people not represented also reflects a bit, like
3916.69s - 3921.37s |  why I didn't go to cons too much because in a lot of ways, like, yeah, sure.
3921.41s - 3925.25s |  They're like, John, you got voluminous knowledge, but like, yo, it's still,
3925.25s - 3931.69s |  it felt like, like the other, and it's not necessarily ethnicity based.
3931.73s - 3934.69s |  It's also could be like class based or whatever.
3934.69s - 3937.81s |  It just was a different way to navigate.
3937.81s - 3942.73s |  And then, you know, a lot of people would say like, okay, well, um, yeah,
3942.73s - 3946.69s |  they don't have a good concept that like, you know, you don't have to have a
3946.69s - 3950.41s |  conspiracy to have conspiracy like effects, but when you set up a thing where
3950.41s - 3954.37s |  there seems to be like an underlying, like sort of misogyny in certain languages
3954.37s - 3959.21s |  that you may take people take for granted is normal, normal for them actually
3959.21s - 3963.53s |  puts people off or they say like, you know what, maybe this culture isn't for
3963.53s - 3967.13s |  me and they walk away and they, you know, for the person they think, oh shit,
3967.13s - 3968.41s |  that was so funny.
3968.41s - 3970.01s |  I'm so fucking Chad.
3970.01s - 3975.05s |  But in reality, yo, they totally made someone's fucking life path curve to
3975.05s - 3976.25s |  something they may really want to do.
3976.29s - 3978.13s |  I think that that's a valuable point.
3978.13s - 3980.49s |  Cause like, you know, we're, we're talking about here and we're, we're like
3980.49s - 3983.57s |  talking about like, oh, this, this great community and stuff like that, but you
3983.57s - 3986.73s |  know, it's a great community that we were welcomed into and like, I don't, you
3986.73s - 3987.73s |  know, we can't sugarcoat it.
3987.73s - 3989.09s |  Like there was a lot of misogyny.
3989.09s - 3992.57s |  There was a lot of sexism, a fucking hell of a lot of homophobia, like just
3992.57s - 3996.69s |  casual, like not, you know, most of it I think wasn't really, you know, vicious.
3996.69s - 4001.61s |  However, you know, you're using terms that make people, people feel unwelcome.
4001.61s - 4004.81s |  And, and just, you know, just building on that, just a historical point is that
4004.81s - 4008.77s |  one, one hacker that I was cool with, anybody remember Traxtor?
4008.85s - 4011.85s |  Oh, uh, speaking of feds or speaking of narcs.
4011.89s - 4013.61s |  Well, he didn't narc on me.
4014.61s - 4021.38s |  So if you don't know Traxtor, he was a blind and he also identified as gay and
4021.38s - 4022.82s |  like, yo, the kids would make fun of him.
4022.82s - 4025.38s |  And I was just like, you're my boy.
4025.54s - 4026.06s |  Yeah.
4026.42s - 4027.50s |  And he taught me a lot too.
4027.50s - 4033.66s |  So one thing I wanted to say is that, um, uh, the scene was, I think, more
4033.66s - 4037.54s |  inclusive than a lot of, a lot of things that were going on in the nineties,
4037.78s - 4042.78s |  because some of the most successful people from our scene, uh, were gay.
4043.14s - 4046.46s |  People from our scene, uh, are women.
4046.86s - 4047.18s |  It's true.
4047.18s - 4050.34s |  Um, some of the most successful, successful people that I know are, are women.
4050.34s - 4051.14s |  Heather Adkins.
4051.14s - 4052.26s |  And yeah, yeah.
4052.26s - 4053.58s |  Window and window.
4053.58s - 4053.78s |  Yeah.
4053.78s - 4054.10s |  Windows.
4054.46s - 4055.10s |  Lady Ada.
4055.22s - 4055.66s |  Lady Ada.
4055.66s - 4056.14s |  Lady Ada.
4056.14s - 4062.78s |  I mean, yeah, it was, I mean, inclusion, we were, we were, I think we were, we
4062.78s - 4066.58s |  were much more inclusive than at least some of the things that were going on there.
4066.66s - 4067.66s |  I think that's true.
4067.66s - 4072.14s |  But I also think that like, it was to some extent, like, I mean, it's been,
4072.74s - 4077.14s |  you know, speaking as, you know, I can only speak as a straight white man.
4077.18s - 4081.34s |  Like, um, but like, I think that things are getting better and I think it's,
4081.34s - 4082.78s |  it's gotten, gotten better over time.
4082.78s - 4087.38s |  It's not only work with women now, so it's, it's, it's, but yeah, I mean,
4087.38s - 4091.94s |  like CDC was the first group to the first hacker group to sort of induct
4091.94s - 4094.58s |  a woman member, um, lady Carolyn.
4095.18s - 4098.86s |  Um, but then, you know, and I'm not trying to pat ourselves on our
4098.86s - 4101.38s |  back or anything like that because it took us, you know, you know, almost
4101.38s - 4102.82s |  30 years to induct another woman.
4102.82s - 4106.26s |  So it's like, what's, what's that that, you know, and, and I'm not, I don't
4106.26s - 4110.10s |  mean to suggest that she was any sort of like, you know, a token or anything
4110.10s - 4111.34s |  like that, she was fucking awesome.
4111.34s - 4112.66s |  So that's why we invited her in.
4113.06s - 4118.66s |  But, you know, there was this, yeah, it's, I think there's a, there
4118.66s - 4120.10s |  has been something systemic.
4121.06s - 4123.70s |  There's no question that it was, it was, um, a different
4123.70s - 4125.90s |  environment back in the eighties.
4126.30s - 4130.58s |  Um, early summer cons were almost exclusively straight white males.
4130.90s - 4132.50s |  Um, who all knew each other.
4132.78s - 4135.46s |  It was uncomfortable because if you didn't know them, yeah.
4135.46s - 4137.30s |  If you didn't know that these people, if you weren't in good
4137.30s - 4139.06s |  with them, you were ostracized.
4139.54s - 4144.94s |  Um, and that's, that's part of our growing pains, uh, that we eventually,
4145.34s - 4149.46s |  uh, started to be more inclusive, but it didn't happen right away.
4149.54s - 4150.50s |  It didn't happen right away.
4150.94s - 4155.86s |  Um, and as soon as the, uh, the kids from the city got involved, all of a
4155.86s - 4160.06s |  sudden the media was all over it saying, oh my God, this is a real danger to
4160.06s - 4162.74s |  the average American, you know, you saw the difference.
4162.74s - 4165.82s |  We saw all kinds of racism, sexism, homophobia.
4166.22s - 4167.14s |  We're not immune from that.
4167.14s - 4167.90s |  We still aren't.
4168.14s - 4172.78s |  But looking around here, looking around, uh, what I see at hope, boy,
4172.78s - 4173.70s |  we've come a long way.
4173.70s - 4174.94s |  I'm proud of this community.
4174.94s - 4176.70s |  I'm proud of what we are trying to do.
4177.10s - 4178.74s |  Uh, but let's just not forget.
4178.74s - 4180.66s |  It's a work in progress and we have to keep trying.
4184.74s - 4186.50s |  Okay, let's, let's come back.
4186.54s - 4188.74s |  Let's say one thing that like, you know, you're talking about when the
4188.74s - 4190.74s |  kids from the city got home, this is something I was speaking to John
4190.74s - 4195.50s |  about earlier, like about how, um, you need the New York scene specific.
4195.50s - 4197.74s |  Like New York is a very diverse city and stuff.
4197.74s - 4202.58s |  So like when you guys, I think we're much more sort of like MOD specifically,
4202.58s - 4206.34s |  like much more sort of like a diverse group than, you know, for certainly
4206.34s - 4210.78s |  CDC or many, many of the LOD, lots of other groups out there came out of a
4210.78s - 4212.94s |  different culture, everybody in there.
4212.94s - 4213.78s |  It was really good.
4213.78s - 4216.26s |  I mean, I think anybody seen that movie hackers.
4217.90s - 4218.26s |  All right.
4218.50s - 4220.66s |  I only just saw it for the first time.
4221.14s - 4225.30s |  No, the other day they invited me to what the Academy to see it.
4225.30s - 4225.74s |  Right.
4226.34s - 4227.14s |  I never saw it.
4227.74s - 4231.98s |  Part of it is that that movie actually kind of steals from it's, it's based
4232.02s - 4238.22s |  roughly on, on, uh, on MOD, but whatever conversation about it, you know what I'm
4238.22s - 4238.50s |  saying?
4238.50s - 4244.50s |  Like I don't touch that film, but I will say I love the diversity and it does
4244.50s - 4249.26s |  represent what New York was like, both in terms of like gender identity in the
4249.26s - 4255.26s |  film, fucking the different ethnicities, even small twist on a dial, like, you
4255.26s - 4258.94s |  know, like different, like, you know, like even like, I just, I'll just say it
4258.94s - 4262.54s |  like a, you know, like there was like Afro Latina as well as Latinos.
4262.54s - 4268.02s |  Like it doesn't like all these like small pieces that for me was like every day in
4268.02s - 4270.22s |  New York city is reflected in that film.
4270.50s - 4273.62s |  So obviously that's why I like, you know, I didn't come to cons cause I was like,
4274.62s - 4276.58s |  I don't need to go to the cons, you know what I'm saying?
4276.58s - 4280.86s |  And it is just fucking hackers in New York that represent all of that.
4280.86s - 4284.74s |  Both, you know, like I said, is it, but it was also really good for me cause it
4284.74s - 4286.70s |  really expanded my boundaries.
4286.70s - 4290.50s |  But you can see where sometimes that might have come up against other people who
4290.50s - 4294.66s |  were like, well, I'm just going to say something out of turn about all these,
4294.90s - 4299.38s |  this whole group of people who have feelings and identities and skills, but I'm
4299.38s - 4301.30s |  just going to dismiss them with one word.
4301.34s - 4303.06s |  And, you know, but you know what?
4303.14s - 4306.26s |  Luckily those days over mostly.
4308.06s - 4308.46s |  All right.
4308.46s - 4308.70s |  Right.
4310.58s - 4314.22s |  Let me, let me come back to another really important aspect of the early hacker
4314.22s - 4314.66s |  scene.
4314.94s - 4316.06s |  Um, so here's the next question.
4316.06s - 4320.90s |  How did text files in zines shape hacking culture and why perhaps do they hold
4320.90s - 4322.42s |  relevance for today?
4322.62s - 4326.38s |  I think, I think Patrick, you might have, cause you know, you, you were before,
4326.74s - 4329.06s |  you're older than us in terms of in the scene and like,
4329.42s - 4330.46s |  I'm 300 and
4331.46s - 4331.74s |  Oh yeah.
4331.74s - 4335.42s |  I mean like LOD, as I said, like one of my introduction was LOD text files.
4335.54s - 4339.06s |  So like I, you know, the LOD technical journals, I don't know if you have a,
4339.38s - 4341.62s |  anything you want to talk about how you guys started.
4341.70s - 4345.18s |  And you've read some pretty mind blowing text files in your day.
4345.18s - 4345.50s |  So.
4346.30s - 4350.14s |  Yeah, I'm a, I, I, I write out my, my thoughts and stuff.
4350.18s - 4354.58s |  It was all of us just kind of began as extended rants that were taking place
4354.58s - 4355.30s |  online.
4355.70s - 4360.74s |  The, the whole culture of, you know, K rad, the, the, you know,
4360.78s - 4364.70s |  instead of using an exclamation point, there's an exclamation point, a one,
4364.74s - 4367.22s |  another exclamation point, a two, a string of zeros,
4367.58s - 4371.14s |  because people actually did that when they were posting like, Oh,
4371.18s - 4373.30s |  they're brand new uploaded cracked software.
4373.30s - 4374.30s |  It was very exciting.
4374.30s - 4375.42s |  Everything was zero day.
4375.70s - 4378.66s |  We were mocking things that were really happening.
4378.66s - 4382.98s |  And that sort of like metamorphosed into being culture.
4382.98s - 4387.90s |  And we, we wrote about it and we at a certain point in
4387.90s - 4391.30s |  time, you just kind of like step back and you start mocking yourself.
4391.30s - 4393.66s |  It's like, okay, I'm Lee tweet.
4393.66s - 4395.62s |  We have climbed this great mountain.
4395.62s - 4397.78s |  We are all together at the top of it.
4397.78s - 4399.66s |  And it's, it's all a bunch of bullshit.
4400.38s - 4401.50s |  But what is my name?
4401.54s - 4403.38s |  I'm I'm fluffy bunny.
4403.42s - 4405.14s |  I'm nobody I'm invisible.
4405.18s - 4406.58s |  Just don't pay any attention to me.
4406.58s - 4408.10s |  And you can tell me how great you are.
4408.54s - 4414.02s |  And all of that sort of filtered down and made its way into the text files.
4414.02s - 4420.98s |  They sort of were, uh, pieces of culture and time sort of embedded
4420.98s - 4425.98s |  in just in a text file that would sort of help you get into the headspace
4426.02s - 4430.18s |  of what it was like at that particular intersection point.
4430.58s - 4434.62s |  And right now, you know, 35 years after I can't enter that
4434.62s - 4436.34s |  headspace like at will.
4436.34s - 4438.86s |  I have to sort of coax myself into it.
4438.86s - 4440.74s |  Cause I haven't been there in a long time.
4440.74s - 4446.18s |  And, uh, that, that, that, that's basically, I'll pass it right back to
4446.18s - 4450.62s |  you because that, that group CDC, I, I think it's done a lot of text files.
4451.58s - 4454.22s |  Number 200 was awesome.
4454.26s - 4456.82s |  You see 200 is that's, that's the high point for me.
4456.82s - 4459.62s |  So if you're not read it, that's, that's the way to go through the good starting
4459.62s - 4459.86s |  point.
4460.34s - 4464.98s |  Um, yeah, I mean, CDC started out as like, uh, was founded by, by, you know,
4465.06s - 4470.10s |  punk kids in Lubbock, Texas who like, uh, uh, you know, were hanging out in
4470.10s - 4475.06s |  abandoned slaughterhouse, um, you know, playing heavy metal music and punk and
4475.06s - 4478.26s |  skateboarding and like, also just trying to like, you know, they were counter
4478.26s - 4481.50s |  culture sort of things like trying to, cause it was, you know, especially back
4481.50s - 4483.86s |  then it was very conservative, like socially conservative.
4484.34s - 4487.86s |  Um, and so kind of rebelling against that, but like, and then just, we're
4487.86s - 4490.14s |  going to write the shit down and there's that.
4490.14s - 4494.74s |  And then also certainly CDC was born out of a, like, I think this is a
4494.74s - 4498.78s |  thread that runs through cultivated cow in general is like this sort of, um, not
4498.78s - 4503.10s |  just anti-establishment area, like abolition, anti-establishment NIS, but,
4503.14s - 4509.02s |  uh, also, um, kind of like wanting to poke holes in anybody or anything that,
4509.02s - 4510.78s |  that takes itself too seriously.
4511.10s - 4514.66s |  And so we would like write like parodies of hacker files and things like that
4514.66s - 4516.86s |  originally and, and publish them.
4517.22s - 4522.98s |  But, uh, I think, you know, as your point, like, uh, talking about like K rad and
4522.98s - 4525.54s |  putting these numbers, I think that's something that come out of text files and
4525.54s - 4527.38s |  come into the hacker community that a lot of people don't understand.
4527.38s - 4531.14s |  Like the whole, you know, whether it's elite speak, you know, 3, 1, 3, 3, 7, and
4531.14s - 4533.62s |  stuff, that's something that, you know, CDC has said like, Hey, you know, we were
4533.62s - 4535.10s |  the ones that first did that or whatever.
4535.54s - 4539.10s |  And, uh, other things like now, like things that have entered the, the, the.
4539.74s - 4544.14s |  Like mainstream consciousness, like owned, like the, as a verb, like, Oh, he owned
4544.14s - 4548.46s |  that, or, you know, he owns the system owns pwns shirts at that too, but that is
4548.46s - 4549.50s |  directly at a hacking system.
4549.50s - 4551.18s |  You owned a system like that.
4551.22s - 4556.14s |  And now it's just entered the, like, it was never a verb in that sense before it
4556.14s - 4556.78s |  came out of the hacker.
4556.78s - 4560.58s |  We're doxxed that you hear that on the, on the news, you hear news commentators
4560.58s - 4561.82s |  saying he was doxxed.
4561.86s - 4562.02s |  Yeah.
4562.06s - 4563.30s |  It's like, what the fuck is happening?
4563.30s - 4563.46s |  Right.
4563.46s - 4563.98s |  Yeah, yeah, yeah.
4567.82s - 4568.74s |  What about the zines?
4568.74s - 4570.78s |  Emmanuel, do you want to tell us about like the early days of that?
4571.18s - 4574.94s |  Well, it was a beautiful period in the nineties because zines were exploding
4574.94s - 4575.62s |  everywhere.
4575.66s - 4577.54s |  Uh, how many of you remember tower books?
4578.34s - 4579.14s |  What a great place.
4579.14s - 4583.46s |  That's what got us started on newsstands was a connection to tower books and then
4583.46s - 4587.42s |  all the other bookstores, which were around then independent ones, uh, would
4587.42s - 4591.18s |  also want our zine and a hundred other zines.
4591.62s - 4595.82s |  Uh, then the chains moved in borders, Barnes and Noble and drove them out of
4595.82s - 4596.30s |  business.
4596.46s - 4601.10s |  Then the chain started going out of business and with them, um, they kind of
4601.10s - 4605.38s |  took a lot of the small independent zines with them because they had no real way to
4605.38s - 4606.06s |  survive.
4606.58s - 4610.34s |  Um, I remember, uh, my gun Delores fact sheet five, anybody ever read that?
4610.70s - 4615.58s |  It was the zine of zines and every issue would be a review of your latest issue.
4615.98s - 4617.22s |  Uh, it was the coolest thing.
4617.22s - 4621.06s |  It was just this, um, explosion of creativity and some of the zines were
4621.06s - 4625.74s |  handwritten, but you could find them in bookstores all over the country.
4626.22s - 4631.18s |  Um, yeah, it's replaced by, um, uh, you know, webpages and blogs and things like
4631.18s - 4631.34s |  that.
4631.34s - 4632.14s |  It's not the same.
4632.42s - 4632.98s |  It's not the same.
4632.98s - 4636.94s |  People still have collections of their zines from the nineties that they will
4636.94s - 4637.82s |  never let go of.
4638.26s - 4641.70s |  Um, and I'm, I'm just hoping, you know, I'm seeing more independent bookstores
4641.70s - 4642.90s |  opening these days.
4643.18s - 4647.46s |  I'm hoping to see more printed zines as well, because you know, that, that is just
4647.46s - 4650.06s |  something that you can't replace digitally.
4650.22s - 4652.62s |  There are some stores that like, especially like if you ever go to San
4652.62s - 4657.02s |  Francisco, silver sprocket in the mission or in Chicago, Quimby's like are basically
4657.02s - 4661.46s |  stores that specialize in zines, like both sort of like, you know, comic stuff, but
4661.46s - 4662.62s |  also like DIY.
4662.62s - 4664.54s |  It's, it's, you know, the same, the same stuff.
4664.74s - 4668.46s |  I think one thing you mentioned about like the, the idea of like, uh, the, the
4668.46s - 4672.18s |  zine of zines and reviews of things like that ties into text files, because one of
4672.18s - 4675.34s |  the other reasons you, you would get text files is that the bottom of every text
4675.34s - 4679.34s |  file, a lot of times be a list of other elite BBSs like phone numbers.
4679.34s - 4683.26s |  And so you'd find that and like, uh, I, you know, going back to myself in 86
4683.26s - 4687.46s |  finding this, this, uh, this disc, like with, with text files at the bottom are
4687.46s - 4688.14s |  all these phone numbers.
4688.14s - 4690.58s |  And I was like, okay, like I can call these up and some of them are down.
4690.58s - 4693.50s |  Cause you know, some of these things were a couple of years up older, but some
4693.50s - 4696.18s |  were still up and it's like, and then it sort of builds and builds and builds and
4696.18s - 4700.90s |  you, your network, you know, social network sort of, uh, um, Veggie.
4701.22s - 4701.54s |  Yeah.
4701.58s - 4702.98s |  I think, I feel like this alternative media, right.
4702.98s - 4703.78s |  It's so crucial.
4703.86s - 4704.14s |  Yeah.
4704.38s - 4704.54s |  Yeah.
4704.78s - 4709.58s |  I will say that the very first time that I laughed out loud in front of a computer
4709.58s - 4713.90s |  screen from reading something was, was drunk fucks going to McDonald's and trying
4713.90s - 4716.66s |  to order a big Mac with four patties, a quadro pounder.
4716.66s - 4716.90s |  Yeah.
4717.66s - 4717.98s |  Yeah.
4718.34s - 4719.42s |  Uh, no veggies.
4719.42s - 4720.10s |  Don't wrap it.
4720.10s - 4723.94s |  Throw it on the founder and I'll take it like a pounder bitch.
4724.02s - 4724.34s |  Yeah.
4724.42s - 4725.74s |  This is your homework assignment.
4725.74s - 4728.14s |  If you're in the audience, read this text file tonight.
4728.38s - 4729.42s |  It will change your life.
4731.30s - 4731.66s |  All right.
4731.70s - 4735.62s |  I want to do one more question before we open the floor for questions.
4735.82s - 4737.10s |  Where is all this going?
4737.14s - 4740.02s |  Where, what is the relevance, especially of these older ideas?
4740.14s - 4742.06s |  I mean, think about what the internet is today, right?
4742.06s - 4743.10s |  It's very corporate.
4743.34s - 4744.62s |  It's centralizing.
4744.86s - 4748.98s |  Um, I think there definitely is a need for fresh voices and alternative media, right?
4748.98s - 4751.94s |  Zines text files, can this stuff actually come back, right.
4751.94s - 4754.34s |  And have this kind of relevance like it did back in the eighties and nineties.
4754.42s - 4758.02s |  I mean, I, I think it's important to point out that like the, the tech world
4758.02s - 4762.98s |  today is run by, and you know, the founded by people who are, were hackers.
4763.06s - 4763.46s |  Exactly.
4763.46s - 4766.78s |  I mean, everything from, from Steve Wozniak and Steve jobs, you like the way
4766.78s - 4770.50s |  they got the money to, to build the first Apple ones is by selling blue boxes, you
4770.50s - 4774.54s |  know, like, and, and it, you look at how many companies are out there, how many
4774.54s - 4777.50s |  big businesses like came out of like people from the hacker scene, like it's,
4777.78s - 4778.94s |  it's not to be underestimated.
4778.94s - 4780.18s |  How did it get so bland then?
4780.46s - 4780.58s |  Yeah.
4780.58s - 4781.38s |  They all got corrupt.
4781.90s - 4783.30s |  People get boring and they want money.
4785.74s - 4785.94s |  Yeah.
4785.94s - 4787.26s |  That's part of the issue.
4787.26s - 4788.06s |  Selling out.
4788.22s - 4788.58s |  Yeah.
4788.62s - 4793.38s |  Well, no, I think, I think, well, well, first I just want, let me just sideways
4793.38s - 4799.54s |  say that like another parallel technical culture that grew up with hacking and
4799.54s - 4802.22s |  parallel was EDM, like EDM matured.
4802.22s - 4806.14s |  I don't know if you guys know, like the Detroit scene, like, you know, and
4806.14s - 4811.94s |  connected, I mean, initially influenced by German, Germany, which also had an
4811.94s - 4814.90s |  amazing hackering culture to this day.
4814.98s - 4819.54s |  Yo, that ran parallel, but in terms of like where, like in terms of what you're
4819.54s - 4825.38s |  saying, like there's also been a rapid commodification in terms of like security,
4825.38s - 4830.94s |  like in a lot of ways, once again, people think about the mythology of hackers.
4830.94s - 4831.26s |  Right.
4831.26s - 4835.18s |  But then it's been commoditized so effectively.
4835.18s - 4837.42s |  Cause yo, you just get your like a life hacking.
4840.82s - 4846.58s |  So you, it's so easy to like, sort of like, um, um, uh, yeah, all the channels
4846.58s - 4851.38s |  have been commodified in a way and that in a way suppresses culture because like
4851.38s - 4856.26s |  you could just monetize it so fast and that doesn't give a culture breathing room.
4856.30s - 4859.98s |  Now I think that culture is still there evolving and stuff.
4859.98s - 4860.58s |  I see it.
4860.58s - 4863.22s |  But like I said, that is, you know, kind of an end run.
4863.22s - 4866.58s |  And a lot of times when that happens, that's when like new shit breaks
4866.58s - 4868.38s |  out or a new kind of thing.
4868.38s - 4873.26s |  Like, you know, that like hip hop and punk and EDM, that's all a turning
4873.26s - 4874.98s |  point response to, you know what I mean?
4874.98s - 4876.02s |  A change in culture.
4876.30s - 4879.54s |  And even now I feel like there's a change in culture afoot and
4879.54s - 4881.58s |  we'll see that both in film.
4881.86s - 4883.74s |  I watch Skippity Toilet every day.
4883.78s - 4886.46s |  Like I don't watch that corny fucking movie shit.
4886.54s - 4891.50s |  I think my point being that like you can see the culture turning and in that,
4891.70s - 4895.90s |  you know, we'll see like a new evolution of, uh, of that kind of underground
4895.90s - 4899.26s |  and what form that'll take will be interesting to me, I'll be watching.
4899.82s - 4899.98s |  Yeah.
4899.98s - 4906.34s |  You know, it's, um, the way, um, the net is evolving now and the
4906.34s - 4910.30s |  concept of creativity, they're not compatible, they're not compatible.
4910.34s - 4915.62s |  Amazon, Google, um, all these massive entities that want to control every
4915.62s - 4922.10s |  single, um, uh, ingredient in the whole, uh, the whole process, that's
4922.10s - 4924.06s |  not what being creative is.
4924.14s - 4926.38s |  Um, so something is going to change.
4926.38s - 4927.10s |  I don't have the answer.
4927.10s - 4930.46s |  I don't know what's going to change, but something major has to change if
4930.46s - 4934.70s |  we're going to continue to, um, encourage creative people to express
4934.70s - 4936.98s |  themselves using digital technology.
4937.02s - 4938.62s |  I see it happening myself.
4938.66s - 4943.18s |  I mean, in my practice, you know, one of my practices is, is working as a
4943.18s - 4945.82s |  futurist and with young people.
4945.82s - 4948.02s |  And I run this space in Los Angeles called R.I.P.
4948.02s - 4954.46s |  Space that is like a, it allows like, it's a hacker, hack tech media place.
4954.46s - 4958.30s |  And I have like a, a strong, um, community.
4958.30s - 4961.62s |  Like I have a bunch of friends in the cyber feminism world
4961.62s - 4964.18s |  who, uh, who curate with me there.
4964.18s - 4969.30s |  And I think like you can see the new emergence happening and stuff.
4969.30s - 4972.42s |  And it, and like I said, you can see the parts of the culture falling apart.
4972.42s - 4975.26s |  Like you were saying with the corporate thing, there's like the dead internet
4975.30s - 4977.42s |  theory, which is not really a theory.
4977.42s - 4981.14s |  You see it and media, like what, you know, just as you, you see pieces
4981.14s - 4985.62s |  disappearing because once, once it's purchased and locked the rights, they
4985.62s - 4986.82s |  could just make it disappear.
4986.82s - 4987.30s |  And that's it.
4987.30s - 4988.50s |  You don't have any ephemera.
4988.50s - 4990.50s |  You don't have any physical media.
4990.50s - 4994.22s |  Like you were saying, like with the newsletters, like a blog can just, you
4994.22s - 4997.42s |  could turn out the lights, we get to pay the bill or more importantly, yo,
4997.42s - 4999.70s |  somebody buys GeoCities and it's just gone.
4999.70s - 5002.50s |  And they're like, it's not cost effective to run it anymore.
5002.78s - 5005.58s |  And then that saps an entire part of creativity.
5005.58s - 5008.86s |  But that being said, everything's a cycle that happens.
5009.02s - 5014.50s |  Something else will begin to emerge from, from the detrius that is from that
5014.50s - 5017.22s |  particular, you know, in run of corporate mouth.
5017.54s - 5018.90s |  You come, you come back to the whole thing.
5018.90s - 5022.34s |  Like, you know, the internet interprets censorship as, as, you know, a
5022.34s - 5023.50s |  problem and routes around it.
5023.50s - 5025.98s |  Like, you know, it's the same sort of, you know, the cultural will interpret
5026.30s - 5031.54s |  commodification and, and control as, as an, as a, as a blocker and just route
5031.54s - 5031.94s |  around it.
5033.46s - 5034.38s |  Culture hacking.
5035.78s - 5038.02s |  Remember all, all the protocols are open.
5038.22s - 5039.30s |  The code is out there.
5039.42s - 5040.50s |  Build an alternative.
5041.54s - 5041.90s |  Yeah.
5043.26s - 5044.38s |  That's your homework assignment.
5045.46s - 5046.02s |  Let's do Q&A.
5046.06s - 5046.30s |  Okay.
5046.30s - 5048.74s |  I just want to say first, like we're going to, we're going to do a Q&A, but
5048.74s - 5050.70s |  also we have a very limited number.
5050.70s - 5053.30s |  I don't know if actually or any are left of the cult of the dead cow book that
5053.30s - 5054.54s |  are going to, that we have for sale.
5054.98s - 5058.42s |  Autographed by the author and a member of the seat, much of the CDC members.
5058.74s - 5061.98s |  Um, money is going, speaking of building a new network, uh, to
5061.98s - 5063.18s |  benefit the veil of foundation.
5063.42s - 5068.22s |  There's also CDC 40th anniversary challenge coins and various other
5068.22s - 5068.82s |  stuff over there.
5068.82s - 5071.78s |  If anybody's interested that, that we're selling as well as I think there's
5071.78s - 5074.66s |  still some free stickers, but there was a feeding frenzy on the stickers.
5074.66s - 5074.86s |  Yeah.
5075.14s - 5078.14s |  Oh, and also too, before you do the Q and a, you're not going to show.
5078.14s - 5080.74s |  I got, I got a little surprise.
5080.74s - 5082.30s |  Wait, I got to go to the end of the.
5083.30s - 5084.50s |  Is this a surprise job?
5086.62s - 5087.94s |  I can't see what's on the screen.
5087.94s - 5091.06s |  I'm just flipping through all the weird stuff at the end.
5091.46s - 5092.22s |  Yeah, man.
5092.22s - 5094.82s |  I mean, we need a little bit of, we talked about text files.
5094.82s - 5096.14s |  How about some real hacking?
5097.06s - 5098.50s |  A redacted document.
5098.98s - 5100.34s |  Yeah.
5100.34s - 5101.82s |  Take a look at that.
5101.90s - 5104.58s |  So one of the things, Oh, this is, this is elite.
5104.62s - 5105.22s |  This is elite.
5105.50s - 5108.46s |  So I don't know if it's on the screen, but, uh, it's still on the screen.
5108.50s - 5108.78s |  Yeah.
5108.78s - 5110.02s |  Well, why don't you read it real quick?
5110.02s - 5111.82s |  The unredacted parts, just a little bit.
5111.86s - 5115.06s |  Time of meeting place of meeting people involved.
5115.22s - 5118.54s |  The purpose of this report is to summarize the meeting that took place
5118.54s - 5123.46s |  between myself and two individuals from the redacted intelligence redacted.
5123.90s - 5128.18s |  The intent of the meeting was for the redacted to provide, am I a
5128.18s - 5132.06s |  comprehensive up-to-date training session on the techniques employed
5132.06s - 5135.06s |  to gather intelligence in this community?
5135.06s - 5138.78s |  The computer underground, Ooh, some of the more specific topics
5139.42s - 5143.70s |  included how to effectively create an alias that would produce favorable
5143.70s - 5145.94s |  results in gathering intelligence.
5147.18s - 5148.10s |  Agent steel.
5148.14s - 5148.42s |  Good.
5148.42s - 5148.62s |  Good.
5148.90s - 5149.10s |  What?
5149.10s - 5150.42s |  Not the death vegetable.
5151.70s - 5155.74s |  Buzzwords used by hackers when describing particular items like
5155.74s - 5159.82s |  where's items to be searching for when gathering intelligence from the
5159.82s - 5164.62s |  computer underground boxes, maybe, uh, techniques employed by law enforcement
5164.62s - 5168.34s |  to effectively protect their personal professional profile from
5168.38s - 5170.38s |  compromised by the hackers.
5171.18s - 5172.66s |  That's a little navel gazing there.
5172.66s - 5172.82s |  Yeah.
5175.30s - 5178.98s |  And then if you just go to the last page, what is this, this letter greetings?
5179.02s - 5179.30s |  Yeah.
5179.30s - 5183.10s |  It's, uh, it's, uh, from the mail spool at a mind box.
5186.58s - 5187.02s |  Wow.
5187.94s - 5190.86s |  Hackers, hacking, hacker, law enforcement.
5190.90s - 5197.78s |  Um, if, uh, he said he's going to nail the person that hacked the mind box.
5198.62s - 5200.02s |  So I don't think that happened.
5200.14s - 5201.10s |  Did he ever nail him?
5201.10s - 5204.26s |  I'm just curious on, on mind box.
5204.30s - 5207.26s |  But the letter from, Oh, Oh, it's Matt.
5208.18s - 5210.62s |  Oh, Matt cable system administrator.
5211.46s - 5212.30s |  Oh, no, no, no.
5212.34s - 5213.14s |  Access technology.
5213.14s - 5214.14s |  Probably did not.
5214.14s - 5215.22s |  I think he probably did not.
5216.22s - 5218.74s |  Of course he didn't nail a consulting pearl.
5219.02s - 5221.30s |  It's highly unlikely.
5223.14s - 5225.62s |  These are some folks, some very deep cuts.
5225.62s - 5229.70s |  For someone who gave you a password and said, welcome, have fun.
5230.90s - 5234.54s |  So, uh, but there are a couple of microphones, if you have a question for
5234.54s - 5238.58s |  our panel, come on up on each aisle.
5238.58s - 5241.38s |  So if you have a question, if we've got like, I think about as you can tell,
5241.38s - 5243.30s |  our panelists love to talk.
5243.30s - 5247.30s |  So let's start, let's start over here on the right.
5247.54s - 5248.86s |  It's a great text file for anyone.
5249.06s - 5253.70s |  Oh, are the mics on the Q and a mics?
5253.74s - 5253.86s |  Yeah.
5253.86s - 5255.22s |  The Q and a mics need to be on.
5255.82s - 5256.10s |  Okay.
5256.10s - 5256.54s |  Try again.
5257.10s - 5257.42s |  Hello.
5257.98s - 5258.50s |  Can you hear me?
5258.82s - 5259.14s |  Yes.
5259.46s - 5261.74s |  So, um, it's, I mean, it's interesting.
5261.74s - 5263.30s |  I've been, I think it needs to be louder.
5263.30s - 5263.54s |  Sorry.
5263.54s - 5263.66s |  Yeah.
5263.66s - 5264.02s |  Louder.
5265.38s - 5265.82s |  Hello.
5265.86s - 5266.26s |  There we go.
5266.26s - 5266.66s |  There we go.
5266.66s - 5271.58s |  Now, um, uh, I just wanted to ask you, I I've been kind of.
5272.26s - 5273.78s |  Periphery to what you guys have been doing.
5273.78s - 5279.14s |  I've been in a computer networking space since the seventies, but I wanted to ask
5279.14s - 5285.22s |  you about modern hacking, particularly with the, um, you know, the authoritarian
5285.26s - 5291.54s |  countries like Russia, China, North Korea, kind of coming into the, you know, the
5291.54s - 5295.22s |  hacking space, so to speak, just want to get your thoughts on that, you know?
5295.46s - 5299.98s |  You mean in terms of, of, uh, as nation state actors or, or people in
5299.98s - 5303.54s |  authoritarian States trying to get access to the free internet or.
5303.86s - 5306.06s |  Well, I mean, yeah, it could be that true.
5306.06s - 5311.06s |  I mean, it's impacting the culture and, and you know, what's your perceptions
5311.06s - 5314.18s |  on that whole, that, that evolution that's occurred.
5315.18s - 5316.46s |  Does anybody want to take that first?
5316.78s - 5320.82s |  Well, if one thing I'll say about that is one thing about the hacking community
5320.82s - 5321.78s |  has been really good.
5322.26s - 5327.18s |  Um, on all sides of the spectrum is the idea to be able to help people in other
5327.18s - 5331.14s |  countries, freely communicate with other countries because a lot of countries
5331.18s - 5336.58s |  authoritarian sometime, um, they want, yeah, they seek to control the conversation
5336.90s - 5341.42s |  between other countries and definitely people try to relate at with proxies or
5341.42s - 5342.14s |  different tools.
5342.14s - 5346.74s |  So that way they can get information out or get the information in for whatever
5346.74s - 5351.26s |  purpose that could be just to talk to family or, you know, if there is, you
5351.26s - 5355.90s |  know, like I said, a change in, uh, um, in, uh, you know, in, uh, in what the
5355.90s - 5357.66s |  people want from their government.
5358.06s - 5361.06s |  Um, so in that regard, the hacker community has been great and there's
5361.06s - 5364.94s |  definitely, you know, public organizations you can get involved with and there's
5364.94s - 5369.30s |  also private ones, but that part is actually a really amazing, you know,
5369.62s - 5373.86s |  smaller, not as well documented in the press, which is probably for the best in
5373.86s - 5374.14s |  a way.
5374.50s - 5378.42s |  Cause one thing is definitely nation States like to target reporters quite a
5378.42s - 5382.14s |  bit, which is another very expensive, uh, expansive topic actually.
5382.46s - 5383.02s |  But yeah,
5384.62s - 5384.82s |  yeah.
5385.50s - 5386.34s |  Next question over here.
5387.62s - 5391.74s |  Um, back in the day we had like a Commodore and if the kid messed it up,
5391.74s - 5392.66s |  you could reset it.
5392.66s - 5396.18s |  And later on we had windows and you couldn't mess with it anymore because
5396.18s - 5398.94s |  then dad couldn't do his work and had to get somebody to fix it.
5399.38s - 5400.94s |  And you could explore.
5400.94s - 5405.46s |  And now we've got webpages where you get sued because you vote, viewed the
5405.46s - 5407.22s |  source code of the webpage.
5407.74s - 5411.74s |  Uh, hacking used to be fun and educational and now it's become downright
5411.74s - 5412.74s |  dangerous.
5412.90s - 5414.02s |  So it was always dangerous.
5415.78s - 5421.66s |  It's, I think it, there was a lot of us back then that we did it even despite
5421.66s - 5422.50s |  it being dangerous.
5422.50s - 5426.30s |  And now a lot of people are afraid to even try, what can we do to help this?
5426.34s - 5430.22s |  Well, you gotta get the idiots, uh, who think they're in power out of power.
5430.22s - 5433.50s |  I think what you're referring to is the attorney general in Missouri.
5435.10s - 5438.74s |  Uh, if I'm to have this correct, the attorney general in Missouri decided
5438.74s - 5443.78s |  that viewing source code of a webpage was tantamount to committing a crime.
5444.10s - 5446.14s |  Uh, I think he threatened a reporter with jail time.
5446.34s - 5449.46s |  Look, there are people who don't get technology who don't get what we're all
5449.46s - 5450.82s |  about or they're not interested in getting it.
5450.82s - 5452.66s |  They're just using it as hammer.
5452.70s - 5453.82s |  They use fear tactics.
5453.82s - 5457.18s |  They use their own ignorance and I think that they can intimidate people.
5457.50s - 5461.98s |  And, you know, hacking has always been about, um, saying, you know, we're
5461.98s - 5462.78s |  going to do it anyway.
5463.26s - 5467.46s |  And, um, we have to, to stand by each other and, and, and not let
5467.46s - 5468.42s |  ourselves be intimidated.
5468.46s - 5470.22s |  I think for me, oh yeah.
5470.74s - 5475.30s |  Uh, for me, I view like hacking as inherently, uh, anti-authoritarian,
5475.34s - 5479.18s |  like, like, like you are breaking into a system for me, like hacking means
5479.18s - 5483.06s |  like you're doing something to a system, whether it's a computer system, a
5483.06s - 5486.66s |  cultural system, anything, whether it's Ikea hacking, whatever you are doing
5486.90s - 5491.86s |  something with a system that it was not intended to, that you were not intended
5491.86s - 5493.26s |  to do, it might be illegal.
5493.30s - 5496.14s |  I mean, Ikea hacking isn't illegal, but it's, you know, you were not that
5496.14s - 5497.34s |  you're not following the instructions.
5497.34s - 5498.62s |  You're doing it your own way kind of thing.
5498.70s - 5499.50s |  It's a mindset.
5499.54s - 5500.26s |  Yeah, exactly.
5500.30s - 5501.82s |  Hacking is an individual act.
5501.82s - 5505.38s |  I mean, you know, you couldn't say that nation states use hacking, uh,
5505.38s - 5506.98s |  abilities, use hacking skills.
5507.34s - 5510.58s |  Uh, but hackers as a rule are individuals.
5510.58s - 5513.82s |  They don't make good soldiers because they ask a lot of questions and they,
5513.82s - 5518.18s |  they think outside the box and they, they type things that they shouldn't
5518.18s - 5519.66s |  type and according to the rules.
5519.66s - 5520.10s |  Exactly.
5520.10s - 5521.54s |  So, um, something to keep in mind.
5522.54s - 5523.42s |  All right over here.
5524.14s - 5525.46s |  Uh, I have a question for the panel.
5525.50s - 5527.74s |  Uh, the guys that could you speak up a little bit?
5527.74s - 5530.50s |  I think I, uh, I have a question for the panel.
5530.50s - 5534.50s |  You spoke briefly about freaking and, and ISDN and all that kind of cool stuff.
5534.82s - 5536.62s |  Um, I'm super interested in the topic.
5536.70s - 5540.26s |  Uh, what would be a good starting point for me to dive into that, that world?
5540.58s - 5541.70s |  2,600 magazine.
5542.14s - 5543.26s |  Well, that's just one of many.
5543.26s - 5548.46s |  There are so many, um, um, books and guides and online tutorials.
5548.62s - 5550.58s |  It's hard to point to one thing.
5550.86s - 5551.82s |  Exploding the phone.
5552.26s - 5555.10s |  Lapsley has a book on this topic.
5555.10s - 5558.18s |  It's, it's, um, it's a very long book on the history of freaking called
5558.18s - 5560.10s |  exploding the phone by Phil Lapsley.
5560.98s - 5561.18s |  Yeah.
5561.18s - 5563.18s |  I think, I think it's, it's hacker approved.
5563.22s - 5564.02s |  Everybody loves it.
5564.26s - 5564.86s |  Check it out.
5565.66s - 5566.06s |  Appreciate it.
5566.26s - 5566.50s |  All right.
5569.70s - 5570.06s |  Level.
5570.26s - 5570.66s |  Oh, there we go.
5570.66s - 5574.38s |  Now we have, um, back in the day, I loved reading the books
5574.38s - 5576.18s |  about hackers in the eighties and nineties.
5576.62s - 5580.26s |  Uh, I'm curious about commentary from folks who have appeared, uh, as
5580.30s - 5585.38s |  semi fictional characters in unauthorized biographies, laud mod wars, things like
5585.38s - 5590.18s |  that, or those who have appeared as a named character in a movie, or even
5590.18s - 5595.26s |  to have in a book now where they've worked with the author, I mean, uh, I
5595.26s - 5598.82s |  can't speaking, you know, from, for the CDC book who the author of whom is
5598.82s - 5602.58s |  hiding behind his notebook right there for some men, like, you know, what I
5602.58s - 5605.86s |  would say is it is not the book that, that we would have written about CDC,
5605.90s - 5607.18s |  but we didn't write the fucking book.
5607.54s - 5610.82s |  So, uh, you know, and I think he, he did, he did write by us.
5610.82s - 5615.42s |  I think, um, largely speaking, I think, you know, uh, John might have a
5615.42s - 5617.78s |  different opinion about the, the, the MOD book.
5617.82s - 5619.78s |  Maybe you can talk about how, what that was for you.
5619.86s - 5620.26s |  Yeah.
5621.86s - 5624.02s |  Was there even a, um, a mod laud war?
5624.54s - 5625.34s |  Did that really happen?
5625.38s - 5625.74s |  Oh yeah.
5625.74s - 5626.06s |  What?
5626.34s - 5627.26s |  Did that even exist?
5627.46s - 5628.62s |  Was there a mod laud war?
5628.62s - 5629.30s |  Cyber war.
5631.06s - 5632.42s |  That's for a different session.
5632.54s - 5632.82s |  Okay.
5634.82s - 5637.70s |  And if you're referring to Emmanuel Goldstein in, uh, in the film
5637.70s - 5638.82s |  Hackers, that was a joke.
5638.90s - 5641.54s |  But I have a, oh yeah, I do have a quick story.
5641.54s - 5643.26s |  So, and, and, and a plug.
5643.26s - 5647.94s |  So I have a, uh, I'm working, I, I rep by, uh, uh, SpectraVision,
5647.94s - 5649.22s |  which is Elijah Woods company.
5649.22s - 5653.62s |  And I'm going to do, uh, one of the projects I'm going to do is a Spotify,
5654.50s - 5659.14s |  uh, based, um, uh, podcasts about hacking and stuff, you know?
5659.38s - 5662.66s |  But one of the stories that's interesting is that this guy wrote a,
5663.26s - 5666.42s |  a book, a fucking, what's it called?
5666.42s - 5668.10s |  A, a graphic novel.
5668.10s - 5672.18s |  He's a very famous graphic novelist and he wrote a story and he
5672.18s - 5675.62s |  actually lifted a lot of my story.
5675.90s - 5678.78s |  There's actually another book that, uh, the Hacker Cracker book
5678.78s - 5680.58s |  that that guy stole my story.
5680.58s - 5685.38s |  He said he was a Decepticon from Brooklyn, but yo, Decepts was over by 2000,
5685.38s - 5685.66s |  brother.
5685.66s - 5686.62s |  I was the only one.
5687.06s - 5688.70s |  Yo, why you stealing my street cred?
5688.70s - 5692.86s |  But yo, this other guy wrote this book, steals part of my story, puts it in
5692.86s - 5696.10s |  there, but didn't turn around just the other day.
5696.10s - 5701.18s |  Unfortunately he, he committed suicide and it's just such a bizarre set of
5701.18s - 5706.38s |  circumstances that like, you know, we're going to have his partner on the show.
5706.38s - 5708.10s |  I just can't believe like that.
5708.66s - 5708.98s |  Yeah.
5709.10s - 5712.42s |  And, and then, yeah, just some shit happened where he, um, wound up accused
5712.46s - 5717.70s |  of, um, um, inappropriate, um, conversations with people who are under
5717.70s - 5719.70s |  age and a sexual manner.
5719.70s - 5722.18s |  And then, you know, and, and he committed suicide.
5722.18s - 5724.10s |  So it was just weird, you know, link.
5724.10s - 5726.30s |  But anyway, I just wanted to tell that story since you had mentioned like
5726.58s - 5730.46s |  fictional stuff and you know, I see stuff sometime, like I'm like, ah, I
5730.46s - 5731.82s |  say, yo, I don't give a shit.
5731.86s - 5732.54s |  Like, you know what I mean?
5732.54s - 5736.54s |  But sometime they do, they kind of, yeah, they be stealing my shit a little too much.
5736.90s - 5738.46s |  In, in a CDC, we have a thing.
5738.46s - 5740.86s |  Like we keep track of like people who like claim they're part of the
5740.86s - 5741.66s |  cult of the cow, whatever.
5741.66s - 5743.42s |  And we, the phrase you use is stolen utter.
5743.74s - 5748.90s |  So I'm still, yeah, we get, we, we keep a list, man.
5749.74s - 5749.98s |  All right.
5749.98s - 5750.66s |  Next one over here.
5751.38s - 5753.46s |  Uh, so not so much questions.
5753.62s - 5757.26s |  Oh, not so much a question or anything.
5757.26s - 5761.06s |  Just wanted to say, this is the, my fourth con, my fourth death con, uh,
5761.10s - 5761.66s |  DEF CON.
5761.66s - 5766.74s |  And, uh, uh, this is probably my favorite panel in the four DEF CONS.
5766.90s - 5767.50s |  All right.
5771.50s - 5774.10s |  You know, I always wonder, like when I was putting in the proposal for this,
5774.10s - 5775.62s |  I'm like, is this something people give a shit about?
5775.62s - 5776.46s |  Like, it's important to me.
5776.46s - 5778.38s |  It's important to us, but I don't know whether you guys care.
5778.38s - 5780.58s |  Like I'm going to give you a little piece of my history.
5780.62s - 5787.50s |  Uh, I started hacking two to three years before you guys created CDC.
5788.22s - 5794.86s |  And, uh, my first, you know, Commodore 64, um, with the modem, I had the
5794.86s - 5800.66s |  little plugin slide modem, uh, I, I, I reserved the airline ticket for
5800.66s - 5802.82s |  Michael Jackson to fly and come to my house.
5805.18s - 5810.02s |  One of the first things I had the, the Casio phone dialer, and I used to
5810.02s - 5812.62s |  freak the hell out of my face with that.
5812.62s - 5815.98s |  So I want to say, you know, you guys gave me a flashback to the past, man.
5815.98s - 5817.02s |  That was a beautiful thing.
5817.26s - 5817.82s |  Got the book.
5817.82s - 5818.50s |  I'm going to love it.
5818.50s - 5818.90s |  Read it.
5819.38s - 5820.14s |  Thank you for coming.
5820.46s - 5821.18s |  I want to hear more.
5823.46s - 5826.02s |  I think you got one over here and then, yeah, I think we're almost out of time.
5826.02s - 5826.14s |  Right?
5826.14s - 5826.34s |  Yeah.
5826.82s - 5827.02s |  Yeah.
5827.06s - 5827.42s |  Over here.
5827.78s - 5828.70s |  Until they kick us off.
5828.74s - 5829.30s |  That's what they kick us.
5829.30s - 5829.50s |  Okay.
5829.50s - 5830.14s |  We're just going to keep going.
5830.50s - 5831.50s |  We're hacking the schedule.
5831.54s - 5833.70s |  How are we going to talk about real hacking shit?
5833.74s - 5834.58s |  You guys ready?
5834.58s - 5836.58s |  That, that just only got started.
5838.02s - 5838.14s |  Yeah.
5838.14s - 5840.94s |  I mean, like we could talk about this shit for fucking days, as you can tell,
5841.54s - 5847.06s |  so I saw a few of you have a title of archivist or part of your, your bios for
5847.54s - 5853.10s |  archivist for those that might be in the audience, like me, who might have archives
5853.10s - 5857.78s |  from the eighties and nineties, all that old crap that we have laying around on
5857.78s - 5859.86s |  floppy disks or printouts or something.
5860.30s - 5861.78s |  Is there stuff you're looking for?
5862.22s - 5863.50s |  That is an excellent question.
5863.50s - 5864.22s |  All of it.
5864.46s - 5865.22s |  Yeah, absolutely.
5865.22s - 5865.70s |  All of it.
5865.82s - 5866.10s |  Okay.
5866.70s - 5870.50s |  We should chat after, uh, I don't know.
5870.50s - 5875.14s |  I mean, I have ran an elite three disks laying around from the bulletin board that
5875.14s - 5875.66s |  I ran.
5875.90s - 5880.46s |  I mean, you definitely want to talk to Jason Scott, archive.org.
5880.50s - 5883.14s |  I mean, that's, that's good for like the, the, the media and stuff.
5883.14s - 5885.98s |  I think a bigger question that, you know, we've been talking about for years is some
5885.98s - 5889.14s |  sort of like to find an organization, a university, a museum or something that
5889.14s - 5892.14s |  would take, create like a collection based for the computer underground.
5892.14s - 5896.30s |  And I've been talking about like the need to do, you know, basically an oral history
5896.30s - 5896.98s |  of the computer underground.
5896.98s - 5898.34s |  Cause we're fucking dying, man.
5898.34s - 5902.02s |  Like literally like, you know, three, there are three CDC members who've died in the
5902.02s - 5902.90s |  last few years.
5903.30s - 5907.42s |  Um, the founder of root just passed away last year and like, these are, you know,
5907.42s - 5911.02s |  it's like, like the Blade Runner thing, you know, these are stories passing away
5911.02s - 5912.58s |  like tears and tears in the rain.
5912.58s - 5916.54s |  Like, uh, and, and for me, you know, I certainly wouldn't be the person I am if
5916.54s - 5919.38s |  it hadn't been for the hacker community and like coming up through this and like,
5919.38s - 5923.46s |  so I think this culture is important both personally and because as I was alluding to
5923.50s - 5929.70s |  earlier, it has had a massive impact on, you know, outside culture, you know, sort
5929.70s - 5931.38s |  of Normie culture.
5932.10s - 5935.86s |  But if you're looking for a clearing house, um, right now, in my opinion,
5935.86s - 5939.70s |  archive.org is doing the best job and Jason Scott has a real passion for our
5939.70s - 5941.78s |  community and has done so much.
5941.82s - 5946.02s |  He was, he, you know, the, my, the, the, the big hacker board that was a CDC board
5946.06s - 5948.86s |  that I was on was the works in, in Boston.
5948.86s - 5952.78s |  You, if you read like duo securities, like history of the loft, like that is where
5952.78s - 5955.54s |  the loft came together, was on this bulletin board on the works.
5955.54s - 5957.10s |  And it was founded by Jason Scott.
5957.10s - 5960.82s |  So, you know, he doesn't really talk about that stuff, but he was instrumental, like
5960.82s - 5966.06s |  sort of, um, by extension in bringing together a lot of the people who were then
5966.06s - 5968.22s |  instrumental in, in the hacker scene of the nineties.
5968.38s - 5971.46s |  And any remnant of geo cities that still exist today, it's because of him.
5977.02s - 5978.42s |  So, first of all, thank you guys.
5978.46s - 5984.38s |  Uh, you know, growing up with CDC text files and hope 2001, 2002, um, hugely
5984.50s - 5985.54s |  formative experiences.
5985.54s - 5986.66s |  So thank you guys for this.
5986.66s - 5988.46s |  This is a, is a big deal for me.
5989.30s - 5993.66s |  Um, we talked about, you know, hacking has always been dangerous, but which is true,
5993.66s - 5995.74s |  but you know, back in the day, they didn't really know what to do with us.
5995.74s - 5995.94s |  Right.
5995.94s - 5999.94s |  You talked about stuff was left on passworded and whatever these days you
5999.94s - 6002.30s |  really run the risk getting in somewhere.
6002.30s - 6004.50s |  They're going to, you know, throw the book at you.
6005.14s - 6010.70s |  Um, what are some things you think we can do to kind of give back, you know, uh,
6010.74s - 6016.30s |  provide hosting or something without exposing ourselves to undue risk, um, and
6016.30s - 6019.18s |  contribute to the de-shitification of being inclusive is huge.
6019.18s - 6023.74s |  Being inclusive to the people we perceive as enemies, because that's the way they
6023.74s - 6025.30s |  understand what we're all about.
6025.34s - 6029.18s |  You know, having people attend conferences like this one, seeing what hacker spirit
6029.18s - 6034.10s |  truly is, maybe they won't want to lock us up then maybe, you know, they'll listen.
6034.10s - 6035.98s |  Maybe they'll reach out to us instead.
6036.26s - 6040.02s |  You know, speaking personally, uh, what I was convicted of.
6040.06s - 6044.02s |  If that happened today, I wouldn't be around, you know, that there's just no
6044.02s - 6048.98s |  way I was treated fairly and look what I did, you know, I annoyed the hell out of,
6048.98s - 6051.90s |  uh, uh, the, the powers that be for, for four decades.
6052.30s - 6057.06s |  Um, so, you know, it's, um, if, if you treat people, right.
6057.06s - 6059.90s |  If you, uh, listen to what they're doing, what they're saying, you'll
6059.90s - 6060.98s |  learn something from them.
6060.98s - 6062.66s |  And that, that works in all directions.
6062.78s - 6067.06s |  I mean, I think that's true, but also like there are, you know, as you, things
6067.06s - 6070.54s |  have changed in some ways, like there's stuff that I did, um, that I'm not going
6070.54s - 6073.94s |  to necessarily talk about that, that, uh, you know, I might've gotten like at the
6073.94s - 6077.22s |  time, kind of like a slap on the wrist or it might've been a, you know, something
6077.22s - 6080.86s |  that now, now, you know, it wouldn't necessarily be Gitmo, but it would, you
6080.86s - 6085.34s |  know, like I would not, it would not be a happy experience for me if today, if I
6085.34s - 6088.78s |  was busted for stuff that happened, that, you know, that what the punishment would
6088.78s - 6089.50s |  have been back then.
6089.50s - 6094.30s |  And there are kids whose lives are going to be ruined in the future if we don't
6094.30s - 6095.02s |  change this.
6095.90s - 6096.42s |  All right.
6096.62s - 6101.46s |  Well, let me, if I could jump in on that real quick, just the idea, one, one thing
6101.46s - 6106.66s |  that I think is interesting is that that question is interesting for me.
6106.66s - 6113.54s |  I would say that ultimately it is better to not have fear.
6113.54s - 6117.78s |  You should be not afraid to explore the world around us.
6117.82s - 6123.58s |  I think the first thought is to just think about, I like the idea of just blue sky
6123.58s - 6127.70s |  ideation and just being able to explore, which is the heart of the hacker
6127.70s - 6128.34s |  community.
6128.74s - 6133.22s |  When you start erecting too many rules around yourself and guidelines, yo, you
6133.22s - 6135.70s |  just limit your own creativity.
6135.74s - 6142.02s |  Like I had a class that I taught at university and about hacktivism and one
6142.02s - 6147.94s |  of the, one of the amazing classes was called a, we, we had them ask, come up
6147.94s - 6150.62s |  with ideas how to defeat AI just on paper.
6151.06s - 6152.58s |  And they loved the class.
6152.58s - 6154.62s |  It was an amazing fucking class.
6155.34s - 6160.54s |  I would hire all of them for work on a, on a, on a contract.
6160.82s - 6164.74s |  But my point being is that it's multiple ways to think about ideas.
6164.74s - 6169.22s |  I think what happens is so many people get caught up in, in that.
6169.26s - 6173.94s |  And like I said, they never get a chance to fully explore the intellectual, you
6173.94s - 6176.18s |  know, abilities that they have.
6176.18s - 6179.54s |  And that may include exploring and finding new loopholes.
6179.54s - 6184.14s |  Like I said, just even doing it on paper or chat GPT, you know, you could break
6184.14s - 6186.06s |  chat GPT, go poison the model.
6186.06s - 6189.82s |  Maybe I'm saying too much, but the point is that, yo, no one's gonna arrest you
6189.82s - 6191.86s |  for that yet, soon, not yet.
6193.30s - 6195.70s |  There's so many domains to explore.
6196.02s - 6197.26s |  Um, um, yeah.
6197.26s - 6200.90s |  And I think, you know, you could say, be careful, but I also say, yo, sometimes
6200.90s - 6202.42s |  you just gotta get out there and do shit.
6202.78s - 6204.46s |  This is not legal advice.
6206.90s - 6207.82s |  But it's good advice.
6207.94s - 6208.54s |  It's good advice.
6208.54s - 6209.06s |  It's good advice.
6209.26s - 6209.98s |  I'm trying my best.
6209.98s - 6211.02s |  My I'm from Canada.
6211.02s - 6216.26s |  My flipper zero is illegal, but, Oh, Oh, all right.
6216.26s - 6216.66s |  Over here.
6221.18s - 6222.02s |  Hit the microphone on.
6223.42s - 6224.22s |  Oh, there's nobody here.
6224.38s - 6225.10s |  There's nobody there.
6226.02s - 6227.06s |  Wait, wait, wait, wait, wait.
6228.06s - 6228.42s |  Test.
6228.50s - 6228.98s |  Yeah, there you go.
6228.98s - 6229.50s |  You're good.
6232.50s - 6235.46s |  I don't know what to call it, but I'm going to call it the underground fed side
6236.94s - 6241.46s |  because we did things that weren't approved of by the FBI.
6242.78s - 6243.30s |  Okay.
6244.14s - 6249.06s |  Um, one of them was even coming to DEF CON conferences surreptitiously because
6249.06s - 6252.70s |  we wanted to know how to harden a nationally secure computer, which we'd
6252.70s - 6256.18s |  signed off in blood that we did a good job, but we couldn't get a list of what
6256.18s - 6261.94s |  was vulnerable because yes, the fed, the FBI, you know, what's the list of
6261.94s - 6262.50s |  vulnerabilities?
6262.50s - 6266.58s |  Where can I get a list of vulnerabilities of an HBUX system or a Sun microsystem?
6266.86s - 6270.46s |  And he said, the only person on earth who cares about that is criminal.
6270.50s - 6271.74s |  And you're not turning criminal.
6271.74s - 6272.02s |  Are you?
6273.58s - 6275.22s |  How in the world did I harden such a system?
6276.30s - 6280.74s |  Well, I went places I wasn't supposed to go under names.
6280.74s - 6281.90s |  I wasn't supposed to be.
6282.98s - 6287.22s |  Um, I remember 12 of us went to a DEF CON conference very early in the
6287.22s - 6288.70s |  sequence and I won't list the one.
6289.78s - 6292.02s |  And the idea was, is that no feds were going to come.
6292.78s - 6294.06s |  We could recognize feds.
6294.42s - 6295.30s |  They had a contest.
6296.06s - 6296.62s |  Okay.
6296.86s - 6298.54s |  To try to recognize feds.
6298.82s - 6303.26s |  And, uh, if any one of us told on the others under mutual assured
6303.26s - 6304.70s |  destruction, we're going to alter each other.
6306.34s - 6307.42s |  You get all the t-shirts that way.
6307.62s - 6308.10s |  Well, yeah.
6308.10s - 6313.02s |  So, so mutual is sure destruction of our careers was the deal.
6313.58s - 6316.82s |  So we just went off into a side conference and talked about what was
6316.82s - 6319.26s |  vulnerable for systems so we could harden them when we got back.
6320.26s - 6324.06s |  Now I know even the movie hidden figures doesn't cover all the hidden figures.
6324.06s - 6327.90s |  I know there are a lot of ladies that did some really awesome stuff.
6328.86s - 6329.34s |  Okay.
6330.66s - 6331.94s |  Not just the ones they showed.
6331.94s - 6335.26s |  I got names and people I met, they were just amazing.
6335.50s - 6344.02s |  Um, one of them did the invention of wing flutter analysis in 1943 because
6344.02s - 6345.70s |  all the engineers went to war.
6345.78s - 6348.70s |  So she was not a Rosie of the river.
6348.70s - 6352.14s |  She was a wing flutter analysis designer.
6353.78s - 6356.22s |  She went into computer programming in the 1960s.
6357.22s - 6366.14s |  Um, but I'm a decriminalization of hacking and the whole concept that
6366.14s - 6375.26s |  vulnerability, uncovery, disclosure, express exploration, uh, cleanup
6375.74s - 6380.06s |  limitation should be normal and it's okay.
6380.38s - 6384.62s |  And it's the idea of what's called what we now call a security researcher.
6385.14s - 6385.66s |  Right.
6386.46s - 6387.70s |  So that that's okay.
6387.82s - 6388.82s |  That's legal.
6388.98s - 6390.10s |  That's fine.
6390.18s - 6391.42s |  That's normal.
6391.94s - 6399.10s |  Um, we, uh, we did complaints to the FBI.
6399.18s - 6401.10s |  Like there was no tomorrow on that one.
6401.22s - 6401.62s |  We did.
6401.62s - 6402.34s |  We really did.
6402.62s - 6410.03s |  Um, I got into computer security because of a competing warfare exercise with a
6410.03s - 6411.87s |  toy national top secret on my hard drive.
6413.47s - 6415.75s |  I had to take out all computers, foreign and domestic.
6417.03s - 6424.07s |  To prove that I could move a secret from a top secret computer to merely a secret
6424.07s - 6427.79s |  computer, just because I wanted the computer update.
6427.95s - 6428.11s |  Yeah.
6428.11s - 6432.35s |  I mean, I think it's, I think it's fair to say that like, um, there are, could
6432.35s - 6433.55s |  you repeat that entire question?
6434.59s - 6439.11s |  Actually, sir, can you fill in the blanks in this document I have on the screen?
6439.31s - 6439.95s |  Oh, yeah.
6440.67s - 6450.79s |  Uh, unfortunately, no, I, I, I, I spent more time, um, spotting feds then, uh,
6451.19s - 6456.95s |  then, uh, uh, then attesting to the intelligence of a fed, sorry.
6457.35s - 6461.67s |  I do think, you know, you kind of raise a valid point, which is that there are
6461.67s - 6465.91s |  people working within a system that also need to, to maneuver around
6465.91s - 6467.67s |  the strictures of that system.
6467.71s - 6467.99s |  Yes.
6468.07s - 6468.27s |  Yeah.
6468.95s - 6471.27s |  But I, I know that we're almost running out of time, so I want to make sure
6471.27s - 6473.87s |  that, that these guys have a chance to, to, to get in their questions.
6475.31s - 6475.55s |  All right.
6476.43s - 6477.47s |  Oh, another microphone.
6477.51s - 6477.91s |  Okay, great.
6477.91s - 6478.23s |  Thanks.
6478.63s - 6480.67s |  First of all, thank you for coming out here.
6480.67s - 6482.99s |  I think the person to person is very important.
6483.51s - 6489.39s |  Um, so you all grew up, well, you were there when the internet was born and, uh,
6489.43s - 6495.15s |  you all had your, uh, really unique ways of thinking about information.
6495.71s - 6500.79s |  Um, and it seems like half of your energy was just getting to that
6500.79s - 6502.55s |  information when it started out.
6502.95s - 6507.95s |  And as you pointed out, now it's, it's free, it's everywhere, but you
6507.95s - 6510.35s |  also have your echo chambers.
6510.63s - 6514.47s |  You have, you get, you get a, you know, street cred for being the person
6514.47s - 6515.43s |  who found something, et cetera.
6515.55s - 6520.71s |  So, so now you have your, your echo chambers, you have your, uh, algorithmic
6520.99s - 6525.75s |  content, you have your, uh, machine learning, uh, hallucinations.
6526.35s - 6530.03s |  I just want to get your thoughts on how do you separate fact from fiction?
6530.03s - 6531.91s |  Now data is everywhere.
6532.19s - 6538.03s |  Well, speaking as the author of history of fake things on the internet available
6538.03s - 6539.71s |  wherever fine books are sold.
6540.07s - 6544.03s |  I mean, like there is no one single answer like, or, or specific thing,
6544.03s - 6545.43s |  but it's critical thinking, man.
6545.43s - 6550.07s |  It's like, uh, you know, being able to, being sure to assess everything
6550.07s - 6553.43s |  critically and, you know, I don't pretend to be a professor of this, but,
6553.43s - 6556.83s |  you know, it's, you know, think about, um, what the source is, like where's it,
6556.83s - 6559.63s |  where it's coming from, what the motivations might be, et cetera.
6559.63s - 6563.19s |  Like, you know, if other sources are saying the same things, et cetera.
6563.47s - 6565.91s |  And having real in-person conversations.
6566.87s - 6571.07s |  One thing, one thing that I would say about that is just, I think
6571.07s - 6573.39s |  about it like a thought problem.
6573.39s - 6578.03s |  We live in an era of like what I would call like an information atmosphere.
6578.55s - 6581.39s |  There's an amazing amount of data out there.
6581.39s - 6586.51s |  You can see every breach gets bigger and bigger and it's so much data to
6586.51s - 6588.39s |  process and there's all these tools.
6588.39s - 6594.31s |  Now in that is this like a, it's an amazing moment to figure out new tools
6594.31s - 6599.11s |  and ideas, how to move through this information atmosphere that has enveloped
6599.11s - 6605.99s |  the entire world and us, our personal, our digital selves, um, um, every, every
6605.99s - 6611.95s |  complex app or whatever webpage or fucking piece of media, it has all these
6611.95s - 6613.99s |  different layers of information.
6614.59s - 6619.51s |  So I don't, I'm just proposing back to you the idea of like thinking about it
6619.51s - 6622.23s |  that way as a way to like, to tackle it.
6622.23s - 6628.35s |  Cause in a way, in, in some ways figuring out how to navigate that, not as an
6628.35s - 6634.95s |  abstract can help you like reorient on what data is real.
6635.07s - 6639.39s |  I mean, in some ways it doesn't, there's so much misinformation and culture
6639.39s - 6642.23s |  jamming, I don't know how many people in here into culture jamming at all.
6642.63s - 6647.51s |  That's a whole other track, but the, but the idea of it, the idea that there's so
6647.51s - 6652.39s |  much voluminous information out there that you can actually get lost in your
6652.39s - 6657.91s |  own data and not able to really concentrate and make sense of your own thing.
6657.91s - 6662.95s |  There's that term about a hyper normalization and ideas about that.
6662.95s - 6666.79s |  Yo, you could actually be overloaded with information and lose yourself.
6667.31s - 6671.51s |  And I think you see that a lot in society, but it's an evolutionary
6671.51s - 6676.03s |  process as we try to figure out how to discern through the information
6676.03s - 6679.19s |  atmosphere, what's real and pull that out.
6679.19s - 6682.03s |  And in some ways it doesn't even matter if it's not real, if you
6682.03s - 6683.91s |  believe it, it's all that matters.
6683.95s - 6684.67s |  I don't know about that.
6684.95s - 6685.35s |  Whoa.
6685.35s - 6685.51s |  Yeah.
6685.51s - 6686.47s |  Check that film out actually.
6686.47s - 6689.59s |  Hyper normalization by Adam Curtis that covers like all of this and
6689.59s - 6691.51s |  Masters of Deception are in that film.
6691.71s - 6693.31s |  That we, we have, we got room for one.
6693.35s - 6693.51s |  Yeah.
6693.51s - 6697.55s |  Well, more of a, if anyone wants to catch up with us afterwards,
6697.55s - 6698.75s |  you know, we'll be around.
6698.75s - 6699.51s |  So, yeah.
6700.03s - 6700.31s |  All right.
6700.31s - 6700.79s |  Awesome.
6700.83s - 6704.31s |  So, uh, I have a comment that leads into a question.
6704.67s - 6709.59s |  So I got my start into computers, uh, with an Apple two plus in the late
6709.59s - 6713.11s |  eighties when my grandfather gave it to me and thank you.
6713.15s - 6717.31s |  Uh, he and my parents worked very hard to build a level of curiosity
6717.31s - 6718.43s |  of how things worked for me.
6718.87s - 6721.03s |  So I was naturally intrigued.
6721.43s - 6725.35s |  Uh, when I got this, I had, he gave me books of how to write, literally
6725.35s - 6727.39s |  write poker games, copying from the book.
6727.39s - 6729.19s |  It wasn't, I mean, it was literally.
6729.75s - 6732.43s |  Code with comments of this is what it does.
6732.47s - 6734.51s |  They had magazines that they would, you could order that
6734.51s - 6735.47s |  would like have people.
6735.47s - 6735.71s |  Yeah.
6735.83s - 6735.95s |  Yeah.
6735.95s - 6737.39s |  You don't, I can't find that anymore.
6737.39s - 6738.11s |  I've been looking.
6738.31s - 6742.71s |  So, um, my daughter just completed her second bachelor degree in
6742.71s - 6746.31s |  software engineering at 19 and they don't teach that style anymore.
6746.31s - 6748.27s |  And it's a, it's a lost art, I think.
6748.31s - 6750.67s |  But you take two hours typing in a program.
6750.71s - 6752.27s |  You you're vested.
6752.79s - 6753.23s |  Yes.
6753.39s - 6757.55s |  And you want to know why every line and every character works the way it does.
6758.03s - 6762.51s |  So, uh, leading into that, I have first visited my first dial up BBS in like
6762.51s - 6768.15s |  1989, uh, I was like nine years old with my Apple two plus moving forward.
6768.15s - 6769.63s |  And we are being rushed off.
6770.91s - 6775.15s |  The goons are like, we're getting, I'll be quick.
6775.15s - 6779.95s |  So in, uh, uh, 1994, I started actively going to dial up BBS is all of you
6779.95s - 6784.35s |  became legends to me as I was looking at text files, but looking at that.
6784.35s - 6788.07s |  And with my daughter coming up, she's 19, her friends, other people, how
6788.07s - 6792.59s |  would you suggest to build that in the same nostalgic learning experience
6792.59s - 6796.47s |  for the next generation so that they're mentally, emotionally,
6797.19s - 6799.07s |  spiritually engaged in the tech?
6799.27s - 6800.67s |  Who's who's her hero.
6800.71s - 6801.99s |  Who does she look up to?
6803.39s - 6803.79s |  I don't know.
6805.15s - 6809.63s |  I mean, if you can make a connection there, you know, find a role model
6809.71s - 6811.91s |  and, you know, kind of push towards that.
6811.91s - 6816.63s |  I mean, I, I I'm on stage with a lot of people that I consider role models
6816.63s - 6818.43s |  and, you know, I'm, I'm honored to be here.
6818.43s - 6823.19s |  So these are the people I look to, it was like, find that person, I guess,
6823.19s - 6825.23s |  who, who can, you know, light up the path.
6825.23s - 6829.67s |  I can't necessarily suggest that, but, you know, listen to her and her interests.
6829.71s - 6830.03s |  Yeah.
6830.31s - 6834.23s |  I was looking at the overall younger community, you know, because when I was
6834.23s - 6837.83s |  growing up, I, like you talked about, we had dial up BBS, we had to search, we
6837.83s - 6843.23s |  had to go, it was an active search, which engaged at a different level, you know,
6843.39s - 6846.71s |  but the only thing, and someone recommended this to me recently is tour,
6847.23s - 6852.71s |  not necessarily the most hospitable place to go, but you have to go on a search
6852.71s - 6854.55s |  and a hunt to actually find things you want.
6854.95s - 6858.51s |  Sometimes there is actually fun, creative, artistic sites, other things.
6859.11s - 6863.67s |  But is there, do you have any ideas or maybe you could put it, you know, if
6863.67s - 6867.15s |  this idea sinks in posts and share some ideas.
6867.35s - 6871.27s |  I've noticed kids are very interested in learning about things like old cameras,
6871.27s - 6874.55s |  old computers, things that they can get their hands on, things they can take
6874.55s - 6878.39s |  apart, things that can break and fix, answer their questions, encourage them,
6878.39s - 6885.43s |  give them books, take them to a vintage computer festivals or whatnot.
6885.71s - 6889.43s |  So it's like rebels, hacker spaces, maker spaces.
6889.51s - 6889.83s |  All right.
6890.59s - 6891.75s |  We're going to leave it there, folks.
6891.75s - 6892.95s |  You were an awesome audience.
6892.95s - 6893.75s |  Thank you.
6894.23s - 6898.27s |  Thank you for everybody stuck around, you know, thanks, man.
6898.27s - 6899.15s |  That was awesome.


