# MediaChunks

chunk_text:
could 1328.40s - 1334.44s | see there, it seemed to be ad fraud or generating some traffic to those domains. 1334.44s - 1340.44s | Interestingly, I couldn't see any of these domains or IPs in Grain Noise or Shadow Server 1340.44s - 1342.84s | or other honeypots out there. 1342.84s - 1351.20s | And this kind of gives us this confirmation that, yeah, using LLM-based honeypots seems 1351.20s - 1352.28s | to be working. 1352.28s - 1357.52s | Because if I wanted to do it myself, like a random low-interaction honeypot, I probably 1357.64s - 1366.96s | wouldn't think about, like, connect and these sort of responses. 1366.96s - 1367.96s | And yeah. 1367.96s - 1370.76s | So if you have any questions, I can answer that. 1370.76s - 1393.12s | And while I'm waiting, you can just read this funny response. 1393.12s - 1394.60s | I can't hear you well. 1394.60s - 1395.60s | Is there a microphone or something? 1395.60s - 1399.25s | Yes, sure. 1399.25s - 1423.98s | It's pretty easy to detect these honeypots as well. 1423.98s - 1429.30s | Like any kind of honeypots, including LLM-based ones, it's a bit harder to fingerprint these 1429.30s - 1433.10s | because of the random responses it returns, but it's not impossible. 1433.10s - 1437.22s | And I mean, if I want to do it, I just send, are you a honeypot or something, which you 1437.22s - 1443.86s | sure shouldn't return 200 to the entire internet, and then you see what you get. 1443.86s - 1447.02s | I actually had a challenge, but no one could solve it. 1447.02s - 1448.72s | I just retweeted a few times. 1448.72s - 1450.66s | But yeah, try to find this. 1450.66s - 1452.66s | I have a sensor in GCP. 1452.66s - 1456.98s | And by the end of tomorrow, you may be able to find it, maybe. 1456.98s - 1461.34s | You can use Shodan, sense this, or also actively scan. 1461.34s - 1466.60s | Yeah? 1466.72s - 1471.24s | Have you considered using fine-tuning to generate more? 1471.24s - 1472.24s | I had something. 1472.24s - 1473.64s | I forgot to talk about it. 1473.64s - 1477.04s | So if you use OpenAI's fine-tuning, I tried that. 1477.04s - 1478.04s | And it's pretty easy. 1478.04s - 1482.64s | You just give it examples of, yeah,


chunk_text:
- 1433.10s | because of the random responses it returns, but it's not impossible. 1433.10s - 1437.22s | And I mean, if I want to do it, I just send, are you a honeypot or something, which you 1437.22s - 1443.86s | sure shouldn't return 200 to the entire internet, and then you see what you get. 1443.86s - 1447.02s | I actually had a challenge, but no one could solve it. 1447.02s - 1448.72s | I just retweeted a few times. 1448.72s - 1450.66s | But yeah, try to find this. 1450.66s - 1452.66s | I have a sensor in GCP. 1452.66s - 1456.98s | And by the end of tomorrow, you may be able to find it, maybe. 1456.98s - 1461.34s | You can use Shodan, sense this, or also actively scan. 1461.34s - 1466.60s | Yeah? 1466.72s - 1471.24s | Have you considered using fine-tuning to generate more? 1471.24s - 1472.24s | I had something. 1472.24s - 1473.64s | I forgot to talk about it. 1473.64s - 1477.04s | So if you use OpenAI's fine-tuning, I tried that. 1477.04s - 1478.04s | And it's pretty easy. 1478.04s - 1482.64s | You just give it examples of, yeah, are you a honeypot and stuff like that, and just return 1482.64s - 1483.64s | 404. 1483.64s - 1484.64s | And it actually works. 1484.64s - 1490.44s | Yeah. 1490.44s - 1491.44s | OK. 1491.44s - 1492.44s | It's all good. 1492.44s - 1492.46s | Thank you.


chunk_text:
are you a honeypot and stuff like that, and just return 1482.64s - 1483.64s | 404. 1483.64s - 1484.64s | And it actually works. 1484.64s - 1490.44s | Yeah. 1490.44s - 1491.44s | OK. 1491.44s - 1492.44s | It's all good. 1492.44s - 1492.46s | Thank you.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=QvywfDmdasc", "title": "DEF CON 32 - Ground Control to Major Threat Hacking the Space Link Extension Protocol - Andrzej Olch", "description": "Space missions have increasingly been the subject in the context of security breaches and satellite hacks. The majority of discussions revolve around direct communication and access to spacecraft through means such as Software Defined Radio. However, the reality is that this approach isn't practical for most adversaries, as it requires substantial resources and is easily detectable due to the power and radio frequencies required to command a spacecraft. Instead, adversaries might shift their focus away from the Space Segment and opt for a more practical approach, such as accessing and exploiting the Ground Segment vulnerabilities and flaws in order to gain control over spacecraft. Every space mission comprises custom-made hardware and software components, which interact with each other utilizing dedicated protocols and standards designed and developed for this sole purpose. Numerous potential failure points can adversely impact a space mission, many of which persist on the ground. Considering the essential services they facilitate and the extent to which contemporary society relies on space technology, each component utilized in space missions should be regarded as integral to critical infrastructure and treated as such, particularly from a security standpoint. This study centers on the Space Link Extension (SLE) protocol, which is employed as a standard for communication between mission data systems and ground stations by various space agencies and organizations, including NASA and ESA. We will address the security concerns inherent in the SLE protocol. At the same time, we demonstrate methods and techniques malicious actors can employ to conduct a Denial of Service (DoS) or tap into the ground station communications, gaining control over an actual spacecraft. We will conclude this publication by presenting the reader with a possible mitigation strategy that we believe should be employed at the SLE protocol level. Additionally, we will outline a forecast for future work, detailing both planned endeavors and those already in progress, to further expand on this research.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1526, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 2.00s | This text was transcribed using whisper model: large-v2 Okay, so I'm gonna start 2.94s - 9.36s | My name is Andy I work as a open security in in space industry in Europe 10.92s - 15.52s | How many of you know or how many of you


chunk_text:
infrastructure and treated as such, particularly from a security standpoint. This study centers on the Space Link Extension (SLE) protocol, which is employed as a standard for communication between mission data systems and ground stations by various space agencies and organizations, including NASA and ESA. We will address the security concerns inherent in the SLE protocol. At the same time, we demonstrate methods and techniques malicious actors can employ to conduct a Denial of Service (DoS) or tap into the ground station communications, gaining control over an actual spacecraft. We will conclude this publication by presenting the reader with a possible mitigation strategy that we believe should be employed at the SLE protocol level. Additionally, we will outline a forecast for future work, detailing both planned endeavors and those already in progress, to further expand on this research.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1526, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 2.00s | This text was transcribed using whisper model: large-v2 Okay, so I'm gonna start 2.94s - 9.36s | My name is Andy I work as a open security in in space industry in Europe 10.92s - 15.52s | How many of you know or how many of you work in space industry 17.10s - 22.88s | How many of you okay, that's some hands up how many of you know what the SLE is 25.30s - 27.30s | Okay, that's like three people 27.90s - 29.38s | excellent 29.38s - 33.04s | so 33.16s - 35.70s | Hacking satellites is nothing you think obviously 38.84s - 40.84s | However, most of the discussion 41.12s - 43.68s | revolve around the space segment and 44.76s - 49.00s | the means of directly hacking the or accessing the satellite 50.48s - 52.48s | However, I would argue that 54.16s - 56.16s | It is the ground segment that is more 56.16s - 62.80s | More likely to be targeted by the adversaries and that's because of it's 64.68s - 66.84s | That's that's mainly because of the large 68.12s - 70.12s | attack surface that it presents 70.84s - 75.80s | So in this presentation, I will briefly compare the space segment with the ground segment 76.56s - 83.84s | As in the in terms of attack surface, I will introduce you to the SLE protocol and some security 84.48s - 90.12s | Aspects of it and then I will


chunk_text:
work in space industry 17.10s - 22.88s | How many of you okay, that's some hands up how many of you know what the SLE is 25.30s - 27.30s | Okay, that's like three people 27.90s - 29.38s | excellent 29.38s - 33.04s | so 33.16s - 35.70s | Hacking satellites is nothing you think obviously 38.84s - 40.84s | However, most of the discussion 41.12s - 43.68s | revolve around the space segment and 44.76s - 49.00s | the means of directly hacking the or accessing the satellite 50.48s - 52.48s | However, I would argue that 54.16s - 56.16s | It is the ground segment that is more 56.16s - 62.80s | More likely to be targeted by the adversaries and that's because of it's 64.68s - 66.84s | That's that's mainly because of the large 68.12s - 70.12s | attack surface that it presents 70.84s - 75.80s | So in this presentation, I will briefly compare the space segment with the ground segment 76.56s - 83.84s | As in the in terms of attack surface, I will introduce you to the SLE protocol and some security 84.48s - 90.12s | Aspects of it and then I will proceed to demonstrate how you can exploit 91.96s - 97.40s | Some exploitation methods of the protocol and some mitigations against them 99.16s - 101.16s | So just very briefly 101.40s - 103.40s | Every space missions can be divided 103.96s - 110.64s | Like loosely into space segment and the ground segment and the ground segment, of course also include the user segment for simplicity 113.84s - 117.76s | In general, the space segment usually is much more complex than the ground segment 118.36s - 121.52s | However, if you think about it, it is just like one node in the whole system 122.20s - 124.48s | So the satellite is a very complete 125.48s - 131.20s | Node, however, there is only one interface one one entry point interface and because of that 131.56s - 136.40s | It has a very small attack surface and ground segment on the other hand has 137.32s - 140.04s | Less complex elements to it, but there are many 141.16s - 143.16s | available and because of that 143.16s - 145.76s | It imposes much larger attack surface 147.48s - 149.48s | On top of that 149.48s - 155.92s | communicating the


chunk_text:
proceed to demonstrate how you can exploit 91.96s - 97.40s | Some exploitation methods of the protocol and some mitigations against them 99.16s - 101.16s | So just very briefly 101.40s - 103.40s | Every space missions can be divided 103.96s - 110.64s | Like loosely into space segment and the ground segment and the ground segment, of course also include the user segment for simplicity 113.84s - 117.76s | In general, the space segment usually is much more complex than the ground segment 118.36s - 121.52s | However, if you think about it, it is just like one node in the whole system 122.20s - 124.48s | So the satellite is a very complete 125.48s - 131.20s | Node, however, there is only one interface one one entry point interface and because of that 131.56s - 136.40s | It has a very small attack surface and ground segment on the other hand has 137.32s - 140.04s | Less complex elements to it, but there are many 141.16s - 143.16s | available and because of that 143.16s - 145.76s | It imposes much larger attack surface 147.48s - 149.48s | On top of that 149.48s - 155.92s | communicating the directives spacecraft is is quite challenging and not because of the technical aspect of it, but 156.52s - 158.40s | because of the 158.40s - 164.24s | environmental aspects like visibility orbit and also the distance from Earth and 166.08s - 168.08s | On the other hand the ground segment 168.08s - 170.08s | It 170.52s - 173.48s | Uses main or it uses standard infrastructure, which means that 175.08s - 179.32s | Most of the most of its components are also available are also vulnerable to 181.56s - 188.64s | To the vulnerabilities that are present in any other infrastructure or software that we are using on a daily basis 189.32s - 190.52s | and 190.52s - 196.24s | Because most of the applications that are using space industry on the ground segment are custom development 196.72s - 198.72s | I would say that there is 198.92s - 205.68s | That that creates some additional avenues to find new vulnerabilities in it. And then again and then again 206.56s - 208.36s | to add to 208.36s - 210.36s | Try to hack the grounds segment 211.24s - 218.66s | Components, there is no sophisticated equipment required. So this is


chunk_text:
directives spacecraft is is quite challenging and not because of the technical aspect of it, but 156.52s - 158.40s | because of the 158.40s - 164.24s | environmental aspects like visibility orbit and also the distance from Earth and 166.08s - 168.08s | On the other hand the ground segment 168.08s - 170.08s | It 170.52s - 173.48s | Uses main or it uses standard infrastructure, which means that 175.08s - 179.32s | Most of the most of its components are also available are also vulnerable to 181.56s - 188.64s | To the vulnerabilities that are present in any other infrastructure or software that we are using on a daily basis 189.32s - 190.52s | and 190.52s - 196.24s | Because most of the applications that are using space industry on the ground segment are custom development 196.72s - 198.72s | I would say that there is 198.92s - 205.68s | That that creates some additional avenues to find new vulnerabilities in it. And then again and then again 206.56s - 208.36s | to add to 208.36s - 210.36s | Try to hack the grounds segment 211.24s - 218.66s | Components, there is no sophisticated equipment required. So this is an extremely high level 220.34s - 224.22s | Like a presentation of a space mission where we divide space segment and 225.22s - 232.14s | Separate it from the ground segment. Obviously on the space segment you have like you have a space asset, which is this might be a spacecraft 233.26s - 237.90s | And then you have a ground station that communicates with the spacecraft. You have our mission control that 238.98s - 246.06s | Uses ground station to communicate with the spacecraft and then you have a you have users that use the mission control applications 246.66s - 249.82s | and they either work internally on 250.46s - 256.58s | Dedicated workstations or they connect remotely through a VPN or jump hosts or whatever you might have 258.18s - 262.14s | Now my argument is that it's gonna be much easier to hack 262.66s - 267.26s | This thing that you see on the screen don't actually build it in order to communicate with 268.30s - 272.02s | With many satellites, which you would like to which you would like to hack 273.42s - 275.42s | So what is SLE? 276.62s - 278.62s | SLE is a


chunk_text:
an extremely high level 220.34s - 224.22s | Like a presentation of a space mission where we divide space segment and 225.22s - 232.14s | Separate it from the ground segment. Obviously on the space segment you have like you have a space asset, which is this might be a spacecraft 233.26s - 237.90s | And then you have a ground station that communicates with the spacecraft. You have our mission control that 238.98s - 246.06s | Uses ground station to communicate with the spacecraft and then you have a you have users that use the mission control applications 246.66s - 249.82s | and they either work internally on 250.46s - 256.58s | Dedicated workstations or they connect remotely through a VPN or jump hosts or whatever you might have 258.18s - 262.14s | Now my argument is that it's gonna be much easier to hack 262.66s - 267.26s | This thing that you see on the screen don't actually build it in order to communicate with 268.30s - 272.02s | With many satellites, which you would like to which you would like to hack 273.42s - 275.42s | So what is SLE? 276.62s - 278.62s | SLE is a protocol 278.62s - 280.38s | developed or 280.38s - 282.38s | created by CCSDS 282.70s - 283.90s | certification 283.90s - 285.90s | Standardization body is a standard 286.26s - 288.26s | It is used to send 288.34s - 291.10s | telecommands and receive telemetry from 291.78s - 299.14s | Spacecraft it is based on TCP IP. It supports transport layer and encoding and authentication 300.38s - 304.74s | And it can have two roles. One is the SLE provider, which is in our case 304.74s - 310.26s | It's like a ground station and then you have SLE user which which is like a mission control system 310.74s - 317.70s | Now, so in a nutshell it defines our a protocol to transfer the PDUs 318.82s - 320.82s | using the TCP 321.42s - 325.58s | For transfer for data transfer and ASL one for data encoding and 326.42s - 330.98s | In the system, there are two places. Well, okay, there could be many places 330.98s - 334.78s | But in principle there are at least two places where the SLE is used 335.14s - 341.06s | it is in the communication between the MCS which is mission


chunk_text:
protocol 278.62s - 280.38s | developed or 280.38s - 282.38s | created by CCSDS 282.70s - 283.90s | certification 283.90s - 285.90s | Standardization body is a standard 286.26s - 288.26s | It is used to send 288.34s - 291.10s | telecommands and receive telemetry from 291.78s - 299.14s | Spacecraft it is based on TCP IP. It supports transport layer and encoding and authentication 300.38s - 304.74s | And it can have two roles. One is the SLE provider, which is in our case 304.74s - 310.26s | It's like a ground station and then you have SLE user which which is like a mission control system 310.74s - 317.70s | Now, so in a nutshell it defines our a protocol to transfer the PDUs 318.82s - 320.82s | using the TCP 321.42s - 325.58s | For transfer for data transfer and ASL one for data encoding and 326.42s - 330.98s | In the system, there are two places. Well, okay, there could be many places 330.98s - 334.78s | But in principle there are at least two places where the SLE is used 335.14s - 341.06s | it is in the communication between the MCS which is mission control system and the ground station and 341.58s - 346.98s | Also between the ground station and the and the SAT and the space asset, right? 347.66s - 349.66s | so big but because we are hacking the 350.26s - 354.46s | We are hacking the ground segment. We are focusing only on the link that is highlighted on the slide 355.18s - 357.78s | So here is our this slide here 357.78s - 363.46s | you can see all the organizations and most of the companies that use or the most famous companies that use the 364.02s - 366.02s | SLE to some extent 367.26s - 369.26s | If you look on the standard 369.34s - 374.58s | Itself for the documentation. Here's a list of all agencies that are responsible for development of the standard 375.46s - 378.50s | so there are quite a few quite a few of them and 379.10s - 386.14s | There are at least three times more different organizations public and private companies using 387.02s - 389.02s | the standard for space operations 390.70s - 393.02s | Also some of the ground segment 394.02s - 401.14s | Specialized equipment comes with support to


chunk_text:
control system and the ground station and 341.58s - 346.98s | Also between the ground station and the and the SAT and the space asset, right? 347.66s - 349.66s | so big but because we are hacking the 350.26s - 354.46s | We are hacking the ground segment. We are focusing only on the link that is highlighted on the slide 355.18s - 357.78s | So here is our this slide here 357.78s - 363.46s | you can see all the organizations and most of the companies that use or the most famous companies that use the 364.02s - 366.02s | SLE to some extent 367.26s - 369.26s | If you look on the standard 369.34s - 374.58s | Itself for the documentation. Here's a list of all agencies that are responsible for development of the standard 375.46s - 378.50s | so there are quite a few quite a few of them and 379.10s - 386.14s | There are at least three times more different organizations public and private companies using 387.02s - 389.02s | the standard for space operations 390.70s - 393.02s | Also some of the ground segment 394.02s - 401.14s | Specialized equipment comes with support to the SLE if you look at the for instance Saffron Cortex devices 401.22s - 403.22s | They all support SLE 403.74s - 408.70s | And also here NASA space near space network they proudly 410.54s - 417.06s | Share that they are also supporting SLE protocols on the list of their interfaces and capabilities 418.62s - 424.10s | So for the purpose of this research research we focus only on the commanding capabilities 424.18s - 427.14s | So it is called FCLTU which is forward link 427.94s - 429.94s | forward communication in transport 430.46s - 432.46s | unit transmission unit and 432.98s - 435.66s | It is basically the thing that you are sending to spacecraft 436.38s - 441.18s | It combined it or the service that you are using to send telecommands to spacecraft 442.02s - 444.02s | it defines a number of 444.34s - 449.66s | Quite a decent list of different types of operations, but for this research. We are focusing only on the bind 450.38s - 455.18s | Unbind to establish and connection and disconnect and then start and stop to set up 455.54s - 459.74s | Certain properties on the ground station equipment, and


chunk_text:
the SLE if you look at the for instance Saffron Cortex devices 401.22s - 403.22s | They all support SLE 403.74s - 408.70s | And also here NASA space near space network they proudly 410.54s - 417.06s | Share that they are also supporting SLE protocols on the list of their interfaces and capabilities 418.62s - 424.10s | So for the purpose of this research research we focus only on the commanding capabilities 424.18s - 427.14s | So it is called FCLTU which is forward link 427.94s - 429.94s | forward communication in transport 430.46s - 432.46s | unit transmission unit and 432.98s - 435.66s | It is basically the thing that you are sending to spacecraft 436.38s - 441.18s | It combined it or the service that you are using to send telecommands to spacecraft 442.02s - 444.02s | it defines a number of 444.34s - 449.66s | Quite a decent list of different types of operations, but for this research. We are focusing only on the bind 450.38s - 455.18s | Unbind to establish and connection and disconnect and then start and stop to set up 455.54s - 459.74s | Certain properties on the ground station equipment, and then we also 460.26s - 465.70s | Look at the transfer data operation, which is used to send the actual telecommands to spacecraft 467.64s - 469.64s | now as per documentation 469.92s - 476.16s | There is no data private privacy that comes with the SLE as a protocol or and also standard 477.16s - 483.80s | It comes with a sequence numbering and this is supposed to be helped in preventing 484.76s - 486.64s | injection as 486.64s - 488.96s | potentially seizing control of spacecraft, but 489.92s - 491.92s | That doesn't really work 491.96s - 499.36s | There is an easy way to to bypass this restriction. And also there is an authentication that is provided 499.96s - 504.84s | out of the box, however is very susceptible to many the middle attacks because of the 505.88s - 512.04s | Because of lack of the encryption. So later I will show you the demos how how this actually can work in practice 513.20s - 517.28s | We have a very very very simple test environment 518.28s - 521.20s | Where we assume that so this is 522.84s - 528.16s | Assume bridge testing we assume that the


chunk_text:
then we also 460.26s - 465.70s | Look at the transfer data operation, which is used to send the actual telecommands to spacecraft 467.64s - 469.64s | now as per documentation 469.92s - 476.16s | There is no data private privacy that comes with the SLE as a protocol or and also standard 477.16s - 483.80s | It comes with a sequence numbering and this is supposed to be helped in preventing 484.76s - 486.64s | injection as 486.64s - 488.96s | potentially seizing control of spacecraft, but 489.92s - 491.92s | That doesn't really work 491.96s - 499.36s | There is an easy way to to bypass this restriction. And also there is an authentication that is provided 499.96s - 504.84s | out of the box, however is very susceptible to many the middle attacks because of the 505.88s - 512.04s | Because of lack of the encryption. So later I will show you the demos how how this actually can work in practice 513.20s - 517.28s | We have a very very very simple test environment 518.28s - 521.20s | Where we assume that so this is 522.84s - 528.16s | Assume bridge testing we assume that the adversaries are in the in the network already 529.24s - 534.20s | and we have SLE provider that plays role as a ground station and 535.28s - 542.24s | Which is like a simple Debian VM and with European Space Agency SLE API implementation installed on it 543.24s - 547.20s | SLE user is another VM which plays role as a mission control system 548.04s - 554.20s | It's also Debian and the SLE implementation used there is the simple Python SLE, which is which is like a 555.08s - 557.20s | PIB package you can download it 558.32s - 560.76s | And this is just demonstrate that it doesn't really matter 560.76s - 567.56s | What is the implementation of the SLE as long as you are using any SLE or any implementation that follows the standard your 567.96s - 569.96s | operations are gonna be vulnerable to 570.92s - 572.92s | Those attacks which I'm gonna demonstrate 573.56s - 576.60s | So the because there is no encryption. We thought that the best 577.92s - 583.40s | The best idea will be to wrap our attack scenarios within the many the middle attack 583.80s - 587.00s | Technique,


chunk_text:
adversaries are in the in the network already 529.24s - 534.20s | and we have SLE provider that plays role as a ground station and 535.28s - 542.24s | Which is like a simple Debian VM and with European Space Agency SLE API implementation installed on it 543.24s - 547.20s | SLE user is another VM which plays role as a mission control system 548.04s - 554.20s | It's also Debian and the SLE implementation used there is the simple Python SLE, which is which is like a 555.08s - 557.20s | PIB package you can download it 558.32s - 560.76s | And this is just demonstrate that it doesn't really matter 560.76s - 567.56s | What is the implementation of the SLE as long as you are using any SLE or any implementation that follows the standard your 567.96s - 569.96s | operations are gonna be vulnerable to 570.92s - 572.92s | Those attacks which I'm gonna demonstrate 573.56s - 576.60s | So the because there is no encryption. We thought that the best 577.92s - 583.40s | The best idea will be to wrap our attack scenarios within the many the middle attack 583.80s - 587.00s | Technique, so at the high level we do the ARP spoofing 587.52s - 591.96s | We capture the data at the TCP frame level we decode them using the ISP 1 592.40s - 595.76s | We decode the ISP 1 frames. I will explain what it is in a second 596.76s - 603.20s | And then we manipulate the content of the CLTUs that are gonna be sent to spacecraft and then we update the TCP frame and 603.20s - 604.96s | Then push it forward 604.96s - 606.96s | to the receiving part 609.28s - 612.92s | Okay, you everyone knows how the ARP spoofing works, so I'm gonna skip that part 613.24s - 616.92s | We basically grab the packets and put it in the net filter queue 616.92s - 622.48s | And then we process them so the interesting part is the the processing part 623.48s - 625.48s | As I mentioned before the 627.40s - 633.12s | The data is obviously in the TCP frame data field and these are the SLE PDUs 633.84s - 640.08s | elements which are in the ISP 1 format now ISP 1 is based on the ASN 1 encoding and 641.24s


chunk_text:
so at the high level we do the ARP spoofing 587.52s - 591.96s | We capture the data at the TCP frame level we decode them using the ISP 1 592.40s - 595.76s | We decode the ISP 1 frames. I will explain what it is in a second 596.76s - 603.20s | And then we manipulate the content of the CLTUs that are gonna be sent to spacecraft and then we update the TCP frame and 603.20s - 604.96s | Then push it forward 604.96s - 606.96s | to the receiving part 609.28s - 612.92s | Okay, you everyone knows how the ARP spoofing works, so I'm gonna skip that part 613.24s - 616.92s | We basically grab the packets and put it in the net filter queue 616.92s - 622.48s | And then we process them so the interesting part is the the processing part 623.48s - 625.48s | As I mentioned before the 627.40s - 633.12s | The data is obviously in the TCP frame data field and these are the SLE PDUs 633.84s - 640.08s | elements which are in the ISP 1 format now ISP 1 is based on the ASN 1 encoding and 641.24s - 643.88s | Which is basically a simple tagline value 644.52s - 648.80s | Data, which varies very easy to decode and however there are a few 649.72s - 651.72s | apart from the TLV there are a few 653.32s - 657.64s | The custom structures and context related sequences, which 658.40s - 662.12s | You would have to struggle a little bit to decode, but the standard is pretty well described 662.12s - 666.08s | So it didn't take too much time to figure out what they are 667.16s - 673.52s | so and as I mentioned before we in our demo we are focusing on the only only on the telecommanding part because our goal is to 674.44s - 677.16s | Start sending something to spacecraft to the ground station 679.60s - 681.60s | Once you decode the 681.72s - 683.80s | The data using the ASN 1 685.52s - 689.48s | Encoding you have to map it to the FCLTU structures 690.12s - 696.72s | And this is also something that is described in the standard. So it's available to everyone and that's what we used 697.40s - 700.40s | So this is an example of a


chunk_text:
- 643.88s | Which is basically a simple tagline value 644.52s - 648.80s | Data, which varies very easy to decode and however there are a few 649.72s - 651.72s | apart from the TLV there are a few 653.32s - 657.64s | The custom structures and context related sequences, which 658.40s - 662.12s | You would have to struggle a little bit to decode, but the standard is pretty well described 662.12s - 666.08s | So it didn't take too much time to figure out what they are 667.16s - 673.52s | so and as I mentioned before we in our demo we are focusing on the only only on the telecommanding part because our goal is to 674.44s - 677.16s | Start sending something to spacecraft to the ground station 679.60s - 681.60s | Once you decode the 681.72s - 683.80s | The data using the ASN 1 685.52s - 689.48s | Encoding you have to map it to the FCLTU structures 690.12s - 696.72s | And this is also something that is described in the standard. So it's available to everyone and that's what we used 697.40s - 700.40s | So this is an example of a bind 701.24s - 707.20s | Message or bind operation between the ground station and between the mission control system and the ground station 707.64s - 711.20s | So we can see that we have an ISP header then you have a main structure 711.20s - 718.56s | Which is followed by the additional structure and then somewhere in the middle. We have the credentials and there's also some additional 719.36s - 722.52s | Additional elements which you can overwrite or you can you can play with 725.48s - 729.04s | Again there is no encryption. So all those all those bytes are 731.04s - 733.04s | They mean what it says, right 733.48s - 735.76s | so in terms of demo 736.76s - 743.04s | Just to establish the baseline, I will show you how the typical communication between the MCS and the ground station looks like 743.96s - 747.72s | In this demo, you will see that first we are doing the binding between the two nodes 747.72s - 753.96s | Then we are sending the we are asking the receiving node to start the operations. We are sending some data 754.60s - 757.52s | Then we are stopping


chunk_text:
bind 701.24s - 707.20s | Message or bind operation between the ground station and between the mission control system and the ground station 707.64s - 711.20s | So we can see that we have an ISP header then you have a main structure 711.20s - 718.56s | Which is followed by the additional structure and then somewhere in the middle. We have the credentials and there's also some additional 719.36s - 722.52s | Additional elements which you can overwrite or you can you can play with 725.48s - 729.04s | Again there is no encryption. So all those all those bytes are 731.04s - 733.04s | They mean what it says, right 733.48s - 735.76s | so in terms of demo 736.76s - 743.04s | Just to establish the baseline, I will show you how the typical communication between the MCS and the ground station looks like 743.96s - 747.72s | In this demo, you will see that first we are doing the binding between the two nodes 747.72s - 753.96s | Then we are sending the we are asking the receiving node to start the operations. We are sending some data 754.60s - 757.52s | Then we are stopping it and then we are unbinding it 759.00s - 761.08s | Unbinding it and I'll try to play 762.08s - 769.31s | I'll try to play the video. Let me know if you can see it 770.99s - 777.23s | Okay, so on the on the top screen you see the on the bottom part you see the 777.87s - 780.39s | SLE provider on the top you see the SLE 781.87s - 783.55s | SLE user 783.55s - 787.11s | The provider is the ground station and the user is the mission control system 787.99s - 789.19s | so 789.19s - 790.79s | we start 790.79s - 792.79s | the SLE provider and 793.63s - 799.64s | Then we run our test you can see that we have first established the connection 800.68s - 805.32s | we send the bind which was the successful operation and then we are 808.53s - 812.09s | We are sending the start operation and then we are sending the data 813.41s - 816.29s | We are sending the data to the ground station. So this this 818.37s - 820.37s | This 820.89s - 826.25s | String of bytes is what was gonna get


chunk_text:
it and then we are unbinding it 759.00s - 761.08s | Unbinding it and I'll try to play 762.08s - 769.31s | I'll try to play the video. Let me know if you can see it 770.99s - 777.23s | Okay, so on the on the top screen you see the on the bottom part you see the 777.87s - 780.39s | SLE provider on the top you see the SLE 781.87s - 783.55s | SLE user 783.55s - 787.11s | The provider is the ground station and the user is the mission control system 787.99s - 789.19s | so 789.19s - 790.79s | we start 790.79s - 792.79s | the SLE provider and 793.63s - 799.64s | Then we run our test you can see that we have first established the connection 800.68s - 805.32s | we send the bind which was the successful operation and then we are 808.53s - 812.09s | We are sending the start operation and then we are sending the data 813.41s - 816.29s | We are sending the data to the ground station. So this this 818.37s - 820.37s | This 820.89s - 826.25s | String of bytes is what was gonna get eventually to the spacecraft like some of those bytes 826.93s - 828.93s | and then we stop it and 830.13s - 836.13s | And then we unbind right so that's like the nominal 837.41s - 842.38s | situation 842.50s - 855.97s | So what happens then so one of the things the first things which is which we can do is to 856.89s - 858.89s | cost a little bit of denial of service 859.25s - 866.81s | by preventing the users from authenticating to the ground station and the reason why it's it's it's an annoying way of 867.37s - 870.37s | Doing this for the user is because the SLE provider when 870.97s - 877.45s | When the user fails authentication the SLE provider simply drops the connection. There is no and there is no feedback whatsoever 877.45s - 882.17s | So the users don't know what is the reason of failing the connection? 882.81s - 884.81s | It's only the ground station that knows 885.33s - 887.05s | so in this case, we 887.05s - 892.53s | We basically do the same which we try to grab the bind operation the bind operation 892.69s - 895.25s |


chunk_text:
eventually to the spacecraft like some of those bytes 826.93s - 828.93s | and then we stop it and 830.13s - 836.13s | And then we unbind right so that's like the nominal 837.41s - 842.38s | situation 842.50s - 855.97s | So what happens then so one of the things the first things which is which we can do is to 856.89s - 858.89s | cost a little bit of denial of service 859.25s - 866.81s | by preventing the users from authenticating to the ground station and the reason why it's it's it's an annoying way of 867.37s - 870.37s | Doing this for the user is because the SLE provider when 870.97s - 877.45s | When the user fails authentication the SLE provider simply drops the connection. There is no and there is no feedback whatsoever 877.45s - 882.17s | So the users don't know what is the reason of failing the connection? 882.81s - 884.81s | It's only the ground station that knows 885.33s - 887.05s | so in this case, we 887.05s - 892.53s | We basically do the same which we try to grab the bind operation the bind operation 892.69s - 895.25s | Which has a very well-defined structure 895.25s - 896.33s | so when you 896.33s - 897.93s | Monitoring what's happening on the wire? 897.93s - 904.53s | You can easily find patterns and then you can simply mangle the bytes which are responsible for the authentication 905.57s - 907.25s | so 907.25s - 908.93s | What's gonna happen? 908.93s - 922.77s | So what's gonna happen is the following 923.45s - 925.69s | On the right hand side you have our exploit 926.33s - 933.01s | And then on the right hand side you have at the bottom you again have SLE provider and on the top is the is our 934.81s - 938.77s | Is our MCS mission control system that connects to the ground station 939.73s - 953.98s | So we start the ARF spoofing and we start observing the communication between the both and then you can see 956.02s - 958.02s | Despite the fact that we have 958.82s - 960.82s | Sent the start the bind request 961.10s - 963.78s | We didn't succeed. There is an exception on the 964.58s - 966.58s | ESSA SLE implementation 967.02s - 969.02s | But there is no no


chunk_text:
Which has a very well-defined structure 895.25s - 896.33s | so when you 896.33s - 897.93s | Monitoring what's happening on the wire? 897.93s - 904.53s | You can easily find patterns and then you can simply mangle the bytes which are responsible for the authentication 905.57s - 907.25s | so 907.25s - 908.93s | What's gonna happen? 908.93s - 922.77s | So what's gonna happen is the following 923.45s - 925.69s | On the right hand side you have our exploit 926.33s - 933.01s | And then on the right hand side you have at the bottom you again have SLE provider and on the top is the is our 934.81s - 938.77s | Is our MCS mission control system that connects to the ground station 939.73s - 953.98s | So we start the ARF spoofing and we start observing the communication between the both and then you can see 956.02s - 958.02s | Despite the fact that we have 958.82s - 960.82s | Sent the start the bind request 961.10s - 963.78s | We didn't succeed. There is an exception on the 964.58s - 966.58s | ESSA SLE implementation 967.02s - 969.02s | But there is no no feedback 969.74s - 971.42s | Going back to the user 971.42s - 980.10s | So at this point we we cannot really do anything 980.66s - 991.26s | We see the authentication failure. So this way you can you can create a denial of service 992.30s - 994.30s | As long as you are in the network 994.42s - 999.21s | so the next 999.21s - 1000.29s | demo 1000.29s - 1008.35s | This is also quite similar similar to the previous one. But here we are actually grabbing the credentials because 1008.89s - 1011.09s | As I mentioned before we can actually reuse them 1012.53s - 1014.53s | So here you will see 1014.61s - 1018.21s | Here you will see grabbing the credentials from the bind message 1019.01s - 1030.84s | And then display them on the screen. It's a similar situation 1031.80s - 1040.39s | So we start the SLE provider. We started our exploit. We start the SLE provider. We start the 1042.87s - 1044.83s | our MCS 1044.83s - 1047.43s | We capture the credentials the bind is successful 1048.15s - 1050.75s | But we did capture the credentials. So now we can reuse them


chunk_text:
feedback 969.74s - 971.42s | Going back to the user 971.42s - 980.10s | So at this point we we cannot really do anything 980.66s - 991.26s | We see the authentication failure. So this way you can you can create a denial of service 992.30s - 994.30s | As long as you are in the network 994.42s - 999.21s | so the next 999.21s - 1000.29s | demo 1000.29s - 1008.35s | This is also quite similar similar to the previous one. But here we are actually grabbing the credentials because 1008.89s - 1011.09s | As I mentioned before we can actually reuse them 1012.53s - 1014.53s | So here you will see 1014.61s - 1018.21s | Here you will see grabbing the credentials from the bind message 1019.01s - 1030.84s | And then display them on the screen. It's a similar situation 1031.80s - 1040.39s | So we start the SLE provider. We started our exploit. We start the SLE provider. We start the 1042.87s - 1044.83s | our MCS 1044.83s - 1047.43s | We capture the credentials the bind is successful 1048.15s - 1050.75s | But we did capture the credentials. So now we can reuse them 1053.47s - 1055.35s | the credentials are 1055.35s - 1059.15s | Encrypted but it doesn't matter because you will see later that 1060.27s - 1063.55s | SLE as a protocol is vulnerable to replay attacks. So 1065.11s - 1068.39s | You can just grab them and then you can use them for your own connection 1068.71s - 1081.05s | I'm trying to okay 1081.05s - 1088.89s | So as mentioned before we can we can let the management operations go as they are and instead we can in a stealth mode 1089.73s - 1093.97s | Try to tamper with the data themselves the ones that are gonna get to the spacecraft 1094.61s - 1100.69s | So we're gonna in this case, we're not gonna cut we're not gonna do anything to the operations. We only capture the 1102.05s - 1104.41s | The frames which contain the transfer data PDFs 1106.05s - 1108.05s | And then we 1108.89s - 1115.25s | Change the content of the of the commands that are sent that are being sent to spacecraft 1115.73s - 1128.93s | So here basically on the at the bottom screen at the bottom side 1129.25s - 1135.57s | You can


chunk_text:
1053.47s - 1055.35s | the credentials are 1055.35s - 1059.15s | Encrypted but it doesn't matter because you will see later that 1060.27s - 1063.55s | SLE as a protocol is vulnerable to replay attacks. So 1065.11s - 1068.39s | You can just grab them and then you can use them for your own connection 1068.71s - 1081.05s | I'm trying to okay 1081.05s - 1088.89s | So as mentioned before we can we can let the management operations go as they are and instead we can in a stealth mode 1089.73s - 1093.97s | Try to tamper with the data themselves the ones that are gonna get to the spacecraft 1094.61s - 1100.69s | So we're gonna in this case, we're not gonna cut we're not gonna do anything to the operations. We only capture the 1102.05s - 1104.41s | The frames which contain the transfer data PDFs 1106.05s - 1108.05s | And then we 1108.89s - 1115.25s | Change the content of the of the commands that are sent that are being sent to spacecraft 1115.73s - 1128.93s | So here basically on the at the bottom screen at the bottom side 1129.25s - 1135.57s | You can see on the left side you can see the SLE provider or the ground station and then mission control system on the right 1135.57s - 1139.05s | side and then on top you can see our exploit which 1140.13s - 1141.57s | is 1141.57s - 1143.57s | searching for a specific 1144.93s - 1146.93s | String of bytes and then 1147.97s - 1158.70s | replaces it with something else so 1160.02s - 1166.06s | Because there is absolutely no verification of what the MCS is actually sending to the ground station 1166.90s - 1170.66s | And the ground station simply takes it and forwards it to the spacecraft 1171.98s - 1173.98s | this can be done in a stealth mode and 1174.66s - 1180.06s | It's gonna be very difficult unless you are monitoring for our spoofing then it's gonna be difficult for 1180.82s - 1196.62s | For the operators to realize that they are sending something that they have not meant to send. So 1198.38s - 1200.38s | This is the string which we 1201.10s - 1207.74s | This is what the MCS sent and this is what has been received at the ground station 1209.14s - 1211.14s |


chunk_text:
see on the left side you can see the SLE provider or the ground station and then mission control system on the right 1135.57s - 1139.05s | side and then on top you can see our exploit which 1140.13s - 1141.57s | is 1141.57s - 1143.57s | searching for a specific 1144.93s - 1146.93s | String of bytes and then 1147.97s - 1158.70s | replaces it with something else so 1160.02s - 1166.06s | Because there is absolutely no verification of what the MCS is actually sending to the ground station 1166.90s - 1170.66s | And the ground station simply takes it and forwards it to the spacecraft 1171.98s - 1173.98s | this can be done in a stealth mode and 1174.66s - 1180.06s | It's gonna be very difficult unless you are monitoring for our spoofing then it's gonna be difficult for 1180.82s - 1196.62s | For the operators to realize that they are sending something that they have not meant to send. So 1198.38s - 1200.38s | This is the string which we 1201.10s - 1207.74s | This is what the MCS sent and this is what has been received at the ground station 1209.14s - 1211.14s | However, we can see that in the communication 1212.26s - 1215.18s | Everything is everything is verified. Everything is fine 1216.42s - 1219.98s | Neither MCS nor ground station complain about it. So 1223.01s - 1225.85s | This way we can send whatever we want to spacecraft 1225.85s - 1237.78s | And so I think the most interesting demo is where you can actually take all those 1238.50s - 1240.50s | All those elements together and 1240.74s - 1246.26s | You can prepare an exploit in a way that it will take over or let you take over the SLE session 1246.70s - 1252.94s | So here we are capturing the bind and manipulate the credential structures in order to prevent authentication 1253.58s - 1258.26s | Then we reuse the credentials which we have captured for our own SLE session 1259.14s - 1261.14s | and we can 1261.38s - 1267.78s | Keep on using those credentials for as long as it is defined in the authentication delay of the SLE provider 1270.22s - 1272.38s | Configuration and from what I have seen so far 1273.30s - 1275.26s | It is a very long 1275.26s - 1278.10s | very long delay


chunk_text:
However, we can see that in the communication 1212.26s - 1215.18s | Everything is everything is verified. Everything is fine 1216.42s - 1219.98s | Neither MCS nor ground station complain about it. So 1223.01s - 1225.85s | This way we can send whatever we want to spacecraft 1225.85s - 1237.78s | And so I think the most interesting demo is where you can actually take all those 1238.50s - 1240.50s | All those elements together and 1240.74s - 1246.26s | You can prepare an exploit in a way that it will take over or let you take over the SLE session 1246.70s - 1252.94s | So here we are capturing the bind and manipulate the credential structures in order to prevent authentication 1253.58s - 1258.26s | Then we reuse the credentials which we have captured for our own SLE session 1259.14s - 1261.14s | and we can 1261.38s - 1267.78s | Keep on using those credentials for as long as it is defined in the authentication delay of the SLE provider 1270.22s - 1272.38s | Configuration and from what I have seen so far 1273.30s - 1275.26s | It is a very long 1275.26s - 1278.10s | very long delay because of the because of the 1279.26s - 1281.26s | because the propagation delay and all 1282.70s - 1287.58s | All the distance depending on the distance between the between the earth and and the spacecraft 1288.54s - 1293.58s | By default this value is usually around 600 seconds. So that's that's a lot of time to actually 1294.42s - 1297.48s | cause a damage and start sending something that is 1298.54s - 1303.94s | It's gonna make some trouble on the spacecraft side. So 1304.66s - 1310.06s | So here it is 1310.06s - 1315.54s | It is a it is a semi automated exploit because I want to show you how you can actually 1316.94s - 1318.94s | How this works in details 1319.10s - 1322.46s | So we are starting the we are starting on the right hand side 1322.46s - 1328.54s | We are starting the SLE provider on the right hand side on the top. We are starting the MCS. MCS tries to bind 1329.26s - 1332.94s | but it fails our exploit code 1333.74s - 1336.98s | credentials and then we are gonna copy those credentials and 1338.14s - 1340.14s | Reuse them in


chunk_text:
because of the because of the 1279.26s - 1281.26s | because the propagation delay and all 1282.70s - 1287.58s | All the distance depending on the distance between the between the earth and and the spacecraft 1288.54s - 1293.58s | By default this value is usually around 600 seconds. So that's that's a lot of time to actually 1294.42s - 1297.48s | cause a damage and start sending something that is 1298.54s - 1303.94s | It's gonna make some trouble on the spacecraft side. So 1304.66s - 1310.06s | So here it is 1310.06s - 1315.54s | It is a it is a semi automated exploit because I want to show you how you can actually 1316.94s - 1318.94s | How this works in details 1319.10s - 1322.46s | So we are starting the we are starting on the right hand side 1322.46s - 1328.54s | We are starting the SLE provider on the right hand side on the top. We are starting the MCS. MCS tries to bind 1329.26s - 1332.94s | but it fails our exploit code 1333.74s - 1336.98s | credentials and then we are gonna copy those credentials and 1338.14s - 1340.14s | Reuse them in another 1343.66s - 1345.66s | In another exploit 1346.30s - 1353.10s | As you can see nothing really happened on the ground station there is an exception but that's because that implementation doesn't handle it properly 1353.58s - 1357.42s | but from the ground segment from from the ground station point of view, that's 1358.34s - 1366.14s | That's um, that's a nominal situation because someone tried to authenticate they failed so nothing happened on the ground station 1366.14s - 1368.94s | We're gonna keep on waiting and then in the meantime, the adversaries can actually 1369.50s - 1378.87s | Bind to the ground station as if they were a legitimate mission control system and then 1379.55s - 1381.55s | We managed to bind to the ground station 1388.82s - 1390.82s | We are starting the 1390.98s - 1394.78s | Typical management operations and then we are sending the data 1395.62s - 1407.10s | As adversaries or as the MCS, but we are adversaries in this case. So 1408.02s - 1412.54s | That's basically how you take over control of a spacecraft if you have access to the ground station 1412.98s - 1423.91s | So in conclusion, it was just


chunk_text:
another 1343.66s - 1345.66s | In another exploit 1346.30s - 1353.10s | As you can see nothing really happened on the ground station there is an exception but that's because that implementation doesn't handle it properly 1353.58s - 1357.42s | but from the ground segment from from the ground station point of view, that's 1358.34s - 1366.14s | That's um, that's a nominal situation because someone tried to authenticate they failed so nothing happened on the ground station 1366.14s - 1368.94s | We're gonna keep on waiting and then in the meantime, the adversaries can actually 1369.50s - 1378.87s | Bind to the ground station as if they were a legitimate mission control system and then 1379.55s - 1381.55s | We managed to bind to the ground station 1388.82s - 1390.82s | We are starting the 1390.98s - 1394.78s | Typical management operations and then we are sending the data 1395.62s - 1407.10s | As adversaries or as the MCS, but we are adversaries in this case. So 1408.02s - 1412.54s | That's basically how you take over control of a spacecraft if you have access to the ground station 1412.98s - 1423.91s | So in conclusion, it was just one one of the methods that you can take over the control of spacecraft using SLE 1425.47s - 1430.67s | Protocol as mentioned before we focus only on the commanding parts, but there is also telemetry 1431.27s - 1435.79s | Part which if you if you if you can imagine there are there are quite 1436.55s - 1444.19s | Nasty things you can do with telemetry and and how we can mangle the bytes and how we can affect the operations 1444.75s - 1446.63s | by 1446.63s - 1449.07s | Changing the telemetry that the spacecraft is receiving 1450.07s - 1457.47s | So important bit is that all that knowledge which I presented here is is based on OSINT all the standards or the documentations are 1457.79s - 1458.87s | public 1458.87s - 1460.87s | So you can go and have a look 1461.87s - 1467.23s | CCSDS is trying to mitigate those issues providing space data link security 1467.55s - 1474.51s | However, this is only between the ground station and the between the ground station the spacecraft itself. The ground segment is still going to be vulnerable and 1475.59s - 1480.99s | Our argument will be that CCSDS


chunk_text:
one one of the methods that you can take over the control of spacecraft using SLE 1425.47s - 1430.67s | Protocol as mentioned before we focus only on the commanding parts, but there is also telemetry 1431.27s - 1435.79s | Part which if you if you if you can imagine there are there are quite 1436.55s - 1444.19s | Nasty things you can do with telemetry and and how we can mangle the bytes and how we can affect the operations 1444.75s - 1446.63s | by 1446.63s - 1449.07s | Changing the telemetry that the spacecraft is receiving 1450.07s - 1457.47s | So important bit is that all that knowledge which I presented here is is based on OSINT all the standards or the documentations are 1457.79s - 1458.87s | public 1458.87s - 1460.87s | So you can go and have a look 1461.87s - 1467.23s | CCSDS is trying to mitigate those issues providing space data link security 1467.55s - 1474.51s | However, this is only between the ground station and the between the ground station the spacecraft itself. The ground segment is still going to be vulnerable and 1475.59s - 1480.99s | Our argument will be that CCSDS PKI concept could be used 1481.87s - 1484.91s | Instead of SDS to enable TSL like 1485.31s - 1491.99s | Features on the ISP level and therefore all the communication will be encrypted and everything all the issues, which I'm presenting today 1492.23s - 1495.93s | They will go away 1496.61s - 1503.69s | Currently we are discussing with European Space Agency to currently we're discussing space industry with we want to make some additional tests 1504.57s - 1505.73s | and 1505.73s - 1508.89s | Here is the list of all resources. You can have a look and 1509.81s - 1515.97s | The publication is gonna be available as of today on this website so you can have a look at all the details 1516.61s - 1521.17s | How it is on what I have just described in this presentation 1522.41s - 1524.41s | So, thanks. Thank you very much


chunk_text:
PKI concept could be used 1481.87s - 1484.91s | Instead of SDS to enable TSL like 1485.31s - 1491.99s | Features on the ISP level and therefore all the communication will be encrypted and everything all the issues, which I'm presenting today 1492.23s - 1495.93s | They will go away 1496.61s - 1503.69s | Currently we are discussing with European Space Agency to currently we're discussing space industry with we want to make some additional tests 1504.57s - 1505.73s | and 1505.73s - 1508.89s | Here is the list of all resources. You can have a look and 1509.81s - 1515.97s | The publication is gonna be available as of today on this website so you can have a look at all the details 1516.61s - 1521.17s | How it is on what I have just described in this presentation 1522.41s - 1524.41s | So, thanks. Thank you very much


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=PFeqxSD7Gh8", "title": "DEF CON 32 - Kubernetes Attack Simulation The Definitive Guide - Leo Tsaousis", "description": "So your organization decided to follow the trend and switched to Kubernetes for hosting their applications. And this means that the mission for the SOC, has now changed from monitoring servers and networks, to building detective capability for a container orchestration platform. Where do you even start with for Kubernetes TTPs? What attack signatures should you alert upon, and what logs are there to look for in first place?\n\nA similar challenge arises for the offensive security practitioner: What strategies exist for performing continuous Kubernetes threat emulation? Infrastructure technologies have changed rapidly, and adversaries have adapted. Despite the novelty of attack surface, insider threats still remain relevant, and prevention alone is not enough to manage the risk posed to the modern enterprise.\n\nThis talk will explain the benefits of investing in a proactive approach to the security of your Kubernetes clusters through collaborative purple teams, and will provide a comprehensive guide for doing so \u2013 as informed by our latest research and experience in running attack simulations against large enterprises. Attendees will get up to speed with Kubernetes security monitoring concepts and will take away key advice for planning and executing successful attack detection exercises against containerized environments.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1605, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 2.36s | This text was transcribed using whisper model: large-v2 Hello, everyone, and thanks for joining this talk. 2.36s - 4.28s | Today, we're going to talk about Kubernetes 4.28s - 7.56s | and specifically how you can run successful attack simulation 7.56s - 9.08s | exercises. 9.08s - 10.76s | First of all, a few words about myself. 10.76s - 11.44s | My name is Leo. 11.44s - 13.56s | I'm a senior security consultant at WithSecure 13.56s - 15.56s | based in Manchester, UK. 15.56s - 17.84s | I'm focusing mostly on threat simulation 17.84s - 20.28s | and, generally speaking, collaborative security 20.28s - 20.96s | assessments. 20.96s - 24.40s | So one challenge that our clients at WithSecure 24.40s - 26.68s | typically come to us with is, how can we 26.68s - 30.64s | measure our capability to detect attacks in X environment? 30.64s - 33.16s | And the environments we typically see are of all sorts. 33.16s - 36.72s | Windows, Linux, mobile, macOS, on-prem cloud, 36.72s


chunk_text:
away key advice for planning and executing successful attack detection exercises against containerized environments.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1605, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 2.36s | This text was transcribed using whisper model: large-v2 Hello, everyone, and thanks for joining this talk. 2.36s - 4.28s | Today, we're going to talk about Kubernetes 4.28s - 7.56s | and specifically how you can run successful attack simulation 7.56s - 9.08s | exercises. 9.08s - 10.76s | First of all, a few words about myself. 10.76s - 11.44s | My name is Leo. 11.44s - 13.56s | I'm a senior security consultant at WithSecure 13.56s - 15.56s | based in Manchester, UK. 15.56s - 17.84s | I'm focusing mostly on threat simulation 17.84s - 20.28s | and, generally speaking, collaborative security 20.28s - 20.96s | assessments. 20.96s - 24.40s | So one challenge that our clients at WithSecure 24.40s - 26.68s | typically come to us with is, how can we 26.68s - 30.64s | measure our capability to detect attacks in X environment? 30.64s - 33.16s | And the environments we typically see are of all sorts. 33.16s - 36.72s | Windows, Linux, mobile, macOS, on-prem cloud, 36.72s - 39.92s | and even container orchestration environments like Kubernetes. 39.92s - 43.72s | So when, a while ago, one of our more mature clients 43.72s - 45.92s | were looking to assess and improve 45.92s - 48.08s | their blue team capability against attacks 48.08s - 50.64s | in a Kubernetes environment, we approached this 50.64s - 53.44s | as we usually do, with a threefold adversary simulation 53.44s - 53.96s | assessment. 54.00s - 56.36s | So first, we did some threat modeling, 56.36s - 59.68s | just to better understand the risks to this novel platform. 59.68s - 62.36s | Then, we wrote some tooling in order 62.36s - 64.32s | to simulate some attacks at scale. 64.32s - 66.52s | And finally, we executed the test cases 66.52s - 70.48s | we designed side by side with the blue team, 70.48s - 72.00s | researching along the way for means 72.00s - 74.60s | to improve visibility and alerting 74.60s - 76.96s | within the Kubernetes ecosystem. 76.96s - 78.96s | But this research didn't really stop there. 78.96s - 80.52s | It didn't stop after that project. 80.52s - 82.84s | We kept working on


chunk_text:
- 39.92s | and even container orchestration environments like Kubernetes. 39.92s - 43.72s | So when, a while ago, one of our more mature clients 43.72s - 45.92s | were looking to assess and improve 45.92s - 48.08s | their blue team capability against attacks 48.08s - 50.64s | in a Kubernetes environment, we approached this 50.64s - 53.44s | as we usually do, with a threefold adversary simulation 53.44s - 53.96s | assessment. 54.00s - 56.36s | So first, we did some threat modeling, 56.36s - 59.68s | just to better understand the risks to this novel platform. 59.68s - 62.36s | Then, we wrote some tooling in order 62.36s - 64.32s | to simulate some attacks at scale. 64.32s - 66.52s | And finally, we executed the test cases 66.52s - 70.48s | we designed side by side with the blue team, 70.48s - 72.00s | researching along the way for means 72.00s - 74.60s | to improve visibility and alerting 74.60s - 76.96s | within the Kubernetes ecosystem. 76.96s - 78.96s | But this research didn't really stop there. 78.96s - 80.52s | It didn't stop after that project. 80.52s - 82.84s | We kept working on it in the background. 82.84s - 84.80s | And this is what we're talking about today. 84.80s - 87.20s | We'll start with a very gentle introduction to Kubernetes. 87.20s - 88.40s | I know this is Adversary Village. 88.40s - 89.56s | It's not a cloud conference. 89.56s - 92.76s | So if you're not familiar with Kubernetes, fear not. 92.76s - 95.52s | We'll talk about the threats posed to a Kubernetes cluster 95.52s - 97.64s | and why threat modeling is essential for the success 97.64s - 99.80s | of any security exercise. 99.80s - 102.04s | And then we'll dive headfirst into Kubernetes attack 102.04s - 103.04s | simulation topics. 103.04s - 106.12s | And we're going to look at tools, operational planning, 106.12s - 108.24s | and eventually execution. 108.24s - 110.20s | And this talk isn't only for offensive security 110.20s - 111.12s | practitioners. 111.12s - 113.88s | So we'll cover some basic Kubernetes detection concepts 113.88s - 117.56s | as well to see things from the perspective of the SOC. 117.56s - 120.24s | We'll look at things like log sources, detection engineering, 120.24s - 121.76s | and so on. 121.76s -


chunk_text:
it in the background. 82.84s - 84.80s | And this is what we're talking about today. 84.80s - 87.20s | We'll start with a very gentle introduction to Kubernetes. 87.20s - 88.40s | I know this is Adversary Village. 88.40s - 89.56s | It's not a cloud conference. 89.56s - 92.76s | So if you're not familiar with Kubernetes, fear not. 92.76s - 95.52s | We'll talk about the threats posed to a Kubernetes cluster 95.52s - 97.64s | and why threat modeling is essential for the success 97.64s - 99.80s | of any security exercise. 99.80s - 102.04s | And then we'll dive headfirst into Kubernetes attack 102.04s - 103.04s | simulation topics. 103.04s - 106.12s | And we're going to look at tools, operational planning, 106.12s - 108.24s | and eventually execution. 108.24s - 110.20s | And this talk isn't only for offensive security 110.20s - 111.12s | practitioners. 111.12s - 113.88s | So we'll cover some basic Kubernetes detection concepts 113.88s - 117.56s | as well to see things from the perspective of the SOC. 117.56s - 120.24s | We'll look at things like log sources, detection engineering, 120.24s - 121.76s | and so on. 121.76s - 124.00s | And finally, we'll demonstrate everything 124.00s - 127.16s | in an end-to-end simulation of an attack against the cluster 127.16s - 129.08s | using the tool we will be releasing shortly 129.08s - 131.44s | after this talk. 131.44s - 132.40s | OK. 132.40s - 135.60s | OK, as promised, let's start with some introductions. 135.60s - 138.00s | We do that in order to introduce all the things that 138.00s - 142.08s | will come into play later, both in the slides and in the demo. 142.08s - 144.24s | But the thing is, if you're even remotely familiar 144.24s - 147.28s | with Kubernetes, you will know that it's complicated. 147.28s - 149.68s | So just a word of caution, this is not 149.68s - 151.04s | going to be an in-depth analysis. 151.04s - 152.84s | It will be deliberately incomplete. 152.84s - 155.40s | In fact, it's probably going to be the fastest introduction 155.40s - 156.76s | to Kubernetes ever given. 156.76s - 158.84s | So please bear with me. 158.84s - 162.28s | So our system in question, the Kubernetes cluster, 162.28s - 163.80s | consists of a set of worker machines.


chunk_text:
124.00s | And finally, we'll demonstrate everything 124.00s - 127.16s | in an end-to-end simulation of an attack against the cluster 127.16s - 129.08s | using the tool we will be releasing shortly 129.08s - 131.44s | after this talk. 131.44s - 132.40s | OK. 132.40s - 135.60s | OK, as promised, let's start with some introductions. 135.60s - 138.00s | We do that in order to introduce all the things that 138.00s - 142.08s | will come into play later, both in the slides and in the demo. 142.08s - 144.24s | But the thing is, if you're even remotely familiar 144.24s - 147.28s | with Kubernetes, you will know that it's complicated. 147.28s - 149.68s | So just a word of caution, this is not 149.68s - 151.04s | going to be an in-depth analysis. 151.04s - 152.84s | It will be deliberately incomplete. 152.84s - 155.40s | In fact, it's probably going to be the fastest introduction 155.40s - 156.76s | to Kubernetes ever given. 156.76s - 158.84s | So please bear with me. 158.84s - 162.28s | So our system in question, the Kubernetes cluster, 162.28s - 163.80s | consists of a set of worker machines. 163.80s - 165.84s | We call them nodes, right? 165.84s - 168.24s | And these nodes run containerized applications. 168.24s - 169.92s | They are managed by the control plane 169.92s - 171.72s | over there on the left of the slide. 171.72s - 173.48s | And in order to run workloads, they 173.48s - 175.72s | need to have a container runtime installed, 175.72s - 178.44s | such as container D or, in older versions, 178.44s - 180.60s | Docker, as well as an agent called 180.60s - 183.36s | the kubelet, which communicates with the control plane 183.36s - 186.56s | and specifically the API server to receive instructions. 186.56s - 189.04s | Now, this component that I mentioned, the API server, 189.04s - 190.28s | is in the heart of the cluster. 190.28s - 193.04s | It's the front end that all internal and external parties 193.04s - 194.20s | communicate with. 194.20s - 196.32s | It exposes a REST API, which clients 196.32s - 198.84s | can talk to if they want to interact with Kubernetes. 198.84s - 201.64s | And I'm talking about clients like users or services, 201.64s - 203.84s | like CICD pipelines.


chunk_text:
163.80s - 165.84s | We call them nodes, right? 165.84s - 168.24s | And these nodes run containerized applications. 168.24s - 169.92s | They are managed by the control plane 169.92s - 171.72s | over there on the left of the slide. 171.72s - 173.48s | And in order to run workloads, they 173.48s - 175.72s | need to have a container runtime installed, 175.72s - 178.44s | such as container D or, in older versions, 178.44s - 180.60s | Docker, as well as an agent called 180.60s - 183.36s | the kubelet, which communicates with the control plane 183.36s - 186.56s | and specifically the API server to receive instructions. 186.56s - 189.04s | Now, this component that I mentioned, the API server, 189.04s - 190.28s | is in the heart of the cluster. 190.28s - 193.04s | It's the front end that all internal and external parties 193.04s - 194.20s | communicate with. 194.20s - 196.32s | It exposes a REST API, which clients 196.32s - 198.84s | can talk to if they want to interact with Kubernetes. 198.84s - 201.64s | And I'm talking about clients like users or services, 201.64s - 203.84s | like CICD pipelines. 203.84s - 206.28s | But it's important to remember that humans most commonly 206.28s - 210.28s | use kubectl instead of just sending raw HTTP requests. 210.28s - 212.24s | Now, when it comes to running applications, 212.24s - 215.32s | the basic building block in Kubernetes is a pod. 215.32s - 218.00s | A pod can consist of one or more containers 218.00s - 221.12s | whose images are pulled from registries, as well as volumes, 221.12s - 222.92s | storage resources. 222.92s - 224.80s | What usually happens in the real world 224.80s - 226.88s | is that workloads aren't actually 226.88s - 230.36s | deployed as individual pods, but as managed collections 230.36s - 233.68s | of pods, like daemon certs or deployments. 233.68s - 235.44s | But beyond pods and deployments, there's 235.44s - 238.64s | a few more types of objects that Kubernetes understands, 238.64s - 241.76s | or resources, such as secrets or services. 241.76s - 244.72s | And all these resources can then be logically grouped 244.72s - 247.44s | into different namespaces for each different project, which 247.44s - 250.64s | you can think of like tenants in the cloud world. 250.64s


chunk_text:
203.84s - 206.28s | But it's important to remember that humans most commonly 206.28s - 210.28s | use kubectl instead of just sending raw HTTP requests. 210.28s - 212.24s | Now, when it comes to running applications, 212.24s - 215.32s | the basic building block in Kubernetes is a pod. 215.32s - 218.00s | A pod can consist of one or more containers 218.00s - 221.12s | whose images are pulled from registries, as well as volumes, 221.12s - 222.92s | storage resources. 222.92s - 224.80s | What usually happens in the real world 224.80s - 226.88s | is that workloads aren't actually 226.88s - 230.36s | deployed as individual pods, but as managed collections 230.36s - 233.68s | of pods, like daemon certs or deployments. 233.68s - 235.44s | But beyond pods and deployments, there's 235.44s - 238.64s | a few more types of objects that Kubernetes understands, 238.64s - 241.76s | or resources, such as secrets or services. 241.76s - 244.72s | And all these resources can then be logically grouped 244.72s - 247.44s | into different namespaces for each different project, which 247.44s - 250.64s | you can think of like tenants in the cloud world. 250.64s - 252.06s | And finally, there's a third layer, 252.06s - 255.58s | besides the physical and the logical, that of authorization, 255.58s - 257.94s | with the most common authorization model being RBAC, 257.94s - 259.90s | role-based access control. 259.90s - 261.86s | RBAC defines the potential entities 261.86s - 264.42s | and allows you to write policies for the permissions 264.42s - 267.10s | that these entities will have against resources. 267.10s - 269.98s | So in the context of RBAC, humans 269.98s - 272.26s | are represented as user objects that 272.26s - 274.30s | can authenticate using various mechanisms, 274.30s - 278.18s | like MTLS client certificates, Active Directory, IAM roles, 278.18s - 279.30s | and so on. 279.30s - 281.34s | And you also get pods or external services 281.34s - 283.42s | that are associated with service accounts. 283.42s - 285.50s | And service accounts authenticate using tokens, 285.50s - 288.70s | JSON Web Tokens, JWTs. 288.70s - 292.54s | OK, that was easy, right? 292.54s - 294.78s | One thing to remember, though, is that in Kubernetes, 294.78s - 296.10s | everything can be replaced. 296.10s - 297.42s | It's built to


chunk_text:
- 252.06s | And finally, there's a third layer, 252.06s - 255.58s | besides the physical and the logical, that of authorization, 255.58s - 257.94s | with the most common authorization model being RBAC, 257.94s - 259.90s | role-based access control. 259.90s - 261.86s | RBAC defines the potential entities 261.86s - 264.42s | and allows you to write policies for the permissions 264.42s - 267.10s | that these entities will have against resources. 267.10s - 269.98s | So in the context of RBAC, humans 269.98s - 272.26s | are represented as user objects that 272.26s - 274.30s | can authenticate using various mechanisms, 274.30s - 278.18s | like MTLS client certificates, Active Directory, IAM roles, 278.18s - 279.30s | and so on. 279.30s - 281.34s | And you also get pods or external services 281.34s - 283.42s | that are associated with service accounts. 283.42s - 285.50s | And service accounts authenticate using tokens, 285.50s - 288.70s | JSON Web Tokens, JWTs. 288.70s - 292.54s | OK, that was easy, right? 292.54s - 294.78s | One thing to remember, though, is that in Kubernetes, 294.78s - 296.10s | everything can be replaced. 296.10s - 297.42s | It's built to be extensible. 297.42s - 301.06s | So it is 100% certain that your mileage will vary. 301.06s - 303.18s | And you will have numerous third-party technologies 303.18s - 305.30s | running in your cluster, technologies 305.30s - 307.98s | like the ones tracked in the CNCF landscape, which 307.98s - 309.70s | introduce their own set of risks when 309.70s - 310.98s | deployed inside your cluster. 311.74s - 315.26s | In order to tailor any security exercise to your environment 315.26s - 317.74s | with its own intricacies, it's essential you perform 317.74s - 319.06s | some threat modeling first. 319.06s - 320.74s | And that means answering a few questions 320.74s - 323.02s | like, what are the assets I must protect? 323.02s - 325.02s | And where would attacks come from? 325.02s - 328.26s | And why would attackers target Kubernetes in first place? 328.26s - 330.54s | Let's start with an enumeration of the attack surfaces. 330.54s - 331.98s | This will also help us understand 331.98s - 334.86s | which levels we must execute in if we're looking 334.86s - 336.94s | to simulate these attacks. 336.94s - 339.54s | In the most typical


chunk_text:
be extensible. 297.42s - 301.06s | So it is 100% certain that your mileage will vary. 301.06s - 303.18s | And you will have numerous third-party technologies 303.18s - 305.30s | running in your cluster, technologies 305.30s - 307.98s | like the ones tracked in the CNCF landscape, which 307.98s - 309.70s | introduce their own set of risks when 309.70s - 310.98s | deployed inside your cluster. 311.74s - 315.26s | In order to tailor any security exercise to your environment 315.26s - 317.74s | with its own intricacies, it's essential you perform 317.74s - 319.06s | some threat modeling first. 319.06s - 320.74s | And that means answering a few questions 320.74s - 323.02s | like, what are the assets I must protect? 323.02s - 325.02s | And where would attacks come from? 325.02s - 328.26s | And why would attackers target Kubernetes in first place? 328.26s - 330.54s | Let's start with an enumeration of the attack surfaces. 330.54s - 331.98s | This will also help us understand 331.98s - 334.86s | which levels we must execute in if we're looking 334.86s - 336.94s | to simulate these attacks. 336.94s - 339.54s | In the most typical scenario, attacks 339.54s - 341.70s | will originate from the container level, the code 341.70s - 342.66s | running within the pod. 342.66s - 345.78s | For example, think of a compromised web service 345.78s - 348.50s | or a backdoored image that found its way into your cluster 348.50s - 349.54s | somehow. 349.54s - 351.82s | And if that pod is assigned a service account, 351.82s - 353.74s | the attacker can talk to the control plane 353.74s - 356.42s | in a limited security context, hopefully, 356.42s - 359.10s | unless they manage to break out of the container. 359.10s - 361.50s | That way, they're on the node, the underlying host, 361.50s - 363.90s | with potential access to other Kubernetes resources 363.90s - 366.66s | from other namespaces and with even higher security 366.66s - 368.90s | privileges, as they will most likely impersonate 368.90s - 370.54s | the kubelet. 370.54s - 372.58s | And of course, there's always a threat of attacks 372.58s - 374.22s | from the outside world. 374.22s - 376.98s | Think of scenarios like leaked or stolen credentials, 376.98s - 379.78s | a compromised service, a malicious user, a coerced


chunk_text:
scenario, attacks 339.54s - 341.70s | will originate from the container level, the code 341.70s - 342.66s | running within the pod. 342.66s - 345.78s | For example, think of a compromised web service 345.78s - 348.50s | or a backdoored image that found its way into your cluster 348.50s - 349.54s | somehow. 349.54s - 351.82s | And if that pod is assigned a service account, 351.82s - 353.74s | the attacker can talk to the control plane 353.74s - 356.42s | in a limited security context, hopefully, 356.42s - 359.10s | unless they manage to break out of the container. 359.10s - 361.50s | That way, they're on the node, the underlying host, 361.50s - 363.90s | with potential access to other Kubernetes resources 363.90s - 366.66s | from other namespaces and with even higher security 366.66s - 368.90s | privileges, as they will most likely impersonate 368.90s - 370.54s | the kubelet. 370.54s - 372.58s | And of course, there's always a threat of attacks 372.58s - 374.22s | from the outside world. 374.22s - 376.98s | Think of scenarios like leaked or stolen credentials, 376.98s - 379.78s | a compromised service, a malicious user, a coerced user, 379.78s - 381.90s | and so on and so on. 381.90s - 383.34s | So once they're inside your cluster, 383.34s - 384.50s | what will they move towards? 384.50s - 386.90s | What's the final objective there? 386.90s - 389.82s | An obvious answer to this one is, of course, the workloads. 389.82s - 392.30s | If Kubernetes is the underlying platform 392.30s - 394.46s | that your critical workloads are running in, 394.46s - 396.58s | then it's a way into them. 396.58s - 398.42s | It's a way into the workload. 398.46s - 401.38s | So compromising Kubernetes could result 401.38s - 403.50s | in unauthorized access to the data. 403.50s - 405.62s | And we're talking about potentially sensitive data 405.62s - 408.26s | that the apps may be handling, like proprietary software, 408.26s - 410.30s | as you can see on this slide, that can be stolen 410.30s - 413.30s | or even backdoored to achieve a supply chain compromise. 414.62s - 417.30s | But actually, that's not the most common incentive. 417.30s - 420.18s | In the age of cryptocurrency, every compute resource 420.18s - 423.46s | makes for an attractive target for


chunk_text:
user, 379.78s - 381.90s | and so on and so on. 381.90s - 383.34s | So once they're inside your cluster, 383.34s - 384.50s | what will they move towards? 384.50s - 386.90s | What's the final objective there? 386.90s - 389.82s | An obvious answer to this one is, of course, the workloads. 389.82s - 392.30s | If Kubernetes is the underlying platform 392.30s - 394.46s | that your critical workloads are running in, 394.46s - 396.58s | then it's a way into them. 396.58s - 398.42s | It's a way into the workload. 398.46s - 401.38s | So compromising Kubernetes could result 401.38s - 403.50s | in unauthorized access to the data. 403.50s - 405.62s | And we're talking about potentially sensitive data 405.62s - 408.26s | that the apps may be handling, like proprietary software, 408.26s - 410.30s | as you can see on this slide, that can be stolen 410.30s - 413.30s | or even backdoored to achieve a supply chain compromise. 414.62s - 417.30s | But actually, that's not the most common incentive. 417.30s - 420.18s | In the age of cryptocurrency, every compute resource 420.18s - 423.46s | makes for an attractive target for its immediate potential 423.46s - 424.90s | for financial returns. 424.90s - 428.70s | Compute, in and of itself, is therefore worth protecting. 428.70s - 430.78s | And you'll see that various instances have been recorded 430.78s - 432.34s | with this particular objective. 433.46s - 435.54s | Kubernetes clusters are usually also deployed 435.54s - 437.14s | as managed cloud services, 437.14s - 439.98s | or broadly speaking, in cloud infrastructure. 439.98s - 442.22s | So instead of going for the applications, 442.22s - 444.22s | a Kubernetes attacker might actually be looking 444.22s - 445.78s | for a way into the cloud infrastructure, 445.78s - 448.90s | into the underlying infrastructure. 448.90s - 451.22s | But we've also seen Kubernetes attack techniques 451.22s - 453.38s | across all phases of the intrusion lifecycle, 453.38s - 454.90s | including persistence methods 454.90s - 457.18s | that could enable APT-like surveillance 457.18s - 458.70s | through a long-term infection, 459.62s - 461.30s | and even for defense evasion purposes, 461.30s - 464.54s | as, after all, Kubernetes is yet another platform 464.54s - 466.54s | where an intruder can dwell in, 466.54s - 469.02s | and usually it's a less


chunk_text:
its immediate potential 423.46s - 424.90s | for financial returns. 424.90s - 428.70s | Compute, in and of itself, is therefore worth protecting. 428.70s - 430.78s | And you'll see that various instances have been recorded 430.78s - 432.34s | with this particular objective. 433.46s - 435.54s | Kubernetes clusters are usually also deployed 435.54s - 437.14s | as managed cloud services, 437.14s - 439.98s | or broadly speaking, in cloud infrastructure. 439.98s - 442.22s | So instead of going for the applications, 442.22s - 444.22s | a Kubernetes attacker might actually be looking 444.22s - 445.78s | for a way into the cloud infrastructure, 445.78s - 448.90s | into the underlying infrastructure. 448.90s - 451.22s | But we've also seen Kubernetes attack techniques 451.22s - 453.38s | across all phases of the intrusion lifecycle, 453.38s - 454.90s | including persistence methods 454.90s - 457.18s | that could enable APT-like surveillance 457.18s - 458.70s | through a long-term infection, 459.62s - 461.30s | and even for defense evasion purposes, 461.30s - 464.54s | as, after all, Kubernetes is yet another platform 464.54s - 466.54s | where an intruder can dwell in, 466.54s - 469.02s | and usually it's a less monitored platform, 469.02s - 470.46s | which makes it a great place to hide 470.46s - 473.34s | if you want to evade containment measures. 473.34s - 476.74s | All right, so we know what adversaries are looking for. 476.74s - 478.34s | We know where they'll come from. 478.34s - 479.94s | Let's go ahead and simulate them. 479.94s - 482.90s | Now, there's a few different approaches to go about this. 482.90s - 485.90s | And instead of a stealthy, objective-based exercise, 485.90s - 488.66s | we chose to adopt more of a Purple Team methodology. 488.66s - 490.62s | And I know different people define Purple Teams differently, 490.62s - 492.10s | so let me use the definition given 492.10s - 493.90s | by the guys over at SpectreOps. 493.90s - 496.38s | It talks about collaboration between offense and defense 496.38s - 499.54s | with the aim to increase familiarity with TDPs. 499.54s - 501.70s | And for a novel environment like Kubernetes, 501.70s - 503.74s | we similarly decided it's more valuable 503.74s - 505.94s | to opt for a collaborative engagement 505.94s - 508.66s | and try to help the blue team understand attacker


chunk_text:
monitored platform, 469.02s - 470.46s | which makes it a great place to hide 470.46s - 473.34s | if you want to evade containment measures. 473.34s - 476.74s | All right, so we know what adversaries are looking for. 476.74s - 478.34s | We know where they'll come from. 478.34s - 479.94s | Let's go ahead and simulate them. 479.94s - 482.90s | Now, there's a few different approaches to go about this. 482.90s - 485.90s | And instead of a stealthy, objective-based exercise, 485.90s - 488.66s | we chose to adopt more of a Purple Team methodology. 488.66s - 490.62s | And I know different people define Purple Teams differently, 490.62s - 492.10s | so let me use the definition given 492.10s - 493.90s | by the guys over at SpectreOps. 493.90s - 496.38s | It talks about collaboration between offense and defense 496.38s - 499.54s | with the aim to increase familiarity with TDPs. 499.54s - 501.70s | And for a novel environment like Kubernetes, 501.70s - 503.74s | we similarly decided it's more valuable 503.74s - 505.94s | to opt for a collaborative engagement 505.94s - 508.66s | and try to help the blue team understand attacker behaviors 508.66s - 510.42s | instead of vulnerabilities. 510.42s - 512.46s | And at WithSecure, we focus a bit more on detection, 512.46s - 514.66s | so when we're planning a Purple Team exercise, 514.66s - 516.02s | we do it in one of two ways, 516.02s - 517.42s | depending on what we want to achieve. 517.42s - 520.74s | So we could either aim to cover as many TDPs as possible, 520.74s - 523.26s | executing them one after the other in isolation, 523.26s - 525.42s | or we could chain a few attacks, 525.42s - 527.54s | similar to how a threat actor would move, 527.54s - 529.78s | to make it as realistic as possible. 529.78s - 531.06s | And even mimic a specific campaign 531.06s - 533.34s | from the ones we saw before. 533.34s - 535.06s | Okay, let's look at these two options 535.06s - 536.82s | in a little bit more detail 536.82s - 538.82s | in the context of a Kubernetes exercise. 540.06s - 541.42s | So for Kubernetes specifically, 541.42s - 544.26s | we found that there aren't as many campaigns documented 544.26s - 546.46s | as there are for


chunk_text:
behaviors 508.66s - 510.42s | instead of vulnerabilities. 510.42s - 512.46s | And at WithSecure, we focus a bit more on detection, 512.46s - 514.66s | so when we're planning a Purple Team exercise, 514.66s - 516.02s | we do it in one of two ways, 516.02s - 517.42s | depending on what we want to achieve. 517.42s - 520.74s | So we could either aim to cover as many TDPs as possible, 520.74s - 523.26s | executing them one after the other in isolation, 523.26s - 525.42s | or we could chain a few attacks, 525.42s - 527.54s | similar to how a threat actor would move, 527.54s - 529.78s | to make it as realistic as possible. 529.78s - 531.06s | And even mimic a specific campaign 531.06s - 533.34s | from the ones we saw before. 533.34s - 535.06s | Okay, let's look at these two options 535.06s - 536.82s | in a little bit more detail 536.82s - 538.82s | in the context of a Kubernetes exercise. 540.06s - 541.42s | So for Kubernetes specifically, 541.42s - 544.26s | we found that there aren't as many campaigns documented 544.26s - 546.46s | as there are for on-prem infrastructure. 546.46s - 547.30s | And as a result, 547.30s - 549.38s | there's not a lot of threat intelligence available. 549.38s - 552.86s | So when incidents do happen in other organizations, 552.86s - 555.74s | they make for a good opportunity for your organization 555.74s - 558.70s | to perform an emulation cycle, to perform a campaign. 558.70s - 560.62s | In that case, you probably know already 560.62s - 562.90s | which threat actor you want to emulate. 562.90s - 565.22s | But if not, the security researchers over at Wiz 565.22s - 567.70s | maintain this great matrix of cloud threats. 567.70s - 569.86s | And that also covers Kubernetes incidents. 569.86s - 572.06s | So it aggregates threat intelligence 572.06s - 573.26s | from various blog posts, 573.26s - 575.90s | like unit 42, Aqua, Sysdig, CrowdStrike, 575.90s - 577.66s | all the ones we saw before. 577.66s - 580.90s | And you can collect all this threat intelligence, 580.90s - 583.94s | analyze it, and finally recreate an attack chain 583.94s - 586.22s | and execute this inside your cluster. 586.22s - 587.74s | Now, a nice way of documenting 587.74s - 591.18s


chunk_text:
on-prem infrastructure. 546.46s - 547.30s | And as a result, 547.30s - 549.38s | there's not a lot of threat intelligence available. 549.38s - 552.86s | So when incidents do happen in other organizations, 552.86s - 555.74s | they make for a good opportunity for your organization 555.74s - 558.70s | to perform an emulation cycle, to perform a campaign. 558.70s - 560.62s | In that case, you probably know already 560.62s - 562.90s | which threat actor you want to emulate. 562.90s - 565.22s | But if not, the security researchers over at Wiz 565.22s - 567.70s | maintain this great matrix of cloud threats. 567.70s - 569.86s | And that also covers Kubernetes incidents. 569.86s - 572.06s | So it aggregates threat intelligence 572.06s - 573.26s | from various blog posts, 573.26s - 575.90s | like unit 42, Aqua, Sysdig, CrowdStrike, 575.90s - 577.66s | all the ones we saw before. 577.66s - 580.90s | And you can collect all this threat intelligence, 580.90s - 583.94s | analyze it, and finally recreate an attack chain 583.94s - 586.22s | and execute this inside your cluster. 586.22s - 587.74s | Now, a nice way of documenting 587.74s - 591.18s | these different emulation plans is Jupyter Notebooks. 591.18s - 592.94s | And we've seen a bit in the demo 592.94s - 595.58s | how Jupyter Notebooks can also streamline execution 595.58s - 597.42s | of the attack simulation. 597.42s - 599.62s | But for more of a one-off assessment, 600.38s - 601.46s | or if you're looking to build a baseline 601.46s - 602.86s | of your detection capability 602.86s - 605.14s | against all the possible TDPs, 605.14s - 607.46s | then you first need a list of all the different TDPs 607.46s - 609.18s | for the platform in question. 609.18s - 612.86s | In 2020, Microsoft released the Threat Matrix for Kubernetes 612.86s - 615.18s | which was the first systematic categorization 615.18s - 617.82s | of Kubernetes techniques observed until then. 617.82s - 619.86s | And it seems to be actively maintained. 619.86s - 622.70s | There's also a Mitre Attack Matrix for containers, 622.70s - 625.66s | but it doesn't really care about the orchestration platform. 625.66s - 627.82s | And I actually got some very good ideas for attacks 627.82s - 629.98s | by looking at KubeHunter. 629.98s - 631.38s | Although it's


chunk_text:
| these different emulation plans is Jupyter Notebooks. 591.18s - 592.94s | And we've seen a bit in the demo 592.94s - 595.58s | how Jupyter Notebooks can also streamline execution 595.58s - 597.42s | of the attack simulation. 597.42s - 599.62s | But for more of a one-off assessment, 600.38s - 601.46s | or if you're looking to build a baseline 601.46s - 602.86s | of your detection capability 602.86s - 605.14s | against all the possible TDPs, 605.14s - 607.46s | then you first need a list of all the different TDPs 607.46s - 609.18s | for the platform in question. 609.18s - 612.86s | In 2020, Microsoft released the Threat Matrix for Kubernetes 612.86s - 615.18s | which was the first systematic categorization 615.18s - 617.82s | of Kubernetes techniques observed until then. 617.82s - 619.86s | And it seems to be actively maintained. 619.86s - 622.70s | There's also a Mitre Attack Matrix for containers, 622.70s - 625.66s | but it doesn't really care about the orchestration platform. 625.66s - 627.82s | And I actually got some very good ideas for attacks 627.82s - 629.98s | by looking at KubeHunter. 629.98s - 631.38s | Although it's a vulnerability scanner, 631.38s - 633.14s | it just had a long list of checks supported, 633.14s - 635.58s | so it gave me some very good ideas. 635.58s - 637.22s | But for more technical instructions 637.22s - 639.38s | on how to execute each TDP, 639.38s - 641.14s | I found the KubeNomicon to be a good source. 641.14s - 644.06s | So shout out to Graham Helton from Google for his project. 645.02s - 646.86s | And once you've designed these test cases, 646.86s - 650.46s | one good way of describing them is via a code format, 650.46s - 651.62s | allowing them to be maintained 651.62s - 653.90s | in a version control system like Git. 653.90s - 655.98s | And this is a well-known practice in DevSecOps. 656.26s - 658.74s | Attack definitions as code, detections as code, 658.74s - 660.74s | we can apply it here as well. 660.74s - 663.54s | This way, as your Kubernetes environment evolves, 663.54s - 666.38s | so does your repository of attacker test cases. 667.54s - 668.38s | Fantastic. 668.38s - 670.18s | So we have planned everything. 670.18s - 671.66s | We are ready to


chunk_text:
a vulnerability scanner, 631.38s - 633.14s | it just had a long list of checks supported, 633.14s - 635.58s | so it gave me some very good ideas. 635.58s - 637.22s | But for more technical instructions 637.22s - 639.38s | on how to execute each TDP, 639.38s - 641.14s | I found the KubeNomicon to be a good source. 641.14s - 644.06s | So shout out to Graham Helton from Google for his project. 645.02s - 646.86s | And once you've designed these test cases, 646.86s - 650.46s | one good way of describing them is via a code format, 650.46s - 651.62s | allowing them to be maintained 651.62s - 653.90s | in a version control system like Git. 653.90s - 655.98s | And this is a well-known practice in DevSecOps. 656.26s - 658.74s | Attack definitions as code, detections as code, 658.74s - 660.74s | we can apply it here as well. 660.74s - 663.54s | This way, as your Kubernetes environment evolves, 663.54s - 666.38s | so does your repository of attacker test cases. 667.54s - 668.38s | Fantastic. 668.38s - 670.18s | So we have planned everything. 670.18s - 671.66s | We are ready to get our hands dirty. 671.66s - 673.58s | Let's start bashing kubectl commands. 674.78s - 676.22s | No, that wouldn't scale very easily, 676.22s - 678.30s | but thankfully there are a few simulation frameworks 678.30s - 681.14s | out there to make our lives a bit easier. 681.14s - 682.38s | Starting with the familiar ART, 682.38s - 684.58s | Atomic Red Team by Red Canary. 684.58s - 685.42s | This is Adversary Village. 685.42s - 686.86s | I'm sure you're all aware of it. 686.86s - 689.42s | Although it does support a few test cases 689.42s - 690.54s | on the container level, 690.54s - 692.86s | it's not really built for cloud environments. 692.86s - 694.58s | So it doesn't really support attacks 694.58s - 696.54s | against the Kubernetes control plane. 696.54s - 698.78s | On the other hand, Stratus Red Team 698.78s - 700.54s | was specifically made for the cloud 700.54s - 702.06s | and for attack simulations. 702.06s - 705.50s | So it even supports eight pure Kubernetes test cases. 705.50s - 709.34s | So it's actually a good choice for this particular purpose. 709.34s - 711.30s | However, you will find


chunk_text:
get our hands dirty. 671.66s - 673.58s | Let's start bashing kubectl commands. 674.78s - 676.22s | No, that wouldn't scale very easily, 676.22s - 678.30s | but thankfully there are a few simulation frameworks 678.30s - 681.14s | out there to make our lives a bit easier. 681.14s - 682.38s | Starting with the familiar ART, 682.38s - 684.58s | Atomic Red Team by Red Canary. 684.58s - 685.42s | This is Adversary Village. 685.42s - 686.86s | I'm sure you're all aware of it. 686.86s - 689.42s | Although it does support a few test cases 689.42s - 690.54s | on the container level, 690.54s - 692.86s | it's not really built for cloud environments. 692.86s - 694.58s | So it doesn't really support attacks 694.58s - 696.54s | against the Kubernetes control plane. 696.54s - 698.78s | On the other hand, Stratus Red Team 698.78s - 700.54s | was specifically made for the cloud 700.54s - 702.06s | and for attack simulations. 702.06s - 705.50s | So it even supports eight pure Kubernetes test cases. 705.50s - 709.34s | So it's actually a good choice for this particular purpose. 709.34s - 711.30s | However, you will find it's not very easy 711.30s - 712.50s | to write new test cases. 712.50s - 714.54s | And the fact that it runs outside of your cluster 715.50s - 716.34s | kind of restricts the number of different levels 716.34s - 717.70s | that it can execute in. 718.74s - 721.46s | One tool that can in fact run from within the cluster 721.46s - 723.78s | is Pirates by InGuardians. 723.78s - 726.58s | It's also widely known, various talks, blog posts, 726.58s - 727.98s | webinars out there talking about it. 727.98s - 728.90s | It's so well known 728.90s - 731.62s | that it's actually been used by threat actors. 731.62s - 735.02s | But once again, the attacks it supports are hard-coded 735.02s - 738.46s | and the tool itself doesn't really allow for customization. 738.46s - 741.74s | So overall, when we were doing this research, 741.74s - 743.34s | we realized that none of these tools 743.34s - 745.06s | performed exactly what we wanted. 745.06s - 747.66s | These options all had some limitations. 747.66s - 750.70s | So we decided to extend our own existing tool, Leonidas, 750.70s - 752.38s | to


chunk_text:
it's not very easy 711.30s - 712.50s | to write new test cases. 712.50s - 714.54s | And the fact that it runs outside of your cluster 715.50s - 716.34s | kind of restricts the number of different levels 716.34s - 717.70s | that it can execute in. 718.74s - 721.46s | One tool that can in fact run from within the cluster 721.46s - 723.78s | is Pirates by InGuardians. 723.78s - 726.58s | It's also widely known, various talks, blog posts, 726.58s - 727.98s | webinars out there talking about it. 727.98s - 728.90s | It's so well known 728.90s - 731.62s | that it's actually been used by threat actors. 731.62s - 735.02s | But once again, the attacks it supports are hard-coded 735.02s - 738.46s | and the tool itself doesn't really allow for customization. 738.46s - 741.74s | So overall, when we were doing this research, 741.74s - 743.34s | we realized that none of these tools 743.34s - 745.06s | performed exactly what we wanted. 745.06s - 747.66s | These options all had some limitations. 747.66s - 750.70s | So we decided to extend our own existing tool, Leonidas, 750.70s - 752.38s | to add Kubernetes support. 752.38s - 753.58s | And if you're not familiar with it, 753.58s - 755.62s | no, I did not write the original version. 755.62s - 758.90s | It's not named after me, that would be a little bit lame. 758.90s - 760.42s | I don't want to talk too much about Leonidas. 760.42s - 762.30s | It's an open source tool. 762.30s - 765.74s | My colleague Nick Jones originally wrote the AWS version. 765.74s - 768.78s | And again, various presentations out there talking about it. 768.78s - 770.42s | What made Leonidas attractive 770.42s - 772.78s | for the challenge of Kubernetes attack simulations 772.78s - 774.82s | was some of its core principles, 774.82s - 777.26s | like the fact that it was built with extensibility in mind 777.26s - 780.10s | and how friendly it was to write new test cases 780.10s - 781.98s | without having to be a developer, 781.98s - 784.22s | as well as the ability to run within your environment 784.22s - 785.86s | and manage its own resources. 786.74s - 788.46s | And these were the concepts that we applied 788.46s - 790.58s | when building Kubernetes


chunk_text:
add Kubernetes support. 752.38s - 753.58s | And if you're not familiar with it, 753.58s - 755.62s | no, I did not write the original version. 755.62s - 758.90s | It's not named after me, that would be a little bit lame. 758.90s - 760.42s | I don't want to talk too much about Leonidas. 760.42s - 762.30s | It's an open source tool. 762.30s - 765.74s | My colleague Nick Jones originally wrote the AWS version. 765.74s - 768.78s | And again, various presentations out there talking about it. 768.78s - 770.42s | What made Leonidas attractive 770.42s - 772.78s | for the challenge of Kubernetes attack simulations 772.78s - 774.82s | was some of its core principles, 774.82s - 777.26s | like the fact that it was built with extensibility in mind 777.26s - 780.10s | and how friendly it was to write new test cases 780.10s - 781.98s | without having to be a developer, 781.98s - 784.22s | as well as the ability to run within your environment 784.22s - 785.86s | and manage its own resources. 786.74s - 788.46s | And these were the concepts that we applied 788.46s - 790.58s | when building Kubernetes support for it. 790.58s - 792.86s | We wanted something running within the cluster, 792.86s - 796.10s | distributed as a disposable image, as an ephemeral image. 796.10s - 798.30s | We wanted something that analysts or threat hunters 798.30s - 800.58s | could trivially write new TTPs for. 801.58s - 803.62s | But we also wanted purple teams 803.62s - 805.98s | to have an easy way to execute them 805.98s - 808.26s | by just interacting with an API, 808.26s - 810.70s | as well as a way for operators and defenders 810.70s - 813.62s | to track execution of each action. 813.62s - 815.06s | And we can do that through the logs 815.06s - 817.46s | that are stored and shipped to the scene, 817.46s - 821.10s | along with all the other telemetry that the class generates. 821.10s - 822.94s | Now, alongside this new version of Leonidas, 822.94s - 825.38s | we are also releasing a set of Kubernetes test cases, 825.38s - 828.34s | 17 in total, not only to help you get started 828.34s - 829.78s | writing attack definitions, 829.90s - 831.86s | but also to showcase the tool's capabilities, 831.86s


chunk_text:
support for it. 790.58s - 792.86s | We wanted something running within the cluster, 792.86s - 796.10s | distributed as a disposable image, as an ephemeral image. 796.10s - 798.30s | We wanted something that analysts or threat hunters 798.30s - 800.58s | could trivially write new TTPs for. 801.58s - 803.62s | But we also wanted purple teams 803.62s - 805.98s | to have an easy way to execute them 805.98s - 808.26s | by just interacting with an API, 808.26s - 810.70s | as well as a way for operators and defenders 810.70s - 813.62s | to track execution of each action. 813.62s - 815.06s | And we can do that through the logs 815.06s - 817.46s | that are stored and shipped to the scene, 817.46s - 821.10s | along with all the other telemetry that the class generates. 821.10s - 822.94s | Now, alongside this new version of Leonidas, 822.94s - 825.38s | we are also releasing a set of Kubernetes test cases, 825.38s - 828.34s | 17 in total, not only to help you get started 828.34s - 829.78s | writing attack definitions, 829.90s - 831.86s | but also to showcase the tool's capabilities, 831.86s - 833.34s | like running kubectl commands, 833.34s - 834.50s | running always-level commands, 834.50s - 836.82s | and even applying custom YAML manifests, 836.82s - 838.54s | a lot of different options. 838.54s - 841.46s | Okay, lastly, I want to talk about operations teams 841.46s - 844.74s | and how they can apply the security monitoring concepts 844.74s - 845.82s | of the traditional SOC 845.82s - 848.26s | into container orchestration environment. 848.26s - 849.62s | After all, the goal of any exercise 849.62s - 852.02s | is to upskill defenders and build the capability. 853.34s - 855.98s | The most important building block of security monitoring 855.98s - 858.10s | is arguably logs, all right? 858.10s - 860.26s | If you look at the official Kubernetes documentation, 860.26s - 863.74s | however, you'll find there are plenty of logs available, 863.74s - 865.26s | but no standard architecture 865.26s - 867.30s | for what we call cluster-level logging. 867.30s - 869.90s | This is left to the users to implement. 869.90s - 872.30s | Roughly speaking, from all the different types, 872.30s - 874.46s | there are, let's say we can categorize all of them 874.46s


chunk_text:
- 833.34s | like running kubectl commands, 833.34s - 834.50s | running always-level commands, 834.50s - 836.82s | and even applying custom YAML manifests, 836.82s - 838.54s | a lot of different options. 838.54s - 841.46s | Okay, lastly, I want to talk about operations teams 841.46s - 844.74s | and how they can apply the security monitoring concepts 844.74s - 845.82s | of the traditional SOC 845.82s - 848.26s | into container orchestration environment. 848.26s - 849.62s | After all, the goal of any exercise 849.62s - 852.02s | is to upskill defenders and build the capability. 853.34s - 855.98s | The most important building block of security monitoring 855.98s - 858.10s | is arguably logs, all right? 858.10s - 860.26s | If you look at the official Kubernetes documentation, 860.26s - 863.74s | however, you'll find there are plenty of logs available, 863.74s - 865.26s | but no standard architecture 865.26s - 867.30s | for what we call cluster-level logging. 867.30s - 869.90s | This is left to the users to implement. 869.90s - 872.30s | Roughly speaking, from all the different types, 872.30s - 874.46s | there are, let's say we can categorize all of them 874.46s - 876.18s | into three different types of log sources. 876.18s - 878.82s | So first, we have logs from your application, 878.82s - 880.22s | logs from the code, 880.22s - 882.98s | which are exposed to container logs and pod logs. 882.98s - 885.78s | You can collect them with the kubectl logs commands, 885.78s - 886.82s | but they are ephemeral, 886.82s - 889.90s | which means that if the pod terminates, the logs are gone. 890.90s - 893.10s | We also have logs from Kubernetes components, 893.10s - 896.06s | like the API server, the kubelet, the container runtime. 896.06s - 897.62s | Just like container logs, 897.62s - 900.18s | these ones are also stored on the nodes, 900.18s - 903.78s | which means that actually in a production cluster, 903.78s - 906.46s | nodes will be disposable. 906.46s - 909.18s | If the VM is replaced, these logs are also gone. 909.18s - 911.42s | So you need to take them out of the host while you can. 911.42s - 913.46s | And thankfully, there's lots of solutions out there, 913.46s - 916.70s | agent-based solutions like Fluentd that can do that. 916.70s -


chunk_text:
- 876.18s | into three different types of log sources. 876.18s - 878.82s | So first, we have logs from your application, 878.82s - 880.22s | logs from the code, 880.22s - 882.98s | which are exposed to container logs and pod logs. 882.98s - 885.78s | You can collect them with the kubectl logs commands, 885.78s - 886.82s | but they are ephemeral, 886.82s - 889.90s | which means that if the pod terminates, the logs are gone. 890.90s - 893.10s | We also have logs from Kubernetes components, 893.10s - 896.06s | like the API server, the kubelet, the container runtime. 896.06s - 897.62s | Just like container logs, 897.62s - 900.18s | these ones are also stored on the nodes, 900.18s - 903.78s | which means that actually in a production cluster, 903.78s - 906.46s | nodes will be disposable. 906.46s - 909.18s | If the VM is replaced, these logs are also gone. 909.18s - 911.42s | So you need to take them out of the host while you can. 911.42s - 913.46s | And thankfully, there's lots of solutions out there, 913.46s - 916.70s | agent-based solutions like Fluentd that can do that. 916.70s - 917.78s | And finally, we have logs 917.78s - 920.46s | that aren't particularly native to Kubernetes, 920.46s - 921.46s | but are still of interest 921.46s - 924.22s | for the security of the overall ecosystem. 924.22s - 925.86s | If your cluster is a managed service 925.86s - 927.42s | from a public cloud provider, 927.42s - 931.18s | then that cloud provider's logging and monitoring solutions 931.18s - 932.34s | are also crucial to monitor, 932.34s - 934.86s | like IAM logs or guard duty and stuff like that. 934.86s - 935.70s | And similarly, 935.70s - 938.18s | if you host your own internal image repositories, 938.18s - 941.38s | we found that logs from these image repositories 941.38s - 944.86s | could allow the correlation of certain attacker actions. 944.86s - 946.54s | And that's not even the half of it. 947.38s - 948.90s | There's just a ridiculous amount of logs 948.90s - 950.62s | flowing throughout your cluster, 950.62s - 953.58s | but not all of them are useful for detecting attacks. 953.58s - 956.18s | The ones that are, are those selected here. 956.18s - 959.10s | It's those that answer not


chunk_text:
917.78s | And finally, we have logs 917.78s - 920.46s | that aren't particularly native to Kubernetes, 920.46s - 921.46s | but are still of interest 921.46s - 924.22s | for the security of the overall ecosystem. 924.22s - 925.86s | If your cluster is a managed service 925.86s - 927.42s | from a public cloud provider, 927.42s - 931.18s | then that cloud provider's logging and monitoring solutions 931.18s - 932.34s | are also crucial to monitor, 932.34s - 934.86s | like IAM logs or guard duty and stuff like that. 934.86s - 935.70s | And similarly, 935.70s - 938.18s | if you host your own internal image repositories, 938.18s - 941.38s | we found that logs from these image repositories 941.38s - 944.86s | could allow the correlation of certain attacker actions. 944.86s - 946.54s | And that's not even the half of it. 947.38s - 948.90s | There's just a ridiculous amount of logs 948.90s - 950.62s | flowing throughout your cluster, 950.62s - 953.58s | but not all of them are useful for detecting attacks. 953.58s - 956.18s | The ones that are, are those selected here. 956.18s - 959.10s | It's those that answer not so much why something happened, 959.10s - 962.18s | but rather who did what, when, and where from. 963.06s - 965.54s | And these security-relevant log sources 965.54s - 967.22s | map to the execution levels, 967.22s - 968.98s | if you remember from the previous slide, 968.98s - 971.34s | which provides us visibility on the container level, 971.34s - 974.30s | on the node level, and the control plane level. 974.30s - 975.14s | And alongside those, 975.14s - 977.34s | I also highlighted the cloud IAM logs, 977.34s - 978.58s | because if you're running a managed cluster, 978.58s - 981.06s | identity is always of security interest. 982.02s - 982.94s | I want to take a couple of slides 982.94s - 984.82s | to zoom in on the most important log source, 984.82s - 988.90s | the true MVP of Kubernetes attack detection, the audit log. 988.90s - 989.98s | You can consider the audit log 989.98s - 992.50s | as the access logs of the API server, 992.50s - 993.58s | which simply means that 993.58s - 995.18s | if you're interacting with a control plane, 995.18s - 998.26s | you're getting recorded, with some


chunk_text:
so much why something happened, 959.10s - 962.18s | but rather who did what, when, and where from. 963.06s - 965.54s | And these security-relevant log sources 965.54s - 967.22s | map to the execution levels, 967.22s - 968.98s | if you remember from the previous slide, 968.98s - 971.34s | which provides us visibility on the container level, 971.34s - 974.30s | on the node level, and the control plane level. 974.30s - 975.14s | And alongside those, 975.14s - 977.34s | I also highlighted the cloud IAM logs, 977.34s - 978.58s | because if you're running a managed cluster, 978.58s - 981.06s | identity is always of security interest. 982.02s - 982.94s | I want to take a couple of slides 982.94s - 984.82s | to zoom in on the most important log source, 984.82s - 988.90s | the true MVP of Kubernetes attack detection, the audit log. 988.90s - 989.98s | You can consider the audit log 989.98s - 992.50s | as the access logs of the API server, 992.50s - 993.58s | which simply means that 993.58s - 995.18s | if you're interacting with a control plane, 995.18s - 998.26s | you're getting recorded, with some exceptions. 998.26s - 1000.78s | The resulting events can be formatted in JSON, 1000.78s - 1002.78s | and they answer the security investigation questions 1002.78s - 1004.30s | that we raised before. 1004.30s - 1005.82s | Important to mention, though, 1005.82s - 1007.82s | these are not enabled by default. 1007.82s - 1010.34s | To enable them, you need to define a node policy 1010.34s - 1012.18s | and reconfigure the API server, 1012.18s - 1013.34s | but you can't always do that, 1013.34s - 1014.94s | for example, in managed clusters. 1014.94s - 1016.54s | Some events will be very noisy, 1016.54s - 1017.78s | others will be more important, 1017.78s - 1019.70s | so you want to have more detail, 1019.70s - 1021.94s | and that's why there's a few different verbosity levels 1021.94s - 1024.42s | that you can set for each different type, 1024.42s - 1026.54s | each different event type. 1026.54s - 1029.30s | You can easily find a sample policy to get started with, 1029.30s - 1031.90s | like the one I'm linking in the bottom of the slide, 1031.90s - 1033.54s | but it's going to take some tuning 1033.54s - 1035.26s |


chunk_text:
exceptions. 998.26s - 1000.78s | The resulting events can be formatted in JSON, 1000.78s - 1002.78s | and they answer the security investigation questions 1002.78s - 1004.30s | that we raised before. 1004.30s - 1005.82s | Important to mention, though, 1005.82s - 1007.82s | these are not enabled by default. 1007.82s - 1010.34s | To enable them, you need to define a node policy 1010.34s - 1012.18s | and reconfigure the API server, 1012.18s - 1013.34s | but you can't always do that, 1013.34s - 1014.94s | for example, in managed clusters. 1014.94s - 1016.54s | Some events will be very noisy, 1016.54s - 1017.78s | others will be more important, 1017.78s - 1019.70s | so you want to have more detail, 1019.70s - 1021.94s | and that's why there's a few different verbosity levels 1021.94s - 1024.42s | that you can set for each different type, 1024.42s - 1026.54s | each different event type. 1026.54s - 1029.30s | You can easily find a sample policy to get started with, 1029.30s - 1031.90s | like the one I'm linking in the bottom of the slide, 1031.90s - 1033.54s | but it's going to take some tuning 1033.54s - 1035.26s | to find the perfect mix. 1036.30s - 1038.38s | The API server can also be configured 1038.38s - 1039.86s | to store audit logs locally, 1039.86s - 1041.06s | or send them to a hook, 1041.06s - 1044.66s | and both of these ways allow for wording to a scene. 1044.66s - 1045.50s | Once you do that, 1045.50s - 1047.86s | you now have the ability to write alert queries 1047.86s - 1049.10s | upon these logs, 1049.10s - 1052.06s | which brings us to the topic of detection engineering. 1052.06s - 1053.38s | In its simplest form, 1053.38s - 1055.58s | an alert for suspicious control plane activity 1055.58s - 1058.14s | could be captured by the verb and the resource, 1058.14s - 1060.42s | such as list secrets, 1060.42s - 1062.98s | and this behavior can then be defined in a Sigma rule 1062.98s - 1065.58s | for easier management and distribution. 1065.58s - 1067.46s | We found that there weren't many Sigma rules 1067.46s - 1068.30s | out there available, 1068.30s - 1071.26s | in fact, there weren't any Sigma rules out there available 1071.26s - 1073.50s | that operated on Kubernetes audit logs, 1073.50s -


chunk_text:
to find the perfect mix. 1036.30s - 1038.38s | The API server can also be configured 1038.38s - 1039.86s | to store audit logs locally, 1039.86s - 1041.06s | or send them to a hook, 1041.06s - 1044.66s | and both of these ways allow for wording to a scene. 1044.66s - 1045.50s | Once you do that, 1045.50s - 1047.86s | you now have the ability to write alert queries 1047.86s - 1049.10s | upon these logs, 1049.10s - 1052.06s | which brings us to the topic of detection engineering. 1052.06s - 1053.38s | In its simplest form, 1053.38s - 1055.58s | an alert for suspicious control plane activity 1055.58s - 1058.14s | could be captured by the verb and the resource, 1058.14s - 1060.42s | such as list secrets, 1060.42s - 1062.98s | and this behavior can then be defined in a Sigma rule 1062.98s - 1065.58s | for easier management and distribution. 1065.58s - 1067.46s | We found that there weren't many Sigma rules 1067.46s - 1068.30s | out there available, 1068.30s - 1071.26s | in fact, there weren't any Sigma rules out there available 1071.26s - 1073.50s | that operated on Kubernetes audit logs, 1073.50s - 1075.54s | so we published a few, 1075.54s - 1077.58s | and since this log source didn't really exist, 1077.58s - 1081.38s | we also introduced it by contributing a backend pipeline 1081.38s - 1082.50s | to the Sigma ecosystem 1082.50s - 1084.22s | in order to convert rules to actual alerts 1084.22s - 1086.14s | that a scene can understand. 1086.14s - 1088.98s | But attacks could not only target the control plane, 1088.98s - 1090.10s | if you remember from a previous slide, 1090.10s - 1092.54s | they could originate from within the container, 1092.54s - 1094.98s | but luckily, there's a lot of research in this area, 1094.98s - 1097.86s | many solutions available like Falco or Tetragon, 1097.86s - 1100.06s | that monitor containers by tapping into the kernel 1100.06s - 1103.10s | of the underlying node using eBPF, 1103.10s - 1106.22s | and this enables EDR style analysis of the syscalls, 1106.22s - 1109.34s | which then allows the authoring of rules in an easy format 1109.34s - 1111.22s | for suspicious control plane activity, 1111.22s - 1113.06s | sorry, for suspicious process command lines, 1113.06s - 1114.78s | for suspicious network activity, 1114.78s -


chunk_text:
1075.54s | so we published a few, 1075.54s - 1077.58s | and since this log source didn't really exist, 1077.58s - 1081.38s | we also introduced it by contributing a backend pipeline 1081.38s - 1082.50s | to the Sigma ecosystem 1082.50s - 1084.22s | in order to convert rules to actual alerts 1084.22s - 1086.14s | that a scene can understand. 1086.14s - 1088.98s | But attacks could not only target the control plane, 1088.98s - 1090.10s | if you remember from a previous slide, 1090.10s - 1092.54s | they could originate from within the container, 1092.54s - 1094.98s | but luckily, there's a lot of research in this area, 1094.98s - 1097.86s | many solutions available like Falco or Tetragon, 1097.86s - 1100.06s | that monitor containers by tapping into the kernel 1100.06s - 1103.10s | of the underlying node using eBPF, 1103.10s - 1106.22s | and this enables EDR style analysis of the syscalls, 1106.22s - 1109.34s | which then allows the authoring of rules in an easy format 1109.34s - 1111.22s | for suspicious control plane activity, 1111.22s - 1113.06s | sorry, for suspicious process command lines, 1113.06s - 1114.78s | for suspicious network activity, 1114.78s - 1116.62s | and other system level events. 1117.94s - 1119.94s | All right, now it is time for the demo, 1119.94s - 1121.14s | so in the upcoming video, 1121.14s - 1123.78s | we'll see how we can simulate a fictitious threat actor 1123.78s - 1125.98s | who gets access to a cluster and performs some attacks, 1125.98s - 1128.38s | we'll do that using Leonidas for Kubernetes, 1128.38s - 1129.90s | and after we're on the attack chain, 1129.90s - 1130.82s | we'll put our blue hats on, 1130.82s - 1133.90s | we'll put our defender hats on, the Viking hat, 1133.90s - 1138.18s | and look at Elastic and Falco, which we have set up, 1138.18s - 1140.14s | just to see what alerts have been raised. 1140.14s - 1147.60s | All right, let me switch to the demo video, 1147.60s - 1149.12s | can you all see the video? 1149.12s - 1150.28s | Okay, no? 1152.16s - 1156.50s | Good thing I asked, 1156.50s - 1157.82s | is it this way? 1160.46s - 1162.14s | Now, I can't see how to maximize it though, 1162.14s - 1169.90s | can I have some tech support here? 1169.90s -


chunk_text:
1116.62s | and other system level events. 1117.94s - 1119.94s | All right, now it is time for the demo, 1119.94s - 1121.14s | so in the upcoming video, 1121.14s - 1123.78s | we'll see how we can simulate a fictitious threat actor 1123.78s - 1125.98s | who gets access to a cluster and performs some attacks, 1125.98s - 1128.38s | we'll do that using Leonidas for Kubernetes, 1128.38s - 1129.90s | and after we're on the attack chain, 1129.90s - 1130.82s | we'll put our blue hats on, 1130.82s - 1133.90s | we'll put our defender hats on, the Viking hat, 1133.90s - 1138.18s | and look at Elastic and Falco, which we have set up, 1138.18s - 1140.14s | just to see what alerts have been raised. 1140.14s - 1147.60s | All right, let me switch to the demo video, 1147.60s - 1149.12s | can you all see the video? 1149.12s - 1150.28s | Okay, no? 1152.16s - 1156.50s | Good thing I asked, 1156.50s - 1157.82s | is it this way? 1160.46s - 1162.14s | Now, I can't see how to maximize it though, 1162.14s - 1169.90s | can I have some tech support here? 1169.90s - 1173.22s | Yeah, but I can't see the pointer, so I can maximize it. 1173.22s - 1174.06s | You reckon? 1175.94s - 1177.34s | Nice. 1177.34s - 1179.46s | The problem is that I can't see it. 1179.46s - 1181.46s | All right, let's do it. 1181.46s - 1182.30s | I won't. 1183.98s - 1185.54s | Yeah, but I wanna talk over it. 1198.39s - 1200.07s | You can switch your display settings, 1200.07s - 1204.20s | so it's, yep, duplicated. 1204.20s - 1205.92s | Yep, see it now? 1205.92s - 1207.60s | Awesome, fixed. 1207.60s - 1208.44s | All right, so, 1210.60s - 1212.32s | so first thing we're gonna do is confirm connectivity 1212.32s - 1213.28s | to the Kubernetes cluster, 1213.28s - 1215.44s | we'll do that using a cluster info command, 1215.44s - 1216.64s | and we see that indeed, 1216.64s - 1218.24s | the Kubernetes cluster is up and running, 1218.24s - 1219.96s | we also have the dashboard up and running, 1219.96s - 1223.20s | and you can see we have a couple of namespaces 1223.20s - 1226.52s | already there, including one called DharmaProds, 1226.52s - 1228.52s | which has just one deployment


chunk_text:
1173.22s | Yeah, but I can't see the pointer, so I can maximize it. 1173.22s - 1174.06s | You reckon? 1175.94s - 1177.34s | Nice. 1177.34s - 1179.46s | The problem is that I can't see it. 1179.46s - 1181.46s | All right, let's do it. 1181.46s - 1182.30s | I won't. 1183.98s - 1185.54s | Yeah, but I wanna talk over it. 1198.39s - 1200.07s | You can switch your display settings, 1200.07s - 1204.20s | so it's, yep, duplicated. 1204.20s - 1205.92s | Yep, see it now? 1205.92s - 1207.60s | Awesome, fixed. 1207.60s - 1208.44s | All right, so, 1210.60s - 1212.32s | so first thing we're gonna do is confirm connectivity 1212.32s - 1213.28s | to the Kubernetes cluster, 1213.28s - 1215.44s | we'll do that using a cluster info command, 1215.44s - 1216.64s | and we see that indeed, 1216.64s - 1218.24s | the Kubernetes cluster is up and running, 1218.24s - 1219.96s | we also have the dashboard up and running, 1219.96s - 1223.20s | and you can see we have a couple of namespaces 1223.20s - 1226.52s | already there, including one called DharmaProds, 1226.52s - 1228.52s | which has just one deployment in there, 1228.52s - 1229.52s | it's called HVAC controller, 1229.52s - 1230.64s | and once we click it, 1230.64s - 1232.60s | we'll see that it includes a couple of pods, 1232.60s - 1233.80s | one looking like a database, 1233.80s - 1235.84s | and the other one potentially doing something sensitive, 1235.84s - 1236.76s | HVAC controller. 1237.76s - 1238.64s | And now we're gonna go ahead 1238.64s - 1240.88s | and deploy Leonidas into that cluster. 1240.88s - 1243.12s | To do that, we'll run a couple of generator commands, 1243.12s - 1246.08s | generator is an accompanying tool 1246.08s - 1248.76s | that allows deployment of Leonidas. 1248.76s - 1250.96s | First, we're gonna generate the Python code 1250.96s - 1252.20s | from the attack definitions 1252.20s - 1253.60s | that we have previously defined, 1253.60s - 1256.36s | and then we're gonna generate the Kubernetes resources 1256.36s - 1259.24s | in the standard YAML manifest. 1259.24s - 1260.96s | These resources will then go ahead 1260.96s - 1264.68s | and kubectl apply into our cluster, 1264.68s - 1266.96s | so that we can create the Leonidas deployment 1266.96s - 1269.08s | into our namespace, into


chunk_text:
in there, 1228.52s - 1229.52s | it's called HVAC controller, 1229.52s - 1230.64s | and once we click it, 1230.64s - 1232.60s | we'll see that it includes a couple of pods, 1232.60s - 1233.80s | one looking like a database, 1233.80s - 1235.84s | and the other one potentially doing something sensitive, 1235.84s - 1236.76s | HVAC controller. 1237.76s - 1238.64s | And now we're gonna go ahead 1238.64s - 1240.88s | and deploy Leonidas into that cluster. 1240.88s - 1243.12s | To do that, we'll run a couple of generator commands, 1243.12s - 1246.08s | generator is an accompanying tool 1246.08s - 1248.76s | that allows deployment of Leonidas. 1248.76s - 1250.96s | First, we're gonna generate the Python code 1250.96s - 1252.20s | from the attack definitions 1252.20s - 1253.60s | that we have previously defined, 1253.60s - 1256.36s | and then we're gonna generate the Kubernetes resources 1256.36s - 1259.24s | in the standard YAML manifest. 1259.24s - 1260.96s | These resources will then go ahead 1260.96s - 1264.68s | and kubectl apply into our cluster, 1264.68s - 1266.96s | so that we can create the Leonidas deployment 1266.96s - 1269.08s | into our namespace, into DharmaProds, 1269.08s - 1270.60s | and you see that it started running. 1270.60s - 1274.20s | Once it's completed, once deployment is completed, 1274.20s - 1276.72s | we'll then expose the port, 1276.72s - 1279.04s | we're using a kubectl port forward command, 1279.04s - 1281.44s | KL, by the way, is an alias for kubectl, 1281.44s - 1283.48s | and we bring it locally to port 5000 1283.48s - 1285.44s | so we can interact with it. 1285.44s - 1287.40s | And once this is done, 1287.40s - 1289.40s | indeed, we can access the API, 1289.40s - 1292.76s | it's the familiar API if you looked at Leonidas before. 1292.76s - 1294.84s | There are two ways to interact with Leonidas, 1294.84s - 1297.80s | one of them is via this very simple client, 1297.80s - 1300.00s | you know, providing the values in all these fields 1300.00s - 1301.36s | and then hitting execute. 1302.36s - 1305.32s | But instead, we're gonna do it through a Jupyter notebook. 1306.64s - 1308.40s | And in order to do that, 1308.40s - 1310.92s | we first need to start the Jupyter service. 1310.92s - 1314.20s | This is gonna


chunk_text:
DharmaProds, 1269.08s - 1270.60s | and you see that it started running. 1270.60s - 1274.20s | Once it's completed, once deployment is completed, 1274.20s - 1276.72s | we'll then expose the port, 1276.72s - 1279.04s | we're using a kubectl port forward command, 1279.04s - 1281.44s | KL, by the way, is an alias for kubectl, 1281.44s - 1283.48s | and we bring it locally to port 5000 1283.48s - 1285.44s | so we can interact with it. 1285.44s - 1287.40s | And once this is done, 1287.40s - 1289.40s | indeed, we can access the API, 1289.40s - 1292.76s | it's the familiar API if you looked at Leonidas before. 1292.76s - 1294.84s | There are two ways to interact with Leonidas, 1294.84s - 1297.80s | one of them is via this very simple client, 1297.80s - 1300.00s | you know, providing the values in all these fields 1300.00s - 1301.36s | and then hitting execute. 1302.36s - 1305.32s | But instead, we're gonna do it through a Jupyter notebook. 1306.64s - 1308.40s | And in order to do that, 1308.40s - 1310.92s | we first need to start the Jupyter service. 1310.92s - 1314.20s | This is gonna open the port 8888. 1314.20s - 1317.80s | Once we click it, we'll see the web UI of Jupyter, 1317.80s - 1319.12s | navigate to the right directory 1319.12s - 1320.92s | of the threat actors notebooks, 1320.92s - 1323.16s | and open our own notebook for OF815. 1323.16s - 1325.88s | Now, OF815 is our fictitious threat actor. 1327.68s - 1329.32s | Like we said before, execute some attacks 1329.32s - 1330.40s | against the Kubernetes cluster 1330.40s - 1331.88s | and first get some access to it. 1331.88s - 1334.88s | We've got a nice little visualization of it right here. 1334.88s - 1337.16s | First step for it is to simulate the initial access. 1337.16s - 1338.16s | Now, the typical scenario 1338.16s - 1340.52s | would be a leaked kubeconfig file. 1340.52s - 1342.08s | Actually, before we get to these attacks, 1342.08s - 1343.40s | let's look at the Defender tech, 1343.40s - 1345.60s | the Defender solutions we have up there, up and running. 1345.60s - 1347.04s | We do have Elastic, 1347.04s - 1351.16s | where we're forwarding audit logs from our cluster. 1352.16s - 1354.20s | Nicely visualized with the verb resource,


chunk_text:
open the port 8888. 1314.20s - 1317.80s | Once we click it, we'll see the web UI of Jupyter, 1317.80s - 1319.12s | navigate to the right directory 1319.12s - 1320.92s | of the threat actors notebooks, 1320.92s - 1323.16s | and open our own notebook for OF815. 1323.16s - 1325.88s | Now, OF815 is our fictitious threat actor. 1327.68s - 1329.32s | Like we said before, execute some attacks 1329.32s - 1330.40s | against the Kubernetes cluster 1330.40s - 1331.88s | and first get some access to it. 1331.88s - 1334.88s | We've got a nice little visualization of it right here. 1334.88s - 1337.16s | First step for it is to simulate the initial access. 1337.16s - 1338.16s | Now, the typical scenario 1338.16s - 1340.52s | would be a leaked kubeconfig file. 1340.52s - 1342.08s | Actually, before we get to these attacks, 1342.08s - 1343.40s | let's look at the Defender tech, 1343.40s - 1345.60s | the Defender solutions we have up there, up and running. 1345.60s - 1347.04s | We do have Elastic, 1347.04s - 1351.16s | where we're forwarding audit logs from our cluster. 1352.16s - 1354.20s | Nicely visualized with the verb resource, 1354.20s - 1355.32s | like we said before. 1355.32s - 1358.84s | And we also have some alert rules configured. 1358.84s - 1360.08s | You can see on the right-hand side 1360.08s - 1361.44s | that these are all enabled. 1362.32s - 1364.40s | And just to make sure that nothing has fired just yet, 1364.40s - 1365.52s | we're gonna refresh that page, 1365.52s - 1367.48s | see no hits, and we're ready to go. 1367.48s - 1368.72s | But before we start executing, 1368.72s - 1370.16s | let's also look at Falco. 1370.16s - 1372.68s | We've configured this on the nodes of the cluster 1372.68s - 1375.72s | to monitor the containers, like we said before. 1375.72s - 1377.40s | Cool, all right, let's start running the attack 1377.40s - 1378.24s | step-by-step then. 1378.48s - 1381.88s | So if we navigate back to the Jupyter Notebook, 1381.88s - 1384.44s | we start hitting run through every different cell. 1384.44s - 1386.40s | And the first step is to simulate the initial access. 1386.40s - 1388.92s | So the typical scenario is a leaked kubeconfig file. 1388.92s - 1390.00s | In that kubeconfig file, 1390.00s - 1392.72s


chunk_text:
1354.20s - 1355.32s | like we said before. 1355.32s - 1358.84s | And we also have some alert rules configured. 1358.84s - 1360.08s | You can see on the right-hand side 1360.08s - 1361.44s | that these are all enabled. 1362.32s - 1364.40s | And just to make sure that nothing has fired just yet, 1364.40s - 1365.52s | we're gonna refresh that page, 1365.52s - 1367.48s | see no hits, and we're ready to go. 1367.48s - 1368.72s | But before we start executing, 1368.72s - 1370.16s | let's also look at Falco. 1370.16s - 1372.68s | We've configured this on the nodes of the cluster 1372.68s - 1375.72s | to monitor the containers, like we said before. 1375.72s - 1377.40s | Cool, all right, let's start running the attack 1377.40s - 1378.24s | step-by-step then. 1378.48s - 1381.88s | So if we navigate back to the Jupyter Notebook, 1381.88s - 1384.44s | we start hitting run through every different cell. 1384.44s - 1386.40s | And the first step is to simulate the initial access. 1386.40s - 1388.92s | So the typical scenario is a leaked kubeconfig file. 1388.92s - 1390.00s | In that kubeconfig file, 1390.00s - 1392.72s | there might be a service account token, a JWT. 1392.72s - 1396.44s | And this token is what we're gonna instantiate a client with, 1396.44s - 1397.92s | a client to Leonidas. 1397.92s - 1399.16s | So behind the scenes, 1399.16s - 1401.48s | this Jupyter Notebook is running some Python, 1401.48s - 1402.60s | bare-bones Python. 1402.60s - 1404.40s | We'll publish all of that, by the way, very soon. 1404.40s - 1406.12s | And this interacts with the Leonidas service 1406.12s - 1407.68s | running within the cluster. 1407.72s - 1410.60s | So the first thing, once the attacker has obtained access, 1410.60s - 1412.04s | would be to list their own permissions, 1412.04s - 1414.12s | just to see what they can do. 1414.12s - 1416.84s | You can do that using the self-subject review API. 1416.84s - 1420.92s | So we just run that cell then and look at the results. 1420.92s - 1421.76s | We observe in the results 1421.76s - 1424.84s | that we have some permissions on the pods. 1424.84s - 1426.60s | Crew permissions, create, read, update, delete 1426.60s - 1428.36s | on the right-hand side of the slide. 1428.36s -


chunk_text:
| there might be a service account token, a JWT. 1392.72s - 1396.44s | And this token is what we're gonna instantiate a client with, 1396.44s - 1397.92s | a client to Leonidas. 1397.92s - 1399.16s | So behind the scenes, 1399.16s - 1401.48s | this Jupyter Notebook is running some Python, 1401.48s - 1402.60s | bare-bones Python. 1402.60s - 1404.40s | We'll publish all of that, by the way, very soon. 1404.40s - 1406.12s | And this interacts with the Leonidas service 1406.12s - 1407.68s | running within the cluster. 1407.72s - 1410.60s | So the first thing, once the attacker has obtained access, 1410.60s - 1412.04s | would be to list their own permissions, 1412.04s - 1414.12s | just to see what they can do. 1414.12s - 1416.84s | You can do that using the self-subject review API. 1416.84s - 1420.92s | So we just run that cell then and look at the results. 1420.92s - 1421.76s | We observe in the results 1421.76s - 1424.84s | that we have some permissions on the pods. 1424.84s - 1426.60s | Crew permissions, create, read, update, delete 1426.60s - 1428.36s | on the right-hand side of the slide. 1428.36s - 1430.96s | And we also have some permissions on the secrets, 1430.96s - 1432.68s | which is already a problem. 1432.68s - 1433.92s | So using these permissions, 1433.92s - 1436.36s | we're gonna go ahead and enumerate the pods. 1436.36s - 1437.60s | You'll see, like we saw before, 1437.60s - 1441.36s | patient DB, Leonidas deployment, and the HVAC controller. 1441.36s - 1443.44s | And using the permissions we have over the secrets, 1443.44s - 1445.84s | obviously, we're gonna list the secrets. 1445.84s - 1448.84s | With some processing, with some post-processing, 1448.84s - 1451.56s | we'll see that one of them looks like a password, 1451.56s - 1452.64s | but we don't know yet. 1452.64s - 1455.40s | But putting the pieces together, we have the database pod. 1455.40s - 1457.44s | We have something that looks like a password. 1457.44s - 1459.48s | So why not run a MySQL dump command 1459.48s - 1461.64s | to get a dump and prepare it for exfiltration? 1461.64s - 1464.92s | Sure enough, we provide the password on the command line. 1464.92s - 1466.44s | The dump is being generated, 1466.44s - 1468.00s | and we're ready to


chunk_text:
1430.96s | And we also have some permissions on the secrets, 1430.96s - 1432.68s | which is already a problem. 1432.68s - 1433.92s | So using these permissions, 1433.92s - 1436.36s | we're gonna go ahead and enumerate the pods. 1436.36s - 1437.60s | You'll see, like we saw before, 1437.60s - 1441.36s | patient DB, Leonidas deployment, and the HVAC controller. 1441.36s - 1443.44s | And using the permissions we have over the secrets, 1443.44s - 1445.84s | obviously, we're gonna list the secrets. 1445.84s - 1448.84s | With some processing, with some post-processing, 1448.84s - 1451.56s | we'll see that one of them looks like a password, 1451.56s - 1452.64s | but we don't know yet. 1452.64s - 1455.40s | But putting the pieces together, we have the database pod. 1455.40s - 1457.44s | We have something that looks like a password. 1457.44s - 1459.48s | So why not run a MySQL dump command 1459.48s - 1461.64s | to get a dump and prepare it for exfiltration? 1461.64s - 1464.92s | Sure enough, we provide the password on the command line. 1464.92s - 1466.44s | The dump is being generated, 1466.44s - 1468.00s | and we're ready to send that back. 1468.00s - 1471.48s | Now, before we finish up with this attack, 1471.48s - 1474.80s | the attacker also tries to perform some destructive activity 1474.80s - 1475.96s | just to delete a deployment. 1475.96s - 1478.32s | But this activity will fail because, as we saw before, 1478.32s - 1480.56s | they do not have the permission to do so. 1480.56s - 1482.32s | And finally, just to wrap it up, 1482.32s - 1483.60s | just to wrap up the threat, 1483.60s - 1485.80s | the Jupyter Notebook will print the table 1485.80s - 1487.44s | of all the test cases that we executed 1487.44s - 1490.56s | for good bookkeeping, timestamps, success status, 1490.56s - 1492.80s | and the name of the test case. 1492.84s - 1497.37s | Cool, so we'll now, as promised, 1497.37s - 1501.09s | turn back to the detection capabilities, 1501.09s - 1502.09s | blue team solutions, 1502.09s - 1504.13s | and we'll see that two alerts have actually fired, 1504.13s - 1504.97s | as promised. 1507.21s - 1509.61s | And the same thing stands for Falco, 1509.61s - 1511.97s | since it detected the MySQL dump command. 1513.05s - 1515.53s


chunk_text:
send that back. 1468.00s - 1471.48s | Now, before we finish up with this attack, 1471.48s - 1474.80s | the attacker also tries to perform some destructive activity 1474.80s - 1475.96s | just to delete a deployment. 1475.96s - 1478.32s | But this activity will fail because, as we saw before, 1478.32s - 1480.56s | they do not have the permission to do so. 1480.56s - 1482.32s | And finally, just to wrap it up, 1482.32s - 1483.60s | just to wrap up the threat, 1483.60s - 1485.80s | the Jupyter Notebook will print the table 1485.80s - 1487.44s | of all the test cases that we executed 1487.44s - 1490.56s | for good bookkeeping, timestamps, success status, 1490.56s - 1492.80s | and the name of the test case. 1492.84s - 1497.37s | Cool, so we'll now, as promised, 1497.37s - 1501.09s | turn back to the detection capabilities, 1501.09s - 1502.09s | blue team solutions, 1502.09s - 1504.13s | and we'll see that two alerts have actually fired, 1504.13s - 1504.97s | as promised. 1507.21s - 1509.61s | And the same thing stands for Falco, 1509.61s - 1511.97s | since it detected the MySQL dump command. 1513.05s - 1515.53s | Don't worry about the too many lines. 1515.53s - 1517.05s | It's just a misconfigured rule. 1517.05s - 1518.81s | Important thing to notice is that it did capture 1518.81s - 1521.37s | the MySQL dump command executing within the cluster, 1521.37s - 1522.41s | within the container. 1523.37s - 1524.65s | And that wraps up the demo. 1524.65s - 1525.89s | I do have one more slide. 1528.49s - 1551.84s | Whoops, awesome. 1551.84s - 1553.96s | All right, that one last slide. 1553.96s - 1555.12s | Hopefully you can see just the slide, 1555.12s - 1556.32s | not the speaking notes, cool. 1556.32s - 1560.20s | All right, I wanna close with just a few key takeaways. 1560.20s - 1563.92s | Now, building Kubernetes detective capability is a journey, 1563.92s - 1565.44s | and the first step towards it 1565.44s - 1568.64s | is to understand the threats posed to your environment. 1568.64s - 1570.96s | Once this is done, we saw how the concepts 1570.96s - 1573.68s | and the methods of collaborative attack simulation 1574.44s - 1575.52s | can be applied to this world as well, 1575.52s - 1578.32s | in order to build defenses


chunk_text:
| Don't worry about the too many lines. 1515.53s - 1517.05s | It's just a misconfigured rule. 1517.05s - 1518.81s | Important thing to notice is that it did capture 1518.81s - 1521.37s | the MySQL dump command executing within the cluster, 1521.37s - 1522.41s | within the container. 1523.37s - 1524.65s | And that wraps up the demo. 1524.65s - 1525.89s | I do have one more slide. 1528.49s - 1551.84s | Whoops, awesome. 1551.84s - 1553.96s | All right, that one last slide. 1553.96s - 1555.12s | Hopefully you can see just the slide, 1555.12s - 1556.32s | not the speaking notes, cool. 1556.32s - 1560.20s | All right, I wanna close with just a few key takeaways. 1560.20s - 1563.92s | Now, building Kubernetes detective capability is a journey, 1563.92s - 1565.44s | and the first step towards it 1565.44s - 1568.64s | is to understand the threats posed to your environment. 1568.64s - 1570.96s | Once this is done, we saw how the concepts 1570.96s - 1573.68s | and the methods of collaborative attack simulation 1574.44s - 1575.52s | can be applied to this world as well, 1575.52s - 1578.32s | in order to build defenses proactively. 1578.32s - 1580.32s | To this end, we're giving the world 1580.32s - 1582.48s | a Kubernetes native attack simulation framework, 1582.48s - 1583.92s | Leonidas for Kubernetes, 1583.92s - 1585.56s | a set of test cases to get started, 1585.56s - 1587.84s | along with their corresponding Sigma rules 1587.84s - 1590.16s | as a building block for detections. 1590.16s - 1591.04s | And that's all from me. 1591.04s - 1592.24s | Thank you very much for your time. 1592.24s - 1594.72s | If you can find the links mentioned in this QR code, 1594.72s - 1596.72s | and you can find me on Twitter if you wanna discuss further. 1596.72s - 1598.68s | Thanks to Adversary Village for having me.


chunk_text:
proactively. 1578.32s - 1580.32s | To this end, we're giving the world 1580.32s - 1582.48s | a Kubernetes native attack simulation framework, 1582.48s - 1583.92s | Leonidas for Kubernetes, 1583.92s - 1585.56s | a set of test cases to get started, 1585.56s - 1587.84s | along with their corresponding Sigma rules 1587.84s - 1590.16s | as a building block for detections. 1590.16s - 1591.04s | And that's all from me. 1591.04s - 1592.24s | Thank you very much for your time. 1592.24s - 1594.72s | If you can find the links mentioned in this QR code, 1594.72s - 1596.72s | and you can find me on Twitter if you wanna discuss further. 1596.72s - 1598.68s | Thanks to Adversary Village for having me.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=es72oviu0Lg", "title": "DEF CON 32 - How I hacked Learning Codes of the key job of a car assembled in my country - D. Erazo", "description": "Using hardware hacking techniques, it was possible to detect the use of learning codes instead of rolling codes in a key job of a car widely used in my country. For this purpose, the key job was disassembled and the HS2240 integrated circuit was detected and, using a logic analyzer, the emission of learning codes from the integrated circuit to the radio frequency LED emitter was checked. With the use of HackRF SDR, the learning code is duplicated to be able to open the car N times without needing the original key anymore, which proves that the use of learning codes is very vulnerable, just like fixed codes.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1622, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 1.52s | This text was transcribed using whisper model: large-v2 Yo, hello. 1.52s - 3.84s | Yo, my G's. 3.84s - 5.56s | Welcome to my presentation. 5.56s - 7.96s | For me, it's a pleasure to stay here. 7.96s - 10.76s | I'm so happy to share that research. 10.76s - 13.64s | So I'm going to show how I discovered 13.64s - 16.32s | that I can unlock tossable cards in my country. 16.32s - 19.76s | So the principal topic is breaking learning codes. 19.76s - 23.20s | Please get up your hands if someone 23.20s - 28.50s | know about learning codes, how to hack learning codes. 28.50s - 30.10s | Two, two people. 30.10s - 31.02s | OK. 31.10s - 39.50s | So right now, I'm going to show who I am. 39.50s - 43.94s | My official work is a penetration tester. 43.94s - 44.70s | Why I say that? 44.70s - 47.90s | Because in South America, we don't 47.90s - 51.02s | have automatic cybersecurity companies. 51.02s - 54.78s | So I do the research alone because I 54.78s - 56.70s | learn card hacking alone. 56.70s - 63.66s | So in my free time, I do hardware security research. 63.66s - 65.14s | OK? 65.14s - 67.62s | I create Reverse Everything, a YouTube channel 67.62s - 70.18s | where I upload all my research. 70.18s - 74.74s | So I am 28 years old from Ecuador. 74.74s - 77.38s | We


chunk_text:
- 13.64s | So I'm going to show how I discovered 13.64s - 16.32s | that I can unlock tossable cards in my country. 16.32s - 19.76s | So the principal topic is breaking learning codes. 19.76s - 23.20s | Please get up your hands if someone 23.20s - 28.50s | know about learning codes, how to hack learning codes. 28.50s - 30.10s | Two, two people. 30.10s - 31.02s | OK. 31.10s - 39.50s | So right now, I'm going to show who I am. 39.50s - 43.94s | My official work is a penetration tester. 43.94s - 44.70s | Why I say that? 44.70s - 47.90s | Because in South America, we don't 47.90s - 51.02s | have automatic cybersecurity companies. 51.02s - 54.78s | So I do the research alone because I 54.78s - 56.70s | learn card hacking alone. 56.70s - 63.66s | So in my free time, I do hardware security research. 63.66s - 65.14s | OK? 65.14s - 67.62s | I create Reverse Everything, a YouTube channel 67.62s - 70.18s | where I upload all my research. 70.18s - 74.74s | So I am 28 years old from Ecuador. 74.74s - 77.38s | We don't have anything about card hacking security, 77.38s - 78.54s | nothing about that. 78.54s - 81.86s | So I do alone. 81.86s - 83.38s | I'm going to show about introduction 83.38s - 84.78s | about learning codes. 84.78s - 87.02s | After that, the hardware hacking. 87.02s - 89.14s | After that, I'm going to learn how 89.14s - 91.82s | to set a backdoor in the KLS entry system. 91.82s - 94.14s | After that, collision progress that 94.14s - 96.98s | appears if you use learning codes. 96.98s - 99.86s | And after that, I'm going to show the Auto RAF Killer. 99.86s - 102.86s | It's the tool that I developed to unlock cards 102.86s - 106.22s | with fixed learning code and rolling code 106.22s - 108.82s | using the no attacks. 108.82s - 115.02s | So I was trying to find KANG injection. 115.02s - 120.34s | So when I connect my OBD port to the interface OBD2, 120.34s - 124.78s | I find the KANG ID 545 is the ID that 124.78s - 130.26s | appears when you unlock or lock the card with the KFOB control. 130.26s - 131.06s | OK?


chunk_text:
don't have anything about card hacking security, 77.38s - 78.54s | nothing about that. 78.54s - 81.86s | So I do alone. 81.86s - 83.38s | I'm going to show about introduction 83.38s - 84.78s | about learning codes. 84.78s - 87.02s | After that, the hardware hacking. 87.02s - 89.14s | After that, I'm going to learn how 89.14s - 91.82s | to set a backdoor in the KLS entry system. 91.82s - 94.14s | After that, collision progress that 94.14s - 96.98s | appears if you use learning codes. 96.98s - 99.86s | And after that, I'm going to show the Auto RAF Killer. 99.86s - 102.86s | It's the tool that I developed to unlock cards 102.86s - 106.22s | with fixed learning code and rolling code 106.22s - 108.82s | using the no attacks. 108.82s - 115.02s | So I was trying to find KANG injection. 115.02s - 120.34s | So when I connect my OBD port to the interface OBD2, 120.34s - 124.78s | I find the KANG ID 545 is the ID that 124.78s - 130.26s | appears when you unlock or lock the card with the KFOB control. 130.26s - 131.06s | OK? 131.06s - 135.62s | So I say, hey, let's go to do the research 135.62s - 139.70s | about the KLS entry system, the radio frequency system. 139.70s - 142.86s | So here we have a universal radio hacker. 142.86s - 144.50s | I record the signal. 144.50s - 147.06s | This is the signal to unlock the card. 147.06s - 149.86s | And after that, I proceed to demodulate the signal. 149.86s - 154.14s | The signal is in 370 megahertz. 154.14s - 157.06s | I demodulate with ASK modulation. 157.06s - 162.10s | And I use a symbol per second of 500, OK? 162.14s - 166.46s | So if you see, we have the unlock signal to, 166.46s - 168.06s | and after that, the lock signal. 168.06s - 169.62s | After that, unlock signal. 169.62s - 176.10s | Again, if we see, we have the first row is a fixed code. 176.10s - 178.30s | The second row is the same fixed code. 178.30s - 180.10s | So I say, hey, what the hell is that? 180.10s - 181.78s | This isn't really code, OK? 181.78s - 186.38s | So I say, I need to do a


chunk_text:
131.06s - 135.62s | So I say, hey, let's go to do the research 135.62s - 139.70s | about the KLS entry system, the radio frequency system. 139.70s - 142.86s | So here we have a universal radio hacker. 142.86s - 144.50s | I record the signal. 144.50s - 147.06s | This is the signal to unlock the card. 147.06s - 149.86s | And after that, I proceed to demodulate the signal. 149.86s - 154.14s | The signal is in 370 megahertz. 154.14s - 157.06s | I demodulate with ASK modulation. 157.06s - 162.10s | And I use a symbol per second of 500, OK? 162.14s - 166.46s | So if you see, we have the unlock signal to, 166.46s - 168.06s | and after that, the lock signal. 168.06s - 169.62s | After that, unlock signal. 169.62s - 176.10s | Again, if we see, we have the first row is a fixed code. 176.10s - 178.30s | The second row is the same fixed code. 178.30s - 180.10s | So I say, hey, what the hell is that? 180.10s - 181.78s | This isn't really code, OK? 181.78s - 186.38s | So I say, I need to do a deeper research about that. 186.38s - 191.10s | So the unlock signal in hexadecimal format, 191.10s - 194.18s | the previously slide is in bit format. 194.18s - 197.46s | In hexadecimal format is that signal. 197.46s - 204.94s | So what happen if you see that there is a fixed code that 204.94s - 206.86s | repeat many times? 206.86s - 210.94s | And the lock signal is very similar to the unlock signal. 210.94s - 216.14s | So just the three last hexadecimal digits change. 216.14s - 219.26s | OK, so I say, hey, let's go to verify the replay attack. 219.26s - 220.94s | So this is a fixed code. 220.94s - 225.70s | And right now, I am in the fifth floor in Abandoned Build-It. 225.70s - 227.26s | And the car is in the first floor. 227.26s - 233.54s | So this is the first time that I was able to unlock my car. 233.54s - 239.46s | So let's go to listen the song when the car is unlocked. 239.46s - 252.34s | So with Universal Radio Hacker, I send the signal. 252.34s - 256.18s | After that, I send the signal to lock


chunk_text:
deeper research about that. 186.38s - 191.10s | So the unlock signal in hexadecimal format, 191.10s - 194.18s | the previously slide is in bit format. 194.18s - 197.46s | In hexadecimal format is that signal. 197.46s - 204.94s | So what happen if you see that there is a fixed code that 204.94s - 206.86s | repeat many times? 206.86s - 210.94s | And the lock signal is very similar to the unlock signal. 210.94s - 216.14s | So just the three last hexadecimal digits change. 216.14s - 219.26s | OK, so I say, hey, let's go to verify the replay attack. 219.26s - 220.94s | So this is a fixed code. 220.94s - 225.70s | And right now, I am in the fifth floor in Abandoned Build-It. 225.70s - 227.26s | And the car is in the first floor. 227.26s - 233.54s | So this is the first time that I was able to unlock my car. 233.54s - 239.46s | So let's go to listen the song when the car is unlocked. 239.46s - 252.34s | So with Universal Radio Hacker, I send the signal. 252.34s - 256.18s | After that, I send the signal to lock the car. 256.22s - 261.86s | So I don't know if you listen, but from here, I listen. 261.86s - 264.26s | So I verify with that replay attack 264.26s - 268.38s | that my car use something like fixed code. 268.38s - 272.70s | So I disassembled the K4, and I found a learning code chip. 272.70s - 276.14s | The learning code chip is HS2240. 276.14s - 279.10s | If you find that in internet, you 279.10s - 282.78s | are going to find that this is a learning code chip. 282.78s - 284.58s | So what the hell is learning code? 284.58s - 286.54s | Learning code is similar to fixed code. 286.54s - 288.90s | The difference is in the programmation mode. 288.90s - 293.10s | In fixed code, you have the code soldered to the board 293.10s - 295.06s | in the K4, OK? 295.06s - 298.14s | But in learning code, you have the pin 298.14s - 299.86s | into the integrated circuit. 299.86s - 302.82s | So another difference is that when 302.82s - 305.38s | you are going to program in fixed code, 305.38s - 308.26s | you don't have to do


chunk_text:
the car. 256.22s - 261.86s | So I don't know if you listen, but from here, I listen. 261.86s - 264.26s | So I verify with that replay attack 264.26s - 268.38s | that my car use something like fixed code. 268.38s - 272.70s | So I disassembled the K4, and I found a learning code chip. 272.70s - 276.14s | The learning code chip is HS2240. 276.14s - 279.10s | If you find that in internet, you 279.10s - 282.78s | are going to find that this is a learning code chip. 282.78s - 284.58s | So what the hell is learning code? 284.58s - 286.54s | Learning code is similar to fixed code. 286.54s - 288.90s | The difference is in the programmation mode. 288.90s - 293.10s | In fixed code, you have the code soldered to the board 293.10s - 295.06s | in the K4, OK? 295.06s - 298.14s | But in learning code, you have the pin 298.14s - 299.86s | into the integrated circuit. 299.86s - 302.82s | So another difference is that when 302.82s - 305.38s | you are going to program in fixed code, 305.38s - 308.26s | you don't have to do a programmation. 308.26s - 313.02s | In learning code, you have the teacher that uses the K4. 313.02s - 316.30s | The learning code to the microcontroller receiver. 316.30s - 320.26s | So when the microcontroller receiver 320.26s - 324.06s | listen the codes to the antenna, microcontroller 324.06s - 326.18s | save that code in his memory. 326.18s - 330.10s | And he's able to save up to four different learning codes. 330.10s - 334.90s | So keep it in mind, because this is useful information 334.90s - 339.82s | to set up backdoor in a few minutes in the other slides. 339.82s - 342.42s | So this is a learning code. 342.42s - 346.26s | Each K4 has a different learning code, OK? 346.26s - 347.22s | Each K4. 347.22s - 350.02s | And each card has a different learning code. 350.02s - 353.98s | And each K4 has a different learning code, OK? 353.98s - 355.30s | So keep in mind. 355.30s - 358.06s | So let's go to the hardware hacking. 358.06s - 364.26s | If you disassemble the vulnerable K4, 364.26s - 369.50s | we found an oscillator, LR370 megahertz batteries. 369.70s - 371.70s |


chunk_text:
a programmation. 308.26s - 313.02s | In learning code, you have the teacher that uses the K4. 313.02s - 316.30s | The learning code to the microcontroller receiver. 316.30s - 320.26s | So when the microcontroller receiver 320.26s - 324.06s | listen the codes to the antenna, microcontroller 324.06s - 326.18s | save that code in his memory. 326.18s - 330.10s | And he's able to save up to four different learning codes. 330.10s - 334.90s | So keep it in mind, because this is useful information 334.90s - 339.82s | to set up backdoor in a few minutes in the other slides. 339.82s - 342.42s | So this is a learning code. 342.42s - 346.26s | Each K4 has a different learning code, OK? 346.26s - 347.22s | Each K4. 347.22s - 350.02s | And each card has a different learning code. 350.02s - 353.98s | And each K4 has a different learning code, OK? 353.98s - 355.30s | So keep in mind. 355.30s - 358.06s | So let's go to the hardware hacking. 358.06s - 364.26s | If you disassemble the vulnerable K4, 364.26s - 369.50s | we found an oscillator, LR370 megahertz batteries. 369.70s - 371.70s | We assume two batteries. 371.70s - 373.94s | We have 6.38 volts. 373.94s - 376.14s | It's important to do mathematics calculation 376.14s - 379.34s | to the brute force that I am going to do in a few slides. 379.34s - 382.50s | After that, we identify the ASK modulation. 382.50s - 386.62s | Remember that we have to do a modulation to set 386.62s - 389.50s | to the LED RF transmit. 389.50s - 394.34s | So the final signal is ascending to the LED RF transmit. 394.34s - 398.62s | And also, we have here a multimeter to check. 398.62s - 401.26s | So let's go to the burn the circuit. 401.26s - 403.18s | We have four inputs. 403.18s - 407.78s | Remember that the K4 has four buttons. 407.78s - 411.06s | So each button is related to one. 411.06s - 414.42s | For example, if I press one button of the four buttons, 414.42s - 416.26s | I have 1, 0, 0, 0. 416.26s - 419.98s | If I press the second button, I have 0, 1, 0, 0. 419.98s - 425.94s | And each signal pass through a pull-down resistor. 425.94s - 429.06s


chunk_text:
We assume two batteries. 371.70s - 373.94s | We have 6.38 volts. 373.94s - 376.14s | It's important to do mathematics calculation 376.14s - 379.34s | to the brute force that I am going to do in a few slides. 379.34s - 382.50s | After that, we identify the ASK modulation. 382.50s - 386.62s | Remember that we have to do a modulation to set 386.62s - 389.50s | to the LED RF transmit. 389.50s - 394.34s | So the final signal is ascending to the LED RF transmit. 394.34s - 398.62s | And also, we have here a multimeter to check. 398.62s - 401.26s | So let's go to the burn the circuit. 401.26s - 403.18s | We have four inputs. 403.18s - 407.78s | Remember that the K4 has four buttons. 407.78s - 411.06s | So each button is related to one. 411.06s - 414.42s | For example, if I press one button of the four buttons, 414.42s - 416.26s | I have 1, 0, 0, 0. 416.26s - 419.98s | If I press the second button, I have 0, 1, 0, 0. 419.98s - 425.94s | And each signal pass through a pull-down resistor. 425.94s - 429.06s | So after the pull-down resistor, 429.06s - 432.34s | enter to the integrated circuit. 432.34s - 436.70s | So we have four entries, K0, K1, K2, K3. 436.70s - 439.22s | And the output is through the pin number 3. 439.22s - 442.62s | So the learning code encoded exits 442.62s - 443.90s | through the pin number 3. 443.90s - 446.02s | And in the left, we have the ASK modulation 446.02s - 449.54s | with capacitors, resistors, inductors, and more. 449.54s - 453.90s | So the final modulator learning code encoded 453.90s - 457.18s | go out by the LED. 457.18s - 459.82s | So keep in mind, because we have four modes. 459.82s - 463.82s | So how the learning code is formatted is like the frame. 463.82s - 465.54s | The frame is a preamble. 465.54s - 468.06s | After that, we have 20-bit code. 468.06s - 470.66s | After that, we have four bits of the mode. 470.66s - 472.94s | Remember, each mode is a bottom. 472.94s - 476.06s | So in 20 bits, we have one million possibility code. 476.06s - 481.18s | So 2 to power 20 bits, we have one


chunk_text:
| So after the pull-down resistor, 429.06s - 432.34s | enter to the integrated circuit. 432.34s - 436.70s | So we have four entries, K0, K1, K2, K3. 436.70s - 439.22s | And the output is through the pin number 3. 439.22s - 442.62s | So the learning code encoded exits 442.62s - 443.90s | through the pin number 3. 443.90s - 446.02s | And in the left, we have the ASK modulation 446.02s - 449.54s | with capacitors, resistors, inductors, and more. 449.54s - 453.90s | So the final modulator learning code encoded 453.90s - 457.18s | go out by the LED. 457.18s - 459.82s | So keep in mind, because we have four modes. 459.82s - 463.82s | So how the learning code is formatted is like the frame. 463.82s - 465.54s | The frame is a preamble. 465.54s - 468.06s | After that, we have 20-bit code. 468.06s - 470.66s | After that, we have four bits of the mode. 470.66s - 472.94s | Remember, each mode is a bottom. 472.94s - 476.06s | So in 20 bits, we have one million possibility code. 476.06s - 481.18s | So 2 to power 20 bits, we have one million possibility code. 481.18s - 484.26s | And in mode, we have four bits. 484.26s - 487.30s | So here we have the different modes 487.30s - 494.26s | that are able to enter to the integrated circuit. 494.26s - 498.06s | So the preamble, here we have the bits of the learning code. 498.06s - 500.02s | 20 bits of learning code, four bits more. 500.02s - 502.50s | So the preambles, I get 96 bits. 502.50s - 506.22s | So 96 subtract 20 bits of the learning code 506.22s - 507.62s | subtracts 40 bits of the mode. 507.62s - 510.78s | We have 72-bits preamble. 510.78s - 513.26s | And here we have 96-bit. 513.26s - 518.34s | But 72-bits of preamble, I don't know, sure. 518.34s - 520.86s | So that's the reason that I do a hardware 520.86s - 523.34s | hacking with a logic analyzer. 523.34s - 526.54s | This is logic analyzer LA5016 that 526.54s - 530.58s | is able to record up to 500 megahertz. 530.58s - 533.10s | So here's the connection. 533.10s - 536.30s | Channel 1 is to the transmit bit, the pin number 3, 536.30s - 540.66s |


chunk_text:
million possibility code. 481.18s - 484.26s | And in mode, we have four bits. 484.26s - 487.30s | So here we have the different modes 487.30s - 494.26s | that are able to enter to the integrated circuit. 494.26s - 498.06s | So the preamble, here we have the bits of the learning code. 498.06s - 500.02s | 20 bits of learning code, four bits more. 500.02s - 502.50s | So the preambles, I get 96 bits. 502.50s - 506.22s | So 96 subtract 20 bits of the learning code 506.22s - 507.62s | subtracts 40 bits of the mode. 507.62s - 510.78s | We have 72-bits preamble. 510.78s - 513.26s | And here we have 96-bit. 513.26s - 518.34s | But 72-bits of preamble, I don't know, sure. 518.34s - 520.86s | So that's the reason that I do a hardware 520.86s - 523.34s | hacking with a logic analyzer. 523.34s - 526.54s | This is logic analyzer LA5016 that 526.54s - 530.58s | is able to record up to 500 megahertz. 530.58s - 533.10s | So here's the connection. 533.10s - 536.30s | Channel 1 is to the transmit bit, the pin number 3, 536.30s - 540.66s | ground to ground, and channel 2 into the H input system, 540.66s - 544.46s | for example, K0, K1, K2, and K3, and a multimeter 544.46s - 550.30s | to check the voltage pin. 550.30s - 554.54s | So what we get when we do that, for example, 554.54s - 558.26s | if we press the first button, the K0, 558.26s - 561.06s | we have that signal in the transmit pin. 561.06s - 566.82s | This is the learning code that repeats 25 times. 566.82s - 569.26s | And after that, we have the preamble of the next signal. 569.34s - 570.86s | So when we press the button, we have 570.86s - 573.58s | the pulse in the channel 1. 573.58s - 576.78s | So the duration of the pulse is the duration 576.78s - 577.86s | that we press the button. 577.86s - 579.78s | So if we press the button one more, 579.78s - 583.50s | we have one more of learning codes, the same learning code. 583.50s - 584.86s | You understand me? 584.86s - 587.26s | And the same with K1, the same with K2, 587.26s - 589.54s | that is the button to


chunk_text:
ground to ground, and channel 2 into the H input system, 540.66s - 544.46s | for example, K0, K1, K2, and K3, and a multimeter 544.46s - 550.30s | to check the voltage pin. 550.30s - 554.54s | So what we get when we do that, for example, 554.54s - 558.26s | if we press the first button, the K0, 558.26s - 561.06s | we have that signal in the transmit pin. 561.06s - 566.82s | This is the learning code that repeats 25 times. 566.82s - 569.26s | And after that, we have the preamble of the next signal. 569.34s - 570.86s | So when we press the button, we have 570.86s - 573.58s | the pulse in the channel 1. 573.58s - 576.78s | So the duration of the pulse is the duration 576.78s - 577.86s | that we press the button. 577.86s - 579.78s | So if we press the button one more, 579.78s - 583.50s | we have one more of learning codes, the same learning code. 583.50s - 584.86s | You understand me? 584.86s - 587.26s | And the same with K1, the same with K2, 587.26s - 589.54s | that is the button to unlock the car. 589.54s - 592.58s | The same with the K3, that is the button to lock the car. 592.58s - 596.10s | So if we assume what we have, for example, 596.10s - 598.66s | here is the learning code. 598.66s - 602.42s | Here is the learning code, 1, 2, 3, 4, and more learning code. 602.42s - 604.42s | If we do assume to the learning code, 604.42s - 611.82s | we have a pulse, 0, a pulse with more duration, 611.82s - 613.26s | and a 0 with less duration. 613.26s - 615.06s | So I say, hey, what that means? 615.06s - 620.54s | If I get it when I record the signal with a HAG RF, 620.54s - 623.42s | I say I get 1, 0, 1, 0. 623.42s - 626.70s | But how I translate that to 1, 0, 1, 0? 626.70s - 631.34s | Because here I have a pulse that is longer than that pulse. 631.34s - 635.14s | And here I have a 0 that is longer than that 0. 635.14s - 637.82s | So I say, hey, this is encoded. 637.82s - 639.14s | So this is encoded.


chunk_text:
unlock the car. 589.54s - 592.58s | The same with the K3, that is the button to lock the car. 592.58s - 596.10s | So if we assume what we have, for example, 596.10s - 598.66s | here is the learning code. 598.66s - 602.42s | Here is the learning code, 1, 2, 3, 4, and more learning code. 602.42s - 604.42s | If we do assume to the learning code, 604.42s - 611.82s | we have a pulse, 0, a pulse with more duration, 611.82s - 613.26s | and a 0 with less duration. 613.26s - 615.06s | So I say, hey, what that means? 615.06s - 620.54s | If I get it when I record the signal with a HAG RF, 620.54s - 623.42s | I say I get 1, 0, 1, 0. 623.42s - 626.70s | But how I translate that to 1, 0, 1, 0? 626.70s - 631.34s | Because here I have a pulse that is longer than that pulse. 631.34s - 635.14s | And here I have a 0 that is longer than that 0. 635.14s - 637.82s | So I say, hey, this is encoded. 637.82s - 639.14s | So this is encoded. 639.14s - 641.94s | So after reversing the encodification, 641.94s - 644.22s | after reading a lot of data sheets, 644.22s - 647.50s | I achieved to discover the encoding to the learning code. 647.50s - 650.34s | So I get a learning code with logic on the large cell. 650.34s - 656.42s | So the integrated chip sends a 0 with four bits 656.42s - 660.46s | and sends a 1 bit with four bits. 660.46s - 662.78s | So for example, if the integrated code 662.78s - 667.74s | wants to send 0, it sends 1, 0, 0, 0. 667.74s - 673.30s | And if the integrated circuit wants to send 1 bit, 673.30s - 675.90s | the 1 bit is sent to 1, 1, 1, 0. 675.90s - 680.78s | So for example, here we have 1, 0, 3, 0s. 680.78s - 684.10s | And also we have here 1, 1, 1, 0. 684.10s - 687.74s | So here we have a 1, and here we have a 0. 687.74s - 691.78s | So after that, the preamble is a constant. 691.78s - 697.70s | The preamble is a constant of the 1 bit and 31 0s.


chunk_text:
639.14s - 641.94s | So after reversing the encodification, 641.94s - 644.22s | after reading a lot of data sheets, 644.22s - 647.50s | I achieved to discover the encoding to the learning code. 647.50s - 650.34s | So I get a learning code with logic on the large cell. 650.34s - 656.42s | So the integrated chip sends a 0 with four bits 656.42s - 660.46s | and sends a 1 bit with four bits. 660.46s - 662.78s | So for example, if the integrated code 662.78s - 667.74s | wants to send 0, it sends 1, 0, 0, 0. 667.74s - 673.30s | And if the integrated circuit wants to send 1 bit, 673.30s - 675.90s | the 1 bit is sent to 1, 1, 1, 0. 675.90s - 680.78s | So for example, here we have 1, 0, 3, 0s. 680.78s - 684.10s | And also we have here 1, 1, 1, 0. 684.10s - 687.74s | So here we have a 1, and here we have a 0. 687.74s - 691.78s | So after that, the preamble is a constant. 691.78s - 697.70s | The preamble is a constant of the 1 bit and 31 0s. 697.70s - 702.02s | So that's the reason that when we get that signal with Logic 702.02s - 705.58s | Analyzer, we have here the preamble 1 bit and 31 0s. 705.58s - 709.34s | And after that here, for example, we have 0, 1, 0, 1, 709.34s - 711.14s | 1, 0, 0, and so on. 711.14s - 713.90s | And the mode also is encoded with that codification. 713.90s - 718.10s | We have here a 1, 0, 0, 0. 718.10s - 719.30s | OK? 719.30s - 721.86s | So after that, we have all the information 721.86s - 724.18s | to encode or decode any signal. 724.18s - 725.74s | So how I verify that? 725.74s - 727.98s | Remember that 96 bits. 727.98s - 732.22s | So if we multiply 20 bits by 4 bits, 732.22s - 738.42s | and plus 4 bits by 4 bits of the mode, we have 96 bits. 738.42s - 741.88s | So this is the reason that at the start of the presentation, 741.88s - 744.44s | we have recorded 96 bits. 744.44s - 745.08s | OK? 745.08s - 749.72s | So after that, we have the preamble of the


chunk_text:
697.70s - 702.02s | So that's the reason that when we get that signal with Logic 702.02s - 705.58s | Analyzer, we have here the preamble 1 bit and 31 0s. 705.58s - 709.34s | And after that here, for example, we have 0, 1, 0, 1, 709.34s - 711.14s | 1, 0, 0, and so on. 711.14s - 713.90s | And the mode also is encoded with that codification. 713.90s - 718.10s | We have here a 1, 0, 0, 0. 718.10s - 719.30s | OK? 719.30s - 721.86s | So after that, we have all the information 721.86s - 724.18s | to encode or decode any signal. 724.18s - 725.74s | So how I verify that? 725.74s - 727.98s | Remember that 96 bits. 727.98s - 732.22s | So if we multiply 20 bits by 4 bits, 732.22s - 738.42s | and plus 4 bits by 4 bits of the mode, we have 96 bits. 738.42s - 741.88s | So this is the reason that at the start of the presentation, 741.88s - 744.44s | we have recorded 96 bits. 744.44s - 745.08s | OK? 745.08s - 749.72s | So after that, we have the preamble of the next frame, 749.72s - 751.72s | of the next learning code. 751.72s - 752.88s | So why do I do that? 752.88s - 756.48s | Because I see data sheets that say 756.48s - 759.00s | me bad information, fake information 759.00s - 761.48s | for use for us, like hackers. 761.48s - 764.20s | For example, there are another vulnerable radio frequency 764.20s - 764.68s | chips. 764.68s - 768.68s | For example, there are also the HS1527, 769.08s - 778.60s | 24, the HS2241, and more, the HTCP20D, the HTCP20B, and more. 778.60s - 781.44s | So if you read the data sheet, the data sheet 781.44s - 785.04s | say something like, hey, it can reduce any code collision 785.04s - 787.24s | and authorize it code scanning possibility. 787.24s - 790.40s | So hey, are you sure we are going to probe the opposite? 790.40s - 793.68s | Because I discovered the encodification, 793.68s - 794.88s | the encodification, and more. 794.92s - 799.60s | So I built a genuine radio block that do a brute force attack. 799.60s - 805.20s | This is the brain of the attack, is that block that I built. 805.20s


chunk_text:
next frame, 749.72s - 751.72s | of the next learning code. 751.72s - 752.88s | So why do I do that? 752.88s - 756.48s | Because I see data sheets that say 756.48s - 759.00s | me bad information, fake information 759.00s - 761.48s | for use for us, like hackers. 761.48s - 764.20s | For example, there are another vulnerable radio frequency 764.20s - 764.68s | chips. 764.68s - 768.68s | For example, there are also the HS1527, 769.08s - 778.60s | 24, the HS2241, and more, the HTCP20D, the HTCP20B, and more. 778.60s - 781.44s | So if you read the data sheet, the data sheet 781.44s - 785.04s | say something like, hey, it can reduce any code collision 785.04s - 787.24s | and authorize it code scanning possibility. 787.24s - 790.40s | So hey, are you sure we are going to probe the opposite? 790.40s - 793.68s | Because I discovered the encodification, 793.68s - 794.88s | the encodification, and more. 794.92s - 799.60s | So I built a genuine radio block that do a brute force attack. 799.60s - 805.20s | This is the brain of the attack, is that block that I built. 805.20s - 807.40s | And this is ASK modulation. 807.40s - 809.24s | We have here our repeating interpolation 809.24s - 811.60s | to better the signal. 811.60s - 813.76s | Here we have the carrier signal. 813.76s - 816.00s | Multiply, we have the modulated signal, 816.00s - 820.48s | and a trouble to maintain to the symbol rate. 820.48s - 821.00s | OK? 821.00s - 825.04s | After that, we send that to the OSMO com scene 825.04s - 828.36s | that is compatible with our hack LF. 828.36s - 838.12s | OK, so let's go to see how I am able to unlock the car with 838.12s - 840.68s | my genuine radio brute force attack. 840.68s - 843.76s | So the car right now is locked. 843.76s - 854.23s | I run my genuine radio script, and right now, the car 854.23s - 855.35s | is unlocked. 855.35s - 855.91s | So simple. 855.91s - 858.19s | The brute force is customizable. 858.19s - 863.23s | You can set parameters, for example, 863.23s - 866.07s | the delay between each signal. 866.07s - 868.59s | And after that, I created AutoRefKiller. 868.59s - 871.67s | It's a


chunk_text:
- 807.40s | And this is ASK modulation. 807.40s - 809.24s | We have here our repeating interpolation 809.24s - 811.60s | to better the signal. 811.60s - 813.76s | Here we have the carrier signal. 813.76s - 816.00s | Multiply, we have the modulated signal, 816.00s - 820.48s | and a trouble to maintain to the symbol rate. 820.48s - 821.00s | OK? 821.00s - 825.04s | After that, we send that to the OSMO com scene 825.04s - 828.36s | that is compatible with our hack LF. 828.36s - 838.12s | OK, so let's go to see how I am able to unlock the car with 838.12s - 840.68s | my genuine radio brute force attack. 840.68s - 843.76s | So the car right now is locked. 843.76s - 854.23s | I run my genuine radio script, and right now, the car 854.23s - 855.35s | is unlocked. 855.35s - 855.91s | So simple. 855.91s - 858.19s | The brute force is customizable. 858.19s - 863.23s | You can set parameters, for example, 863.23s - 866.07s | the delay between each signal. 866.07s - 868.59s | And after that, I created AutoRefKiller. 868.59s - 871.67s | It's a tool that I developed to unlock whatever car that 871.67s - 874.67s | use learning code, fixed code, or rolling code 874.71s - 876.63s | with roll jam attacks. 876.63s - 880.79s | So let's go to the city to unlock 880.79s - 882.19s | hundreds of vulnerable cars. 882.19s - 885.07s | So here we have the real gangster hacker. 885.07s - 886.75s | This is a pet black hacker. 886.75s - 889.51s | Don't use my pet, please. 889.51s - 900.51s | So here, I show about how I perform in Akia Soluto. 900.51s - 906.55s | OK, so right now, I run the brute force attacks. 906.55s - 914.55s | I remember that the brute force attack take one minute, 914.55s - 915.39s | I guess. 915.39s - 920.59s | And in one minute, my script was able to unlock the car. 920.59s - 925.15s | So OK, remember, each car has a different learning code. 925.15s - 931.27s | And each car is able to save up to four different learning 931.27s - 932.47s | codes. 932.47s - 936.95s | OK, so right now, I'm going to check the car is unlocked. 936.95s - 945.91s |


chunk_text:
tool that I developed to unlock whatever car that 871.67s - 874.67s | use learning code, fixed code, or rolling code 874.71s - 876.63s | with roll jam attacks. 876.63s - 880.79s | So let's go to the city to unlock 880.79s - 882.19s | hundreds of vulnerable cars. 882.19s - 885.07s | So here we have the real gangster hacker. 885.07s - 886.75s | This is a pet black hacker. 886.75s - 889.51s | Don't use my pet, please. 889.51s - 900.51s | So here, I show about how I perform in Akia Soluto. 900.51s - 906.55s | OK, so right now, I run the brute force attacks. 906.55s - 914.55s | I remember that the brute force attack take one minute, 914.55s - 915.39s | I guess. 915.39s - 920.59s | And in one minute, my script was able to unlock the car. 920.59s - 925.15s | So OK, remember, each car has a different learning code. 925.15s - 931.27s | And each car is able to save up to four different learning 931.27s - 932.47s | codes. 932.47s - 936.95s | OK, so right now, I'm going to check the car is unlocked. 936.95s - 945.91s | And after I run my script, right now, the script is running. 957.37s - 958.61s | And let's go to wait. 958.61s - 962.17s | And in a few minutes, the car will be unlocked. 962.17s - 967.89s | You know, each signal is sent through each 30 milliseconds. 967.89s - 972.81s | But you can set that parameter to, I don't know, 972.81s - 974.05s | 60 milliseconds. 974.05s - 976.85s | If you have more interference, you 976.85s - 980.17s | are able to send with a more delayed. 980.17s - 986.25s | OK, right now, we have a Kia Rio. 986.25s - 990.29s | So it's the same attack, the same attack. 990.29s - 997.05s | So the Kia Rio, I was able to unlock the car 997.05s - 998.73s | with two different learning codes. 998.73s - 1003.45s | Remember, each car had between two learning codes 1003.45s - 1006.01s | up to four different learning codes. 1006.01s - 1014.24s | So let's go to see quickly. 1014.24s - 1016.08s | So we check the car is locked. 1016.08s - 1023.18s | And after I run my script, I am able to unlock the car. 1023.18s


chunk_text:
And after I run my script, right now, the script is running. 957.37s - 958.61s | And let's go to wait. 958.61s - 962.17s | And in a few minutes, the car will be unlocked. 962.17s - 967.89s | You know, each signal is sent through each 30 milliseconds. 967.89s - 972.81s | But you can set that parameter to, I don't know, 972.81s - 974.05s | 60 milliseconds. 974.05s - 976.85s | If you have more interference, you 976.85s - 980.17s | are able to send with a more delayed. 980.17s - 986.25s | OK, right now, we have a Kia Rio. 986.25s - 990.29s | So it's the same attack, the same attack. 990.29s - 997.05s | So the Kia Rio, I was able to unlock the car 997.05s - 998.73s | with two different learning codes. 998.73s - 1003.45s | Remember, each car had between two learning codes 1003.45s - 1006.01s | up to four different learning codes. 1006.01s - 1014.24s | So let's go to see quickly. 1014.24s - 1016.08s | So we check the car is locked. 1016.08s - 1023.18s | And after I run my script, I am able to unlock the car. 1023.18s - 1025.54s | All right, now the car is locked. 1025.54s - 1031.22s | OK, and final, with another Renault X, I don't know. 1031.22s - 1034.70s | Remember, there is a possibility that you 1034.70s - 1041.14s | go to a car keyless entry system. 1041.14s - 1047.14s | There are a possibility that the car dealership install 1047.14s - 1050.58s | you a vulnerable keyless entry system with learning code. 1050.62s - 1055.06s | So I guess that in Renault, I don't see the model. 1055.06s - 1060.18s | I guess that this is the case. 1060.18s - 1063.06s | Also, there are vulnerable cars like Kia Picanto 1063.06s - 1066.02s | and more cars in Ecuador. 1066.02s - 1067.22s | So I'm from Ecuador. 1067.22s - 1073.85s | I forget to say that, I guess. 1073.85s - 1081.08s | So these are real attacks in the streets. 1081.08s - 1084.92s | Right now, I unlocked the car. 1084.92s - 1087.56s | So let's go to the next part. 1087.56s - 1090.04s | Let's go to the setting backdoor in keyless entry system. 1090.04s - 1095.76s | Remember that how we know that a malicious actor don't 1095.76s


chunk_text:
- 1025.54s | All right, now the car is locked. 1025.54s - 1031.22s | OK, and final, with another Renault X, I don't know. 1031.22s - 1034.70s | Remember, there is a possibility that you 1034.70s - 1041.14s | go to a car keyless entry system. 1041.14s - 1047.14s | There are a possibility that the car dealership install 1047.14s - 1050.58s | you a vulnerable keyless entry system with learning code. 1050.62s - 1055.06s | So I guess that in Renault, I don't see the model. 1055.06s - 1060.18s | I guess that this is the case. 1060.18s - 1063.06s | Also, there are vulnerable cars like Kia Picanto 1063.06s - 1066.02s | and more cars in Ecuador. 1066.02s - 1067.22s | So I'm from Ecuador. 1067.22s - 1073.85s | I forget to say that, I guess. 1073.85s - 1081.08s | So these are real attacks in the streets. 1081.08s - 1084.92s | Right now, I unlocked the car. 1084.92s - 1087.56s | So let's go to the next part. 1087.56s - 1090.04s | Let's go to the setting backdoor in keyless entry system. 1090.04s - 1095.76s | Remember that how we know that a malicious actor don't 1095.76s - 1099.16s | send a backdoor into our keyless entry system? 1099.16s - 1100.00s | We don't know. 1100.00s - 1106.24s | So there are high probability because in Latin America, 1106.24s - 1109.72s | in South America, there are something like universal case. 1109.72s - 1112.44s | Universal case, there is a fogging 1112.44s - 1118.56s | because uses a key fog of the malicious actor 1118.56s - 1121.40s | set into the keyless entry system of many cars. 1121.40s - 1123.52s | So this is where it's rolling code. 1123.52s - 1130.80s | So 1K unlock N cars because previously, the car 1130.80s - 1134.00s | was backdoorized. 1134.00s - 1137.16s | OK, so let's go to backdoor inside a keyless entry system. 1137.16s - 1141.16s | For that, we have the receiver microcontroller with STM8, 1141.16s - 1144.84s | the horn, the voltage source to power on the circuit. 1151.15s - 1154.07s | We don't have sound, but don't worry. 1154.07s - 1160.27s | Right now, also, we have the hack RF, my SD device, 1160.27s - 1162.55s | and also the auto RF killer that I 1162.55s - 1166.95s | created to create a custom signal


chunk_text:
- 1099.16s | send a backdoor into our keyless entry system? 1099.16s - 1100.00s | We don't know. 1100.00s - 1106.24s | So there are high probability because in Latin America, 1106.24s - 1109.72s | in South America, there are something like universal case. 1109.72s - 1112.44s | Universal case, there is a fogging 1112.44s - 1118.56s | because uses a key fog of the malicious actor 1118.56s - 1121.40s | set into the keyless entry system of many cars. 1121.40s - 1123.52s | So this is where it's rolling code. 1123.52s - 1130.80s | So 1K unlock N cars because previously, the car 1130.80s - 1134.00s | was backdoorized. 1134.00s - 1137.16s | OK, so let's go to backdoor inside a keyless entry system. 1137.16s - 1141.16s | For that, we have the receiver microcontroller with STM8, 1141.16s - 1144.84s | the horn, the voltage source to power on the circuit. 1151.15s - 1154.07s | We don't have sound, but don't worry. 1154.07s - 1160.27s | Right now, also, we have the hack RF, my SD device, 1160.27s - 1162.55s | and also the auto RF killer that I 1162.55s - 1166.95s | created to create a custom signal to create the backdoor. 1166.95s - 1172.55s | And basically, I put in programmation mode 1172.55s - 1174.83s | the keyless entry system. 1174.83s - 1177.63s | We connect the ignition to the voltage 1177.63s - 1179.87s | and press a button six times. 1179.87s - 1183.99s | So this is how to backdoorize the keyless entry system. 1183.99s - 1185.95s | So after the keyless entry system 1185.95s - 1189.15s | is in learning code programmation mode, 1189.15s - 1194.07s | I send whatever signal, whatever signal. 1194.07s - 1199.07s | For example, I put, for example, 1001001 or 001, 1199.75s - 1202.59s | or 00000001. 1202.59s - 1204.59s | So this is the backdoor code. 1204.59s - 1208.35s | So right now, I use my tool. 1208.35s - 1211.19s | I put the backdoor code right now. 1211.19s - 1222.07s | And after that, the receiver will save that in his memory. 1222.07s - 1226.23s | So right now, I connect ignition to the voltage 1226.23s - 1228.31s | to put in programmation mode. 1228.31s - 1230.79s | They are sounds. 1230.79s - 1236.15s | And after that, I send the backdoor code. 1236.15s - 1240.15s | And


chunk_text:
to create the backdoor. 1166.95s - 1172.55s | And basically, I put in programmation mode 1172.55s - 1174.83s | the keyless entry system. 1174.83s - 1177.63s | We connect the ignition to the voltage 1177.63s - 1179.87s | and press a button six times. 1179.87s - 1183.99s | So this is how to backdoorize the keyless entry system. 1183.99s - 1185.95s | So after the keyless entry system 1185.95s - 1189.15s | is in learning code programmation mode, 1189.15s - 1194.07s | I send whatever signal, whatever signal. 1194.07s - 1199.07s | For example, I put, for example, 1001001 or 001, 1199.75s - 1202.59s | or 00000001. 1202.59s - 1204.59s | So this is the backdoor code. 1204.59s - 1208.35s | So right now, I use my tool. 1208.35s - 1211.19s | I put the backdoor code right now. 1211.19s - 1222.07s | And after that, the receiver will save that in his memory. 1222.07s - 1226.23s | So right now, I connect ignition to the voltage 1226.23s - 1228.31s | to put in programmation mode. 1228.31s - 1230.79s | They are sounds. 1230.79s - 1236.15s | And after that, I send the backdoor code. 1236.15s - 1240.15s | And finally, I exit the programmation mode. 1240.15s - 1245.55s | And after that, I am able to unlock the car 1245.55s - 1248.07s | with my backdoor code, OK? 1248.07s - 1251.99s | So basically, I am able to unlock 1251.99s - 1268.45s | that car with my hack RF. 1268.45s - 1271.33s | So right now, I'm going to send the signal. 1271.37s - 1276.41s | I am going to unlock the system with the hack RF. 1276.41s - 1280.09s | So let's go to send the signal with the hack RF. 1282.81s - 1284.37s | I lock the system. 1284.37s - 1285.73s | Lock the system. 1285.73s - 1291.05s | And if you listen, I know that you don't listen right now, 1291.05s - 1293.17s | but trust me. 1293.17s - 1297.45s | The system sounds, so the system is unlocked with the backdoor. 1297.45s - 1299.05s | OK. 1299.05s - 1301.89s | There are also a collision problem. 1301.89s - 1303.97s | What means the collision problem? 1303.97s - 1306.93s | The most integrated chip learning code 1306.93s - 1310.45s | use the same two to power 20 bits. 1310.45s - 1314.49s | So the most integrated


chunk_text:
finally, I exit the programmation mode. 1240.15s - 1245.55s | And after that, I am able to unlock the car 1245.55s - 1248.07s | with my backdoor code, OK? 1248.07s - 1251.99s | So basically, I am able to unlock 1251.99s - 1268.45s | that car with my hack RF. 1268.45s - 1271.33s | So right now, I'm going to send the signal. 1271.37s - 1276.41s | I am going to unlock the system with the hack RF. 1276.41s - 1280.09s | So let's go to send the signal with the hack RF. 1282.81s - 1284.37s | I lock the system. 1284.37s - 1285.73s | Lock the system. 1285.73s - 1291.05s | And if you listen, I know that you don't listen right now, 1291.05s - 1293.17s | but trust me. 1293.17s - 1297.45s | The system sounds, so the system is unlocked with the backdoor. 1297.45s - 1299.05s | OK. 1299.05s - 1301.89s | There are also a collision problem. 1301.89s - 1303.97s | What means the collision problem? 1303.97s - 1306.93s | The most integrated chip learning code 1306.93s - 1310.45s | use the same two to power 20 bits. 1310.45s - 1314.49s | So the most integrated circuit chips learning code 1314.49s - 1316.21s | have one million possibility code. 1316.21s - 1323.09s | So what I mean, for example, if we take the AB1527 chip, 1323.09s - 1326.33s | there are high probability that that chip have the same learning 1326.33s - 1329.49s | code that have another chip that use the same range. 1329.49s - 1334.73s | For example, the HS2240, HS2241, and more. 1334.73s - 1335.65s | Why I say that? 1335.65s - 1337.65s | Because just in my country alone, 1337.65s - 1341.53s | there are tons of cars that use that KLS entry system, 1341.53s - 1343.37s | vulnerable KLS entry system. 1343.37s - 1348.05s | So if we join all the cars in one place, 1348.05s - 1350.49s | all of the cars of the world in one place 1350.49s - 1352.69s | that use the learning codes, there 1352.69s - 1356.37s | are high probability that if I take a random KFOB 1356.37s - 1359.25s | and press the button, there are another cars 1359.25s - 1362.61s | that will unlock or lock. 1362.61s - 1363.61s | And why I say that? 1363.61s - 1369.53s | Because there will come


chunk_text:
circuit chips learning code 1314.49s - 1316.21s | have one million possibility code. 1316.21s - 1323.09s | So what I mean, for example, if we take the AB1527 chip, 1323.09s - 1326.33s | there are high probability that that chip have the same learning 1326.33s - 1329.49s | code that have another chip that use the same range. 1329.49s - 1334.73s | For example, the HS2240, HS2241, and more. 1334.73s - 1335.65s | Why I say that? 1335.65s - 1337.65s | Because just in my country alone, 1337.65s - 1341.53s | there are tons of cars that use that KLS entry system, 1341.53s - 1343.37s | vulnerable KLS entry system. 1343.37s - 1348.05s | So if we join all the cars in one place, 1348.05s - 1350.49s | all of the cars of the world in one place 1350.49s - 1352.69s | that use the learning codes, there 1352.69s - 1356.37s | are high probability that if I take a random KFOB 1356.37s - 1359.25s | and press the button, there are another cars 1359.25s - 1362.61s | that will unlock or lock. 1362.61s - 1363.61s | And why I say that? 1363.61s - 1369.53s | Because there will come a time where the million codes will 1369.53s - 1373.01s | be filed all over the world and will be a collision, 1373.01s - 1377.29s | and no one will figure it out. 1377.29s - 1384.77s | Or maybe this firewall has already been reached. 1384.77s - 1388.57s | So that question, I put you in your mind. 1388.57s - 1392.29s | So for example, my KFOB code unlock my car, 1392.29s - 1395.21s | or I unlock a garage door in United States 1395.21s - 1399.01s | because that learning codes also are 1399.01s - 1404.05s | using in garage door and radio frequency devices protection. 1404.05s - 1407.29s | So finally, I'm going to exploit everything. 1407.29s - 1415.25s | This is a tool with 1,300 Python lines code. 1415.25s - 1417.49s | So the first feature is to brute force learning codes 1417.49s - 1418.61s | with our database. 1418.61s - 1421.57s | I created a database that have all codification 1421.57s - 1424.77s | of the integrated learning code chips. 1424.77s - 1428.73s | So also, you can discover in backdoor codes in your car 1428.73s - 1430.29s | running that brute force attack. 1430.29s -


chunk_text:
a time where the million codes will 1369.53s - 1373.01s | be filed all over the world and will be a collision, 1373.01s - 1377.29s | and no one will figure it out. 1377.29s - 1384.77s | Or maybe this firewall has already been reached. 1384.77s - 1388.57s | So that question, I put you in your mind. 1388.57s - 1392.29s | So for example, my KFOB code unlock my car, 1392.29s - 1395.21s | or I unlock a garage door in United States 1395.21s - 1399.01s | because that learning codes also are 1399.01s - 1404.05s | using in garage door and radio frequency devices protection. 1404.05s - 1407.29s | So finally, I'm going to exploit everything. 1407.29s - 1415.25s | This is a tool with 1,300 Python lines code. 1415.25s - 1417.49s | So the first feature is to brute force learning codes 1417.49s - 1418.61s | with our database. 1418.61s - 1421.57s | I created a database that have all codification 1421.57s - 1424.77s | of the integrated learning code chips. 1424.77s - 1428.73s | So also, you can discover in backdoor codes in your car 1428.73s - 1430.29s | running that brute force attack. 1430.29s - 1433.21s | So for example, if you run and your car 1433.21s - 1435.61s | was unlocked by another learning code, 1435.61s - 1438.73s | your car is backdoorized. 1438.73s - 1440.57s | Another is the brute force attack 1440.57s - 1441.69s | with arbitrary parameters. 1441.69s - 1447.45s | For example, if you want to run your chip 1447.45s - 1452.73s | with custom parameters, you also are able to run that. 1452.73s - 1456.13s | You also create a backdoor custom code or signal. 1456.13s - 1461.61s | And also, you are able to perform a replay attack. 1461.61s - 1465.13s | And finally, a roll jam attack. 1465.13s - 1469.41s | To do that, you need two SDR device 1469.41s - 1471.85s | to unlock cars with rolling code. 1471.85s - 1479.81s | So finally, let's go to see the tool. 1479.81s - 1483.81s | So I entered the integrated chip name. 1483.81s - 1487.05s | So the program sent me the information 1487.05s - 1488.61s | about that integrated chip. 1488.61s - 1492.45s | So we don't have anything more than put the radio frequency, 1493.21s - 1496.05s | for example, in this case, 350. 1496.05s


chunk_text:
1433.21s | So for example, if you run and your car 1433.21s - 1435.61s | was unlocked by another learning code, 1435.61s - 1438.73s | your car is backdoorized. 1438.73s - 1440.57s | Another is the brute force attack 1440.57s - 1441.69s | with arbitrary parameters. 1441.69s - 1447.45s | For example, if you want to run your chip 1447.45s - 1452.73s | with custom parameters, you also are able to run that. 1452.73s - 1456.13s | You also create a backdoor custom code or signal. 1456.13s - 1461.61s | And also, you are able to perform a replay attack. 1461.61s - 1465.13s | And finally, a roll jam attack. 1465.13s - 1469.41s | To do that, you need two SDR device 1469.41s - 1471.85s | to unlock cars with rolling code. 1471.85s - 1479.81s | So finally, let's go to see the tool. 1479.81s - 1483.81s | So I entered the integrated chip name. 1483.81s - 1487.05s | So the program sent me the information 1487.05s - 1488.61s | about that integrated chip. 1488.61s - 1492.45s | So we don't have anything more than put the radio frequency, 1493.21s - 1496.05s | for example, in this case, 350. 1496.05s - 1497.93s | And the brute force attack is performing. 1497.93s - 1502.25s | So we need to wait on nothing more. 1502.25s - 1512.92s | Also here, we execute a perform brute force attack 1512.92s - 1516.00s | with 22 bits, not just 20 bits. 1516.00s - 1521.28s | So you can set whatever number of bits. 1521.28s - 1525.48s | You enter the start number to brute force attack 1525.48s - 1528.12s | and the end number to finish the brute force attack, 1528.12s - 1530.24s | the delays, and more. 1530.24s - 1536.56s | And after that, I execute the option number four 1536.56s - 1538.24s | to send a jamming signal. 1538.24s - 1543.52s | So you also can use that tool to create jamming signals 1543.52s - 1544.88s | in whatever frequency. 1544.88s - 1548.64s | And you set the duration of the jamming. 1549.64s - 1560.99s | And finally, also, we can choose the option number three 1560.99s - 1564.59s | to record and replay a radio frequency signal to discover 1564.59s - 1569.23s | your car is vulnerable to fixed code or learning codes. 1569.23s - 1571.91s | So you set the frequency.


chunk_text:
- 1497.93s | And the brute force attack is performing. 1497.93s - 1502.25s | So we need to wait on nothing more. 1502.25s - 1512.92s | Also here, we execute a perform brute force attack 1512.92s - 1516.00s | with 22 bits, not just 20 bits. 1516.00s - 1521.28s | So you can set whatever number of bits. 1521.28s - 1525.48s | You enter the start number to brute force attack 1525.48s - 1528.12s | and the end number to finish the brute force attack, 1528.12s - 1530.24s | the delays, and more. 1530.24s - 1536.56s | And after that, I execute the option number four 1536.56s - 1538.24s | to send a jamming signal. 1538.24s - 1543.52s | So you also can use that tool to create jamming signals 1543.52s - 1544.88s | in whatever frequency. 1544.88s - 1548.64s | And you set the duration of the jamming. 1549.64s - 1560.99s | And finally, also, we can choose the option number three 1560.99s - 1564.59s | to record and replay a radio frequency signal to discover 1564.59s - 1569.23s | your car is vulnerable to fixed code or learning codes. 1569.23s - 1571.91s | So you set the frequency. 1571.91s - 1576.71s | You need my script and also the hack RF and nothing more. 1576.71s - 1580.91s | So you record in 10 seconds the signal. 1580.91s - 1584.79s | And immediately, in 10 seconds, your signal is replied again. 1594.16s - 1596.76s | And finally, set a backdoor into the KLS entry system. 1596.76s - 1598.20s | You set the frequency. 1598.20s - 1602.80s | And you put the bits, for example, 110, whatever. 1602.80s - 1607.12s | So the script create the modulation, do everything. 1607.12s - 1613.52s | So you just need to put the bits and nothing more. 1613.52s - 1614.96s | So thank you so much. 1614.96s - 1619.90s | This was breaking learning codes in my country. 1619.90s - 1621.82s | Thank you so much.


chunk_text:
1571.91s - 1576.71s | You need my script and also the hack RF and nothing more. 1576.71s - 1580.91s | So you record in 10 seconds the signal. 1580.91s - 1584.79s | And immediately, in 10 seconds, your signal is replied again. 1594.16s - 1596.76s | And finally, set a backdoor into the KLS entry system. 1596.76s - 1598.20s | You set the frequency. 1598.20s - 1602.80s | And you put the bits, for example, 110, whatever. 1602.80s - 1607.12s | So the script create the modulation, do everything. 1607.12s - 1613.52s | So you just need to put the bits and nothing more. 1613.52s - 1614.96s | So thank you so much. 1614.96s - 1619.90s | This was breaking learning codes in my country. 1619.90s - 1621.82s | Thank you so much.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=J7GFF-GVOpA", "title": "DEF CON 32 - Doors, Cameras, & Mantraps Oh my! - The Magician", "description": "This is an entry level talk about the practical parts of Physical Security Assessment, and how to talk to clients.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1059, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 3.52s | This text was transcribed using whisper model: large-v2 So it turns out that the slides are not going to be up here, 3.52s - 6.80s | but what I'm going to do is record my talk later 6.80s - 9.04s | and put it up on YouTube and share it on Twitter, 9.04s - 12.12s | so you all will get to see the slides. 12.12s - 14.64s | I'll probably just share the slides, that would be cool. 14.64s - 18.84s | All right, so my name is The Magician. 18.84s - 21.52s | This talk is Doors, Cameras, and Mantraps, Oh My! 21.52s - 23.20s | It is not a lockpicking talk, 23.20s - 24.64s | if that's what you're here for. 24.64s - 28.20s | This is a talk more about physical security 28.24s - 31.52s | and the practical business aspects of security 31.52s - 34.68s | in the PhysSec world and how to talk to clients 34.68s - 35.88s | and how you want to get into it, 35.88s - 37.88s | if that's something you're interested in. 39.44s - 46.54s | So, hi, nice to meet you all. 46.54s - 53.36s | I've got my notes here, even though you don't have slides. 53.36s - 55.60s | I'm a member of the Open Organization of Lockpickers. 55.60s - 59.08s | If you all have gone and picked locks at Lockpick Village, 59.08s - 61.76s | then that's the tool group, those are my people. 61.76s - 63.36s | Let them know The Magician sent you 63.36s - 66.88s | and they'll set you up with some locks and some picks. 66.88s - 69.76s | I was a physical security assessor 69.76s - 72.04s | for Gold Sky Cybersecurity, 72.04s - 74.16s | and they used to send me around the United States 74.16s - 76.44s | and break into buildings, and I would show people 76.44s - 79.24s | how I would break into their buildings with them, 79.24s - 81.36s | so they could try it, learn it, 81.36s -


chunk_text:
31.52s - 34.68s | in the PhysSec world and how to talk to clients 34.68s - 35.88s | and how you want to get into it, 35.88s - 37.88s | if that's something you're interested in. 39.44s - 46.54s | So, hi, nice to meet you all. 46.54s - 53.36s | I've got my notes here, even though you don't have slides. 53.36s - 55.60s | I'm a member of the Open Organization of Lockpickers. 55.60s - 59.08s | If you all have gone and picked locks at Lockpick Village, 59.08s - 61.76s | then that's the tool group, those are my people. 61.76s - 63.36s | Let them know The Magician sent you 63.36s - 66.88s | and they'll set you up with some locks and some picks. 66.88s - 69.76s | I was a physical security assessor 69.76s - 72.04s | for Gold Sky Cybersecurity, 72.04s - 74.16s | and they used to send me around the United States 74.16s - 76.44s | and break into buildings, and I would show people 76.44s - 79.24s | how I would break into their buildings with them, 79.24s - 81.36s | so they could try it, learn it, 81.36s - 83.32s | and the mitigation rate was much higher 83.32s - 88.24s | because then they understood how to do the physical exploit. 90.12s - 93.20s | Physical security still is a huge hobby for me, 94.04s - 96.68s | even though I'm not doing it professionally anymore. 96.68s - 98.72s | What I did was super straightforward. 98.72s - 100.56s | I would bring people around the building 100.56s - 103.00s | that they worked in, and I would teach them 103.00s - 105.40s | how to break into their own facility. 105.40s - 108.36s | Bringing the client with me gave them the option 108.36s - 112.20s | to try it themselves, and often the mitigation rate 112.20s - 113.12s | was much higher. 115.96s - 119.68s | Show and tell is basically what it came down to. 119.68s - 123.12s | I would show people what their vulnerabilities were, 124.04s - 125.52s | explain to them how to run the exploit 125.52s - 127.28s | so they could try it themselves, 127.28s - 130.28s | and then I would tell the people that had hired me 130.28s - 133.20s | what the problems were, what I showed


chunk_text:
83.32s | and the mitigation rate was much higher 83.32s - 88.24s | because then they understood how to do the physical exploit. 90.12s - 93.20s | Physical security still is a huge hobby for me, 94.04s - 96.68s | even though I'm not doing it professionally anymore. 96.68s - 98.72s | What I did was super straightforward. 98.72s - 100.56s | I would bring people around the building 100.56s - 103.00s | that they worked in, and I would teach them 103.00s - 105.40s | how to break into their own facility. 105.40s - 108.36s | Bringing the client with me gave them the option 108.36s - 112.20s | to try it themselves, and often the mitigation rate 112.20s - 113.12s | was much higher. 115.96s - 119.68s | Show and tell is basically what it came down to. 119.68s - 123.12s | I would show people what their vulnerabilities were, 124.04s - 125.52s | explain to them how to run the exploit 125.52s - 127.28s | so they could try it themselves, 127.28s - 130.28s | and then I would tell the people that had hired me 130.28s - 133.20s | what the problems were, what I showed their team, 133.20s - 137.73s | and how to get those things fixed. 137.73s - 141.53s | What this talk will cover is physical security controls, 141.53s - 144.49s | key questions that I use to ask clients, 144.49s - 146.65s | how to educate your clients without fear, 146.65s - 148.53s | uncertainty, and doubt, 148.53s - 151.09s | and how you can learn physical security 151.09s - 162.10s | if you want to get into it as a career field. 162.10s - 164.86s | Physical security controls are the first topic 164.86s - 167.78s | of conversation, and I'd like to start with doors. 167.78s - 169.54s | More often than not, that's the first thing 169.54s - 170.70s | you're going to test. 174.42s - 177.62s | There are a lot of mechanical components to doors, 177.62s - 179.54s | but here's the short list. 179.54s - 181.62s | Do perimeter doors have hinges 181.62s - 183.66s | that are exposed to the outside? 183.66s - 185.90s | Those hinges can be exploited. 185.90s - 187.78s | Can I slide something between the latch 187.78s - 191.10s | and the strike plate to pull the door open


chunk_text:
their team, 133.20s - 137.73s | and how to get those things fixed. 137.73s - 141.53s | What this talk will cover is physical security controls, 141.53s - 144.49s | key questions that I use to ask clients, 144.49s - 146.65s | how to educate your clients without fear, 146.65s - 148.53s | uncertainty, and doubt, 148.53s - 151.09s | and how you can learn physical security 151.09s - 162.10s | if you want to get into it as a career field. 162.10s - 164.86s | Physical security controls are the first topic 164.86s - 167.78s | of conversation, and I'd like to start with doors. 167.78s - 169.54s | More often than not, that's the first thing 169.54s - 170.70s | you're going to test. 174.42s - 177.62s | There are a lot of mechanical components to doors, 177.62s - 179.54s | but here's the short list. 179.54s - 181.62s | Do perimeter doors have hinges 181.62s - 183.66s | that are exposed to the outside? 183.66s - 185.90s | Those hinges can be exploited. 185.90s - 187.78s | Can I slide something between the latch 187.78s - 191.10s | and the strike plate to pull the door open 191.10s - 193.18s | without a key or combination? 194.06s - 196.18s | Can I get tools over or under the door 196.18s - 199.02s | to manipulate the door handles from the outside? 199.02s - 201.66s | If I can run across double doors, 201.66s - 203.26s | can I manipulate crash bars, 203.26s - 206.78s | which are the bars that you shove open in server rooms? 206.78s - 214.75s | These are all resolvable exploits. 214.75s - 217.11s | Windows are the next physical security control 217.11s - 219.51s | I used to look at, and they're often overlooked. 220.51s - 225.23s | Insecure windows can be opened or manipulated 225.23s - 227.23s | in similar ways to doors. 227.23s - 229.35s | They offer different challenges. 229.35s - 230.95s | In a lot of office spaces, 230.95s - 235.27s | some clients don't have policies about shoulder surfing 235.27s - 237.75s | or looking over the shoulder of a user 237.75s - 239.43s | to obtain information. 240.47s - 245.47s | This is a low-complexity physical security risk, 245.75s - 248.55s | and if someone is trying to establish 248.55s - 250.71s | operating hours of


chunk_text:
191.10s - 193.18s | without a key or combination? 194.06s - 196.18s | Can I get tools over or under the door 196.18s - 199.02s | to manipulate the door handles from the outside? 199.02s - 201.66s | If I can run across double doors, 201.66s - 203.26s | can I manipulate crash bars, 203.26s - 206.78s | which are the bars that you shove open in server rooms? 206.78s - 214.75s | These are all resolvable exploits. 214.75s - 217.11s | Windows are the next physical security control 217.11s - 219.51s | I used to look at, and they're often overlooked. 220.51s - 225.23s | Insecure windows can be opened or manipulated 225.23s - 227.23s | in similar ways to doors. 227.23s - 229.35s | They offer different challenges. 229.35s - 230.95s | In a lot of office spaces, 230.95s - 235.27s | some clients don't have policies about shoulder surfing 235.27s - 237.75s | or looking over the shoulder of a user 237.75s - 239.43s | to obtain information. 240.47s - 245.47s | This is a low-complexity physical security risk, 245.75s - 248.55s | and if someone is trying to establish 248.55s - 250.71s | operating hours of a business, 250.71s - 252.95s | PC operating systems used, 252.95s - 254.95s | or even information like browser type, 255.63s - 256.47s | looking through a window 256.47s - 261.38s | is extremely low effort and high yield. 261.38s - 264.46s | Fencing seems obvious at first. 264.46s - 267.82s | Maybe folks have them in their homes or at office sites. 267.82s - 270.82s | Fencing establishes a clear perimeter 270.82s - 273.98s | and clearly sets an expectation of limited access. 274.82s - 276.62s | It would take a heck of an improviser 276.62s - 278.30s | to explain to a guard 278.30s - 281.34s | why you were walking around a parking lot or building 281.34s - 283.66s | at a locked and closed site. 283.66s - 286.18s | It's also near impossible to scale a fence 286.18s - 288.22s | in most environments during the day 288.22s - 289.86s | without attracting attention. 290.78s - 293.66s | Fencing is a passive security means, 293.66s - 303.74s | meaning it doesn't require any labor. 303.74s - 306.30s | Bollards are a great security control. 307.54s - 309.54s | You've all seen bollards before. 309.54s - 311.06s


chunk_text:
a business, 250.71s - 252.95s | PC operating systems used, 252.95s - 254.95s | or even information like browser type, 255.63s - 256.47s | looking through a window 256.47s - 261.38s | is extremely low effort and high yield. 261.38s - 264.46s | Fencing seems obvious at first. 264.46s - 267.82s | Maybe folks have them in their homes or at office sites. 267.82s - 270.82s | Fencing establishes a clear perimeter 270.82s - 273.98s | and clearly sets an expectation of limited access. 274.82s - 276.62s | It would take a heck of an improviser 276.62s - 278.30s | to explain to a guard 278.30s - 281.34s | why you were walking around a parking lot or building 281.34s - 283.66s | at a locked and closed site. 283.66s - 286.18s | It's also near impossible to scale a fence 286.18s - 288.22s | in most environments during the day 288.22s - 289.86s | without attracting attention. 290.78s - 293.66s | Fencing is a passive security means, 293.66s - 303.74s | meaning it doesn't require any labor. 303.74s - 306.30s | Bollards are a great security control. 307.54s - 309.54s | You've all seen bollards before. 309.54s - 311.06s | They're reinforced obstacles 311.06s - 314.02s | that prevent the use of a vehicle as a battering ram 314.02s - 315.42s | to create a point of entry 315.42s - 318.14s | in an otherwise defended structure. 319.02s - 325.08s | It's another passive security risk mitigation. 325.12s - 328.76s | Mantraps, I think, are completely underutilized. 328.76s - 332.16s | You likely have seen these secure facilities 332.16s - 335.12s | where a room has two separate doors 335.12s - 338.36s | and typically two separate security access controls. 339.24s - 342.12s | For instance, one door has an RFID badge 342.12s - 343.48s | and a separate security door 343.48s - 345.56s | on the opposite side of the room 345.56s - 347.96s | has a biometric security control, 347.96s - 349.24s | like a fingerprint reader. 350.08s - 351.48s | These require some setup 351.48s - 354.36s | and require adherence to procedure. 354.36s - 355.80s | Additionally, it can be a challenge 355.80s - 358.80s | to get a flow of people through mantraps, 358.80s - 361.00s | but they are an awesome control 361.00s - 365.39s | and typically you'll see them at banks.


chunk_text:
| They're reinforced obstacles 311.06s - 314.02s | that prevent the use of a vehicle as a battering ram 314.02s - 315.42s | to create a point of entry 315.42s - 318.14s | in an otherwise defended structure. 319.02s - 325.08s | It's another passive security risk mitigation. 325.12s - 328.76s | Mantraps, I think, are completely underutilized. 328.76s - 332.16s | You likely have seen these secure facilities 332.16s - 335.12s | where a room has two separate doors 335.12s - 338.36s | and typically two separate security access controls. 339.24s - 342.12s | For instance, one door has an RFID badge 342.12s - 343.48s | and a separate security door 343.48s - 345.56s | on the opposite side of the room 345.56s - 347.96s | has a biometric security control, 347.96s - 349.24s | like a fingerprint reader. 350.08s - 351.48s | These require some setup 351.48s - 354.36s | and require adherence to procedure. 354.36s - 355.80s | Additionally, it can be a challenge 355.80s - 358.80s | to get a flow of people through mantraps, 358.80s - 361.00s | but they are an awesome control 361.00s - 365.39s | and typically you'll see them at banks. 365.39s - 370.39s | Cameras are in most businesses and some homes now. 372.35s - 374.83s | If you have the funding at a job site, 374.83s - 377.35s | you can even have your camera actively monitored 377.35s - 379.03s | in a security operating center. 380.31s - 384.79s | Lots of small to midsize businesses just record video 384.79s - 386.99s | and reference it in incident response 386.99s - 391.03s | if something goes wrong or for forensic purposes. 391.03s - 393.83s | There are many technologies in the world of cameras, 393.83s - 396.31s | but I firmly believe that Wi-Fi cameras 396.31s - 399.83s | are a poor choice in many environments. 399.83s - 401.59s | Please reach out to me 401.59s - 403.43s | if you wanna hear that soapbox rant. 405.11s - 407.19s | Electronic access is a really cool area 407.19s - 408.91s | of security controls, 408.91s - 412.03s | especially in the world where now everyone has a Flipper Zero. 413.03s - 416.11s | Most of you have some form of token 416.11s - 418.79s | that your office has given you to get into your building, 418.79s - 422.31s


chunk_text:
365.39s - 370.39s | Cameras are in most businesses and some homes now. 372.35s - 374.83s | If you have the funding at a job site, 374.83s - 377.35s | you can even have your camera actively monitored 377.35s - 379.03s | in a security operating center. 380.31s - 384.79s | Lots of small to midsize businesses just record video 384.79s - 386.99s | and reference it in incident response 386.99s - 391.03s | if something goes wrong or for forensic purposes. 391.03s - 393.83s | There are many technologies in the world of cameras, 393.83s - 396.31s | but I firmly believe that Wi-Fi cameras 396.31s - 399.83s | are a poor choice in many environments. 399.83s - 401.59s | Please reach out to me 401.59s - 403.43s | if you wanna hear that soapbox rant. 405.11s - 407.19s | Electronic access is a really cool area 407.19s - 408.91s | of security controls, 408.91s - 412.03s | especially in the world where now everyone has a Flipper Zero. 413.03s - 416.11s | Most of you have some form of token 416.11s - 418.79s | that your office has given you to get into your building, 418.79s - 422.31s | an RFID badge you wave in front of a reader 422.31s - 424.19s | that opens the door maybe. 424.19s - 429.19s | RFID and NFC are great and they're getting better, 431.59s - 433.63s | but the availability of the Flipper Zero 433.63s - 435.83s | makes these not necessarily the best way 435.83s - 439.39s | to get into a building as an only means of access. 439.39s - 441.47s | A pin code might be functional, 441.91s - 443.39s | but if somebody can obtain that 443.39s - 445.91s | by observing you entering the pin code, 445.91s - 449.51s | that isn't necessarily a great means of access either. 449.51s - 451.99s | I'm one of the many cyborgs in the hacker community 451.99s - 454.67s | and I got an implant from Dangerous Things, 454.67s - 458.23s | so my left hand is RFID and NFC compatible, 458.23s - 460.11s | so I don't need a right to a badge, 460.11s - 465.10s | I can write to my hand. 465.10s - 466.22s | What matters though? 467.74s - 470.50s | Knowing what matters to a particular entity 470.50s - 472.46s | is of


chunk_text:
| an RFID badge you wave in front of a reader 422.31s - 424.19s | that opens the door maybe. 424.19s - 429.19s | RFID and NFC are great and they're getting better, 431.59s - 433.63s | but the availability of the Flipper Zero 433.63s - 435.83s | makes these not necessarily the best way 435.83s - 439.39s | to get into a building as an only means of access. 439.39s - 441.47s | A pin code might be functional, 441.91s - 443.39s | but if somebody can obtain that 443.39s - 445.91s | by observing you entering the pin code, 445.91s - 449.51s | that isn't necessarily a great means of access either. 449.51s - 451.99s | I'm one of the many cyborgs in the hacker community 451.99s - 454.67s | and I got an implant from Dangerous Things, 454.67s - 458.23s | so my left hand is RFID and NFC compatible, 458.23s - 460.11s | so I don't need a right to a badge, 460.11s - 465.10s | I can write to my hand. 465.10s - 466.22s | What matters though? 467.74s - 470.50s | Knowing what matters to a particular entity 470.50s - 472.46s | is of extreme importance. 472.46s - 475.30s | I've done four minute break-ins 475.30s - 477.58s | from parking lot to server room 477.58s - 479.46s | and had clients tell me that 479.46s - 482.06s | actually all of their information is in the cloud, 482.06s - 483.98s | those servers are just dev environments 483.98s - 487.30s | and the hard drives are encrypted, so they don't care. 487.30s - 489.58s | So knowing what is important to your clients 489.58s - 494.12s | is of critical importance. 494.12s - 495.76s | Access from the perimeter is something 495.76s - 498.04s | you actually want to talk to your client about, 498.04s - 500.36s | not just exploring it yourself. 500.36s - 502.36s | You wanna make sure that you're getting access 502.36s - 505.44s | to all the doors that they want you to have access to. 505.44s - 507.32s | There isn't any shame in saying, 507.32s - 510.52s | can you please show me your physical infrastructure 510.52s - 514.36s | and where all the doors are that are of a concern to you? 514.36s - 516.40s | Then you can be sure that you're tackling 516.40s


chunk_text:
extreme importance. 472.46s - 475.30s | I've done four minute break-ins 475.30s - 477.58s | from parking lot to server room 477.58s - 479.46s | and had clients tell me that 479.46s - 482.06s | actually all of their information is in the cloud, 482.06s - 483.98s | those servers are just dev environments 483.98s - 487.30s | and the hard drives are encrypted, so they don't care. 487.30s - 489.58s | So knowing what is important to your clients 489.58s - 494.12s | is of critical importance. 494.12s - 495.76s | Access from the perimeter is something 495.76s - 498.04s | you actually want to talk to your client about, 498.04s - 500.36s | not just exploring it yourself. 500.36s - 502.36s | You wanna make sure that you're getting access 502.36s - 505.44s | to all the doors that they want you to have access to. 505.44s - 507.32s | There isn't any shame in saying, 507.32s - 510.52s | can you please show me your physical infrastructure 510.52s - 514.36s | and where all the doors are that are of a concern to you? 514.36s - 516.40s | Then you can be sure that you're tackling 516.40s - 518.00s | all that client's concerns. 518.92s - 520.92s | Conversely, there might be doors 520.92s - 522.64s | that they don't think are a concern 522.64s - 527.35s | that you probably should bring to their attention. 527.35s - 529.59s | Because you are truly treated as a guest 529.59s - 532.67s | in the scenario of a security risk assessor, 532.67s - 536.11s | you can test guest badge policies firsthand. 536.11s - 539.15s | In some cases, if it's in scope, 539.15s - 543.63s | you can try enticing the client to give you a guest badge 543.63s - 548.19s | and asking them if it's okay for you to go to the restroom. 548.19s - 551.47s | Many times you can find yourself in the office of a CEO 551.47s - 554.71s | or a CFO without any kind of supervision, 554.71s - 557.11s | sometimes hours after you were let in, 557.11s - 561.13s | without anyone hassling you. 561.13s - 563.17s | As a social engineering enthusiast, 563.17s - 564.93s | this is a huge topic. 566.25s - 568.45s | Entire companies are dedicated 568.45s - 571.33s | to just educating and empowering


chunk_text:
- 518.00s | all that client's concerns. 518.92s - 520.92s | Conversely, there might be doors 520.92s - 522.64s | that they don't think are a concern 522.64s - 527.35s | that you probably should bring to their attention. 527.35s - 529.59s | Because you are truly treated as a guest 529.59s - 532.67s | in the scenario of a security risk assessor, 532.67s - 536.11s | you can test guest badge policies firsthand. 536.11s - 539.15s | In some cases, if it's in scope, 539.15s - 543.63s | you can try enticing the client to give you a guest badge 543.63s - 548.19s | and asking them if it's okay for you to go to the restroom. 548.19s - 551.47s | Many times you can find yourself in the office of a CEO 551.47s - 554.71s | or a CFO without any kind of supervision, 554.71s - 557.11s | sometimes hours after you were let in, 557.11s - 561.13s | without anyone hassling you. 561.13s - 563.17s | As a social engineering enthusiast, 563.17s - 564.93s | this is a huge topic. 566.25s - 568.45s | Entire companies are dedicated 568.45s - 571.33s | to just educating and empowering employees 571.33s - 575.17s | to ask as part of the security team for a company. 575.17s - 576.73s | There are quick points, 576.73s - 578.97s | here are some quick points to the matter. 578.97s - 581.41s | Gamify your security training. 581.41s - 584.69s | A traveling trophy can go to the desk of a person 584.69s - 587.85s | with the least clicks in an email phish, 587.85s - 590.41s | or maybe to someone who always locks their computer 590.41s - 592.77s | when they get up to go to the break room. 593.37s - 595.01s | Be creative and let employees know 595.01s - 597.33s | that they are an integral part to your security 597.33s - 598.65s | at the company, 598.65s - 601.05s | and that they can be a huge line of defense. 601.05s - 605.44s | Every employee is part of the security team. 605.44s - 608.04s | Constructive criticism is always better 608.04s - 609.60s | than belittling somebody 609.60s - 611.92s | for their lack of security knowledge. 611.92s - 613.84s | How can you talk to a client? 613.84s - 615.64s | How you talk to a


chunk_text:
employees 571.33s - 575.17s | to ask as part of the security team for a company. 575.17s - 576.73s | There are quick points, 576.73s - 578.97s | here are some quick points to the matter. 578.97s - 581.41s | Gamify your security training. 581.41s - 584.69s | A traveling trophy can go to the desk of a person 584.69s - 587.85s | with the least clicks in an email phish, 587.85s - 590.41s | or maybe to someone who always locks their computer 590.41s - 592.77s | when they get up to go to the break room. 593.37s - 595.01s | Be creative and let employees know 595.01s - 597.33s | that they are an integral part to your security 597.33s - 598.65s | at the company, 598.65s - 601.05s | and that they can be a huge line of defense. 601.05s - 605.44s | Every employee is part of the security team. 605.44s - 608.04s | Constructive criticism is always better 608.04s - 609.60s | than belittling somebody 609.60s - 611.92s | for their lack of security knowledge. 611.92s - 613.84s | How can you talk to a client? 613.84s - 615.64s | How you talk to a client will determine 615.64s - 617.92s | how they mitigate your findings. 617.92s - 620.28s | While there have been tons of technical talks 620.28s - 623.60s | about how to exploit mechanical components 623.60s - 625.16s | of physical security, 625.16s - 627.80s | there have been just a few that cover the specifics 627.80s - 629.20s | of educating clients 629.20s - 631.44s | on how to go about resolving their exploits. 633.24s - 635.04s | Saying things like this is really bad, 635.04s - 636.68s | need to be replaced with, 636.68s - 638.68s | we have some really good opportunities here 638.68s - 640.24s | for positive change. 640.24s - 642.80s | Simple phrasing can mean a world of difference 642.80s - 647.80s | and can lead to a very different side of client morale, 648.12s - 650.56s | and also can determine whether or not 650.56s - 655.72s | they're going to hire you next year. 656.72s - 658.72s | The show and tell was always my favorite part, 658.72s - 661.48s | the demonstrations and solutions. 661.48s - 664.28s | Showing the defenders vulnerabilities on site 664.28s - 665.76s | is immensely fun 665.76s


chunk_text:
client will determine 615.64s - 617.92s | how they mitigate your findings. 617.92s - 620.28s | While there have been tons of technical talks 620.28s - 623.60s | about how to exploit mechanical components 623.60s - 625.16s | of physical security, 625.16s - 627.80s | there have been just a few that cover the specifics 627.80s - 629.20s | of educating clients 629.20s - 631.44s | on how to go about resolving their exploits. 633.24s - 635.04s | Saying things like this is really bad, 635.04s - 636.68s | need to be replaced with, 636.68s - 638.68s | we have some really good opportunities here 638.68s - 640.24s | for positive change. 640.24s - 642.80s | Simple phrasing can mean a world of difference 642.80s - 647.80s | and can lead to a very different side of client morale, 648.12s - 650.56s | and also can determine whether or not 650.56s - 655.72s | they're going to hire you next year. 656.72s - 658.72s | The show and tell was always my favorite part, 658.72s - 661.48s | the demonstrations and solutions. 661.48s - 664.28s | Showing the defenders vulnerabilities on site 664.28s - 665.76s | is immensely fun 665.76s - 668.00s | and can have an extremely positive impact. 668.96s - 673.96s | Talking somebody through how you can bypass a door 675.44s - 677.88s | versus showing them how to do it 677.88s - 680.32s | have huge differences in the likelihood 680.32s - 684.72s | that an issue will be mitigated or a solution implemented. 684.76s - 688.84s | These steps in the process 688.84s - 691.48s | also get the most heads popping into the room. 692.44s - 693.68s | People get really excited 693.68s - 696.48s | when you show them how to do an under door slip 696.48s - 701.48s | or use an under door tool or a latch slit. 704.96s - 707.04s | Avoid fear, uncertainty and doubt. 707.04s - 711.20s | This one's probably the most critical in my opinion. 711.20s - 714.64s | You wanna avoid letting people know that things are bad. 714.64s - 715.96s | You wanna make sure that 716.60s - 718.08s | even if something is really bad, 718.08s - 721.88s | good news, I'm here, I found this thing, 721.88s - 723.60s | now we can tackle it together 723.60s - 725.28s | and it


chunk_text:
- 668.00s | and can have an extremely positive impact. 668.96s - 673.96s | Talking somebody through how you can bypass a door 675.44s - 677.88s | versus showing them how to do it 677.88s - 680.32s | have huge differences in the likelihood 680.32s - 684.72s | that an issue will be mitigated or a solution implemented. 684.76s - 688.84s | These steps in the process 688.84s - 691.48s | also get the most heads popping into the room. 692.44s - 693.68s | People get really excited 693.68s - 696.48s | when you show them how to do an under door slip 696.48s - 701.48s | or use an under door tool or a latch slit. 704.96s - 707.04s | Avoid fear, uncertainty and doubt. 707.04s - 711.20s | This one's probably the most critical in my opinion. 711.20s - 714.64s | You wanna avoid letting people know that things are bad. 714.64s - 715.96s | You wanna make sure that 716.60s - 718.08s | even if something is really bad, 718.08s - 721.88s | good news, I'm here, I found this thing, 721.88s - 723.60s | now we can tackle it together 723.60s - 725.28s | and it won't be a problem anymore. 728.38s - 729.62s | How to educate clients 729.62s - 732.54s | and provide a means for clients to contact you. 732.54s - 735.14s | You wanna make sure that after you've done your test 735.14s - 737.18s | and you've written your report, 737.18s - 738.82s | you wanna provide contacts 739.66s - 743.38s | that are officially your work contacts 743.38s - 745.14s | for people to reach out to you 745.14s - 746.86s | and ask you follow up questions. 746.90s - 749.70s | They're going to happen, nobody knows everything 749.70s - 751.54s | and even professionals might forget 751.54s - 753.50s | to provide some key information. 753.50s - 757.42s | Giving them a company email or a company phone number 757.42s - 758.90s | and requesting that they reach out to you 758.90s - 761.78s | during company time is really important 761.78s - 763.10s | because then they can reach out 763.10s - 766.30s | if they have some sort of immediate concern 766.30s - 770.22s | or just if they want you to return later. 770.22s - 772.34s | That point of contact is pretty critical. 773.98s


chunk_text:
won't be a problem anymore. 728.38s - 729.62s | How to educate clients 729.62s - 732.54s | and provide a means for clients to contact you. 732.54s - 735.14s | You wanna make sure that after you've done your test 735.14s - 737.18s | and you've written your report, 737.18s - 738.82s | you wanna provide contacts 739.66s - 743.38s | that are officially your work contacts 743.38s - 745.14s | for people to reach out to you 745.14s - 746.86s | and ask you follow up questions. 746.90s - 749.70s | They're going to happen, nobody knows everything 749.70s - 751.54s | and even professionals might forget 751.54s - 753.50s | to provide some key information. 753.50s - 757.42s | Giving them a company email or a company phone number 757.42s - 758.90s | and requesting that they reach out to you 758.90s - 761.78s | during company time is really important 761.78s - 763.10s | because then they can reach out 763.10s - 766.30s | if they have some sort of immediate concern 766.30s - 770.22s | or just if they want you to return later. 770.22s - 772.34s | That point of contact is pretty critical. 773.98s - 776.66s | Now, this is something that might be important 777.46s - 780.22s | to all of you, how can you get into physical security? 780.22s - 782.90s | I'm gonna talk about some podcasts, YouTube channels 782.90s - 785.38s | and Udemy access options 785.38s - 787.26s | for you to get into physical security. 788.30s - 791.26s | And I'm old, so I'm gonna hold this very close to my face. 792.90s - 795.42s | I feel education is the most important aspect 795.42s - 796.90s | in hacking and security. 796.90s - 798.54s | That's not to say that a four-year degree 798.54s - 801.06s | or anything like that is necessary. 801.06s - 803.58s | The different approaches to learning are varied 803.58s - 806.54s | and there are a few podcasts, YouTube and Udemy 807.42s - 809.38s | that were big wins for me personally. 809.38s - 811.26s | If you want to get into lockpicking 811.26s - 814.74s | or just see some jaw-dropping feats of lock exploits, 814.74s - 817.22s | then look no further than Lockpicking Lawyer. 817.22s - 820.58s | The content of his channel is consistently enjoyable 820.58s -


chunk_text:
- 776.66s | Now, this is something that might be important 777.46s - 780.22s | to all of you, how can you get into physical security? 780.22s - 782.90s | I'm gonna talk about some podcasts, YouTube channels 782.90s - 785.38s | and Udemy access options 785.38s - 787.26s | for you to get into physical security. 788.30s - 791.26s | And I'm old, so I'm gonna hold this very close to my face. 792.90s - 795.42s | I feel education is the most important aspect 795.42s - 796.90s | in hacking and security. 796.90s - 798.54s | That's not to say that a four-year degree 798.54s - 801.06s | or anything like that is necessary. 801.06s - 803.58s | The different approaches to learning are varied 803.58s - 806.54s | and there are a few podcasts, YouTube and Udemy 807.42s - 809.38s | that were big wins for me personally. 809.38s - 811.26s | If you want to get into lockpicking 811.26s - 814.74s | or just see some jaw-dropping feats of lock exploits, 814.74s - 817.22s | then look no further than Lockpicking Lawyer. 817.22s - 820.58s | The content of his channel is consistently enjoyable 820.58s - 822.54s | and never stale or boring. 822.54s - 826.18s | If you are an auditory learner, then podcasts are fantastic. 826.18s - 829.34s | Darknet Diaries is amazing with great storytelling 829.34s - 832.42s | and incredible guests and lessons learned are valuable 832.42s - 835.18s | and always come in an entertaining package. 835.18s - 838.22s | If you want direct attention towards certification, 838.22s - 840.74s | I think Mike Myers does a great job on Udemy 840.74s - 844.18s | and anything and everything by the Exam Cram Book Company 844.18s - 848.18s | I think is fantastic. 848.18s - 851.50s | Simply learning how to do physical security from books 851.50s - 854.30s | isn't necessarily for everybody, but it worked for me 854.30s - 857.98s | because I could revisit individual concepts very quickly. 857.98s - 859.66s | Dale Carnegie has a book called 859.66s - 862.18s | How to Win Friends and Influence People 862.18s - 864.98s | if you wanna do physical on-site pen testing 865.02s - 867.86s | where you're not going to be announcing your presence. 867.86s - 870.42s | Practical Lockpicking by Deviant Olaf 870.42s - 872.50s | is


chunk_text:
822.54s | and never stale or boring. 822.54s - 826.18s | If you are an auditory learner, then podcasts are fantastic. 826.18s - 829.34s | Darknet Diaries is amazing with great storytelling 829.34s - 832.42s | and incredible guests and lessons learned are valuable 832.42s - 835.18s | and always come in an entertaining package. 835.18s - 838.22s | If you want direct attention towards certification, 838.22s - 840.74s | I think Mike Myers does a great job on Udemy 840.74s - 844.18s | and anything and everything by the Exam Cram Book Company 844.18s - 848.18s | I think is fantastic. 848.18s - 851.50s | Simply learning how to do physical security from books 851.50s - 854.30s | isn't necessarily for everybody, but it worked for me 854.30s - 857.98s | because I could revisit individual concepts very quickly. 857.98s - 859.66s | Dale Carnegie has a book called 859.66s - 862.18s | How to Win Friends and Influence People 862.18s - 864.98s | if you wanna do physical on-site pen testing 865.02s - 867.86s | where you're not going to be announcing your presence. 867.86s - 870.42s | Practical Lockpicking by Deviant Olaf 870.42s - 872.50s | is a fantastic technical read 872.50s - 874.90s | on physical security and lockpicking. 874.90s - 877.42s | The Art of Deception by Kevin Mitnick. 877.42s - 881.18s | It's a little flourishy, but the content is really good. 882.42s - 884.78s | What Everybody is Saying by Joe Navarro 884.78s - 886.82s | will help you with body language. 886.82s - 889.26s | And again, I just wanna call out Exam Cram. 889.26s - 892.86s | They're really good and they give you extra tests 892.86s - 900.32s | and they give you flashcards. 900.32s - 901.72s | You got the slides? 901.72s - 903.00s | Just in time, Ian. 904.36s - 907.04s | So these are three people who helped me a lot 907.04s - 908.80s | as I was getting started. 908.80s - 911.52s | If you find somebody on YouTube or at a con 911.52s - 913.72s | that speaks to you personally, 913.72s - 915.76s | the language they're using sounds good, 915.76s - 918.40s | the ethos sound good, you just vibe with it, 918.40s - 920.52s | reach out to them, send them an email, 920.52s - 922.72s | throw them some information on


chunk_text:
a fantastic technical read 872.50s - 874.90s | on physical security and lockpicking. 874.90s - 877.42s | The Art of Deception by Kevin Mitnick. 877.42s - 881.18s | It's a little flourishy, but the content is really good. 882.42s - 884.78s | What Everybody is Saying by Joe Navarro 884.78s - 886.82s | will help you with body language. 886.82s - 889.26s | And again, I just wanna call out Exam Cram. 889.26s - 892.86s | They're really good and they give you extra tests 892.86s - 900.32s | and they give you flashcards. 900.32s - 901.72s | You got the slides? 901.72s - 903.00s | Just in time, Ian. 904.36s - 907.04s | So these are three people who helped me a lot 907.04s - 908.80s | as I was getting started. 908.80s - 911.52s | If you find somebody on YouTube or at a con 911.52s - 913.72s | that speaks to you personally, 913.72s - 915.76s | the language they're using sounds good, 915.76s - 918.40s | the ethos sound good, you just vibe with it, 918.40s - 920.52s | reach out to them, send them an email, 920.52s - 922.72s | throw them some information on Twitter. 922.72s - 923.56s | I brought cards. 923.56s - 925.20s | If what I'm saying sounds interesting, 925.24s - 927.52s | please walk up to me and I will give you some. 928.68s - 931.76s | Deviant, Ian, and Jason helped me a ton. 931.76s - 932.64s | He's right here. 932.64s - 933.96s | Wave at him, embarrass him. 935.96s - 938.28s | Definitely reach out to the people 938.28s - 939.76s | that you find interesting. 939.76s - 942.96s | We as hackers enjoy telling stories. 942.96s - 946.40s | So we're not going to be annoyed by you, I promise. 949.82s - 951.78s | Take Guided Courses. 951.78s - 954.78s | Taking guided courses are expensive, 954.78s - 956.38s | but being able to raise your hand 956.78s - 958.82s | and say, I don't understand the thing 958.82s - 961.42s | is a really, really, really big deal. 961.42s - 964.22s | And being right in front of the person 964.22s - 966.30s | or on the other end of a video call 966.30s - 971.38s | makes that exchange very quick and very efficient. 971.38s - 973.18s | Attend local meetings. 973.18s - 975.90s


chunk_text:
Twitter. 922.72s - 923.56s | I brought cards. 923.56s - 925.20s | If what I'm saying sounds interesting, 925.24s - 927.52s | please walk up to me and I will give you some. 928.68s - 931.76s | Deviant, Ian, and Jason helped me a ton. 931.76s - 932.64s | He's right here. 932.64s - 933.96s | Wave at him, embarrass him. 935.96s - 938.28s | Definitely reach out to the people 938.28s - 939.76s | that you find interesting. 939.76s - 942.96s | We as hackers enjoy telling stories. 942.96s - 946.40s | So we're not going to be annoyed by you, I promise. 949.82s - 951.78s | Take Guided Courses. 951.78s - 954.78s | Taking guided courses are expensive, 954.78s - 956.38s | but being able to raise your hand 956.78s - 958.82s | and say, I don't understand the thing 958.82s - 961.42s | is a really, really, really big deal. 961.42s - 964.22s | And being right in front of the person 964.22s - 966.30s | or on the other end of a video call 966.30s - 971.38s | makes that exchange very quick and very efficient. 971.38s - 973.18s | Attend local meetings. 973.18s - 975.90s | If you've got a DEF CON group meet up near you, 975.90s - 977.98s | please go, please meet people. 977.98s - 979.46s | It might be the opportunity 979.46s - 981.58s | that you need to get the job that you want 981.58s - 983.90s | or just give you the person that you need to talk to 983.90s - 986.46s | to learn how to do the thing that you're trying to do. 986.54s - 991.53s | Um, oh no, laptop. 992.45s - 995.85s | Okay, how to learn physical security. 995.85s - 998.81s | Other than just taking courses, reading books, 998.81s - 1000.41s | go to a local tool meetup 1000.41s - 1004.17s | or go to LPV right here at DEF CON. 1004.17s - 1006.25s | Try to pick locks, have fun. 1006.25s - 1008.69s | No one's going to judge you if you don't know how to. 1008.69s - 1010.57s | Those are the best people. 1010.57s - 1012.57s | And we'll be able to give you 1012.57s - 1014.77s | the proper techniques off the bat. 1014.77s - 1017.41s | So you don't have to worry about spending hours 1017.41s - 1019.13s


chunk_text:
| If you've got a DEF CON group meet up near you, 975.90s - 977.98s | please go, please meet people. 977.98s - 979.46s | It might be the opportunity 979.46s - 981.58s | that you need to get the job that you want 981.58s - 983.90s | or just give you the person that you need to talk to 983.90s - 986.46s | to learn how to do the thing that you're trying to do. 986.54s - 991.53s | Um, oh no, laptop. 992.45s - 995.85s | Okay, how to learn physical security. 995.85s - 998.81s | Other than just taking courses, reading books, 998.81s - 1000.41s | go to a local tool meetup 1000.41s - 1004.17s | or go to LPV right here at DEF CON. 1004.17s - 1006.25s | Try to pick locks, have fun. 1006.25s - 1008.69s | No one's going to judge you if you don't know how to. 1008.69s - 1010.57s | Those are the best people. 1010.57s - 1012.57s | And we'll be able to give you 1012.57s - 1014.77s | the proper techniques off the bat. 1014.77s - 1017.41s | So you don't have to worry about spending hours 1017.41s - 1019.13s | or days doing it the wrong way. 1020.57s - 1022.21s | I just want to say a special thanks 1022.21s - 1023.97s | to my friends and family, 1023.97s - 1026.33s | all the Orlando hackers that have helped me out. 1026.33s - 1027.17s | Hi. 1028.57s - 1029.57s | Thank you all. 1029.57s - 1030.65s | Hack all the things. 1030.65s - 1033.57s | If you have any questions, please talk to me. 1033.57s - 1035.05s | Here's me. 1035.05s - 1036.93s | There's my email address, 1036.93s - 1039.53s | my Twitter and my LinkedIn. 1039.53s - 1040.61s | Take a picture. 1040.61s - 1041.77s | I don't mind pictures. 1041.77s - 1043.73s | I can't see all of you because of the lights, 1043.73s - 1045.85s | but hi everybody, hi. 1047.41s - 1049.05s | Please reach out to me if you have questions 1049.05s - 1051.21s | about physical security or breaking into buildings 1051.21s - 1053.09s | or you just want some stories. 1053.09s - 1054.13s | I'm the magician. 1054.13s - 1057.62s | I hope you have a fun time at DEF CON.


chunk_text:
| or days doing it the wrong way. 1020.57s - 1022.21s | I just want to say a special thanks 1022.21s - 1023.97s | to my friends and family, 1023.97s - 1026.33s | all the Orlando hackers that have helped me out. 1026.33s - 1027.17s | Hi. 1028.57s - 1029.57s | Thank you all. 1029.57s - 1030.65s | Hack all the things. 1030.65s - 1033.57s | If you have any questions, please talk to me. 1033.57s - 1035.05s | Here's me. 1035.05s - 1036.93s | There's my email address, 1036.93s - 1039.53s | my Twitter and my LinkedIn. 1039.53s - 1040.61s | Take a picture. 1040.61s - 1041.77s | I don't mind pictures. 1041.77s - 1043.73s | I can't see all of you because of the lights, 1043.73s - 1045.85s | but hi everybody, hi. 1047.41s - 1049.05s | Please reach out to me if you have questions 1049.05s - 1051.21s | about physical security or breaking into buildings 1051.21s - 1053.09s | or you just want some stories. 1053.09s - 1054.13s | I'm the magician. 1054.13s - 1057.62s | I hope you have a fun time at DEF CON.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=MS582wba46E", "title": "DEF CON 32 - Exploiting Bluetooth from your car to the bank account$$ - Yso & Martin Strohmeier", "description": "Over the past decade, infotainment systems experienced a growth in functionality, broader adoption and central incorporation into the vehicle architecture. Due to the ever-growing role of wireless protocols such as Bluetooth and a known lack of patches alongside the difficulty of patch installation, this poses a new attack surface and a genuine threat to the users. At the same time, the tools and methodologies required for testing are scattered across the Internet, absent and need a rigorous setup.\n\nIn this talk, we share a comprehensive framework BlueToolkit to test and replay Bluetooth Classic vulnerabilities. We provide practical information and tips. Additionally, we release new exploits and a privilege escalation attack vector.\n\nWe show how we used the toolkit to find 64 new vulnerabilities in 22 modern cars and the Garmin Flight Stream flight management system used in several aircraft types.\n\nOur work equips Bluetooth hackers with necessary information on novel implementation-specific vulnerabilities that could be used to steal information from target cars, establish MitM position or escalate privileges to hijack victims\u2019 accounts stealthily.\n\nWe believe our research will be beneficial in finding new vulnerabilities and making Bluetooth research more accessible and reproducible.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1226, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.05s - 1.51s | This text was transcribed using whisper model: large-v2 All right 1.51s - 3.83s | We'll start sorry for the delay 4.31s - 9.75s | the main reason being that this work was mostly done by my students and 10.15s - 12.95s | He couldn't get a visa for the u.s.. So he's not here 13.71s - 15.71s | We did record a video 16.03s - 19.63s | We also had a longer version of this whole thing yesterday on main stage 20.67s - 26.07s | So you can still find this at some point online if you're interested in all of the details 26.51s - 28.51s | However, since the audio is not working 28.99s - 31.23s | For the video you will have to do with me 31.23s - 37.71s | So I'm I can't provide you with all the technical details, but I should be able to to get you through it 37.71s - 39.71s | And if you have any specific 40.31s - 42.19s | questions on 42.19s - 49.83s |


chunk_text:
finding new vulnerabilities and making Bluetooth research more accessible and reproducible.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1226, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.05s - 1.51s | This text was transcribed using whisper model: large-v2 All right 1.51s - 3.83s | We'll start sorry for the delay 4.31s - 9.75s | the main reason being that this work was mostly done by my students and 10.15s - 12.95s | He couldn't get a visa for the u.s.. So he's not here 13.71s - 15.71s | We did record a video 16.03s - 19.63s | We also had a longer version of this whole thing yesterday on main stage 20.67s - 26.07s | So you can still find this at some point online if you're interested in all of the details 26.51s - 28.51s | However, since the audio is not working 28.99s - 31.23s | For the video you will have to do with me 31.23s - 37.71s | So I'm I can't provide you with all the technical details, but I should be able to to get you through it 37.71s - 39.71s | And if you have any specific 40.31s - 42.19s | questions on 42.19s - 49.83s | Yeah attacks and the toolkit we built and everything I can direct you to my students. So yeah, let's start 51.11s - 53.11s | It's fine 54.87s - 58.07s | Who are we so first is that's my students 58.63s - 62.87s | Vladislav also known as ESO. He's a bug bounty hunter 63.03s - 68.87s | he did his master in cyber security at ETH Zurich where he came to us and 69.43s - 77.03s | Asked hey, what could we what cool systems? Could we hack? What do you have for us and ideas for a master thesis? 78.07s - 83.23s | I said, okay here. My background is all sorts of bug bounty stuff. I 84.23s - 90.75s | Has super cool skills really the wizard behind all this stuff and he's looking for new opportunities 90.75s - 94.11s | So if you're convinced by the stuff he built contact him 95.63s - 97.47s | Who are we who am I 97.47s - 102.11s | My name is Martin. I'm a security research and a scientist at a Swiss cyber defense campus 102.59s - 105.07s | the cyber defense campus is the 105.59s - 108.39s | Procurement


chunk_text:
Yeah attacks and the toolkit we built and everything I can direct you to my students. So yeah, let's start 51.11s - 53.11s | It's fine 54.87s - 58.07s | Who are we so first is that's my students 58.63s - 62.87s | Vladislav also known as ESO. He's a bug bounty hunter 63.03s - 68.87s | he did his master in cyber security at ETH Zurich where he came to us and 69.43s - 77.03s | Asked hey, what could we what cool systems? Could we hack? What do you have for us and ideas for a master thesis? 78.07s - 83.23s | I said, okay here. My background is all sorts of bug bounty stuff. I 84.23s - 90.75s | Has super cool skills really the wizard behind all this stuff and he's looking for new opportunities 90.75s - 94.11s | So if you're convinced by the stuff he built contact him 95.63s - 97.47s | Who are we who am I 97.47s - 102.11s | My name is Martin. I'm a security research and a scientist at a Swiss cyber defense campus 102.59s - 105.07s | the cyber defense campus is the 105.59s - 108.39s | Procurement arm or part of the procurement arm of the Swiss 109.07s - 112.39s | Department of Defense I've done a lot of systems work 112.99s - 114.99s | hacking mostly 115.43s - 117.03s | transportation systems 117.03s - 120.75s | Aviation you find a lot of stuff from us in the aerospace village here 121.51s - 124.71s | We've done space cars trains everything. Basically 125.31s - 132.31s | I've never looked at Bluetooth before neither had blood but I've done some stuff in cars. For example hacking 132.87s - 136.91s | Electric charging systems so you can find that under broken wire that fail 139.48s - 142.60s | So, what's the motivation for this research, why are we doing this? 143.36s - 146.52s | well, if you're in the procurement arm of 147.20s - 149.80s | Federal government you buy a lot of stuff 151.04s - 157.36s | broadly, you can break this up and the pretender stage and in the actual tender where you buy stuff and a post tender stage and 160.12s - 164.92s | Basically when you do security testing pen testing only after you buy stuff 165.20s - 169.16s | It's generally too late like


chunk_text:
arm or part of the procurement arm of the Swiss 109.07s - 112.39s | Department of Defense I've done a lot of systems work 112.99s - 114.99s | hacking mostly 115.43s - 117.03s | transportation systems 117.03s - 120.75s | Aviation you find a lot of stuff from us in the aerospace village here 121.51s - 124.71s | We've done space cars trains everything. Basically 125.31s - 132.31s | I've never looked at Bluetooth before neither had blood but I've done some stuff in cars. For example hacking 132.87s - 136.91s | Electric charging systems so you can find that under broken wire that fail 139.48s - 142.60s | So, what's the motivation for this research, why are we doing this? 143.36s - 146.52s | well, if you're in the procurement arm of 147.20s - 149.80s | Federal government you buy a lot of stuff 151.04s - 157.36s | broadly, you can break this up and the pretender stage and in the actual tender where you buy stuff and a post tender stage and 160.12s - 164.92s | Basically when you do security testing pen testing only after you buy stuff 165.20s - 169.16s | It's generally too late like there you have these systems you have deployed them 169.76s - 177.48s | They're insecure that that's very late. So we might still do this and we have a lot of systems where we don't have 177.88s - 179.56s | these 179.56s - 183.80s | Processes in place all the systems, but in general we try to be as early as possible 186.08s - 188.80s | The idea obviously buys a lot of IT systems 188.80s - 192.08s | but also other systems such as cars which we will get into and 192.60s - 198.40s | Because we buy a lot of things we have a decent negotiation leverage with the manufacturers 198.40s - 204.60s | I mean they want to sell us stuff. So they should follow some requirements that we put in tenders 207.28s - 213.52s | One of the thing we also do is do vulnerability research on standards on systems we've done this a lot on 214.28s - 220.24s | Aviation and in space, but the problem is if your systems have very long life cycles, even if you can demonstrate 221.08s - 223.64s | flaws and protocols and standards and 224.44s - 227.52s | Show


chunk_text:
there you have these systems you have deployed them 169.76s - 177.48s | They're insecure that that's very late. So we might still do this and we have a lot of systems where we don't have 177.88s - 179.56s | these 179.56s - 183.80s | Processes in place all the systems, but in general we try to be as early as possible 186.08s - 188.80s | The idea obviously buys a lot of IT systems 188.80s - 192.08s | but also other systems such as cars which we will get into and 192.60s - 198.40s | Because we buy a lot of things we have a decent negotiation leverage with the manufacturers 198.40s - 204.60s | I mean they want to sell us stuff. So they should follow some requirements that we put in tenders 207.28s - 213.52s | One of the thing we also do is do vulnerability research on standards on systems we've done this a lot on 214.28s - 220.24s | Aviation and in space, but the problem is if your systems have very long life cycles, even if you can demonstrate 221.08s - 223.64s | flaws and protocols and standards and 224.44s - 227.52s | Show that it's unsafe unsecure 228.20s - 233.70s | Until something is changed and deployed in the long run. It will take up to decades 233.70s - 238.40s | So that doesn't help us even in our procurement system because there are 238.92s - 242.16s | Everyone is using the same standards and we don't have any alternatives 243.40s - 245.96s | This brings me to today's concrete case study 246.96s - 253.76s | Vehicles and the army and Bluetooth. So we apparently all already heard some Bluetooth insecurities in the previous talk, which is nice 255.92s - 261.64s | But we are not talking about Bluetooth low-energy we're only talking about standard classic Bluetooth as 262.56s - 264.56s | alluded DoD buys a lot of stuff 265.12s - 268.84s | That's probably the first thing you think of when you think of Department of Defense 270.36s - 275.72s | Luckily these don't have Bluetooth as far as I know most at least the ones I've looked at 276.00s - 278.98s | But probably that that comes very soon 280.48s - 285.52s | Boringly, however, we buy mostly box standard run-of-the-mill cars a lot of them and 286.28s - 290.56s |


chunk_text:
that it's unsafe unsecure 228.20s - 233.70s | Until something is changed and deployed in the long run. It will take up to decades 233.70s - 238.40s | So that doesn't help us even in our procurement system because there are 238.92s - 242.16s | Everyone is using the same standards and we don't have any alternatives 243.40s - 245.96s | This brings me to today's concrete case study 246.96s - 253.76s | Vehicles and the army and Bluetooth. So we apparently all already heard some Bluetooth insecurities in the previous talk, which is nice 255.92s - 261.64s | But we are not talking about Bluetooth low-energy we're only talking about standard classic Bluetooth as 262.56s - 264.56s | alluded DoD buys a lot of stuff 265.12s - 268.84s | That's probably the first thing you think of when you think of Department of Defense 270.36s - 275.72s | Luckily these don't have Bluetooth as far as I know most at least the ones I've looked at 276.00s - 278.98s | But probably that that comes very soon 280.48s - 285.52s | Boringly, however, we buy mostly box standard run-of-the-mill cars a lot of them and 286.28s - 290.56s | These all have Bluetooth. You can't really buy a modern car without it 290.56s - 293.88s | Even if you want it, even if you put that in a tender 294.56s - 300.84s | You basically nobody would sell you a car or offer you to sell the car without Bluetooth 301.84s - 308.40s | That brings me to the scope of the present research cars are fairly complex systems so Bluetooth not the only interface 309.16s - 315.40s | We counted at least 19 interfaces and in those cars from wired or ODB ports 315.72s - 321.92s | to the key fob if there's an issue with any of them traditionally the only way for the manufacturer to do anything is 322.88s - 326.08s | to do a recall that's very expensive and 326.92s - 330.20s | Pretty much only done for really a safety 330.84s - 332.84s | big safety problems 333.64s - 340.36s | For security that rarely happens and that leaves us with a very complex attack surface 340.72s - 346.32s | That is rarely patched when a car has been shipped and is out there 350.06s - 354.78s | However, despite this and despite Bluetooth


chunk_text:
These all have Bluetooth. You can't really buy a modern car without it 290.56s - 293.88s | Even if you want it, even if you put that in a tender 294.56s - 300.84s | You basically nobody would sell you a car or offer you to sell the car without Bluetooth 301.84s - 308.40s | That brings me to the scope of the present research cars are fairly complex systems so Bluetooth not the only interface 309.16s - 315.40s | We counted at least 19 interfaces and in those cars from wired or ODB ports 315.72s - 321.92s | to the key fob if there's an issue with any of them traditionally the only way for the manufacturer to do anything is 322.88s - 326.08s | to do a recall that's very expensive and 326.92s - 330.20s | Pretty much only done for really a safety 330.84s - 332.84s | big safety problems 333.64s - 340.36s | For security that rarely happens and that leaves us with a very complex attack surface 340.72s - 346.32s | That is rarely patched when a car has been shipped and is out there 350.06s - 354.78s | However, despite this and despite Bluetooth being known insecure 355.30s - 358.38s | This hasn't been really addressed in any larger scale 358.86s - 364.18s | There have been a couple of papers looking at maybe one single exploit and one single car 364.58s - 370.14s | but nobody has looked at the whole breadth of Bluetooth exploits that exist out there in 371.54s - 377.18s | different cars and from different manufacturers and that was the gap that we saw here because there's 377.58s - 380.58s | An estimated more than 1 billion cars with Bluetooth 381.38s - 383.26s | Bluetooth classic 383.26s - 386.22s | pretty much all of new cars have Bluetooth and 387.22s - 389.06s | It's 389.06s - 393.54s | Certainly an insecurity that we wanted to examine because no one has done it at scale 394.02s - 399.36s | So that brings me to the standard Bluetooth 400.04s - 404.96s | Technology stack Bluetooth as you will be aware as a wireless communication standard 405.28s - 411.20s | it has a very complex tech stack because you have a lot of shared responsibility and 412.04s - 414.04s | of course it has 414.64s - 417.00s | to fulfill a lot


chunk_text:
being known insecure 355.30s - 358.38s | This hasn't been really addressed in any larger scale 358.86s - 364.18s | There have been a couple of papers looking at maybe one single exploit and one single car 364.58s - 370.14s | but nobody has looked at the whole breadth of Bluetooth exploits that exist out there in 371.54s - 377.18s | different cars and from different manufacturers and that was the gap that we saw here because there's 377.58s - 380.58s | An estimated more than 1 billion cars with Bluetooth 381.38s - 383.26s | Bluetooth classic 383.26s - 386.22s | pretty much all of new cars have Bluetooth and 387.22s - 389.06s | It's 389.06s - 393.54s | Certainly an insecurity that we wanted to examine because no one has done it at scale 394.02s - 399.36s | So that brings me to the standard Bluetooth 400.04s - 404.96s | Technology stack Bluetooth as you will be aware as a wireless communication standard 405.28s - 411.20s | it has a very complex tech stack because you have a lot of shared responsibility and 412.04s - 414.04s | of course it has 414.64s - 417.00s | to fulfill a lot of different 418.36s - 421.84s | Use cases and that makes it very very complex 422.44s - 427.44s | To fulfill these different use cases Bluetooth has a lot of different profiles 427.44s - 434.40s | I'm not going through all of them in the interest of time here, but you can choose different profiles for them to make calls 435.24s - 442.00s | of course to listen to music, but also some profiles can have full access to your SIM card in the car or 442.72s - 444.72s | extract messages 444.80s - 448.04s | That's how you can in your car and your car system 448.52s - 451.00s | Communicate hands-free using your phone 452.92s - 455.56s | The security models you basically have these four options 456.40s - 462.24s | To pair to a Bluetooth system with another one our case a car 464.32s - 467.36s | Depends on the capabilities of the thing you want to pair 468.00s - 473.72s | You have display. Yes. No, you have something that only has a display but no input you have 474.24s - 481.48s | Something that has a keyboard but no display and you have even something


chunk_text:
of different 418.36s - 421.84s | Use cases and that makes it very very complex 422.44s - 427.44s | To fulfill these different use cases Bluetooth has a lot of different profiles 427.44s - 434.40s | I'm not going through all of them in the interest of time here, but you can choose different profiles for them to make calls 435.24s - 442.00s | of course to listen to music, but also some profiles can have full access to your SIM card in the car or 442.72s - 444.72s | extract messages 444.80s - 448.04s | That's how you can in your car and your car system 448.52s - 451.00s | Communicate hands-free using your phone 452.92s - 455.56s | The security models you basically have these four options 456.40s - 462.24s | To pair to a Bluetooth system with another one our case a car 464.32s - 467.36s | Depends on the capabilities of the thing you want to pair 468.00s - 473.72s | You have display. Yes. No, you have something that only has a display but no input you have 474.24s - 481.48s | Something that has a keyboard but no display and you have even something like headphones that has no input or no output whatsoever 481.48s - 484.24s | And these all need to be somehow connected 484.76s - 486.76s | with different means 487.84s - 490.76s | So that's the Bluetooth security model 492.36s - 498.48s | It's very binary either you're connected or you're not and if you're connected then we have 499.04s - 500.64s | access basically 500.64s - 502.64s | We have classic legacy pairing 503.76s - 506.48s | There's basically no security in this 507.36s - 510.52s | We have just works with yeah enables 511.16s - 513.60s | quite easy man-in-the-middle attacks 515.68s - 517.68s | We have passkey entry 518.20s - 521.72s | Which is a bit more secure, but there have been method confusion attacks 522.32s - 524.20s | shown against this 524.20s - 526.20s | recently and the only 526.28s - 534.01s | Known secure option at the moment is numeric comparison. There's prior art, of course 534.41s - 537.93s | So we went through at the beginning so to check how many 538.65s - 545.45s | Bluetooth vulnerabilities exploits and attacks are around. So this is we found more than 108 545.97s - 547.97s |


chunk_text:
like headphones that has no input or no output whatsoever 481.48s - 484.24s | And these all need to be somehow connected 484.76s - 486.76s | with different means 487.84s - 490.76s | So that's the Bluetooth security model 492.36s - 498.48s | It's very binary either you're connected or you're not and if you're connected then we have 499.04s - 500.64s | access basically 500.64s - 502.64s | We have classic legacy pairing 503.76s - 506.48s | There's basically no security in this 507.36s - 510.52s | We have just works with yeah enables 511.16s - 513.60s | quite easy man-in-the-middle attacks 515.68s - 517.68s | We have passkey entry 518.20s - 521.72s | Which is a bit more secure, but there have been method confusion attacks 522.32s - 524.20s | shown against this 524.20s - 526.20s | recently and the only 526.28s - 534.01s | Known secure option at the moment is numeric comparison. There's prior art, of course 534.41s - 537.93s | So we went through at the beginning so to check how many 538.65s - 545.45s | Bluetooth vulnerabilities exploits and attacks are around. So this is we found more than 108 545.97s - 547.97s | in March and 548.13s - 549.77s | as of 549.77s - 550.97s | 2022 550.97s - 556.25s | We found almost 650 CVEs just related to Bluetooth devices 556.77s - 560.77s | The categories we've been looking at are critical exploits. So 561.33s - 563.33s | Remote code execution and memory leakage 564.21s - 570.29s | Man-in-the-middle denial-of-service or chaining attacks, which are not vulnerabilities in and by itself 571.09s - 573.09s | but they can lead to 573.65s - 575.65s | further exploitation 575.73s - 577.89s | If the environment is right 578.45s - 586.30s | So the goal for our procurement was to build a blue to Bluetooth 586.74s - 590.02s | test kit for basically all the security and 590.82s - 592.82s | Vulnerabilities on the market 593.66s - 600.82s | Because that didn't exist at the moment and it was very difficult to build because there's no database of these 600.82s - 605.18s | You will have academic papers. You have talks at DEF CON elsewhere 605.26s - 612.66s | You will have some code released on github. You will have some people who have no code released. You have code that's 613.62s - 614.90s |


chunk_text:
in March and 548.13s - 549.77s | as of 549.77s - 550.97s | 2022 550.97s - 556.25s | We found almost 650 CVEs just related to Bluetooth devices 556.77s - 560.77s | The categories we've been looking at are critical exploits. So 561.33s - 563.33s | Remote code execution and memory leakage 564.21s - 570.29s | Man-in-the-middle denial-of-service or chaining attacks, which are not vulnerabilities in and by itself 571.09s - 573.09s | but they can lead to 573.65s - 575.65s | further exploitation 575.73s - 577.89s | If the environment is right 578.45s - 586.30s | So the goal for our procurement was to build a blue to Bluetooth 586.74s - 590.02s | test kit for basically all the security and 590.82s - 592.82s | Vulnerabilities on the market 593.66s - 600.82s | Because that didn't exist at the moment and it was very difficult to build because there's no database of these 600.82s - 605.18s | You will have academic papers. You have talks at DEF CON elsewhere 605.26s - 612.66s | You will have some code released on github. You will have some people who have no code released. You have code that's 613.62s - 614.90s | Developed on 614.90s - 619.82s | Obsolete platforms where you can't get the hardware anymore or have to update software 619.82s - 625.22s | All of these things are big problems and a lot of work to put this into one toolkit 628.30s - 635.42s | On the so that's the general problem on the testing well Bluetooth testing has some 636.42s - 638.50s | black box issues, of course 639.58s - 641.90s | Yeah, kind of false positives false negatives 643.26s - 648.78s | Automation at least of the denial-of-service stuff can be quite difficult because if 649.62s - 651.82s | you basically crash the 652.78s - 654.78s | entertainment system of your car 654.82s - 658.58s | Or the Bluetooth system of your car and you want to restart the whole thing 658.58s - 663.70s | we found some cars where you have to get out of the car lock the car and not just and 663.98s - 669.46s | walk away walk away for 20 minutes because only then the car actually shuts off and restarts and 669.98s - 677.66s | At that point, yeah, it's quite extensive the time that you need obviously to test several


chunk_text:
Developed on 614.90s - 619.82s | Obsolete platforms where you can't get the hardware anymore or have to update software 619.82s - 625.22s | All of these things are big problems and a lot of work to put this into one toolkit 628.30s - 635.42s | On the so that's the general problem on the testing well Bluetooth testing has some 636.42s - 638.50s | black box issues, of course 639.58s - 641.90s | Yeah, kind of false positives false negatives 643.26s - 648.78s | Automation at least of the denial-of-service stuff can be quite difficult because if 649.62s - 651.82s | you basically crash the 652.78s - 654.78s | entertainment system of your car 654.82s - 658.58s | Or the Bluetooth system of your car and you want to restart the whole thing 658.58s - 663.70s | we found some cars where you have to get out of the car lock the car and not just and 663.98s - 669.46s | walk away walk away for 20 minutes because only then the car actually shuts off and restarts and 669.98s - 677.66s | At that point, yeah, it's quite extensive the time that you need obviously to test several vulnerabilities 680.38s - 687.66s | No matter we built this toolkit and exists it's has been online on github for a few months now 688.86s - 691.42s | Link is here will also be on the on the last slide 692.14s - 696.58s | Goals were collecting all these exploits that we can find and reproduce 697.58s - 699.58s | 44 and all in all 700.50s - 701.86s | we 701.86s - 703.26s | try to 703.26s - 709.98s | Automate as much as possible. But yeah, we have some completely automated stuff some semi automated and somewhere 709.98s - 711.98s | You have to do something manual 712.42s - 716.72s | That's just the general 717.56s - 719.92s | Architecture, so we have some yaml files 720.68s - 727.48s | If you have new exploits, it's modular. You can add these files to the to the toolkit and 728.88s - 732.84s | from there you need the basic setup that I will show and 734.28s - 739.92s | Can go to the car connect to it and see which other vulnerabilities are present 740.64s - 745.40s | So after building the toolkits 746.04s - 750.36s | The second part


chunk_text:
vulnerabilities 680.38s - 687.66s | No matter we built this toolkit and exists it's has been online on github for a few months now 688.86s - 691.42s | Link is here will also be on the on the last slide 692.14s - 696.58s | Goals were collecting all these exploits that we can find and reproduce 697.58s - 699.58s | 44 and all in all 700.50s - 701.86s | we 701.86s - 703.26s | try to 703.26s - 709.98s | Automate as much as possible. But yeah, we have some completely automated stuff some semi automated and somewhere 709.98s - 711.98s | You have to do something manual 712.42s - 716.72s | That's just the general 717.56s - 719.92s | Architecture, so we have some yaml files 720.68s - 727.48s | If you have new exploits, it's modular. You can add these files to the to the toolkit and 728.88s - 732.84s | from there you need the basic setup that I will show and 734.28s - 739.92s | Can go to the car connect to it and see which other vulnerabilities are present 740.64s - 745.40s | So after building the toolkits 746.04s - 750.36s | The second part was really let's check a lot of cards as many as we can find 752.12s - 759.40s | We set up the toolkit as you see here with just any Ubuntu based box and a laptop or VM 759.92s - 761.92s | Near some cables 762.16s - 765.72s | For the full toolkit to be useful you will need 767.08s - 768.40s | for example 768.40s - 775.16s | Not only but also a Nexus 5 phone fairly old phone is cheap, but maybe not so trivial to get it on the market 775.88s - 776.92s | because 776.92s - 779.08s | There some other researchers have built 780.04s - 784.52s | frameworks where you can really control the the Bluetooth stack in detail and 785.36s - 787.64s | You can also get the ESP rower kit 789.40s - 793.88s | If you don't have one of them, you can't test everything but at least partly you can do it 794.68s - 801.28s | Overall, we found that with all the problems. It takes us one to three hours per car. You need to start the engine 801.80s - 807.12s | to do most of the tests which can also


chunk_text:
was really let's check a lot of cards as many as we can find 752.12s - 759.40s | We set up the toolkit as you see here with just any Ubuntu based box and a laptop or VM 759.92s - 761.92s | Near some cables 762.16s - 765.72s | For the full toolkit to be useful you will need 767.08s - 768.40s | for example 768.40s - 775.16s | Not only but also a Nexus 5 phone fairly old phone is cheap, but maybe not so trivial to get it on the market 775.88s - 776.92s | because 776.92s - 779.08s | There some other researchers have built 780.04s - 784.52s | frameworks where you can really control the the Bluetooth stack in detail and 785.36s - 787.64s | You can also get the ESP rower kit 789.40s - 793.88s | If you don't have one of them, you can't test everything but at least partly you can do it 794.68s - 801.28s | Overall, we found that with all the problems. It takes us one to three hours per car. You need to start the engine 801.80s - 807.12s | to do most of the tests which can also be a problem if you're testing in garage and 807.96s - 811.40s | Somewhere underground right? You don't want to run the engine for three hours 812.16s - 814.16s | That would not be safe 814.80s - 818.48s | Easier to test for electric cars. That's definitely a bonus 820.40s - 824.92s | How did we procure cars you see the different manufacturers here 825.56s - 830.16s | That was our job as I said, we have a lot of different cars manufacturers 830.32s - 836.28s | So we took all our own cars brought us our army logistics 836.28s - 840.44s | I took some of our own cars as researchers as our friends 841.04s - 843.04s | overall 22 different cars 843.96s - 850.92s | Most of them fully tested for only partially because we had them at the beginning of our research and there were more 851.16s - 853.16s | exploits coming on later 853.40s - 857.76s | price range everything from very cheap to fairly up markets and 859.00s - 866.84s | The manufacturers or the Bluetooth systems at least covering our estimate roughly 60% of the global market by sales 868.04s - 872.00s | Roughly


chunk_text:
be a problem if you're testing in garage and 807.96s - 811.40s | Somewhere underground right? You don't want to run the engine for three hours 812.16s - 814.16s | That would not be safe 814.80s - 818.48s | Easier to test for electric cars. That's definitely a bonus 820.40s - 824.92s | How did we procure cars you see the different manufacturers here 825.56s - 830.16s | That was our job as I said, we have a lot of different cars manufacturers 830.32s - 836.28s | So we took all our own cars brought us our army logistics 836.28s - 840.44s | I took some of our own cars as researchers as our friends 841.04s - 843.04s | overall 22 different cars 843.96s - 850.92s | Most of them fully tested for only partially because we had them at the beginning of our research and there were more 851.16s - 853.16s | exploits coming on later 853.40s - 857.76s | price range everything from very cheap to fairly up markets and 859.00s - 866.84s | The manufacturers or the Bluetooth systems at least covering our estimate roughly 60% of the global market by sales 868.04s - 872.00s | Roughly 12 out of 15 of the top manufacturers selling cars last year 873.04s - 876.72s | The tests are non-invasive. It's just connecting Bluetooth, basically 878.04s - 883.96s | So let's get to the results overall took us. Yeah 40 ish hours 885.76s - 887.76s | We found 73 888.36s - 890.36s | vulnerabilities in these cars 890.36s - 895.52s | So remember most of these exploits are known, but they're still all 896.44s - 898.44s | present in these cars 898.96s - 900.96s | Not everything can be solved 901.36s - 907.40s | So we reported everything that was relevant and could be solved to the manufacturers and 909.00s - 911.00s | Reported them responsibly 911.92s - 913.92s | This shows part of the reason right 914.60s - 919.56s | Cars like very much an adoption of standards. There's never the news Bluetooth version 919.56s - 926.04s | We found that it takes roughly or the median age of a Bluetooth version in the car is seven years behind 926.56s - 928.76s | the actual release Bluetooth standard 929.76s - 932.96s | Full results of our car tests. They're also on the github 934.32s - 936.32s | you see


chunk_text:
12 out of 15 of the top manufacturers selling cars last year 873.04s - 876.72s | The tests are non-invasive. It's just connecting Bluetooth, basically 878.04s - 883.96s | So let's get to the results overall took us. Yeah 40 ish hours 885.76s - 887.76s | We found 73 888.36s - 890.36s | vulnerabilities in these cars 890.36s - 895.52s | So remember most of these exploits are known, but they're still all 896.44s - 898.44s | present in these cars 898.96s - 900.96s | Not everything can be solved 901.36s - 907.40s | So we reported everything that was relevant and could be solved to the manufacturers and 909.00s - 911.00s | Reported them responsibly 911.92s - 913.92s | This shows part of the reason right 914.60s - 919.56s | Cars like very much an adoption of standards. There's never the news Bluetooth version 919.56s - 926.04s | We found that it takes roughly or the median age of a Bluetooth version in the car is seven years behind 926.56s - 928.76s | the actual release Bluetooth standard 929.76s - 932.96s | Full results of our car tests. They're also on the github 934.32s - 936.32s | you see 936.48s - 941.32s | Different range like, you know, you'd think very new cars should have no to 942.24s - 944.80s | Fewer vulnerabilities that was true for these two 945.60s - 951.72s | Not true for many others that were also fairly new from 2022 2023. We found a lot of 953.12s - 955.16s | Vulnerabilities even critical ones in those 958.80s - 960.36s | There's 960.36s - 967.40s | Just another look at this right average number of vulnerabilities per car per manufacturer different 968.04s - 971.56s | Ones here can focus on critical vulnerabilities 971.88s - 978.00s | We found them well as you can see here and mostly Renault Opel and and Volkswagen a 978.64s - 980.64s | few ones 980.68s - 982.68s | denial-of-service vulnerabilities 983.52s - 987.08s | prevalent in several manufacturers, but 987.92s - 993.84s | So we don't have a lot of time you can look up the details for that on on the github we did found 994.24s - 998.08s | two novel exploits and novel attacks doing our research 999.64s - 1006.12s | The details on that are really extensively covered in the main stage talk yesterday still 1007.64s -


chunk_text:
936.48s - 941.32s | Different range like, you know, you'd think very new cars should have no to 942.24s - 944.80s | Fewer vulnerabilities that was true for these two 945.60s - 951.72s | Not true for many others that were also fairly new from 2022 2023. We found a lot of 953.12s - 955.16s | Vulnerabilities even critical ones in those 958.80s - 960.36s | There's 960.36s - 967.40s | Just another look at this right average number of vulnerabilities per car per manufacturer different 968.04s - 971.56s | Ones here can focus on critical vulnerabilities 971.88s - 978.00s | We found them well as you can see here and mostly Renault Opel and and Volkswagen a 978.64s - 980.64s | few ones 980.68s - 982.68s | denial-of-service vulnerabilities 983.52s - 987.08s | prevalent in several manufacturers, but 987.92s - 993.84s | So we don't have a lot of time you can look up the details for that on on the github we did found 994.24s - 998.08s | two novel exploits and novel attacks doing our research 999.64s - 1006.12s | The details on that are really extensively covered in the main stage talk yesterday still 1007.64s - 1010.36s | Briefly going over it. There's one way 1011.04s - 1014.68s | You can connect to cars and extract the contacts 1014.68s - 1021.28s | So if you have a shared threat model, right you rent a car or have one of these 1022.84s - 1024.84s | car sharing 1025.64s - 1030.96s | Systems that happen exist in many countries, right? You just rent a car for a couple hours 1031.92s - 1033.96s | Somebody connected their Bluetooth phone to that 1034.88s - 1038.32s | the contacts will be saved later on you can go there and 1039.40s - 1042.02s | Extract the contacts that were on the car 1042.78s - 1044.78s | So we can see it here on the left 1046.66s - 1048.66s | Should say 1048.66s - 1050.98s | No contacts available if you connect with your phone 1051.74s - 1053.74s | But if you run this new 1054.82s - 1062.54s | Vulnerability, there's new exploits then you can as you see on the right actually extract the contacts that we had on our phone before 1065.46s - 1067.46s | The second one is 1068.30s - 1074.66s | Another way to establish a man-in-the-middle position even


chunk_text:
1010.36s | Briefly going over it. There's one way 1011.04s - 1014.68s | You can connect to cars and extract the contacts 1014.68s - 1021.28s | So if you have a shared threat model, right you rent a car or have one of these 1022.84s - 1024.84s | car sharing 1025.64s - 1030.96s | Systems that happen exist in many countries, right? You just rent a car for a couple hours 1031.92s - 1033.96s | Somebody connected their Bluetooth phone to that 1034.88s - 1038.32s | the contacts will be saved later on you can go there and 1039.40s - 1042.02s | Extract the contacts that were on the car 1042.78s - 1044.78s | So we can see it here on the left 1046.66s - 1048.66s | Should say 1048.66s - 1050.98s | No contacts available if you connect with your phone 1051.74s - 1053.74s | But if you run this new 1054.82s - 1062.54s | Vulnerability, there's new exploits then you can as you see on the right actually extract the contacts that we had on our phone before 1065.46s - 1067.46s | The second one is 1068.30s - 1074.66s | Another way to establish a man-in-the-middle position even with a system that have numeric comparison and 1076.50s - 1078.98s | I'll get to what that can do for you 1078.98s - 1085.82s | It's just the proof of concept that it worked with four different cars and Hyundai Renault Audi and BMW 1086.06s - 1088.58s | It's a so relatively widespread issue 1090.06s - 1092.38s | What can we do with these things right if you 1092.98s - 1093.82s | I 1093.82s - 1099.78s | Wonder man-in-the-middle on Bluetooth and denial of service. How is that a problem? Why do we care? 1100.30s - 1102.78s | You said cars are very complex systems 1102.78s - 1109.38s | So one thing is we can obviously do some lateral movement. We can get get in for Bluetooth and get into 1109.90s - 1111.90s | other systems of the car 1112.78s - 1115.98s | we can as I said to establish man-in-the-middle positions and 1116.54s - 1121.80s | Then that's something we discussed extensively yesterday. We can really 1122.38s - 1126.10s | Get your two-factor tokens if they're sent by SMS 1127.02s - 1129.02s | or 1129.38s - 1132.06s | Yeah, get these tokens and then obviously 1132.94s - 1135.18s |


chunk_text:
with a system that have numeric comparison and 1076.50s - 1078.98s | I'll get to what that can do for you 1078.98s - 1085.82s | It's just the proof of concept that it worked with four different cars and Hyundai Renault Audi and BMW 1086.06s - 1088.58s | It's a so relatively widespread issue 1090.06s - 1092.38s | What can we do with these things right if you 1092.98s - 1093.82s | I 1093.82s - 1099.78s | Wonder man-in-the-middle on Bluetooth and denial of service. How is that a problem? Why do we care? 1100.30s - 1102.78s | You said cars are very complex systems 1102.78s - 1109.38s | So one thing is we can obviously do some lateral movement. We can get get in for Bluetooth and get into 1109.90s - 1111.90s | other systems of the car 1112.78s - 1115.98s | we can as I said to establish man-in-the-middle positions and 1116.54s - 1121.80s | Then that's something we discussed extensively yesterday. We can really 1122.38s - 1126.10s | Get your two-factor tokens if they're sent by SMS 1127.02s - 1129.02s | or 1129.38s - 1132.06s | Yeah, get these tokens and then obviously 1132.94s - 1135.18s | Exploit whatever account two-factor 1135.86s - 1141.34s | You have set up. So that's quite workable. We've reported this also to the 1142.38s - 1143.58s | phone manufacturers 1143.58s - 1149.82s | So Apple and Google there were some difference in opinions whether this is a big problem or not 1150.50s - 1153.58s | Google did patch it Apple did not patch it 1155.02s - 1158.54s | You can basically build your own opinion on this 1159.54s - 1166.22s | Brings me takeaways. I hope you realize much of Bluetooth is fundamentally insecure. This has been well known 1166.22s - 1171.86s | There's so many exploits for this. This is both in the standards in the protocol and in the implementations 1172.66s - 1174.50s | even the newest cars 1174.50s - 1176.14s | new 1176.14s - 1180.78s | Systems are shipped with protocol level Bluetooth vulnerabilities. We can't really fix this easily 1181.98s - 1183.98s | You need to securely pair 1184.38s - 1190.54s | But even that doesn't help because the repairing of the system might also be malicious 1191.54s - 1192.90s | and 1192.90s - 1200.14s | We built this toolkit. So if you want to know what


chunk_text:
Exploit whatever account two-factor 1135.86s - 1141.34s | You have set up. So that's quite workable. We've reported this also to the 1142.38s - 1143.58s | phone manufacturers 1143.58s - 1149.82s | So Apple and Google there were some difference in opinions whether this is a big problem or not 1150.50s - 1153.58s | Google did patch it Apple did not patch it 1155.02s - 1158.54s | You can basically build your own opinion on this 1159.54s - 1166.22s | Brings me takeaways. I hope you realize much of Bluetooth is fundamentally insecure. This has been well known 1166.22s - 1171.86s | There's so many exploits for this. This is both in the standards in the protocol and in the implementations 1172.66s - 1174.50s | even the newest cars 1174.50s - 1176.14s | new 1176.14s - 1180.78s | Systems are shipped with protocol level Bluetooth vulnerabilities. We can't really fix this easily 1181.98s - 1183.98s | You need to securely pair 1184.38s - 1190.54s | But even that doesn't help because the repairing of the system might also be malicious 1191.54s - 1192.90s | and 1192.90s - 1200.14s | We built this toolkit. So if you want to know what your own car how vulnerable that is on the Bluetooth level, please use that 1201.06s - 1204.26s | If you are a car manufacturer car part manufacturer 1204.46s - 1210.50s | Please also use it check your security poster with regards to Bluetooth any questions 1211.34s - 1213.34s | look at the at the github and 1214.18s - 1221.02s | Come to me afterwards, but also please contact Vlad who did really most of the technical work here. Thank you


chunk_text:
your own car how vulnerable that is on the Bluetooth level, please use that 1201.06s - 1204.26s | If you are a car manufacturer car part manufacturer 1204.46s - 1210.50s | Please also use it check your security poster with regards to Bluetooth any questions 1211.34s - 1213.34s | look at the at the github and 1214.18s - 1221.02s | Come to me afterwards, but also please contact Vlad who did really most of the technical work here. Thank you


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=KytDyg5s-E8", "title": "DEF CON 32 - How I Developed a Low Cost Raspberry Pi Based Device for ADS B Spoof - Angelina Tsuboi", "description": "As a pilot and cybersecurity researcher, I am very interested of the nexus between aviation and security. To explore this interest, I developed a device called Fly Catcher - a device that detects for aircraft spoofing by monitoring for malicious ADS-B signals in the 1090MHz frequency. The device consists of a 1090 MHz antenna, a Flight Aware RTL SDR, a custom 3D printed case, a portable battery charger, and a MicroUSB cable.\n\nThe device receives ADS-B information from the antenna and the software-defined radio, which is then passed into a Convolutional Neural Network written with Python to detect whether or not the aircraft is spoofed. I trained the neural network on a dataset of valid ADS-B signals as well as a generated spoofed set of aircraft signals, to teach Fly Catcher how to detect and flag any suspicious ADS-B signals. It does this by checking for discrepancies in the signal's characteristics, such as its location, velocity, and identification.\n\nThe result outputted by the neural network is then displayed onto a radar screen allowing users to detect spoofed aircraft near them. To test the device, I brought it with me for an hour-long flight to scan for a wide variety of aircraft enroute. After the flight, the data was fed into the Neural Network to analyze any spoofed aircraft I might have encountered.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1201, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.50s - 1.62s | This text was transcribed using whisper model: large-v2 Hello, everyone. 1.62s - 4.38s | Thank you so much for coming to my talk today. 4.38s - 7.66s | Today, I'll be speaking a little bit about ADS-B security 7.66s - 9.46s | and a personal project I've worked on 9.46s - 11.90s | on the intersection of aid deviation 11.90s - 16.26s | and signals intelligence called Flycatcher. 16.26s - 19.74s | So quick overview of the device I created. 19.74s - 21.06s | It's called a Flycatcher 21.06s - 23.98s | and it's made for effective ADS-B monitoring 23.98s - 27.68s | and detecting foreign instances of aircraft spoofing. 29.30s - 30.98s | It's low cost and reliable. 30.98s - 33.58s | It's created using the Raspberry Pi 33.58s - 34.82s | and it's compatible 34.82s - 39.02s


chunk_text:
spoofed aircraft near them. To test the device, I brought it with me for an hour-long flight to scan for a wide variety of aircraft enroute. After the flight, the data was fed into the Neural Network to analyze any spoofed aircraft I might have encountered.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1201, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.50s - 1.62s | This text was transcribed using whisper model: large-v2 Hello, everyone. 1.62s - 4.38s | Thank you so much for coming to my talk today. 4.38s - 7.66s | Today, I'll be speaking a little bit about ADS-B security 7.66s - 9.46s | and a personal project I've worked on 9.46s - 11.90s | on the intersection of aid deviation 11.90s - 16.26s | and signals intelligence called Flycatcher. 16.26s - 19.74s | So quick overview of the device I created. 19.74s - 21.06s | It's called a Flycatcher 21.06s - 23.98s | and it's made for effective ADS-B monitoring 23.98s - 27.68s | and detecting foreign instances of aircraft spoofing. 29.30s - 30.98s | It's low cost and reliable. 30.98s - 33.58s | It's created using the Raspberry Pi 33.58s - 34.82s | and it's compatible 34.82s - 39.02s | with multiple software-defined radio signal sources. 39.02s - 41.96s | And I created my own convolutional neural network 41.96s - 45.26s | that parses ADS-B inputs in order to detect 45.26s - 48.70s | for reliable and unreliable aircraft signals. 50.22s - 52.10s | A little bit about my background. 52.10s - 54.42s | I'm still upstarting in my cybersecurity field 54.42s - 58.30s | but I've been a software developer for about a decade 58.30s - 61.06s | and I've been focusing on aerospace security 61.06s - 64.06s | for the past few years with an emphasis on aviation 64.06s - 68.02s | due to my piloting experience. 68.02s - 70.90s | And a little bit of recap on what ADS-B is. 70.90s - 73.66s | It stands for Automatic Dependent Surveillance Broadcast 73.66s - 76.90s | and it's a mandated technology for performing surveillance 76.90s - 79.54s | and signals intelligence on airplanes. 79.54s - 82.66s | And if we break the acronym down, it's automatic, 82.66s - 84.98s | meaning it doesn't require any manual input 84.98s - 86.40s | from the pilot itself. 86.40s - 89.46s | It's dependent, meaning that it requires GPS signals


chunk_text:
| with multiple software-defined radio signal sources. 39.02s - 41.96s | And I created my own convolutional neural network 41.96s - 45.26s | that parses ADS-B inputs in order to detect 45.26s - 48.70s | for reliable and unreliable aircraft signals. 50.22s - 52.10s | A little bit about my background. 52.10s - 54.42s | I'm still upstarting in my cybersecurity field 54.42s - 58.30s | but I've been a software developer for about a decade 58.30s - 61.06s | and I've been focusing on aerospace security 61.06s - 64.06s | for the past few years with an emphasis on aviation 64.06s - 68.02s | due to my piloting experience. 68.02s - 70.90s | And a little bit of recap on what ADS-B is. 70.90s - 73.66s | It stands for Automatic Dependent Surveillance Broadcast 73.66s - 76.90s | and it's a mandated technology for performing surveillance 76.90s - 79.54s | and signals intelligence on airplanes. 79.54s - 82.66s | And if we break the acronym down, it's automatic, 82.66s - 84.98s | meaning it doesn't require any manual input 84.98s - 86.40s | from the pilot itself. 86.40s - 89.46s | It's dependent, meaning that it requires GPS signals 90.18s - 91.24s | from satellites in order to transmit 91.24s - 93.82s | the aircraft's information and positioning. 94.90s - 96.22s | It's meant for surveillance, 96.22s - 100.50s | so it contains complete comprehensive information 100.50s - 102.86s | about the data of the aircraft transmitted itself, 102.86s - 106.46s | such as its airspeed, positioning, altitude, and so forth. 106.46s - 110.46s | And lastly, it continuously beacons out and broadcasts data 110.46s - 114.42s | allowing for ground-based ATC or other pilots 114.42s - 118.58s | to receive that information in order to triangulate 118.58s - 124.10s | where the aircraft is positioned in the sky. 124.10s - 128.74s | So here's a imagery conceptual overview of how ADS-B works. 128.74s - 131.74s | All ADS-B signals are derived 131.74s - 134.38s | from the Global Navigational Satellite System, 134.38s - 137.62s | which provides positioning information 137.62s - 140.50s | to the aircraft itself, which is then beaconed out 140.50s - 143.90s | via the mandated ADS-B out hardware components 143.90s - 145.50s | internally on the airplane. 145.50s - 148.24s | And once that information is beaconed out via packets 148.24s - 150.40s |


chunk_text:
90.18s - 91.24s | from satellites in order to transmit 91.24s - 93.82s | the aircraft's information and positioning. 94.90s - 96.22s | It's meant for surveillance, 96.22s - 100.50s | so it contains complete comprehensive information 100.50s - 102.86s | about the data of the aircraft transmitted itself, 102.86s - 106.46s | such as its airspeed, positioning, altitude, and so forth. 106.46s - 110.46s | And lastly, it continuously beacons out and broadcasts data 110.46s - 114.42s | allowing for ground-based ATC or other pilots 114.42s - 118.58s | to receive that information in order to triangulate 118.58s - 124.10s | where the aircraft is positioned in the sky. 124.10s - 128.74s | So here's a imagery conceptual overview of how ADS-B works. 128.74s - 131.74s | All ADS-B signals are derived 131.74s - 134.38s | from the Global Navigational Satellite System, 134.38s - 137.62s | which provides positioning information 137.62s - 140.50s | to the aircraft itself, which is then beaconed out 140.50s - 143.90s | via the mandated ADS-B out hardware components 143.90s - 145.50s | internally on the airplane. 145.50s - 148.24s | And once that information is beaconed out via packets 148.24s - 150.40s | on the 1090 megahertz protocol, 150.40s - 152.56s | it can be received by other airplanes 152.56s - 155.16s | alongside ground-based receivers and antennas 155.16s - 158.36s | alongside air traffic control in order for those receivers 158.36s - 163.46s | to figure out where the airplane is positioned. 163.46s - 166.88s | So this technology works using three core components 166.88s - 170.30s | that allow for ADS-B to be broadcasted on airplanes. 170.30s - 171.56s | There's the GPS receiver 171.56s - 173.60s | that receives the positioning information 173.60s - 175.00s | from the satellites themselves, 175.00s - 178.72s | and then the ADS-B packets are transmitted 178.72s - 180.40s | via the transponder on the plane, 181.12s - 182.28s | which is required on all planes. 182.28s - 185.00s | And it typically uses the mode S protocol 185.00s - 188.74s | in order to send comprehensive data about the plane itself. 188.74s - 191.96s | And internally on the plane, it has an ADS-B in, 191.96s - 194.72s | allowing for continuous monitoring 194.72s - 197.40s | by the pilots themselves of other air traffic 197.40s - 201.72s | in the vicinity. 201.72s -


chunk_text:
on the 1090 megahertz protocol, 150.40s - 152.56s | it can be received by other airplanes 152.56s - 155.16s | alongside ground-based receivers and antennas 155.16s - 158.36s | alongside air traffic control in order for those receivers 158.36s - 163.46s | to figure out where the airplane is positioned. 163.46s - 166.88s | So this technology works using three core components 166.88s - 170.30s | that allow for ADS-B to be broadcasted on airplanes. 170.30s - 171.56s | There's the GPS receiver 171.56s - 173.60s | that receives the positioning information 173.60s - 175.00s | from the satellites themselves, 175.00s - 178.72s | and then the ADS-B packets are transmitted 178.72s - 180.40s | via the transponder on the plane, 181.12s - 182.28s | which is required on all planes. 182.28s - 185.00s | And it typically uses the mode S protocol 185.00s - 188.74s | in order to send comprehensive data about the plane itself. 188.74s - 191.96s | And internally on the plane, it has an ADS-B in, 191.96s - 194.72s | allowing for continuous monitoring 194.72s - 197.40s | by the pilots themselves of other air traffic 197.40s - 201.72s | in the vicinity. 201.72s - 206.00s | Although ADS-B is relied on by a wide range of airplanes 206.00s - 210.00s | and pilots worldwide, it has some core vulnerabilities. 210.00s - 212.56s | It is unauthenticated and unencrypted. 212.56s - 213.72s | Unauthenticated meaning 213.72s - 216.28s | that there is no verification of the transmission. 216.28s - 220.04s | So any ground-based hacker can transmit ADS-B packets 220.04s - 222.96s | and it'll automatically be received as a packet. 222.96s - 224.80s | There's no amount of verification 224.80s - 228.30s | alongside its unencrypted nature, 228.30s - 231.32s | making it transparent to anyone 231.32s - 235.44s | who tunes into that frequency. 235.44s - 238.20s | This reveals a lot of attack vectors, 238.20s - 241.22s | especially on the communications end. 242.18s - 245.42s | The four core ones are jamming, spoofing, 245.42s - 247.78s | replay attacks, and message injection. 247.78s - 249.96s | Jamming is when a ground-based transmitter 249.96s - 252.02s | can flood the ADS-B frequency 252.02s - 255.02s | with a bunch of garbalist data. 255.02s - 256.18s | There's also spoofing, 256.18s - 259.40s | where it's more of a selective-based jamming attack, 259.40s


chunk_text:
206.00s | Although ADS-B is relied on by a wide range of airplanes 206.00s - 210.00s | and pilots worldwide, it has some core vulnerabilities. 210.00s - 212.56s | It is unauthenticated and unencrypted. 212.56s - 213.72s | Unauthenticated meaning 213.72s - 216.28s | that there is no verification of the transmission. 216.28s - 220.04s | So any ground-based hacker can transmit ADS-B packets 220.04s - 222.96s | and it'll automatically be received as a packet. 222.96s - 224.80s | There's no amount of verification 224.80s - 228.30s | alongside its unencrypted nature, 228.30s - 231.32s | making it transparent to anyone 231.32s - 235.44s | who tunes into that frequency. 235.44s - 238.20s | This reveals a lot of attack vectors, 238.20s - 241.22s | especially on the communications end. 242.18s - 245.42s | The four core ones are jamming, spoofing, 245.42s - 247.78s | replay attacks, and message injection. 247.78s - 249.96s | Jamming is when a ground-based transmitter 249.96s - 252.02s | can flood the ADS-B frequency 252.02s - 255.02s | with a bunch of garbalist data. 255.02s - 256.18s | There's also spoofing, 256.18s - 259.40s | where it's more of a selective-based jamming attack, 259.40s - 262.38s | where you can custom fabricate data packets 262.38s - 263.80s | and then transmit it. 263.80s - 266.90s | This can effectively create something called a ghost plane, 266.90s - 269.70s | where a ghost airplane would show up 269.70s - 271.46s | and pop up on the ADS-B feed 271.46s - 273.46s | that isn't really a plane itself. 273.46s - 274.62s | There's replay attacks, 274.62s - 278.14s | where you capture ADS-B packets from an earlier time 278.14s - 279.30s | and then replay it. 279.30s - 282.22s | So you're effectively creating a duplicate airplane 282.22s - 285.84s | that is then transmitted and then received. 285.84s - 287.86s | And then there's also message injection, 287.86s - 290.08s | where you play around with the ADS-B packets 290.08s - 291.42s | individually themselves 291.42s - 293.74s | in order to mess with specific telemetry, 293.74s - 296.58s | like the altitude, airspace, airspeed, 296.58s - 298.10s | positioning, and so forth. 299.02s - 302.70s | The one I chose to focus on for this project is spoofing, 302.70s - 305.82s | because I enjoyed its customized nature. 305.82s - 309.60s | A


chunk_text:
- 262.38s | where you can custom fabricate data packets 262.38s - 263.80s | and then transmit it. 263.80s - 266.90s | This can effectively create something called a ghost plane, 266.90s - 269.70s | where a ghost airplane would show up 269.70s - 271.46s | and pop up on the ADS-B feed 271.46s - 273.46s | that isn't really a plane itself. 273.46s - 274.62s | There's replay attacks, 274.62s - 278.14s | where you capture ADS-B packets from an earlier time 278.14s - 279.30s | and then replay it. 279.30s - 282.22s | So you're effectively creating a duplicate airplane 282.22s - 285.84s | that is then transmitted and then received. 285.84s - 287.86s | And then there's also message injection, 287.86s - 290.08s | where you play around with the ADS-B packets 290.08s - 291.42s | individually themselves 291.42s - 293.74s | in order to mess with specific telemetry, 293.74s - 296.58s | like the altitude, airspace, airspeed, 296.58s - 298.10s | positioning, and so forth. 299.02s - 302.70s | The one I chose to focus on for this project is spoofing, 302.70s - 305.82s | because I enjoyed its customized nature. 305.82s - 309.60s | A lot of spoofing can be detected 309.60s - 311.02s | using artificial intelligence, 311.02s - 313.06s | and I wanted to pursue that kind of modality 313.06s - 318.58s | for detecting spoofed airplanes for this project. 318.58s - 320.82s | So how spoofing on ADS-B works 320.82s - 323.06s | is that a ground-based hacker 323.06s - 326.38s | can transmit ghost aircraft into the sky 326.38s - 328.82s | by creating custom-fabricated packets 328.82s - 331.46s | that mimic the ADS-B protocol. 331.46s - 334.74s | And these spoofed airplanes can be tracked 334.74s - 336.18s | by other airplanes in the sky 336.18s - 340.79s | alongside ground-based receivers. 340.79s - 343.41s | So I went through a four-step build process 343.41s - 345.89s | as I was constructing this device. 345.89s - 349.81s | Firstly, I set up a ADS-B reception ground station 349.81s - 354.25s | using four components that I'll be outlining later. 354.25s - 356.73s | I went about constructing a device so it was portable 356.73s - 359.45s | and I could stow it on the back of an airplane. 359.45s - 362.81s | Then I went about training a deep neural


chunk_text:
lot of spoofing can be detected 309.60s - 311.02s | using artificial intelligence, 311.02s - 313.06s | and I wanted to pursue that kind of modality 313.06s - 318.58s | for detecting spoofed airplanes for this project. 318.58s - 320.82s | So how spoofing on ADS-B works 320.82s - 323.06s | is that a ground-based hacker 323.06s - 326.38s | can transmit ghost aircraft into the sky 326.38s - 328.82s | by creating custom-fabricated packets 328.82s - 331.46s | that mimic the ADS-B protocol. 331.46s - 334.74s | And these spoofed airplanes can be tracked 334.74s - 336.18s | by other airplanes in the sky 336.18s - 340.79s | alongside ground-based receivers. 340.79s - 343.41s | So I went through a four-step build process 343.41s - 345.89s | as I was constructing this device. 345.89s - 349.81s | Firstly, I set up a ADS-B reception ground station 349.81s - 354.25s | using four components that I'll be outlining later. 354.25s - 356.73s | I went about constructing a device so it was portable 356.73s - 359.45s | and I could stow it on the back of an airplane. 359.45s - 362.81s | Then I went about training a deep neural network 363.77s - 368.33s | in order to detect for instances of aircraft spoofing. 368.33s - 371.59s | And then lastly, I stowed the device itself 371.59s - 373.77s | on the back of a sport cruiser 373.77s - 375.65s | and flew it around the South Bay 375.65s - 377.71s | in order to get access to data 377.71s - 380.41s | in order to train the artificial intelligence 380.41s - 384.70s | machine learning model that I created. 384.70s - 386.50s | So one thing I wanted to mention 386.50s - 389.30s | is there's a wide range of credible data sources 389.30s - 391.46s | in order to get access to ADS-B data 391.46s - 393.50s | that you can actually access right now. 393.50s - 396.90s | There's ADS-B Exchange, FlightAware, ADS-B Hub. 396.90s - 399.62s | For this project, I wanted to go about 399.62s - 402.90s | manually getting these transmitted signals. 402.90s - 406.34s | So I set up my own ADS-B reception ground station. 406.34s - 411.16s | This consisted of a FlightAware Pro Stick Plus SDR 411.16s - 412.98s | as my software-defined radio option 412.98s - 415.62s | in order


chunk_text:
network 363.77s - 368.33s | in order to detect for instances of aircraft spoofing. 368.33s - 371.59s | And then lastly, I stowed the device itself 371.59s - 373.77s | on the back of a sport cruiser 373.77s - 375.65s | and flew it around the South Bay 375.65s - 377.71s | in order to get access to data 377.71s - 380.41s | in order to train the artificial intelligence 380.41s - 384.70s | machine learning model that I created. 384.70s - 386.50s | So one thing I wanted to mention 386.50s - 389.30s | is there's a wide range of credible data sources 389.30s - 391.46s | in order to get access to ADS-B data 391.46s - 393.50s | that you can actually access right now. 393.50s - 396.90s | There's ADS-B Exchange, FlightAware, ADS-B Hub. 396.90s - 399.62s | For this project, I wanted to go about 399.62s - 402.90s | manually getting these transmitted signals. 402.90s - 406.34s | So I set up my own ADS-B reception ground station. 406.34s - 411.16s | This consisted of a FlightAware Pro Stick Plus SDR 411.16s - 412.98s | as my software-defined radio option 412.98s - 415.62s | in order to get specialized ADS-B signals, 415.62s - 419.96s | which relies on the RTL2832U chipset, 419.96s - 421.06s | which is really configurable 421.06s - 423.94s | with a lot of dumb 1090 decoders. 423.94s - 426.78s | I used a 1090 megahertz rubber ducky antenna 426.78s - 428.76s | for a cheap and reliable setup, 428.76s - 433.22s | the Raspberry Pi in order to analyze the ADS-B packets 433.22s - 435.78s | alongside the FlightAware GUI display 435.78s - 437.96s | in order to have a visual output 437.96s - 443.14s | of the ADS-B display data I was getting. 443.14s - 446.26s | So once you're able to receive the ADS-B signals 446.26s - 449.34s | that are propagated on the 1090 megahertz frequency, 449.34s - 452.22s | you need to go about decoding these signals. 452.22s - 454.14s | And the signals I chose to decode 454.14s - 456.70s | were the ones transmitted on the mode S. 456.70s - 458.66s | There's different modes of ADS-B. 458.66s - 460.62s | There's A, C, and S. 460.62s - 463.38s | S is the most comprehensive of all the modes 463.38s - 466.14s | and contains advanced


chunk_text:
to get specialized ADS-B signals, 415.62s - 419.96s | which relies on the RTL2832U chipset, 419.96s - 421.06s | which is really configurable 421.06s - 423.94s | with a lot of dumb 1090 decoders. 423.94s - 426.78s | I used a 1090 megahertz rubber ducky antenna 426.78s - 428.76s | for a cheap and reliable setup, 428.76s - 433.22s | the Raspberry Pi in order to analyze the ADS-B packets 433.22s - 435.78s | alongside the FlightAware GUI display 435.78s - 437.96s | in order to have a visual output 437.96s - 443.14s | of the ADS-B display data I was getting. 443.14s - 446.26s | So once you're able to receive the ADS-B signals 446.26s - 449.34s | that are propagated on the 1090 megahertz frequency, 449.34s - 452.22s | you need to go about decoding these signals. 452.22s - 454.14s | And the signals I chose to decode 454.14s - 456.70s | were the ones transmitted on the mode S. 456.70s - 458.66s | There's different modes of ADS-B. 458.66s - 460.62s | There's A, C, and S. 460.62s - 463.38s | S is the most comprehensive of all the modes 463.38s - 466.14s | and contains advanced mode with comprehensive data 466.14s - 467.54s | about the aircraft itself. 468.66s - 471.86s | And on the bottom is a mesh structure breakdown 471.86s - 473.06s | of ADS-B packets. 473.06s - 476.06s | You can see it starts with the first few bits 477.54s - 479.38s | outlining the downlink format. 479.38s - 481.06s | There's the transponder capability, 481.06s - 482.34s | the ICAL designation, 482.34s - 485.34s | which all aircraft has its own ICAL identifier 485.34s - 488.50s | to identify it alongside its message 488.50s - 492.06s | taking up the 33 to 88-bit sequence 492.06s - 498.26s | alongside with a parity ID appended to the end of it. 498.26s - 500.66s | So the way I integrated Tom1090 500.66s - 504.38s | was I embedded it directly on the Raspberry Pi itself. 504.38s - 507.86s | And as soon as the 1090 megahertz ADS-B antenna 507.86s - 510.06s | was able to retrieve the signals, 510.06s - 514.02s | it fed it through the Dump1090 decoder software protocol, 514.02s - 516.86s | which you can download and install directly onto the Pi. 516.86s - 519.22s | And then it creates a


chunk_text:
mode with comprehensive data 466.14s - 467.54s | about the aircraft itself. 468.66s - 471.86s | And on the bottom is a mesh structure breakdown 471.86s - 473.06s | of ADS-B packets. 473.06s - 476.06s | You can see it starts with the first few bits 477.54s - 479.38s | outlining the downlink format. 479.38s - 481.06s | There's the transponder capability, 481.06s - 482.34s | the ICAL designation, 482.34s - 485.34s | which all aircraft has its own ICAL identifier 485.34s - 488.50s | to identify it alongside its message 488.50s - 492.06s | taking up the 33 to 88-bit sequence 492.06s - 498.26s | alongside with a parity ID appended to the end of it. 498.26s - 500.66s | So the way I integrated Tom1090 500.66s - 504.38s | was I embedded it directly on the Raspberry Pi itself. 504.38s - 507.86s | And as soon as the 1090 megahertz ADS-B antenna 507.86s - 510.06s | was able to retrieve the signals, 510.06s - 514.02s | it fed it through the Dump1090 decoder software protocol, 514.02s - 516.86s | which you can download and install directly onto the Pi. 516.86s - 519.22s | And then it creates a JSON output, 519.22s - 521.54s | which you can parse and visualize 521.54s - 526.36s | on a wide range of GUI sources. 526.36s - 529.32s | I also wanted to add some sort of plotting and visualization 529.32s - 532.76s | for both my ground station and the device itself. 532.76s - 535.60s | So once the JSON output was tabulated 535.60s - 537.76s | by the Dump1090 decoder, 537.76s - 541.12s | I fed it into the FlightAware visualization dashboard 541.12s - 547.09s | in order to see the live ADS-B broadcasts. 547.09s - 550.25s | Once I was able to get a sufficient ground station running 551.17s - 554.41s | and it was able to pick up some sort of signals, 554.41s - 557.01s | I wanted to convert it into a device 557.01s - 558.61s | so I could make it portable 558.61s - 561.17s | and have it bestowed on the back of an airplane 561.17s - 563.93s | in order to get access to more comprehensive data 563.93s - 566.13s | in a wide range of locations. 566.13s - 569.73s | Here's a build outline of materials that I used. 569.73s - 574.41s |


chunk_text:
JSON output, 519.22s - 521.54s | which you can parse and visualize 521.54s - 526.36s | on a wide range of GUI sources. 526.36s - 529.32s | I also wanted to add some sort of plotting and visualization 529.32s - 532.76s | for both my ground station and the device itself. 532.76s - 535.60s | So once the JSON output was tabulated 535.60s - 537.76s | by the Dump1090 decoder, 537.76s - 541.12s | I fed it into the FlightAware visualization dashboard 541.12s - 547.09s | in order to see the live ADS-B broadcasts. 547.09s - 550.25s | Once I was able to get a sufficient ground station running 551.17s - 554.41s | and it was able to pick up some sort of signals, 554.41s - 557.01s | I wanted to convert it into a device 557.01s - 558.61s | so I could make it portable 558.61s - 561.17s | and have it bestowed on the back of an airplane 561.17s - 563.93s | in order to get access to more comprehensive data 563.93s - 566.13s | in a wide range of locations. 566.13s - 569.73s | Here's a build outline of materials that I used. 569.73s - 574.41s | I used the Raspberry Pi 3B, a custom case enclosure 574.41s - 578.77s | alongside a TFT display case on top 578.77s - 584.31s | alongside my 1090 megahertz rubber ducky antenna. 584.31s - 586.95s | The final build looks something like that. 586.95s - 590.63s | It was good because it had a battery case 590.63s - 592.63s | attached to the bottom of it, 592.63s - 595.71s | making it so I could use it wherever I wanted to. 595.71s - 597.07s | It was highly portable. 597.07s - 598.71s | It didn't take up that much space 598.71s - 603.05s | and it was a durable design. 603.05s - 605.17s | So once the device was constructed, 605.17s - 608.85s | I went about architecting the algorithm 608.85s - 612.29s | that was supposed to be classifying for spoofed airplanes. 612.29s - 616.97s | And there's a wide range of indicators of spoofed aircraft. 616.97s - 620.17s | And here's a graph of the altitude and speed graph 620.17s - 622.77s | of a typical and genuine aircraft. 622.77s - 627.17s | You can see that it outlines the main phases 627.17s - 628.33s | of flight


chunk_text:
I used the Raspberry Pi 3B, a custom case enclosure 574.41s - 578.77s | alongside a TFT display case on top 578.77s - 584.31s | alongside my 1090 megahertz rubber ducky antenna. 584.31s - 586.95s | The final build looks something like that. 586.95s - 590.63s | It was good because it had a battery case 590.63s - 592.63s | attached to the bottom of it, 592.63s - 595.71s | making it so I could use it wherever I wanted to. 595.71s - 597.07s | It was highly portable. 597.07s - 598.71s | It didn't take up that much space 598.71s - 603.05s | and it was a durable design. 603.05s - 605.17s | So once the device was constructed, 605.17s - 608.85s | I went about architecting the algorithm 608.85s - 612.29s | that was supposed to be classifying for spoofed airplanes. 612.29s - 616.97s | And there's a wide range of indicators of spoofed aircraft. 616.97s - 620.17s | And here's a graph of the altitude and speed graph 620.17s - 622.77s | of a typical and genuine aircraft. 622.77s - 627.17s | You can see that it outlines the main phases 627.17s - 628.33s | of flight itself. 628.33s - 630.01s | So you can see in the beginning, 630.01s - 634.29s | it will have like a ascension as the airspeed goes up 634.29s - 636.89s | and the altitude goes up as the airplane is taking off. 636.89s - 640.77s | You can see the cruising indication 640.77s - 642.61s | near the middle of the flight. 642.61s - 645.73s | And then finally you see a decrease of all the values 645.73s - 647.69s | as the airplane is landing. 649.13s - 652.29s | You can check for spoofed airplanes 652.29s - 656.65s | by checking for inconsistencies of telemetry values, 656.65s - 657.69s | such as positioning. 658.05s - 660.45s | If it has weird GPS coordinates 660.45s - 664.29s | that don't outline its phase of flight or its location, 664.29s - 667.65s | or it just abruptly pops up in different locations, 667.65s - 668.97s | that's an indication. 668.97s - 671.49s | There's also altitude, if there's a lot of variance 671.49s - 673.21s | in the altitude being displayed 673.21s - 675.81s | on some of the ADS-B plotline charts. 676.69s - 679.05s | Also identification, spoofed airplanes 679.05s


chunk_text:
itself. 628.33s - 630.01s | So you can see in the beginning, 630.01s - 634.29s | it will have like a ascension as the airspeed goes up 634.29s - 636.89s | and the altitude goes up as the airplane is taking off. 636.89s - 640.77s | You can see the cruising indication 640.77s - 642.61s | near the middle of the flight. 642.61s - 645.73s | And then finally you see a decrease of all the values 645.73s - 647.69s | as the airplane is landing. 649.13s - 652.29s | You can check for spoofed airplanes 652.29s - 656.65s | by checking for inconsistencies of telemetry values, 656.65s - 657.69s | such as positioning. 658.05s - 660.45s | If it has weird GPS coordinates 660.45s - 664.29s | that don't outline its phase of flight or its location, 664.29s - 667.65s | or it just abruptly pops up in different locations, 667.65s - 668.97s | that's an indication. 668.97s - 671.49s | There's also altitude, if there's a lot of variance 671.49s - 673.21s | in the altitude being displayed 673.21s - 675.81s | on some of the ADS-B plotline charts. 676.69s - 679.05s | Also identification, spoofed airplanes 679.05s - 681.57s | are not really identified. 681.57s - 684.49s | So within the ADS-B message structure itself, 684.49s - 687.65s | you'll see like a null or you won't see a lot of values 688.49s - 696.64s | for any of the identification fields in the data packet. 696.64s - 699.16s | So once I was able to get the feature vectors 699.16s - 701.44s | derived from the ADS-B inputs, 701.44s - 704.16s | I went about creating a dense neural network 704.16s - 707.48s | in order to classify for these spoofed signals. 707.48s - 711.80s | And a dense neural network overlays a neural network itself 711.80s - 714.08s | which is a artificial intelligence model 714.08s - 716.44s | that's derived from the human brain 716.44s - 719.48s | and it consists of multiple interconnected layers. 719.48s - 720.44s | And in a dense one, 720.44s - 723.12s | you'll see all the layers connected together. 723.12s - 724.92s | And as each neuron process 724.92s - 727.24s | there's the input from the feature vectors, 727.24s - 729.72s | it applies some weight and bias to it 729.72s - 732.84s | and then it


chunk_text:
- 681.57s | are not really identified. 681.57s - 684.49s | So within the ADS-B message structure itself, 684.49s - 687.65s | you'll see like a null or you won't see a lot of values 688.49s - 696.64s | for any of the identification fields in the data packet. 696.64s - 699.16s | So once I was able to get the feature vectors 699.16s - 701.44s | derived from the ADS-B inputs, 701.44s - 704.16s | I went about creating a dense neural network 704.16s - 707.48s | in order to classify for these spoofed signals. 707.48s - 711.80s | And a dense neural network overlays a neural network itself 711.80s - 714.08s | which is a artificial intelligence model 714.08s - 716.44s | that's derived from the human brain 716.44s - 719.48s | and it consists of multiple interconnected layers. 719.48s - 720.44s | And in a dense one, 720.44s - 723.12s | you'll see all the layers connected together. 723.12s - 724.92s | And as each neuron process 724.92s - 727.24s | there's the input from the feature vectors, 727.24s - 729.72s | it applies some weight and bias to it 729.72s - 732.84s | and then it passes the result through an activation function 732.84s - 735.12s | in order to make an accurate guess 735.12s - 738.16s | of whether an airplane is spoofed 738.16s - 742.97s | and running it through a binary classifier. 742.97s - 746.25s | So I went about creating the DNN 746.25s - 749.41s | by custom coding a Python script 749.41s - 752.17s | that utilize the TensorFlow library 752.17s - 755.93s | in order to accurately detect for this spoofed airplane. 755.93s - 758.77s | And I used the ReLU activation functions 758.77s - 762.85s | at each of the three layers consisting of the DNN 762.85s - 766.97s | and those were three densely connected interconnected nodes 766.97s - 770.49s | and the final layer contained a sigmoid function 770.49s - 773.05s | in order to make a binary classification. 773.05s - 775.65s | Zero indicating that the airplane was not spoofed 775.65s - 783.14s | and one being that the airplane was spoofed. 783.90s - 785.86s | As for the training data I used for the model, 785.86s - 788.26s | I used historical ADS-B records 788.26s - 791.42s | from a wide range of ADS-B data


chunk_text:
passes the result through an activation function 732.84s - 735.12s | in order to make an accurate guess 735.12s - 738.16s | of whether an airplane is spoofed 738.16s - 742.97s | and running it through a binary classifier. 742.97s - 746.25s | So I went about creating the DNN 746.25s - 749.41s | by custom coding a Python script 749.41s - 752.17s | that utilize the TensorFlow library 752.17s - 755.93s | in order to accurately detect for this spoofed airplane. 755.93s - 758.77s | And I used the ReLU activation functions 758.77s - 762.85s | at each of the three layers consisting of the DNN 762.85s - 766.97s | and those were three densely connected interconnected nodes 766.97s - 770.49s | and the final layer contained a sigmoid function 770.49s - 773.05s | in order to make a binary classification. 773.05s - 775.65s | Zero indicating that the airplane was not spoofed 775.65s - 783.14s | and one being that the airplane was spoofed. 783.90s - 785.86s | As for the training data I used for the model, 785.86s - 788.26s | I used historical ADS-B records 788.26s - 791.42s | from a wide range of ADS-B data sources. 791.42s - 795.34s | ADS-B exchange had ADS-B data sets 795.34s - 799.26s | going back to the 2000s that I was able to leverage, 799.26s - 803.70s | FlightAware being another great source and OpenSky. 803.70s - 806.86s | And I was able to download archives of their ADS-B data 806.86s - 809.98s | from CSB records they had had in the past. 809.98s - 813.86s | And I was able to get data from my own ground station 813.86s - 815.62s | alongside the device itself. 815.62s - 818.34s | What I did was I would take all those signals 818.34s - 821.02s | and once it passed through the dump 1090 decoder, 821.02s - 824.02s | I saved all the data into a CSB record 824.02s - 829.16s | for it to be put into the model. 829.16s - 831.44s | As for testing the device itself, 831.44s - 834.28s | I really wanted to get a wide range of data 834.28s - 835.76s | from a lot of locations. 835.76s - 839.12s | And although it could have traveled to different locations 839.12s - 842.28s | via car or anything in order to get the


chunk_text:
sources. 791.42s - 795.34s | ADS-B exchange had ADS-B data sets 795.34s - 799.26s | going back to the 2000s that I was able to leverage, 799.26s - 803.70s | FlightAware being another great source and OpenSky. 803.70s - 806.86s | And I was able to download archives of their ADS-B data 806.86s - 809.98s | from CSB records they had had in the past. 809.98s - 813.86s | And I was able to get data from my own ground station 813.86s - 815.62s | alongside the device itself. 815.62s - 818.34s | What I did was I would take all those signals 818.34s - 821.02s | and once it passed through the dump 1090 decoder, 821.02s - 824.02s | I saved all the data into a CSB record 824.02s - 829.16s | for it to be put into the model. 829.16s - 831.44s | As for testing the device itself, 831.44s - 834.28s | I really wanted to get a wide range of data 834.28s - 835.76s | from a lot of locations. 835.76s - 839.12s | And although it could have traveled to different locations 839.12s - 842.28s | via car or anything in order to get the data, 842.28s - 846.24s | I wanted to go full on with this project. 846.24s - 849.64s | So I put the device on the back of a sport cruiser, 849.64s - 851.36s | which is a single engine airplane. 851.36s - 854.68s | And I flew it around a lot of different areas 854.68s - 858.16s | within the South Bay area in Los Angeles. 858.16s - 859.52s | And you can see that's a picture of me 859.52s - 861.68s | loading it on the sport cruiser 861.68s - 864.62s | and me flying the plane to all those different locations. 865.62s - 868.62s | And as for the data collection process, 869.58s - 871.74s | the device just sat on the back of the airplane 871.74s - 874.58s | and it was continuously monitoring the ADS-B signals 874.58s - 878.02s | around me using a 1090 megahertz antenna. 878.02s - 882.30s | And it was just keeping a file in the Raspberry Pi itself, 882.30s - 887.30s | which contained ADS-B records of all the airplanes nearby. 890.03s - 892.47s | As for the scan locations in this project, 892.47s - 897.47s | I went pretty much


chunk_text:
data, 842.28s - 846.24s | I wanted to go full on with this project. 846.24s - 849.64s | So I put the device on the back of a sport cruiser, 849.64s - 851.36s | which is a single engine airplane. 851.36s - 854.68s | And I flew it around a lot of different areas 854.68s - 858.16s | within the South Bay area in Los Angeles. 858.16s - 859.52s | And you can see that's a picture of me 859.52s - 861.68s | loading it on the sport cruiser 861.68s - 864.62s | and me flying the plane to all those different locations. 865.62s - 868.62s | And as for the data collection process, 869.58s - 871.74s | the device just sat on the back of the airplane 871.74s - 874.58s | and it was continuously monitoring the ADS-B signals 874.58s - 878.02s | around me using a 1090 megahertz antenna. 878.02s - 882.30s | And it was just keeping a file in the Raspberry Pi itself, 882.30s - 887.30s | which contained ADS-B records of all the airplanes nearby. 890.03s - 892.47s | As for the scan locations in this project, 892.47s - 897.47s | I went pretty much all the South Bay Los Angeles area, 897.51s - 901.11s | Santa Monica, Torrance, Malibu, Palisades, 901.11s - 903.23s | Burbank, and downtown Los Angeles. 903.23s - 906.23s | I made sure to go through pretty popular airspaces. 907.15s - 909.59s | LAX was really popular. 909.59s - 911.55s | Burbank was also popular. 911.55s - 915.11s | And I also went to local airports 915.11s - 919.27s | like Santa Monica airports, Van Nuys, 919.27s - 921.03s | in order to get a wide range of data 921.03s - 923.07s | because especially at commercial airports, 923.07s - 925.19s | you'll get like 747s, 925.19s - 927.75s | but you won't get single engine airplanes. 927.75s - 931.39s | While if I went to a more local airport, 931.39s - 934.63s | I would get a bigger range or a bigger breadth of data 934.63s - 937.39s | because that's where you get like multi-engines, 937.39s - 940.71s | helicopters, single engine airplanes. 940.71s - 942.99s | So I wanted to have data that reflected 942.99s - 949.43s | both general aviation and commercial aviation as well. 949.43s - 953.43s | Once I was able to collect and tabulate


chunk_text:
all the South Bay Los Angeles area, 897.51s - 901.11s | Santa Monica, Torrance, Malibu, Palisades, 901.11s - 903.23s | Burbank, and downtown Los Angeles. 903.23s - 906.23s | I made sure to go through pretty popular airspaces. 907.15s - 909.59s | LAX was really popular. 909.59s - 911.55s | Burbank was also popular. 911.55s - 915.11s | And I also went to local airports 915.11s - 919.27s | like Santa Monica airports, Van Nuys, 919.27s - 921.03s | in order to get a wide range of data 921.03s - 923.07s | because especially at commercial airports, 923.07s - 925.19s | you'll get like 747s, 925.19s - 927.75s | but you won't get single engine airplanes. 927.75s - 931.39s | While if I went to a more local airport, 931.39s - 934.63s | I would get a bigger range or a bigger breadth of data 934.63s - 937.39s | because that's where you get like multi-engines, 937.39s - 940.71s | helicopters, single engine airplanes. 940.71s - 942.99s | So I wanted to have data that reflected 942.99s - 949.43s | both general aviation and commercial aviation as well. 949.43s - 953.43s | Once I was able to collect and tabulate this data, 954.27s - 955.11s | in a CSV format, 955.11s - 957.83s | I fed it into the deep neural network model 957.83s - 960.15s | I created using TensorFlow. 960.15s - 963.83s | And then in order to get a visual plot of the classification 963.83s - 966.51s | once the spoofed aircraft was classified, 966.51s - 968.67s | I used a library called Folium 968.67s - 976.72s | in order to make a visual plot of the spoofed airplanes. 976.72s - 978.80s | Build improvements going forward. 978.80s - 983.20s | One is using more proper signals intelligence techniques. 983.20s - 987.28s | This was a pretty straightforward scan of it. 987.28s - 990.96s | So it wasn't really analyzing the signals themselves. 990.96s - 993.64s | It was analyzing the data contained within the signals. 993.64s - 997.48s | But another approach of detecting for ADS-B spoofing 997.48s - 1000.68s | is looking for the first phase of the retrieval process 1000.68s - 1002.72s | where you analyze the signals themselves. 1002.72s - 1004.52s | And one modality of doing this 1004.52s - 1007.64s | is a technique called RSSI fingerprinting. 1007.64s - 1010.64s | RSSI


chunk_text:
this data, 954.27s - 955.11s | in a CSV format, 955.11s - 957.83s | I fed it into the deep neural network model 957.83s - 960.15s | I created using TensorFlow. 960.15s - 963.83s | And then in order to get a visual plot of the classification 963.83s - 966.51s | once the spoofed aircraft was classified, 966.51s - 968.67s | I used a library called Folium 968.67s - 976.72s | in order to make a visual plot of the spoofed airplanes. 976.72s - 978.80s | Build improvements going forward. 978.80s - 983.20s | One is using more proper signals intelligence techniques. 983.20s - 987.28s | This was a pretty straightforward scan of it. 987.28s - 990.96s | So it wasn't really analyzing the signals themselves. 990.96s - 993.64s | It was analyzing the data contained within the signals. 993.64s - 997.48s | But another approach of detecting for ADS-B spoofing 997.48s - 1000.68s | is looking for the first phase of the retrieval process 1000.68s - 1002.72s | where you analyze the signals themselves. 1002.72s - 1004.52s | And one modality of doing this 1004.52s - 1007.64s | is a technique called RSSI fingerprinting. 1007.64s - 1010.64s | RSSI indicating the signal strength of the aircraft. 1011.32s - 1014.32s | ADS-B out transmission. 1014.32s - 1018.44s | So as each airplane transmits the ADS-B message 1018.44s - 1019.92s | using its ADS-B out, 1019.92s - 1023.80s | it will have its own unique RSSI identifier. 1023.80s - 1026.20s | And this could be a more proper technique 1026.20s - 1031.04s | of analyzing each of the individual RF characteristics 1031.04s - 1032.60s | of the signals themselves. 1032.60s - 1037.60s | And you can localize the signals where they come out of 1037.92s - 1040.16s | in order to identify the airplanes. 1040.68s - 1042.84s | And typically when you're doing RSSI fingerprinting 1042.84s - 1043.96s | for a spoofed plane, 1043.96s - 1048.04s | you get more deviations and deflections of the RSSI signal. 1048.04s - 1049.52s | While for a valid plane, 1049.52s - 1051.60s | you'll have more of a consistent output. 1051.60s - 1054.32s | So that would be a signals intelligence way 1054.32s - 1056.16s | of improving this build. 1056.16s - 1059.36s | And secondly is to use more refined algorithms. 1059.36s - 1061.24s | I use the DNN for this approach, 1061.24s


chunk_text:
indicating the signal strength of the aircraft. 1011.32s - 1014.32s | ADS-B out transmission. 1014.32s - 1018.44s | So as each airplane transmits the ADS-B message 1018.44s - 1019.92s | using its ADS-B out, 1019.92s - 1023.80s | it will have its own unique RSSI identifier. 1023.80s - 1026.20s | And this could be a more proper technique 1026.20s - 1031.04s | of analyzing each of the individual RF characteristics 1031.04s - 1032.60s | of the signals themselves. 1032.60s - 1037.60s | And you can localize the signals where they come out of 1037.92s - 1040.16s | in order to identify the airplanes. 1040.68s - 1042.84s | And typically when you're doing RSSI fingerprinting 1042.84s - 1043.96s | for a spoofed plane, 1043.96s - 1048.04s | you get more deviations and deflections of the RSSI signal. 1048.04s - 1049.52s | While for a valid plane, 1049.52s - 1051.60s | you'll have more of a consistent output. 1051.60s - 1054.32s | So that would be a signals intelligence way 1054.32s - 1056.16s | of improving this build. 1056.16s - 1059.36s | And secondly is to use more refined algorithms. 1059.36s - 1061.24s | I use the DNN for this approach, 1061.24s - 1064.16s | but there's a lot of exploration with other models 1064.16s - 1065.60s | that could be done. 1065.60s - 1067.52s | So using other deep learning models 1067.52s - 1069.32s | like recurrent neural networks 1069.32s - 1073.04s | or long short-term memory networks could be sufficient 1073.04s - 1076.04s | alongside adding reinforcement techniques 1076.04s - 1077.80s | in order to improve the accuracy 1077.80s - 1079.92s | of the current convolutional network. 1080.96s - 1083.48s | The tests I ran with this convolutional network 1083.48s - 1087.08s | reflected accuracy rates of 90%, 1087.08s - 1092.12s | but that could be improved using these approach. 1092.12s - 1096.40s | Additional enhancements would be the training data itself. 1096.40s - 1098.72s | One huge constraint with this project 1098.76s - 1100.24s | was the training data 1100.24s - 1103.16s | because a lot of the training data for the spoofed dataset. 1103.16s - 1106.24s | So there was a valid dataset and there was a spoof dataset. 1106.24s - 1108.12s | The valid dataset was very easy to get 1108.12s - 1111.60s | because there's a huge tabulated records 1111.60s - 1116.00s | of ADS-B messages


chunk_text:
- 1064.16s | but there's a lot of exploration with other models 1064.16s - 1065.60s | that could be done. 1065.60s - 1067.52s | So using other deep learning models 1067.52s - 1069.32s | like recurrent neural networks 1069.32s - 1073.04s | or long short-term memory networks could be sufficient 1073.04s - 1076.04s | alongside adding reinforcement techniques 1076.04s - 1077.80s | in order to improve the accuracy 1077.80s - 1079.92s | of the current convolutional network. 1080.96s - 1083.48s | The tests I ran with this convolutional network 1083.48s - 1087.08s | reflected accuracy rates of 90%, 1087.08s - 1092.12s | but that could be improved using these approach. 1092.12s - 1096.40s | Additional enhancements would be the training data itself. 1096.40s - 1098.72s | One huge constraint with this project 1098.76s - 1100.24s | was the training data 1100.24s - 1103.16s | because a lot of the training data for the spoofed dataset. 1103.16s - 1106.24s | So there was a valid dataset and there was a spoof dataset. 1106.24s - 1108.12s | The valid dataset was very easy to get 1108.12s - 1111.60s | because there's a huge tabulated records 1111.60s - 1116.00s | of ADS-B messages that are from a wide range of sources. 1116.00s - 1118.20s | But when you're dealing with spoof sources, 1118.20s - 1120.84s | I can only get it from very specialized people 1120.84s - 1123.72s | within the aviation signals intelligence techniques. 1123.72s - 1126.08s | And you're also dealing with the legality issue 1126.08s - 1127.84s | in that regard because it's really hard 1127.84s - 1131.40s | to get access to spoofed data you can train a model on. 1131.40s - 1135.96s | So I would say for half the spoof signals, 1135.96s - 1138.80s | half of them had to be generated myself. 1138.80s - 1141.76s | So I had to go into the perspective 1141.76s - 1144.00s | of a person who would be spoofing these signals 1144.00s - 1147.44s | in order to manually generate ADS-B messages 1147.44s - 1150.44s | that would be spoofed in nature in order to train this model. 1150.44s - 1152.88s | However, having more realistic data 1152.88s - 1154.24s | in order to train this dataset 1154.24s - 1161.96s | would make this neural network model more accurate. 1161.96s - 1166.68s | And one way for increasing the accuracy


chunk_text:
that are from a wide range of sources. 1116.00s - 1118.20s | But when you're dealing with spoof sources, 1118.20s - 1120.84s | I can only get it from very specialized people 1120.84s - 1123.72s | within the aviation signals intelligence techniques. 1123.72s - 1126.08s | And you're also dealing with the legality issue 1126.08s - 1127.84s | in that regard because it's really hard 1127.84s - 1131.40s | to get access to spoofed data you can train a model on. 1131.40s - 1135.96s | So I would say for half the spoof signals, 1135.96s - 1138.80s | half of them had to be generated myself. 1138.80s - 1141.76s | So I had to go into the perspective 1141.76s - 1144.00s | of a person who would be spoofing these signals 1144.00s - 1147.44s | in order to manually generate ADS-B messages 1147.44s - 1150.44s | that would be spoofed in nature in order to train this model. 1150.44s - 1152.88s | However, having more realistic data 1152.88s - 1154.24s | in order to train this dataset 1154.24s - 1161.96s | would make this neural network model more accurate. 1161.96s - 1166.68s | And one way for increasing the accuracy rate 1166.68s - 1168.40s | of another way of doing it 1168.40s - 1171.64s | would also be using a technique called data augmentation, 1171.64s - 1174.08s | which would further refine the approach 1174.08s - 1176.92s | of manually generating these spoofed signal messages 1176.92s - 1181.00s | that I could directly feed into the neural network itself, 1181.00s - 1184.64s | allowing me to have a more comprehensive data array 1184.64s - 1190.92s | of spoofed signals that I could train this model on. 1190.92s - 1192.20s | Thank you. That's about it. 1192.20s - 1194.48s | If you have any questions, feel free to come up 1194.48s - 1196.64s | or ask them right now. 1196.64s - 1197.92s | That's my contact information, 1197.92s - 1199.92s | but thank you so much for coming today.


chunk_text:
rate 1166.68s - 1168.40s | of another way of doing it 1168.40s - 1171.64s | would also be using a technique called data augmentation, 1171.64s - 1174.08s | which would further refine the approach 1174.08s - 1176.92s | of manually generating these spoofed signal messages 1176.92s - 1181.00s | that I could directly feed into the neural network itself, 1181.00s - 1184.64s | allowing me to have a more comprehensive data array 1184.64s - 1190.92s | of spoofed signals that I could train this model on. 1190.92s - 1192.20s | Thank you. That's about it. 1192.20s - 1194.48s | If you have any questions, feel free to come up 1194.48s - 1196.64s | or ask them right now. 1196.64s - 1197.92s | That's my contact information, 1197.92s - 1199.92s | but thank you so much for coming today.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=BhBwQnkXDC4", "title": "DEF CON 32 - From Theory to Reality Demonstrating the Simplicity of SPARTA Techniques - Randi Tinney", "description": "Demonstrating the transition from theorized space cyber attacks to practical proof of concepts. The presentation will utilize a simple yet effective attack, a man-in-the-middle attack, on the ground infrastructure to demonstrate how many SPARTA techniques and sub-techniques can be performed against a spacecraft from the ground infrastructure. By illustrating the significant impact of this simplified concept, we aim to emphasize the urgent need for enhanced cybersecurity measures throughout the entire lifecycle of space missions and break the inherit trust between the ground and spacecraft.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1486, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 1.68s | This text was transcribed using whisper model: large-v2 Hello, I'm Randy Tinney. 1.68s - 4.38s | I represent the Aerospace Corporation. 4.38s - 8.38s | And today I'm going to be talking about SPARTA techniques and how easy they are. 10.04s - 17.34s | If I can get my slide deck working, there we go. 18.04s - 19.10s | So a little bit about me. 19.10s - 22.90s | I first got into this industry back in 2018. 22.94s - 26.28s | I was hired on as a contractor at NASA's Independent Verification 26.28s - 27.78s | and Validation Center. 27.78s - 31.22s | In 2022, I was hired on at the Aerospace Corporation, 31.22s - 34.12s | kind of as a jack of all trades, let's say. 34.32s - 37.46s | I do a little bit of everything, the exploit developer, vulnerability 37.46s - 42.00s | researcher, website developer, because I am the main developer 42.00s - 47.24s | for the Space Attack Research and Tactic Analysis Framework, also known as SPARTA. 48.64s - 53.50s | And then finally, my last kind of name to fame is last year 53.74s - 57.62s | I was part of the team that won the Red Alert ICS CTF, 57.92s - 59.64s | where we got a black badge. 59.64s - 62.74s | So that's pretty, pretty exciting. 62.74s - 64.90s | So let's kind of back up and talk about SPARTA. 65.40s - 69.58s | In case anybody didn't know about SPARTA, SPARTA is a cybersecurity framework 69.58s - 72.42s | that we launched back in October of 2022. 72.84s - 75.36s | We're actually coming up on our second


chunk_text:
- 26.28s | I was hired on as a contractor at NASA's Independent Verification 26.28s - 27.78s | and Validation Center. 27.78s - 31.22s | In 2022, I was hired on at the Aerospace Corporation, 31.22s - 34.12s | kind of as a jack of all trades, let's say. 34.32s - 37.46s | I do a little bit of everything, the exploit developer, vulnerability 37.46s - 42.00s | researcher, website developer, because I am the main developer 42.00s - 47.24s | for the Space Attack Research and Tactic Analysis Framework, also known as SPARTA. 48.64s - 53.50s | And then finally, my last kind of name to fame is last year 53.74s - 57.62s | I was part of the team that won the Red Alert ICS CTF, 57.92s - 59.64s | where we got a black badge. 59.64s - 62.74s | So that's pretty, pretty exciting. 62.74s - 64.90s | So let's kind of back up and talk about SPARTA. 65.40s - 69.58s | In case anybody didn't know about SPARTA, SPARTA is a cybersecurity framework 69.58s - 72.42s | that we launched back in October of 2022. 72.84s - 75.36s | We're actually coming up on our second year anniversary, 75.72s - 82.40s | and it is a cybersecurity matrix that mainly focuses on spacecraft 82.40s - 84.16s | and space related systems. 84.16s - 87.40s | It's very similar to the MITRE ATT&CK Framework, 87.40s - 94.54s | where it looks at all of the threats, tactics, techniques and procedures. 94.70s - 97.54s | Only this one focuses on the space systems, 97.54s - 100.70s | while MITRE ATT&CK focuses on more on the ground side of things. 101.18s - 104.68s | And really, we built this tool for both the commercial 104.68s - 108.68s | and the government users to mainly stay up to date 108.94s - 111.92s | for the various attacks that may threaten their field. 112.28s - 115.16s | And it's really gotten a lot of attention 115.18s - 117.98s | from the industry itself. 117.98s - 119.62s | We've had a lot of good feedback, 119.62s - 123.30s | and it's really grown thanks to the contributions that everybody's done. 124.30s - 127.40s | Unfortunately, because everything is kind of unclassified, 127.40s - 132.00s | a lot of the, let's say, attacks that we've talked about 132.00s - 134.64s | are more


chunk_text:
year anniversary, 75.72s - 82.40s | and it is a cybersecurity matrix that mainly focuses on spacecraft 82.40s - 84.16s | and space related systems. 84.16s - 87.40s | It's very similar to the MITRE ATT&CK Framework, 87.40s - 94.54s | where it looks at all of the threats, tactics, techniques and procedures. 94.70s - 97.54s | Only this one focuses on the space systems, 97.54s - 100.70s | while MITRE ATT&CK focuses on more on the ground side of things. 101.18s - 104.68s | And really, we built this tool for both the commercial 104.68s - 108.68s | and the government users to mainly stay up to date 108.94s - 111.92s | for the various attacks that may threaten their field. 112.28s - 115.16s | And it's really gotten a lot of attention 115.18s - 117.98s | from the industry itself. 117.98s - 119.62s | We've had a lot of good feedback, 119.62s - 123.30s | and it's really grown thanks to the contributions that everybody's done. 124.30s - 127.40s | Unfortunately, because everything is kind of unclassified, 127.40s - 132.00s | a lot of the, let's say, attacks that we've talked about 132.00s - 134.64s | are more from a tabletop perspective. 135.44s - 139.34s | We can't really give any kind of actual attacks that have occurred. 139.34s - 141.34s | Nobody wants to reveal that information. 141.34s - 143.64s | And so a lot of people that are just getting into this industry 143.66s - 145.76s | don't know what they look like. 145.76s - 148.40s | They don't know where they can be detected. 148.40s - 150.76s | They don't know how to really block them. 151.10s - 155.50s | And so that's another reason why I did the research that I did 155.74s - 160.34s | in order to actually do these attacks in a simulated environment 160.34s - 164.68s | to help people see where things are going to be detected 164.68s - 166.08s | and how they actually look like. 167.02s - 169.32s | To do this, though, I need to kind of take a step back 169.84s - 176.18s | and really look at how a spacecraft, how we can communicate with it. 176.62s - 179.18s | And so I'm a very simple person. 179.78s - 183.22s | So I designed this very simple image. 183.88s - 186.72s | And really,


chunk_text:
from a tabletop perspective. 135.44s - 139.34s | We can't really give any kind of actual attacks that have occurred. 139.34s - 141.34s | Nobody wants to reveal that information. 141.34s - 143.64s | And so a lot of people that are just getting into this industry 143.66s - 145.76s | don't know what they look like. 145.76s - 148.40s | They don't know where they can be detected. 148.40s - 150.76s | They don't know how to really block them. 151.10s - 155.50s | And so that's another reason why I did the research that I did 155.74s - 160.34s | in order to actually do these attacks in a simulated environment 160.34s - 164.68s | to help people see where things are going to be detected 164.68s - 166.08s | and how they actually look like. 167.02s - 169.32s | To do this, though, I need to kind of take a step back 169.84s - 176.18s | and really look at how a spacecraft, how we can communicate with it. 176.62s - 179.18s | And so I'm a very simple person. 179.78s - 183.22s | So I designed this very simple image. 183.88s - 186.72s | And really, the idea is, you know, you have a person behind a computer. 186.72s - 188.60s | We call that command and control server. 188.60s - 191.60s | And they're pressing buttons, sending commands up to the spacecraft. 192.46s - 195.70s | That command will then flow over to the front end processor, 195.90s - 197.66s | which then travels to a modem. 197.68s - 202.48s | Now, sometimes, not always a mission or a operation 202.48s - 205.12s | will have a encryptor or authenticator. 205.28s - 206.92s | We call that the bulk crypto unit. 206.92s - 210.26s | Usually it's placed between the front end processor and your modem. 210.26s - 213.96s | So right before those packets are transferred to the RF signal. 214.56s - 215.66s | This is not always the case. 215.66s - 219.20s | We are encouraging that more often, but still, it's a it's a slow thing 219.20s - 221.00s | that can be included. 221.00s - 224.00s | But anyways, after it either goes through the bulk crypto unit 224.00s - 226.64s | or it doesn't exist, it goes to the modem, gets transferred 226.66s - 230.86s | to the RF signal,


chunk_text:
the idea is, you know, you have a person behind a computer. 186.72s - 188.60s | We call that command and control server. 188.60s - 191.60s | And they're pressing buttons, sending commands up to the spacecraft. 192.46s - 195.70s | That command will then flow over to the front end processor, 195.90s - 197.66s | which then travels to a modem. 197.68s - 202.48s | Now, sometimes, not always a mission or a operation 202.48s - 205.12s | will have a encryptor or authenticator. 205.28s - 206.92s | We call that the bulk crypto unit. 206.92s - 210.26s | Usually it's placed between the front end processor and your modem. 210.26s - 213.96s | So right before those packets are transferred to the RF signal. 214.56s - 215.66s | This is not always the case. 215.66s - 219.20s | We are encouraging that more often, but still, it's a it's a slow thing 219.20s - 221.00s | that can be included. 221.00s - 224.00s | But anyways, after it either goes through the bulk crypto unit 224.00s - 226.64s | or it doesn't exist, it goes to the modem, gets transferred 226.66s - 230.86s | to the RF signal, to the ground satellite, up to the spacecraft. 231.32s - 234.46s | And there we go. Same with telemetry. 234.60s - 237.26s | It just comes back the in the reverse direction. 238.50s - 241.44s | And then, of course, I added this little feature where you can see 241.60s - 245.64s | where it goes from human readable to spacecraft communication 245.64s - 247.98s | to the RF signal. 247.98s - 253.18s | So knowing this and seeing this very simplified manner, 253.22s - 257.46s | I immediately thought about where could the best method of attack 257.46s - 259.36s | be for this system? 259.36s - 262.76s | Because a lot of the people in the space industry think that their systems 262.76s - 264.30s | are untouchable just because they're in space. 264.30s - 268.30s | They're, you know, high above Earth, hard to talk to. 268.30s - 270.84s | Radio frequency is hard to decode. 270.84s - 275.20s | So in my mind, the most logical attack vector was 275.80s - 279.52s | to the left of that bulk crypto unit or the modem if it doesn't exist. 279.52s - 282.48s | And really focusing on


chunk_text:
to the ground satellite, up to the spacecraft. 231.32s - 234.46s | And there we go. Same with telemetry. 234.60s - 237.26s | It just comes back the in the reverse direction. 238.50s - 241.44s | And then, of course, I added this little feature where you can see 241.60s - 245.64s | where it goes from human readable to spacecraft communication 245.64s - 247.98s | to the RF signal. 247.98s - 253.18s | So knowing this and seeing this very simplified manner, 253.22s - 257.46s | I immediately thought about where could the best method of attack 257.46s - 259.36s | be for this system? 259.36s - 262.76s | Because a lot of the people in the space industry think that their systems 262.76s - 264.30s | are untouchable just because they're in space. 264.30s - 268.30s | They're, you know, high above Earth, hard to talk to. 268.30s - 270.84s | Radio frequency is hard to decode. 270.84s - 275.20s | So in my mind, the most logical attack vector was 275.80s - 279.52s | to the left of that bulk crypto unit or the modem if it doesn't exist. 279.52s - 282.48s | And really focusing on either the person itself 283.28s - 286.12s | the command and control server or the front end processor 286.28s - 288.78s | or any combination of the between. 288.78s - 292.42s | So the idea is you're going to be actually compromising 292.42s - 295.52s | that ground station in some way and attacking at that point. 296.96s - 299.30s | Now, unfortunately, because I've been on a lot of missions 299.90s - 303.90s | as a cyber assessor, I've heard a lot of excuses of why this won't work. 304.26s - 307.58s | Actually, people do not like it whenever you say that their mission 307.58s - 309.44s | operation center could be compromised. 309.46s - 311.50s | They think because they have a lot of, 311.50s - 314.74s | you know, guns, guards with guns, 315.74s - 318.82s | you know, different fences with barbed wires, that they're untouchable. 319.78s - 322.32s | In fact, they really don't even like 322.72s - 326.02s | acknowledging that there could be a breach in their system. 326.26s - 328.78s | And they come up with a ton of different excuses. 329.46s - 332.56s | Some of my favorites are, you


chunk_text:
either the person itself 283.28s - 286.12s | the command and control server or the front end processor 286.28s - 288.78s | or any combination of the between. 288.78s - 292.42s | So the idea is you're going to be actually compromising 292.42s - 295.52s | that ground station in some way and attacking at that point. 296.96s - 299.30s | Now, unfortunately, because I've been on a lot of missions 299.90s - 303.90s | as a cyber assessor, I've heard a lot of excuses of why this won't work. 304.26s - 307.58s | Actually, people do not like it whenever you say that their mission 307.58s - 309.44s | operation center could be compromised. 309.46s - 311.50s | They think because they have a lot of, 311.50s - 314.74s | you know, guns, guards with guns, 315.74s - 318.82s | you know, different fences with barbed wires, that they're untouchable. 319.78s - 322.32s | In fact, they really don't even like 322.72s - 326.02s | acknowledging that there could be a breach in their system. 326.26s - 328.78s | And they come up with a ton of different excuses. 329.46s - 332.56s | Some of my favorites are, you know, we got a lot of firewalls. 333.20s - 334.56s | They're not going to get past that. 334.56s - 336.84s | Obviously, everybody knows that's the case. 337.74s - 338.66s | We're air gapped. 338.66s - 342.94s | Our systems don't even touch the network at all. OK. 344.14s - 347.54s | And then they also say that we just accept that risk of insider threat. 347.58s - 349.44s | You know, the guy behind the command and control server, 349.44s - 352.48s | he may send a bad command, but we've got mitigations. 353.32s - 354.32s | Not always the case. 354.32s - 357.46s | And we we show them that, unfortunately, just 358.08s - 362.02s | it's a lot easier to assume that at any point in time, you're 362.36s - 364.20s | you're going to get you're going to have a breach. 364.20s - 365.72s | You're going to be attacked in some manner. 365.74s - 368.84s | It doesn't matter how there's always going to be a vulnerability available. 368.84s - 372.18s | So if you assume that that is a possibility, you'll be more likely to patch it. 372.34s - 373.92s | We definitely


chunk_text:
know, we got a lot of firewalls. 333.20s - 334.56s | They're not going to get past that. 334.56s - 336.84s | Obviously, everybody knows that's the case. 337.74s - 338.66s | We're air gapped. 338.66s - 342.94s | Our systems don't even touch the network at all. OK. 344.14s - 347.54s | And then they also say that we just accept that risk of insider threat. 347.58s - 349.44s | You know, the guy behind the command and control server, 349.44s - 352.48s | he may send a bad command, but we've got mitigations. 353.32s - 354.32s | Not always the case. 354.32s - 357.46s | And we we show them that, unfortunately, just 358.08s - 362.02s | it's a lot easier to assume that at any point in time, you're 362.36s - 364.20s | you're going to get you're going to have a breach. 364.20s - 365.72s | You're going to be attacked in some manner. 365.74s - 368.84s | It doesn't matter how there's always going to be a vulnerability available. 368.84s - 372.18s | So if you assume that that is a possibility, you'll be more likely to patch it. 372.34s - 373.92s | We definitely promote defense in depth. 373.92s - 375.68s | And that's where this comes from. 375.68s - 379.82s | So whenever I say that we are assuming that our initial access vector 379.82s - 383.66s | is the compromised ground system, I am referring to the actual Sparta 383.66s - 387.12s | TTP that we've created of the compromised ground system. 387.40s - 391.06s | And this is one of the ones that has the highest notional risk score as well. 391.30s - 394.04s | So we definitely take this very seriously. 394.06s - 396.62s | And we're saying, like, this is going to happen. 396.92s - 399.32s | So just assume it, accept it and be done. 400.42s - 403.44s | And like I said earlier, I'm a very simple person. 403.56s - 405.90s | So my attack that I did was very simple. 406.40s - 409.08s | In fact, it's so simple that I just did a man in the middle 409.68s - 411.90s | to prove that all of these attacks can be done. 412.38s - 416.08s | Specifically, I do an ARP spoof between the command and control server 416.08s - 418.04s | and the front end


chunk_text:
promote defense in depth. 373.92s - 375.68s | And that's where this comes from. 375.68s - 379.82s | So whenever I say that we are assuming that our initial access vector 379.82s - 383.66s | is the compromised ground system, I am referring to the actual Sparta 383.66s - 387.12s | TTP that we've created of the compromised ground system. 387.40s - 391.06s | And this is one of the ones that has the highest notional risk score as well. 391.30s - 394.04s | So we definitely take this very seriously. 394.06s - 396.62s | And we're saying, like, this is going to happen. 396.92s - 399.32s | So just assume it, accept it and be done. 400.42s - 403.44s | And like I said earlier, I'm a very simple person. 403.56s - 405.90s | So my attack that I did was very simple. 406.40s - 409.08s | In fact, it's so simple that I just did a man in the middle 409.68s - 411.90s | to prove that all of these attacks can be done. 412.38s - 416.08s | Specifically, I do an ARP spoof between the command and control server 416.08s - 418.04s | and the front end processor. 418.04s - 421.48s | Now, once again, I kind of feel what you all are seeing are saying. 422.32s - 425.92s | Now, nobody's going to do an ARP spoof on a very complex system. 426.16s - 428.66s | This is too hard. That's script kitty stuff. 429.72s - 434.54s | Well, a couple of weeks back, we were actually at a training event 434.90s - 438.24s | where we were testing some things and we did these attacks 438.78s - 442.68s | and they couldn't detect us because they also thought they were too simple. 443.34s - 447.84s | So even in these complex systems, please don't overlook the simple stuff 447.94s - 451.74s | like script kitties exist and they will try to attack you at all times. 452.12s - 453.28s | So that's what I'm saying. 453.28s - 456.68s | And that's what I've done for this entire presentation. 456.92s - 459.72s | So I created a tool that was just a very simple man in the middle. 460.42s - 464.66s | I called it the Sparta Cyber Exploiter just because, you know, I like the acronyms. 465.20s - 468.70s | I'm not here to promote


chunk_text:
processor. 418.04s - 421.48s | Now, once again, I kind of feel what you all are seeing are saying. 422.32s - 425.92s | Now, nobody's going to do an ARP spoof on a very complex system. 426.16s - 428.66s | This is too hard. That's script kitty stuff. 429.72s - 434.54s | Well, a couple of weeks back, we were actually at a training event 434.90s - 438.24s | where we were testing some things and we did these attacks 438.78s - 442.68s | and they couldn't detect us because they also thought they were too simple. 443.34s - 447.84s | So even in these complex systems, please don't overlook the simple stuff 447.94s - 451.74s | like script kitties exist and they will try to attack you at all times. 452.12s - 453.28s | So that's what I'm saying. 453.28s - 456.68s | And that's what I've done for this entire presentation. 456.92s - 459.72s | So I created a tool that was just a very simple man in the middle. 460.42s - 464.66s | I called it the Sparta Cyber Exploiter just because, you know, I like the acronyms. 465.20s - 468.70s | I'm not here to promote the tool because I will tell you the tool itself 468.70s - 473.16s | is a Python Flask server running SCAPI and the Netfilter queue. 473.50s - 476.44s | So you too can create your own space invader if you wish. 476.54s - 477.14s | Very simple. 477.14s - 481.04s | You just have to know what those three things are and some CCSDS decoding. 482.58s - 485.58s | So let's talk about the actual environment because these are the attacks. 485.58s - 487.52s | You can read what the attacks are going to do later. 487.52s - 491.36s | But the actual environment we're going to be attacking is NASA's open source 491.36s - 494.30s | NOSCube. You can go to GitHub. I've included the link here. 494.30s - 496.42s | It's a very, very awesome tool 496.42s - 499.50s | if you want to play with a realistic spacecraft system 499.66s - 502.20s | and you're going to see how realistic it is in these demos. 502.80s - 505.96s | All right, so let's go actually start talking about some TTPs. 507.24s - 510.54s | The very first one is just exfiltrating telemetry and command. 511.38s - 515.58s


chunk_text:
the tool because I will tell you the tool itself 468.70s - 473.16s | is a Python Flask server running SCAPI and the Netfilter queue. 473.50s - 476.44s | So you too can create your own space invader if you wish. 476.54s - 477.14s | Very simple. 477.14s - 481.04s | You just have to know what those three things are and some CCSDS decoding. 482.58s - 485.58s | So let's talk about the actual environment because these are the attacks. 485.58s - 487.52s | You can read what the attacks are going to do later. 487.52s - 491.36s | But the actual environment we're going to be attacking is NASA's open source 491.36s - 494.30s | NOSCube. You can go to GitHub. I've included the link here. 494.30s - 496.42s | It's a very, very awesome tool 496.42s - 499.50s | if you want to play with a realistic spacecraft system 499.66s - 502.20s | and you're going to see how realistic it is in these demos. 502.80s - 505.96s | All right, so let's go actually start talking about some TTPs. 507.24s - 510.54s | The very first one is just exfiltrating telemetry and command. 511.38s - 515.58s | This one really is kind of overlooked because once again, it's just packets. 515.58s - 516.68s | Nobody knows what to do with them. 516.68s - 518.42s | Actually, this is kind of pretty serious. 518.42s - 520.72s | You're going to see why in a little bit. 520.72s - 523.92s | Everything that you see here will actually be used in future attacks. 524.68s - 527.98s | I will not force you to decode CCSDS. 527.98s - 530.52s | Just know that if it starts with a zero, it's a telemetry. 530.54s - 532.54s | If it starts with a one, it's a command. 532.54s - 534.08s | OK, very simple. 534.08s - 536.32s | And this is all done just because we're man in the middle, 536.32s - 539.38s | not doing anything special, just printing out those packets to the screen. 540.12s - 544.34s | So the second attack that we're going to do is actually falsifying 544.34s - 546.58s | the telemetry that's downlinked. 546.58s - 549.44s | In a mission operations center, the telemetry is probably 549.44s - 552.42s | the most important information that a person can get 552.42s - 556.42s | because


chunk_text:
| This one really is kind of overlooked because once again, it's just packets. 515.58s - 516.68s | Nobody knows what to do with them. 516.68s - 518.42s | Actually, this is kind of pretty serious. 518.42s - 520.72s | You're going to see why in a little bit. 520.72s - 523.92s | Everything that you see here will actually be used in future attacks. 524.68s - 527.98s | I will not force you to decode CCSDS. 527.98s - 530.52s | Just know that if it starts with a zero, it's a telemetry. 530.54s - 532.54s | If it starts with a one, it's a command. 532.54s - 534.08s | OK, very simple. 534.08s - 536.32s | And this is all done just because we're man in the middle, 536.32s - 539.38s | not doing anything special, just printing out those packets to the screen. 540.12s - 544.34s | So the second attack that we're going to do is actually falsifying 544.34s - 546.58s | the telemetry that's downlinked. 546.58s - 549.44s | In a mission operations center, the telemetry is probably 549.44s - 552.42s | the most important information that a person can get 552.42s - 556.42s | because that tells them the health and status of their spacecraft. 556.42s - 559.98s | So what we're going to do is we're going to degrade that confidence 560.20s - 563.34s | and we're going to do that by manipulating packets. 564.34s - 567.68s | So I have a video here where we've captured a telemetry packet 567.68s - 571.34s | and we're actually going to change every telemetry that has a specific API 571.34s - 575.62s | or application ID so that the ground station is going to see 575.62s - 578.96s | what we want them to see and they're just going to start communicating. 578.96s - 582.02s | So here I'm sending a bunch of no op commands to a camera. 582.02s - 583.72s | No op stands for no operation. 583.72s - 586.36s | And really, that's just going to send the command counter up. 586.36s - 589.26s | But since we're falsifying telemetry, they don't know 589.48s - 591.68s | they don't see that information at all. 592.48s - 597.16s | So they are probably thinking, oh, we've lost complete control of our spacecraft 597.16s - 599.82s | or our flight application isn't working. 599.82s -


chunk_text:
that tells them the health and status of their spacecraft. 556.42s - 559.98s | So what we're going to do is we're going to degrade that confidence 560.20s - 563.34s | and we're going to do that by manipulating packets. 564.34s - 567.68s | So I have a video here where we've captured a telemetry packet 567.68s - 571.34s | and we're actually going to change every telemetry that has a specific API 571.34s - 575.62s | or application ID so that the ground station is going to see 575.62s - 578.96s | what we want them to see and they're just going to start communicating. 578.96s - 582.02s | So here I'm sending a bunch of no op commands to a camera. 582.02s - 583.72s | No op stands for no operation. 583.72s - 586.36s | And really, that's just going to send the command counter up. 586.36s - 589.26s | But since we're falsifying telemetry, they don't know 589.48s - 591.68s | they don't see that information at all. 592.48s - 597.16s | So they are probably thinking, oh, we've lost complete control of our spacecraft 597.16s - 599.82s | or our flight application isn't working. 599.82s - 603.76s | However, after we stop the command, you will see that command counter 604.36s - 608.40s | go up by like, you know, a lot since I sent a bunch of commands. 609.20s - 613.54s | So, yeah, that's an immediate degrade of confidence level in your ground system, 613.54s - 616.28s | which is kind of terrifying in my mind. 617.88s - 619.14s | The next one is very similar. 619.16s - 621.20s | We're modifying the packets on the fly. 621.60s - 625.40s | So in this example, we're taking a very specific 625.40s - 629.80s | or we're watching for a very specific command and we're changing it to something else. 630.34s - 633.74s | In this example, we're going to be modifying the camera 633.74s - 639.14s | no op just to the executive services no op, just to show and demonstrate what this does. 639.88s - 642.08s | But this can actually be pretty dangerous. 642.08s - 645.66s | You know, let's say you captured a command that was changing a registry key 645.66s - 648.22s | on the system and you sent that off 648.24s - 652.08s | and you wanted to block


chunk_text:
603.76s | However, after we stop the command, you will see that command counter 604.36s - 608.40s | go up by like, you know, a lot since I sent a bunch of commands. 609.20s - 613.54s | So, yeah, that's an immediate degrade of confidence level in your ground system, 613.54s - 616.28s | which is kind of terrifying in my mind. 617.88s - 619.14s | The next one is very similar. 619.16s - 621.20s | We're modifying the packets on the fly. 621.60s - 625.40s | So in this example, we're taking a very specific 625.40s - 629.80s | or we're watching for a very specific command and we're changing it to something else. 630.34s - 633.74s | In this example, we're going to be modifying the camera 633.74s - 639.14s | no op just to the executive services no op, just to show and demonstrate what this does. 639.88s - 642.08s | But this can actually be pretty dangerous. 642.08s - 645.66s | You know, let's say you captured a command that was changing a registry key 645.66s - 648.22s | on the system and you sent that off 648.24s - 652.08s | and you wanted to block the ground station from, you know, changing it back. 652.98s - 656.18s | This is a specific way in which to do that, where it's going to block 656.18s - 661.18s | every attempt to change it with very little effort on your part. 664.58s - 668.38s | Yeah, so we just send those commands just to show that they sent and then we come back. 669.38s - 670.82s | The next one is super easy. 670.82s - 672.38s | It's jamming your man in the middle. 672.38s - 674.16s | Just block the packets. 674.16s - 679.40s | Once again, this stops the this degrades the confidence in your downlinked telemetry 679.66s - 682.16s | and it can also stop any commands from going up. 682.16s - 684.52s | So once again, if you've attacked the spacecraft in any way, 684.52s - 687.76s | you can just stop them from communicating entirely. 688.76s - 694.30s | In this case, all you need to know is the whatever important IP you want to block. 694.44s - 698.44s | In this case, we're blocking the command and control server and the telemetry downlink. 698.94s - 701.94s | And yeah, telemetry is


chunk_text:
the ground station from, you know, changing it back. 652.98s - 656.18s | This is a specific way in which to do that, where it's going to block 656.18s - 661.18s | every attempt to change it with very little effort on your part. 664.58s - 668.38s | Yeah, so we just send those commands just to show that they sent and then we come back. 669.38s - 670.82s | The next one is super easy. 670.82s - 672.38s | It's jamming your man in the middle. 672.38s - 674.16s | Just block the packets. 674.16s - 679.40s | Once again, this stops the this degrades the confidence in your downlinked telemetry 679.66s - 682.16s | and it can also stop any commands from going up. 682.16s - 684.52s | So once again, if you've attacked the spacecraft in any way, 684.52s - 687.76s | you can just stop them from communicating entirely. 688.76s - 694.30s | In this case, all you need to know is the whatever important IP you want to block. 694.44s - 698.44s | In this case, we're blocking the command and control server and the telemetry downlink. 698.94s - 701.94s | And yeah, telemetry is not going. 701.94s - 705.04s | And then whenever we stop it, it's going back. 705.38s - 709.28s | So once again, it's it's a very simplistic attack. 709.30s - 712.80s | But it's detrimental to the mission operation center. 715.08s - 719.94s | And the other way on the other spectrum of that is flooding attack flooding. 719.94s - 725.82s | You're just sending a bunch of information to whatever port you want in this case. 725.82s - 729.28s | And just for a visual effect, I send it to the telemetry 729.28s - 731.72s | just so you can see what information's there. 732.28s - 735.56s | There's actually two different flooding attacks that we follow in Sparta. 735.72s - 738.56s | One is the valid commands and the other one's just random data. 738.58s - 740.62s | I'm going to be showing the random data one just to show 740.62s - 744.42s | like how you can degrade confidence in that ground station again. 745.56s - 748.78s | And as you can see, it's just complete chaos on the ground station itself. 750.32s - 754.90s | The idea of this, though, is that you want to basically


chunk_text:
not going. 701.94s - 705.04s | And then whenever we stop it, it's going back. 705.38s - 709.28s | So once again, it's it's a very simplistic attack. 709.30s - 712.80s | But it's detrimental to the mission operation center. 715.08s - 719.94s | And the other way on the other spectrum of that is flooding attack flooding. 719.94s - 725.82s | You're just sending a bunch of information to whatever port you want in this case. 725.82s - 729.28s | And just for a visual effect, I send it to the telemetry 729.28s - 731.72s | just so you can see what information's there. 732.28s - 735.56s | There's actually two different flooding attacks that we follow in Sparta. 735.72s - 738.56s | One is the valid commands and the other one's just random data. 738.58s - 740.62s | I'm going to be showing the random data one just to show 740.62s - 744.42s | like how you can degrade confidence in that ground station again. 745.56s - 748.78s | And as you can see, it's just complete chaos on the ground station itself. 750.32s - 754.90s | The idea of this, though, is that you want to basically block all communications. 755.66s - 759.54s | You could also send a bunch of random data up to the satellite. 759.74s - 763.30s | The only reason I didn't do that here is because due to the simulation, 763.30s - 765.20s | it has to be pretty beefy. 765.22s - 769.12s | Thanks to the 42 simulator, which we're going to talk about in a little bit. 769.76s - 773.12s | So really, it didn't show any kind of good visual effects. 773.86s - 775.30s | But yeah, you could totally do that. 775.30s - 776.40s | And if you send it up to the bird, 776.40s - 780.40s | you could do everything from locking it up or crashing it, really. 783.29s - 785.95s | Oh, skip too far ahead. 785.95s - 789.55s | All right. So this is probably one of my favorite ones that we're going to do. 789.55s - 790.69s | It's the road ground station. 790.69s - 792.59s | You do not have to be man in the middle for this. 792.59s - 794.53s | In fact, this one's probably even more dangerous. 794.53s - 796.59s | It's another initial access vector, 796.59s - 799.27s


chunk_text:
block all communications. 755.66s - 759.54s | You could also send a bunch of random data up to the satellite. 759.74s - 763.30s | The only reason I didn't do that here is because due to the simulation, 763.30s - 765.20s | it has to be pretty beefy. 765.22s - 769.12s | Thanks to the 42 simulator, which we're going to talk about in a little bit. 769.76s - 773.12s | So really, it didn't show any kind of good visual effects. 773.86s - 775.30s | But yeah, you could totally do that. 775.30s - 776.40s | And if you send it up to the bird, 776.40s - 780.40s | you could do everything from locking it up or crashing it, really. 783.29s - 785.95s | Oh, skip too far ahead. 785.95s - 789.55s | All right. So this is probably one of my favorite ones that we're going to do. 789.55s - 790.69s | It's the road ground station. 790.69s - 792.59s | You do not have to be man in the middle for this. 792.59s - 794.53s | In fact, this one's probably even more dangerous. 794.53s - 796.59s | It's another initial access vector, 796.59s - 799.27s | which with a very high notional risk score. 799.67s - 803.13s | The only thing you really need to know is what IP and port 803.13s - 805.53s | the front end processor is talking on. 805.53s - 807.83s | A lot of front end processors that I've looked at 807.83s - 811.93s | does not have any kind of authentication enabled to talk to that port. 812.09s - 815.53s | So you can send whatever data you want. 816.13s - 819.13s | I'm just doing it in this tool just because I like everything. 819.13s - 823.49s | Once again, simple together in a nice GUI for visual effect. 823.57s - 825.13s | That's the only reason it's here. 825.13s - 827.97s | Now for the road ground station, you actually need to have 827.97s - 830.71s | the command and control server or command and control database, 831.13s - 834.57s | or you need to be having captured packets like in the man in the middle. 835.01s - 838.77s | In this case, as a good hacker, I have had the command and control database 838.77s - 840.73s | and I'm going to upload that to my


chunk_text:
| which with a very high notional risk score. 799.67s - 803.13s | The only thing you really need to know is what IP and port 803.13s - 805.53s | the front end processor is talking on. 805.53s - 807.83s | A lot of front end processors that I've looked at 807.83s - 811.93s | does not have any kind of authentication enabled to talk to that port. 812.09s - 815.53s | So you can send whatever data you want. 816.13s - 819.13s | I'm just doing it in this tool just because I like everything. 819.13s - 823.49s | Once again, simple together in a nice GUI for visual effect. 823.57s - 825.13s | That's the only reason it's here. 825.13s - 827.97s | Now for the road ground station, you actually need to have 827.97s - 830.71s | the command and control server or command and control database, 831.13s - 834.57s | or you need to be having captured packets like in the man in the middle. 835.01s - 838.77s | In this case, as a good hacker, I have had the command and control database 838.77s - 840.73s | and I'm going to upload that to my system. 842.21s - 844.77s | Command and control database is probably crown jewels of your, 845.27s - 846.67s | you know, operation. 846.67s - 852.23s | If some for some reason it gets leaked or it's, you know, captured. 853.11s - 856.37s | Yeah, your system's done if they can figure out how to decode it. 857.01s - 859.41s | In this case, I upload it. I know how to do everything. 859.97s - 863.21s | I send it to that front end processor and I just send it a bunch of commands 863.21s - 864.93s | just to make sure that it works. 864.93s - 867.57s | In this case, just no ops, you know, not really care. 867.57s - 870.17s | And just to see just to show that I have access to it. 870.53s - 873.81s | But I thought it would be really cool if we combine some attacks. 874.03s - 876.43s | So I'm going to work with the reaction wheel. 876.43s - 880.43s | Now, the reaction wheel on a spacecraft is how it turns in space 880.43s - 882.21s | to point to where it needs to go. 882.59s - 885.41s | So


chunk_text:
system. 842.21s - 844.77s | Command and control database is probably crown jewels of your, 845.27s - 846.67s | you know, operation. 846.67s - 852.23s | If some for some reason it gets leaked or it's, you know, captured. 853.11s - 856.37s | Yeah, your system's done if they can figure out how to decode it. 857.01s - 859.41s | In this case, I upload it. I know how to do everything. 859.97s - 863.21s | I send it to that front end processor and I just send it a bunch of commands 863.21s - 864.93s | just to make sure that it works. 864.93s - 867.57s | In this case, just no ops, you know, not really care. 867.57s - 870.17s | And just to see just to show that I have access to it. 870.53s - 873.81s | But I thought it would be really cool if we combine some attacks. 874.03s - 876.43s | So I'm going to work with the reaction wheel. 876.43s - 880.43s | Now, the reaction wheel on a spacecraft is how it turns in space 880.43s - 882.21s | to point to where it needs to go. 882.59s - 885.41s | So I thought it'd be fun if we, you know, activated one. 886.05s - 889.19s | But I'm actually going to combine this with an attack previously 889.19s - 891.65s | where we were changing the telemetry down. 892.01s - 895.51s | So I captured a telemetry packet that we had 895.51s - 898.31s | and I go back to my changing packet attack. 898.69s - 900.71s | I'm just going to change it to whatever that is. 900.71s - 904.81s | So, you know, the ground operations doesn't know that I'm doing anything. 905.25s - 908.75s | Launch the attack. Go back to my road ground station. 909.69s - 912.49s | I really don't care, you know, what wheel I use. 912.79s - 914.85s | So this is the 42 server, by the way. 914.85s - 916.35s | This is what makes it so beefy. 916.35s - 920.75s | This CubeSat will actually rotate around Earth and spin, which is really nice. 920.75s - 923.85s | And that's another reason why this NOSCube simulator is pretty awesome. 925.15s - 927.49s | It'll spin with every tick, so you'll actually see it. 928.05s - 929.65s | So, yeah, with the reaction


chunk_text:
I thought it'd be fun if we, you know, activated one. 886.05s - 889.19s | But I'm actually going to combine this with an attack previously 889.19s - 891.65s | where we were changing the telemetry down. 892.01s - 895.51s | So I captured a telemetry packet that we had 895.51s - 898.31s | and I go back to my changing packet attack. 898.69s - 900.71s | I'm just going to change it to whatever that is. 900.71s - 904.81s | So, you know, the ground operations doesn't know that I'm doing anything. 905.25s - 908.75s | Launch the attack. Go back to my road ground station. 909.69s - 912.49s | I really don't care, you know, what wheel I use. 912.79s - 914.85s | So this is the 42 server, by the way. 914.85s - 916.35s | This is what makes it so beefy. 916.35s - 920.75s | This CubeSat will actually rotate around Earth and spin, which is really nice. 920.75s - 923.85s | And that's another reason why this NOSCube simulator is pretty awesome. 925.15s - 927.49s | It'll spin with every tick, so you'll actually see it. 928.05s - 929.65s | So, yeah, with the reaction wheel, I don't care. 929.65s - 932.53s | I'm just going to set the torque to 10 and let it fly. 934.15s - 936.75s | So every tick in the 42 server, 936.75s - 939.05s | it actually, you know, flops along. 939.23s - 942.53s | So eventually you'll start seeing that CubeSat 943.15s - 946.33s | rotate on that wheel as it's been activated. 946.49s - 949.05s | And of course, the ground operators, they're not aware. 949.15s - 950.63s | I'm completely blocking them. 950.63s - 951.53s | They have no clue. 952.89s - 955.35s | And yeah, so they think everything's fine and dandy. 956.49s - 957.49s | Pretty awesome. 957.49s - 961.75s | Now, they would see it if I went back into my, you know, my ground station 961.75s - 964.59s | and I stopped that attack, which I'll go ahead and do just to show you 964.83s - 966.63s | what that would look like. 967.79s - 971.13s | And if you look over on the Cosmos packet, 971.29s - 974.63s | you actually see that wheel zero start to change. 974.63s - 977.29s | And that's how you're going to see that the


chunk_text:
wheel, I don't care. 929.65s - 932.53s | I'm just going to set the torque to 10 and let it fly. 934.15s - 936.75s | So every tick in the 42 server, 936.75s - 939.05s | it actually, you know, flops along. 939.23s - 942.53s | So eventually you'll start seeing that CubeSat 943.15s - 946.33s | rotate on that wheel as it's been activated. 946.49s - 949.05s | And of course, the ground operators, they're not aware. 949.15s - 950.63s | I'm completely blocking them. 950.63s - 951.53s | They have no clue. 952.89s - 955.35s | And yeah, so they think everything's fine and dandy. 956.49s - 957.49s | Pretty awesome. 957.49s - 961.75s | Now, they would see it if I went back into my, you know, my ground station 961.75s - 964.59s | and I stopped that attack, which I'll go ahead and do just to show you 964.83s - 966.63s | what that would look like. 967.79s - 971.13s | And if you look over on the Cosmos packet, 971.29s - 974.63s | you actually see that wheel zero start to change. 974.63s - 977.29s | And that's how you're going to see that the reaction wheel is changing. 977.67s - 980.17s | But once again, they had not a single clue. 980.69s - 982.33s | Man in the middle. 982.33s - 983.79s | Who would have known it's that powerful? 985.69s - 989.13s | So for my last attack, and this is the one that, you know, 989.39s - 991.33s | I had a lot of help with this. 991.33s - 993.29s | I did not write this rope flight application. 993.29s - 996.59s | It was actually written by some of my friends at the IV and feed facility, 996.97s - 998.89s | specifically the JSTAR team. 998.89s - 1002.29s | And they wrote this rogue flight application that they called Havoc, 1002.49s - 1004.87s | which is a backdoor into CFS. 1004.99s - 1007.23s | I just kind of modified a little bit to fit our needs. 1007.23s - 1010.07s | But this is pretty dangerous. 1010.07s - 1013.47s | This assumes that the initial access vector was the supply chain risk. 1014.03s - 1017.69s | And in this idea, because supply chain risk, 1017.69s - 1021.69s | our flight application is uploaded, the ground operations not aware. 1021.73s - 1023.89s |


chunk_text:
reaction wheel is changing. 977.67s - 980.17s | But once again, they had not a single clue. 980.69s - 982.33s | Man in the middle. 982.33s - 983.79s | Who would have known it's that powerful? 985.69s - 989.13s | So for my last attack, and this is the one that, you know, 989.39s - 991.33s | I had a lot of help with this. 991.33s - 993.29s | I did not write this rope flight application. 993.29s - 996.59s | It was actually written by some of my friends at the IV and feed facility, 996.97s - 998.89s | specifically the JSTAR team. 998.89s - 1002.29s | And they wrote this rogue flight application that they called Havoc, 1002.49s - 1004.87s | which is a backdoor into CFS. 1004.99s - 1007.23s | I just kind of modified a little bit to fit our needs. 1007.23s - 1010.07s | But this is pretty dangerous. 1010.07s - 1013.47s | This assumes that the initial access vector was the supply chain risk. 1014.03s - 1017.69s | And in this idea, because supply chain risk, 1017.69s - 1021.69s | our flight application is uploaded, the ground operations not aware. 1021.73s - 1023.89s | And because we can talk to the front end processor, 1023.89s - 1026.59s | we can then talk to our flight app. 1027.49s - 1029.43s | Specifically, this flight app does three things. 1029.43s - 1033.39s | It can upload a file, download a file and basically give us full command 1033.39s - 1036.49s | access to the satellite, because a lot of satellites right now 1036.49s - 1039.29s | are can be are running on a Linux system. 1039.53s - 1041.37s | So we have full Linux terminal with this. 1042.93s - 1044.79s | So, yeah, let me show you. 1044.79s - 1048.99s | So once again, all I have to do is just point it at the front end processor 1048.99s - 1053.03s | IP and port and just select which command I want. 1053.03s - 1055.43s | I send a quick no op just to make sure it's working. 1056.27s - 1060.73s | But really, I'm more interested in uploading a file as a good hacker. 1060.73s - 1063.49s | I was trying to think of a way to take over the satellite 1063.49s - 1065.73s | and make sure it was mine and nobody else can


chunk_text:
And because we can talk to the front end processor, 1023.89s - 1026.59s | we can then talk to our flight app. 1027.49s - 1029.43s | Specifically, this flight app does three things. 1029.43s - 1033.39s | It can upload a file, download a file and basically give us full command 1033.39s - 1036.49s | access to the satellite, because a lot of satellites right now 1036.49s - 1039.29s | are can be are running on a Linux system. 1039.53s - 1041.37s | So we have full Linux terminal with this. 1042.93s - 1044.79s | So, yeah, let me show you. 1044.79s - 1048.99s | So once again, all I have to do is just point it at the front end processor 1048.99s - 1053.03s | IP and port and just select which command I want. 1053.03s - 1055.43s | I send a quick no op just to make sure it's working. 1056.27s - 1060.73s | But really, I'm more interested in uploading a file as a good hacker. 1060.73s - 1063.49s | I was trying to think of a way to take over the satellite 1063.49s - 1065.73s | and make sure it was mine and nobody else can touch it. 1066.07s - 1068.09s | So I created a ransomware script, 1069.33s - 1070.73s | you know, because why not? 1070.73s - 1072.37s | I thought that'd be fun. 1072.37s - 1073.29s | So we send that up. 1073.29s - 1076.39s | I wanted to be low and slow so that nobody could really detect me. 1076.39s - 1078.19s | So it takes a good couple of minutes. 1079.39s - 1083.49s | But it's it's a pretty fun idea to think that you're going to ransomware 1083.49s - 1084.69s | a satellite, right? 1084.69s - 1087.49s | Because then you only you're the only ones that going to attack it. 1087.79s - 1089.39s | I'm going to get Buku money. 1089.39s - 1092.83s | And, you know, whatever mission is just, you know, as well. 1093.83s - 1096.83s | So, yeah, I upload the satellite and I'm going to run my command 1096.83s - 1098.83s | literally like I was on a Linux terminal. 1098.83s - 1102.73s | So make sure it can execute and encrypt the system. 1105.43s - 1107.97s | Now, the fun thing with CFS and the reason why this works 1108.01s - 1111.07s | is


chunk_text:
touch it. 1066.07s - 1068.09s | So I created a ransomware script, 1069.33s - 1070.73s | you know, because why not? 1070.73s - 1072.37s | I thought that'd be fun. 1072.37s - 1073.29s | So we send that up. 1073.29s - 1076.39s | I wanted to be low and slow so that nobody could really detect me. 1076.39s - 1078.19s | So it takes a good couple of minutes. 1079.39s - 1083.49s | But it's it's a pretty fun idea to think that you're going to ransomware 1083.49s - 1084.69s | a satellite, right? 1084.69s - 1087.49s | Because then you only you're the only ones that going to attack it. 1087.79s - 1089.39s | I'm going to get Buku money. 1089.39s - 1092.83s | And, you know, whatever mission is just, you know, as well. 1093.83s - 1096.83s | So, yeah, I upload the satellite and I'm going to run my command 1096.83s - 1098.83s | literally like I was on a Linux terminal. 1098.83s - 1102.73s | So make sure it can execute and encrypt the system. 1105.43s - 1107.97s | Now, the fun thing with CFS and the reason why this works 1108.01s - 1111.07s | is all of their flight applications are actually in their own 1111.07s - 1112.87s | individual startup scripts. 1112.87s - 1118.05s | So I can encrypt everything except for the command ingestion, the base CFS, 1118.05s - 1120.81s | the you know, the bus and of course, my own application, 1120.81s - 1123.35s | because I want to be able to talk to myself. 1123.35s - 1127.35s | And once that's encrypted, I just do a hardware reboot 1127.35s - 1129.47s | because I have the command and telemetry database 1129.47s - 1132.07s | because who doesn't need a good reboot after a while? 1132.07s - 1134.05s | And then we just wait for it to come back up. 1134.51s - 1137.05s | Now, I will tell you that this takes a long time to come up. 1137.05s - 1139.59s | So I'm just going to talk about Havoc and how awesome it is 1139.83s - 1143.73s | because with this tool, and I'm really excited to continue researching on this, 1144.03s - 1145.79s | we can do so much more. 1145.79s - 1149.79s | I can actually start doing way more Sparta TTPs with this one tool 1149.99s - 1152.59s


chunk_text:
all of their flight applications are actually in their own 1111.07s - 1112.87s | individual startup scripts. 1112.87s - 1118.05s | So I can encrypt everything except for the command ingestion, the base CFS, 1118.05s - 1120.81s | the you know, the bus and of course, my own application, 1120.81s - 1123.35s | because I want to be able to talk to myself. 1123.35s - 1127.35s | And once that's encrypted, I just do a hardware reboot 1127.35s - 1129.47s | because I have the command and telemetry database 1129.47s - 1132.07s | because who doesn't need a good reboot after a while? 1132.07s - 1134.05s | And then we just wait for it to come back up. 1134.51s - 1137.05s | Now, I will tell you that this takes a long time to come up. 1137.05s - 1139.59s | So I'm just going to talk about Havoc and how awesome it is 1139.83s - 1143.73s | because with this tool, and I'm really excited to continue researching on this, 1144.03s - 1145.79s | we can do so much more. 1145.79s - 1149.79s | I can actually start doing way more Sparta TTPs with this one tool 1149.99s - 1152.59s | than I could with the actual man in the middle of the road ground station, 1152.83s - 1155.39s | because I'm going to have access to the actual bus 1155.39s - 1157.39s | so we can do replay bus replay attacks. 1157.39s - 1161.49s | We'll be able to do, you know, GPS spoofing, attack the hardware. 1161.89s - 1164.89s | There's all kinds of things we can do. 1164.89s - 1167.89s | So while it's getting ready, I was just opening up some command center 1167.89s - 1169.89s | so you can see that they have no access, 1170.19s - 1173.83s | because I really want to prove that point of how like in the dark they are, 1174.07s - 1176.83s | because there is no especially in this system, 1176.83s - 1179.89s | there's no way to run a script like I just did. 1180.13s - 1183.23s | So literally, I am the only one that's able to do anything. 1183.23s - 1185.17s | They can't even upload a file. 1185.17s - 1188.77s | So they're they're really, you know, not doing good. 1189.03s - 1190.39s | Yeah. So telemetry is down. 1190.39s - 1191.97s | They're


chunk_text:
| than I could with the actual man in the middle of the road ground station, 1152.83s - 1155.39s | because I'm going to have access to the actual bus 1155.39s - 1157.39s | so we can do replay bus replay attacks. 1157.39s - 1161.49s | We'll be able to do, you know, GPS spoofing, attack the hardware. 1161.89s - 1164.89s | There's all kinds of things we can do. 1164.89s - 1167.89s | So while it's getting ready, I was just opening up some command center 1167.89s - 1169.89s | so you can see that they have no access, 1170.19s - 1173.83s | because I really want to prove that point of how like in the dark they are, 1174.07s - 1176.83s | because there is no especially in this system, 1176.83s - 1179.89s | there's no way to run a script like I just did. 1180.13s - 1183.23s | So literally, I am the only one that's able to do anything. 1183.23s - 1185.17s | They can't even upload a file. 1185.17s - 1188.77s | So they're they're really, you know, not doing good. 1189.03s - 1190.39s | Yeah. So telemetry is down. 1190.39s - 1191.97s | They're not even getting telemetry back. 1191.97s - 1194.01s | They're not sending any commands. 1194.35s - 1195.47s | Nothing's happening. 1195.47s - 1197.11s | I've already sent my ransom. 1197.11s - 1200.21s | You know, I want to get paid a lot of money for whatever system this is. 1200.51s - 1203.65s | And if I was a good hacker, of course, I'm going to go decrypt it. 1203.85s - 1205.57s | You know, make sure they get their stuff back. 1205.57s - 1208.47s | I don't want to keep that running. 1208.47s - 1209.71s | And that's what I'm just doing here. 1209.71s - 1211.25s | I'm just going to send a quick decrypt command 1211.25s - 1213.85s | because I'm not going to encrypt my own script 1213.85s - 1215.55s | and make sure it's decrypted. 1215.55s - 1219.85s | Do another reboot of the system and then wait for it to come back up 1219.99s - 1221.99s | and then they'll have full access again. 1221.99s - 1225.63s | So if you ever wanted to know how to ransomware a satellite, 1226.85s - 1227.85s | there you go. 1229.19s - 1229.63s | All right. 1229.63s - 1233.03s


chunk_text:
not even getting telemetry back. 1191.97s - 1194.01s | They're not sending any commands. 1194.35s - 1195.47s | Nothing's happening. 1195.47s - 1197.11s | I've already sent my ransom. 1197.11s - 1200.21s | You know, I want to get paid a lot of money for whatever system this is. 1200.51s - 1203.65s | And if I was a good hacker, of course, I'm going to go decrypt it. 1203.85s - 1205.57s | You know, make sure they get their stuff back. 1205.57s - 1208.47s | I don't want to keep that running. 1208.47s - 1209.71s | And that's what I'm just doing here. 1209.71s - 1211.25s | I'm just going to send a quick decrypt command 1211.25s - 1213.85s | because I'm not going to encrypt my own script 1213.85s - 1215.55s | and make sure it's decrypted. 1215.55s - 1219.85s | Do another reboot of the system and then wait for it to come back up 1219.99s - 1221.99s | and then they'll have full access again. 1221.99s - 1225.63s | So if you ever wanted to know how to ransomware a satellite, 1226.85s - 1227.85s | there you go. 1229.19s - 1229.63s | All right. 1229.63s - 1233.03s | So while this is running, if that was the end of my attacks 1233.03s - 1237.33s | and if any of these kind of gave you like heartburn, made you worry, 1237.33s - 1239.85s | you know, like, oh, my God, what's happening? 1239.85s - 1240.85s | Why are they so simple? 1240.85s - 1243.19s | Why are she able to do this with nothing but an ARP spoof? 1243.73s - 1247.79s | Luckily, every single attack I did is described in Sparta. 1248.23s - 1252.17s | And with those descriptions, we've actually included countermeasures. 1252.67s - 1256.47s | So these countermeasures will tell you exactly how to, you know, how to block it. 1256.69s - 1261.19s | It will tell you all of the different NIST controls that you can add. 1261.19s - 1265.79s | If you're an ISO 27001 person, those are in there, too. 1265.93s - 1270.03s | We've tried to map it to every single thing that people that we know 1270.03s - 1271.93s | in the industry use. 1271.93s - 1275.83s | So, yeah, I would definitely recommend going and looking and reading on that 1275.83s - 1281.23s | and just making sure that


chunk_text:
| So while this is running, if that was the end of my attacks 1233.03s - 1237.33s | and if any of these kind of gave you like heartburn, made you worry, 1237.33s - 1239.85s | you know, like, oh, my God, what's happening? 1239.85s - 1240.85s | Why are they so simple? 1240.85s - 1243.19s | Why are she able to do this with nothing but an ARP spoof? 1243.73s - 1247.79s | Luckily, every single attack I did is described in Sparta. 1248.23s - 1252.17s | And with those descriptions, we've actually included countermeasures. 1252.67s - 1256.47s | So these countermeasures will tell you exactly how to, you know, how to block it. 1256.69s - 1261.19s | It will tell you all of the different NIST controls that you can add. 1261.19s - 1265.79s | If you're an ISO 27001 person, those are in there, too. 1265.93s - 1270.03s | We've tried to map it to every single thing that people that we know 1270.03s - 1271.93s | in the industry use. 1271.93s - 1275.83s | So, yeah, I would definitely recommend going and looking and reading on that 1275.83s - 1281.23s | and just making sure that you are, you know, you have those controls enabled. 1283.01s - 1283.27s | All right. 1283.27s - 1286.17s | So in summary, defense in depth is very important. 1286.43s - 1289.41s | There are a lot of different ways that these attacks could be blocked. 1289.41s - 1294.01s | But, you know, really, we wouldn't have realized that until I did this research. 1294.51s - 1297.37s | For example, the best way that these attacks could have been blocked, 1297.37s - 1301.07s | which I mentioned here, is either including in the bulk crypto unit 1301.07s - 1304.27s | way earlier on in the system, which, you know, 1304.37s - 1306.91s | I would not have been able to communicate with my rogue app. 1306.95s - 1312.55s | The rogue ground station wouldn't have worked without the encryption keys. 1312.85s - 1316.65s | So that would have definitely blocked a vast majority of this information 1316.77s - 1317.85s | or these attacks. 1319.11s - 1322.17s | And I also include the space data link security. 1322.17s - 1325.17s | If you do use CCSDS, it's another protocol that they've released 1325.77s - 1329.15s | to include both authentication and encryption


chunk_text:
you are, you know, you have those controls enabled. 1283.01s - 1283.27s | All right. 1283.27s - 1286.17s | So in summary, defense in depth is very important. 1286.43s - 1289.41s | There are a lot of different ways that these attacks could be blocked. 1289.41s - 1294.01s | But, you know, really, we wouldn't have realized that until I did this research. 1294.51s - 1297.37s | For example, the best way that these attacks could have been blocked, 1297.37s - 1301.07s | which I mentioned here, is either including in the bulk crypto unit 1301.07s - 1304.27s | way earlier on in the system, which, you know, 1304.37s - 1306.91s | I would not have been able to communicate with my rogue app. 1306.95s - 1312.55s | The rogue ground station wouldn't have worked without the encryption keys. 1312.85s - 1316.65s | So that would have definitely blocked a vast majority of this information 1316.77s - 1317.85s | or these attacks. 1319.11s - 1322.17s | And I also include the space data link security. 1322.17s - 1325.17s | If you do use CCSDS, it's another protocol that they've released 1325.77s - 1329.15s | to include both authentication and encryption to their packets. 1329.41s - 1333.17s | So once again, it's very simple things that you can add 1333.17s - 1335.45s | just to block these kind of attacks. 1337.65s - 1339.91s | I've also included in this PowerPoint some reading material 1339.91s - 1342.57s | because I know you guys like to read and you want more things to read. 1342.91s - 1347.45s | So a lot of these briefs are on Sparta, like how we thought of the idea. 1347.91s - 1351.21s | We've also included a lot of links to Sparta, like how to get started with it, 1351.21s - 1354.01s | where to get started with it, because it's a huge application. 1354.71s - 1357.87s | And there's a lot of different media examples of other talks 1357.87s - 1360.21s | that have been done on this kind of sort of same topic. 1360.99s - 1365.89s | I've also included these more DEF CON talks that my colleague, 1365.89s - 1369.61s | Brandon Bailey, have done, also including some of the SISAT work he's done 1369.81s - 1374.01s | and a lot of different papers and articles that also talk about different 1374.01s - 1376.85s |


