# Media

url: https://www.youtube.com/watch?v=dnAkvpl48zY
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
title:
DEF CON 32 - Compromising Electronic Logger & Creating Truck2Truck Worm -Jake Jepson, Rik Chatterjee

content:
{
  "webpage_url": "https://www.youtube.com/watch?v=dnAkvpl48zY",
  "title": "DEF CON 32 - Compromising Electronic Logger & Creating Truck2Truck Worm -Jake Jepson, Rik Chatterjee",
  "description": "Presented by Jake Jepson and Rik Chatterjee, two Systems Engineering Master's students at Colorado State University, this talk delves into the critical security implications within the trucking industry, particularly focusing on Electronic Logging Devices (ELDs). These devices, integral to compliance with Hours of Service regulations, present unique cyber-physical threats due to their networked nature and lack of standardized security protocols.\n\nThe presentation will walk through examining potential remote exploits via wireless ELD compromise, leading to cyber physical control payloads and even wormable scenarios. Key vulnerabilities identified include insecure defaults and poor security practices shown on a commercially available ELD. These vulnerabilities not only expose truck networks to potential unauthorized control but also highlight systemic issues in device certification and security oversight.\n\nThe talk will cover their journey from acquiring and reverse engineering ELDs, discovering their common architectures and weaknesses, to demonstrating proof of concept attacks that underline the urgent need for industry-wide security reforms. Notably, Jepson will discuss his first CVE, detailing the coordinated disclosure process and subsequent manufacturer response.\n\nThis session is semi-technical, ideal for cybersecurity professionals and amateurs alike, interested in vehicle network protocols, and embedded systems security. Prior knowledge of network protocols such as CAN and J1939, along with an understanding of firmware reverse engineering, will enhance the learning experience, but is not required. Tools and techniques used include network scanners, reverse engineering platforms like Ghidra, and various wireless communication methods.\n\nBy attending this presentation, participants will not only understand the specific security flaws affecting heavy vehicles but also appreciate the broader implications for embedded systems security in transportation. This talk is a call to action for improving security practices and regulatory standards in an increasingly interconnected world.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1180,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.02s - 6.78s | This text was transcribed using whisper model: large-v2

 That was quite the introduction for compromising an electronic logging device and creating
6.78s - 9.90s |  a truck-to-truck worm, but that's what we're going to be talking about.
9.90s - 16.30s |  So my name is Jake, this is Rick, and Rick, take it away.
16.30s - 18.66s |  Thanks Jake.
18.66s - 25.06s |  So we are systems engineering master's students from Colorado State University and we work
25.06s - 34.64s |  with Dr. Jeremy Daly and primarily concentrate our research on cyber security of heavy vehicles.
34.64s - 39.88s |  And there's a video of the work we have done, hopefully it plays.
39.88s - 54.08s |  Alongside the truck, you reflash the electronic device, which is running its software with
54.08s - 60.24s |  a malicious firmware that will slow down the truck once it starts executing.
60.24s - 64.32s |  We were successful in this attack, the car broke up alongside it.
64.32s - 69.44s |  About 30 seconds later, the truck begins to slow down and the car pulls out.
69.44s - 74.96s |  This is a wireless attack, it gives us the freedom to explore creative attack vectors,
74.96s - 75.96s |  including flying a drone.
75.96s - 79.76s |  Critical infrastructure is becoming more and more connected, including trucks.
79.76s - 82.44s |  One of the reasons is due to the ELD mandate.
82.44s - 86.60s |  When the ELD mandate first came out, it did not have much security in it.
86.60s - 89.04s |  It couldn't use many security improvements.
89.04s - 93.92s |  And so here at Colorado State University, we are exploring the security of heavy vehicles
93.92s - 98.96s |  as well as the security of the devices attached to the heavy vehicles, such as the electronic
98.96s - 103.26s |  log.
103.26s - 109.78s |  So basically what we did is, as far as we know, the first wireless drive-by attack on
109.78s - 112.30s |  a truck.
112.30s - 120.42s |  And I was driving the truck, Ray got to drive the smooth Tesla by it.
120.42s - 125.98s |  And what he did was basically flash the ELD that was plugged into the truck while the
125.98s - 128.58s |  car was driving by the truck.
128.58s - 134.76s |  And after about 30 seconds, after the firmware was loaded, the device rebooted.
134.76s - 140.14s |  Basically what happened was a car pulled ahead and the truck started to slow down.
140.14s - 145.26s |  And what we found and what we did was that the accelerator pedal stopped working.
145.26s - 151.78s |  It was stuck in idle, and that's why we could not move the truck any forward.
151.78s - 159.53s |  So a bit of background on what happened, why we did, and why we chose to do that.
159.53s - 164.89s |  So first big question that comes up is, why do we do research on commercial vehicles?
164.89s - 170.71s |  Well, one simple answer to that thing is they're very important to the supply chain.
170.71s - 175.03s |  And I think the pandemic gave us a good lesson on why it's important to the supply chain.
175.03s - 181.27s |  The shortages were pretty obvious, what lack of trucks on the road can do.
181.27s - 187.47s |  And they are considered part of critical infrastructure for that very same reason.
187.47s - 189.03s |  What's under the hood of trucks?
189.03s - 193.31s |  Well, basically modern trucks are very much electronical.
193.31s - 199.19s |  They have lots of embedded computers inside them, around 150 ECUs, as we call them, electronic
199.19s - 203.31s |  controller units to control functions of modern trucks.
203.31s - 207.95s |  They use a lot of different network protocols like CAN, CAN FD, LIN, and even the most recent
207.95s - 212.55s |  ones have started using automotive Ethernet for some purposes.
212.55s - 218.79s |  In most trucks here in the United States, they say J1939 is the standard of choice.
218.79s - 225.85s |  And most trucks on the road do use that standard for communication between these ECUs.
225.85s - 230.05s |  Now what are electronic logging devices and how do they come into trucks?
231.05s - 237.13s |  Well, it was started off as a mandate for commercial trucks and most of them use it
237.13s - 240.61s |  ever since the mandate in 2017.
240.61s - 246.93s |  The goal of an ELD is to record hours of service because paper logs are not reliable enough.
246.93s - 252.69s |  Truckers would more often than not be honest in those paper logs and keep driving more
252.69s - 254.77s |  than the allotted hours.
254.77s - 259.33s |  And the goal of electronic logging devices was to basically get rid of that and have
259.33s - 263.17s |  a device log your hours of service.
263.17s - 269.13s |  The big problem with that was in the entire mandate that was out there, there was no mention
269.13s - 271.81s |  of security at all.
271.81s - 277.53s |  The process for getting your own ELD was make one, self-certify it, and you can start selling
277.53s - 280.73s |  it out to each of the trucks.
280.73s - 285.89s |  There are about 880 ELDs as of this time that are out there.
285.89s - 290.29s |  So a lot of different variants from a few different manufacturers.
290.29s - 294.61s |  And the goal of the ELD is once again, they go into the diagnostic port of a truck, similar
294.61s - 300.49s |  to that of a car, and they log data.
300.49s - 305.17s |  One of the fundamental issues with this thing is that more often than not, they require
305.17s - 311.69s |  both read and write access to the internal network of a commercial vehicle to do that.
311.89s - 318.05s |  That write access may create a problem if exploited.
318.05s - 324.05s |  The other thing is that ELDs don't work as standalone devices, and more often there are
324.05s - 330.25s |  other apps or other devices that are connected over Wi-Fi, Bluetooth, or sometimes even over
330.25s - 337.92s |  cellular to get the data of the ELDs that the ELDs record from a modern truck.
337.92s - 344.84s |  Now, when we start looking at ELDs from an attacker's perspective, the main goal is to
344.84s - 352.52s |  somehow go in there, compromise the ELD, and write bad messages so that you can do something
352.52s - 354.84s |  bad with the truck.
354.84s - 360.40s |  The initial landscape looks very difficult because there are around 880, and launching
360.40s - 366.44s |  a successful attack on 880 different variants is extremely difficult.
366.44s - 371.92s |  The other big problem is most trucks have started incorporating gateways, which basically
371.92s - 374.04s |  act as firewalls.
374.04s - 378.68s |  They sit between your diagnostic port and the internal components, which need to be
378.68s - 382.00s |  shielded from attacks.
382.00s - 386.72s |  The other thing is that it's a device that plugs in, so plugging it out would stop the
386.72s - 389.19s |  attack.
389.19s - 394.95s |  So, a typical threat scenario would involve two things, either short-range access over
394.95s - 400.43s |  Bluetooth or Wi-Fi, or long-range access via cellular networks.
400.43s - 405.75s |  But doing a deeper dive into the world of ELDs reveals something entirely different.
405.75s - 413.23s |  Actually, there are only a few distinct ELDs, let's say about 10 of them, and most of them
413.23s - 418.75s |  are basically rebranded clones of one another, and there is significant code reuse among
418.75s - 420.75s |  all the ELDs.
421.55s - 426.51s |  Okay, that takes out 880 and leaves us with 10 to look at.
426.51s - 432.07s |  The other problem is gateways, but gateways have become popular most recently, and trucks
432.07s - 433.67s |  run for a lot of time.
433.67s - 438.79s |  They run for 20, 30 years on the road, and gateways are relatively modern.
438.79s - 442.87s |  So most trucks out on the road today don't have gateways.
442.87s - 447.39s |  So there is the question of having a firewall inside a truck is gone.
447.39s - 453.67s |  Even the ones that do have gateways, they can be subjected to some configuration errors,
453.67s - 459.07s |  and recently our team has discovered some diagnostic protocol flaws that allows you
459.07s - 464.19s |  to write messages in a way that can bypass a firewall and go into the parts of the truck
464.19s - 469.95s |  where it should not go and actually cause some harm.
469.95s - 475.35s |  The other thing about ELDs is that if something bad happens, the first thing a diagnostic
475.35s - 480.99s |  technician would do is remove the ELD to plug their own maintenance tool there to
480.99s - 483.75s |  find out what's wrong with the truck.
483.75s - 487.99s |  So actually finding out the issue becomes a big problem if an attack is launched to
487.99s - 496.67s |  an ELD, and thus we introduce in this research a novel approach of actually compromising
496.67s - 501.43s |  an ELD and creating a truck-to-truck warm.
501.43s - 506.43s |  With that, I would like to hand it over to Jake to go into the in-depths of this research.
506.43s - 511.43s |  Just so I can see cameras.
511.43s - 515.95s |  Alrighty, so since it's DEF CON, instead of just going over what we found, I'm also going
515.95s - 519.35s |  to go over how we did it, because it's a bit of a journey.
519.35s - 527.19s |  This was the first, like, big thing that I've reverse-engineered, and therefore it, in comparison
527.19s - 529.27s |  to, like, CTFs and stuff like that.
529.71s - 536.27s |  All right, so real quickly, I want to make it clear that I'm not up here to shame the company.
536.27s - 538.99s |  In my opinion, all companies have security vulnerabilities.
538.99s - 545.03s |  Some might not have been found yet, but this company did a great job in their response.
545.03s - 551.75s |  So we did a responsible disclosure with them, and they ended up putting out a patch, and
551.75s - 555.63s |  in our opinion, they responded pretty well.
555.75s - 561.39s |  So one day, Dr. Daly, which is our advisor, just went on to Amazon, and he bought some
561.39s - 563.07s |  of these devices.
563.07s - 567.31s |  It's actually, screens are up there, it's actually the little disk, right?
567.31s - 572.83s |  So it's about this big, and the reason he bought them is that they all look very similar.
572.83s - 573.83s |  And they were.
573.83s - 577.87s |  They were the exact same devices being sold by many different major brands.
577.87s - 582.39s |  So the devices are IO6, IO1020 micro-ELDs.
582.39s - 587.55s |  We found that this device was sold by, like, 50 plus different brands, and this is kind
587.55s - 590.13s |  of commonplace in the ELD industry.
590.13s - 594.67s |  So as Rick mentioned before, these devices come with additional wireless networks on
594.67s - 595.67s |  them.
595.67s - 600.95s |  So this one had Bluetooth and GPS, which were mentioned in the manual, but what was interesting
600.95s - 605.95s |  is that when you first powered it on, it actually popped up a Wi-Fi network as well, which is
605.95s - 610.67s |  curious because why would you go through all the effort of programming the Wi-Fi if you
610.67s - 612.51s |  don't mention it in the manual?
612.51s - 619.07s |  So that's kind of the first thing that kind of was a clue initially, and if you go ahead
619.07s - 623.35s |  and look at the picture of the PCB, that's the PCB of the board.
623.35s - 628.75s |  It's an ESP32-based device, and that port right there is kind of what we're going to
628.75s - 629.75s |  talk about next.
629.75s - 633.15s |  So it was labeled PROG, which we assumed was likely programming.
633.15s - 637.03s |  It's an ESP32 device, so doing a little bit of hardware reverse engineering, figuring
637.03s - 639.91s |  out what pins, what communication, what programs to use.
639.91s - 644.27s |  We're eventually able to check the e-fuses on it, and checking the e-fuses allowed us
644.27s - 648.19s |  to determine that it had no protections on it at all, so we could go ahead and just dump
648.19s - 651.67s |  the firmware off of it, and the first thing we're going to do with the firmware is run
651.67s - 657.13s |  strings on it, and normally you don't hit the jackpot with just strings, but in this
657.13s - 658.71s |  case we did.
658.71s - 665.79s |  So as looking through strings, I come across that SSID, and then two lines down, I see
665.79s - 670.83s |  what I can only describe as a Wi-Fi password, and that is what we found.
670.83s - 674.39s |  It was the hard-coded default Wi-Fi password for this device.
674.39s - 679.11s |  We continue scrolling down, and we start seeing stuff about web servers, and these endpoints
679.11s - 685.83s |  of slash upload.php, talking about OTAs and flashing, but it needs a key, and as we go
685.83s - 691.31s |  down a little bit more, we see something that starts with a one, and it ends with a six,
691.31s - 694.03s |  and I'll let you figure out what's in between that.
694.03s - 700.11s |  And that was the hard-coded key that protected the over-the-air updates for this device.
700.11s - 706.20s |  All right, so once we now got onto the Wi-Fi network, of course we can go ahead and do
706.20s - 707.68s |  an NMAP scan.
707.68s - 711.92s |  The NMAP results there are incomplete, but essentially it would find three services.
711.92s - 717.92s |  We had a Telnet service on port 23, we had SSH, well, NMAP thought it was SSH on port
717.92s - 723.24s |  22, I did not think it was that, and then we had an HTTP server on port 80.
723.24s - 728.08s |  So if we look at the screenshot of the HTTP server, we can see it's listing serial version,
728.08s - 732.72s |  and then we have that key, and then a little bit of foreshadowing, we have a firmware-mal,
732.72s - 735.56s |  standing for a malicious firmware that we created.
735.56s - 739.92s |  All righty, so this slide is, of course, the part that takes the longest.
739.92s - 741.96s |  This is the reverse engineer.
741.96s - 744.44s |  We found a device that has these vulnerabilities.
744.44s - 748.44s |  We went ahead and did a little bit of testing to confirm it's not doing firmware signing,
748.44s - 751.64s |  and that we could actually upload a modified binary to it.
751.64s - 753.18s |  But now, what do we do with that?
753.18s - 756.98s |  So at this point, we need to reverse engineer the binary, figure out how it works, to the
756.98s - 761.14s |  point that we can create a malicious firmware for it, and get it to do what we want it to
761.14s - 762.14s |  do.
762.14s - 772.26s |  So this was on ESP32, so the code for it is Extensa, and Extensa was not well-supported.
772.26s - 776.50s |  It's now officially supported by Ghidra, but at the time, it was not on any of the major
776.50s - 779.98s |  ones that I at least had the money for.
779.98s - 782.02s |  And so we were looking at community support.
782.02s - 785.78s |  And the best community support was for Ghidra at the time, but it still needed a lot of
785.78s - 786.78s |  work.
786.78s - 791.20s |  So after spending weeks fixing up the decomp and going through all that, I had a bunch
791.20s - 792.66s |  of flows.
792.66s - 795.82s |  And it's kind of hard to describe what I mean by flows, but essentially, I had a bunch of
795.82s - 796.82s |  functions.
796.82s - 797.82s |  They all kind of connected to each other.
797.82s - 802.34s |  It was clear what their purpose was, but I was missing the thing that connected them
802.34s - 805.66s |  and the main function, and that was a giant thing.
805.66s - 806.66s |  I still don't have main.
806.66s - 811.34s |  So I did what any good hacker would do, is I went snooping, and I learned that there's
811.34s - 812.82s |  an Expressive Forms.
812.82s - 817.26s |  I created an account, logged on, and after looking around, I found that there is an account
817.26s - 819.50s |  called io6llc.
819.50s - 825.94s |  And I guess that was probably related to someone that was working at that company.
825.94s - 828.74s |  And most of their questions and that stuff were pretty normal.
828.74s - 835.42s |  They were either reporting bugs, or they were asking about help for certain things.
835.42s - 840.92s |  But on one of them, they posted a full crash dump, which was beautiful, because if we look
840.92s - 844.80s |  at the crash dump, we can see it's talking about having a bunch of different threads,
844.80s - 847.60s |  and it actually gives names to each of those threads.
847.60s - 852.20s |  And so if I cross-reference those strings that we were looking at earlier, and I look
852.20s - 856.88s |  at where those names are used, I came across a function that ended up being main, and it
856.88s - 859.32s |  just wasn't decompiled correctly.
859.32s - 864.00s |  So now that I had that, I was actually able to get the full picture of how it all worked,
864.00s - 868.16s |  and we went from there.
868.16s - 872.64s |  So quick overview of the vulnerabilities that were discovered through the reverse engineer.
872.64s - 878.48s |  We already talked about the default network credentials, and we had this web server that
878.48s - 883.62s |  seemingly was unused by these resellers, but it was always on and it was always there.
883.62s - 886.84s |  We had Bluetooth and Wi-Fi being on at the same time.
886.84s - 888.80s |  Firmware wasn't being signed.
888.80s - 892.44s |  Firmware updates were protected by the weak password.
892.44s - 897.76s |  And then what I ended up finding was that service on port 22 was actually a debug service.
897.76s - 905.32s |  It essentially acted as an echo server, which we had no use for, and it was beautiful, because
905.32s - 910.58s |  it gave us a giant function to go ahead and put our malicious code in that would always
910.58s - 911.58s |  get called.
911.58s - 912.84s |  It was in its own thread.
912.84s - 916.12s |  We didn't have to make any trampolines out for space or anything like that.
916.12s - 922.08s |  And so we went ahead and just put in a pretty simple little bit of malicious code, and it's
922.08s - 925.72s |  what you kind of see on the screen up there.
925.72s - 930.64s |  And so essentially, this would check a status variable, and once the status variable was
930.64s - 935.12s |  equal to certain conditions, we knew that CAN was initialized, and it actually had a
935.12s - 936.64s |  connection to the CAN bus.
936.64s - 940.84s |  And then at this point, we just went ahead and spammed TSC1 messages.
940.84s - 944.60s |  TSC1 messages are Torque Speed Control 1 messages.
944.60s - 950.42s |  They are a J1939 message that are essentially there to allow you to tell the engine to go
950.42s - 952.02s |  to a certain torque.
952.46s - 956.66s |  In the video, you saw us slowing down the truck, because for safety reasons, we're going
956.66s - 962.42s |  to slow down the truck, but we could have also sped up the truck as well.
962.42s - 967.76s |  In terms of how long it takes, it's a wireless attack, so if you're really close to the device,
967.76s - 968.76s |  it goes pretty quickly.
968.76s - 971.56s |  It can go in like 30 seconds, the entire thing.
971.56s - 975.56s |  But the farther you move away, the longer it takes.
975.56s - 979.90s |  We also found that the service on port 23 was this Telnet service, and this provided
979.92s - 985.28s |  a pretty comprehensive API that not only allowed you to do all the normal ELD stuff, but it
985.28s - 991.36s |  also allowed you to go ahead and change those defaults.
991.36s - 995.48s |  Unfortunately, those weren't being used, and then we found something interesting.
995.48s - 999.88s |  As we were looking through a function that was essentially the main command handler,
999.88s - 1004.46s |  we can see that most of the commands are a pretty normal string compare between essentially
1004.46s - 1006.56s |  the command and whatever your input is.
1006.94s - 1012.86s |  But if you go all the way down to the bottom, and you see these five consecutive if statements,
1012.86s - 1018.26s |  and you match all of these very specific criteria, you'll see it goes all the way down to a send
1018.26s - 1021.42s |  can function, and that's what it would allow you to do.
1021.42s - 1026.90s |  This secret function would allow you to arbitrarily wirelessly send whatever can messages you
1026.90s - 1032.22s |  want as if you were connected over Bluetooth, Wi-Fi, anything like that.
1034.34s - 1039.78s |  All right, so while I was doing this, I didn't have much experience with ESP32s, but I know
1039.78s - 1043.58s |  that they're loved in the IoT community, and one of the things I knew about them is that
1043.58s - 1051.26s |  they could simultaneously be an access point and a station, or a client and an access point,
1051.26s - 1052.26s |  essentially.
1052.26s - 1056.50s |  And so this would allow us to create a worm, a device that would not only be able to execute
1056.50s - 1061.66s |  the attack, but could also scan for and spread to other devices.
1061.66s - 1065.92s |  So we get a lot of truck deliveries to our building where we were working, and we didn't
1065.92s - 1069.60s |  really think it was worth it to build this full cyber weapon on the actual device.
1069.60s - 1073.36s |  So we switched over to dev boards, and on these dev boards, we developed this worm.
1073.36s - 1077.72s |  And essentially, it works exactly like how it would on the actual devices.
1077.72s - 1081.72s |  It just goes ahead, uses the default credentials to log in, perform an over-the-air update,
1081.72s - 1084.76s |  and copy itself onto the new device.
1084.76s - 1086.48s |  So is this realistic?
1086.48s - 1087.84s |  I would argue yes.
1087.84s - 1089.52s |  Trucks congregate a lot.
1089.52s - 1093.98s |  They have truck stops, gas stations, rest stops, ports, distribution centers, hubs.
1093.98s - 1098.34s |  And if you've ever been on the highway, sometimes they take a really long time to pass each
1098.34s - 1099.84s |  other.
1099.84s - 1105.58s |  We found that with the normal ESP32 dev boards, we were able to get a total distance of about
1105.58s - 1108.46s |  120 feet in a dense parking lot.
1108.46s - 1112.34s |  So this is between all of the different cars that were parked there.
1112.34s - 1117.02s |  So that's about 12 parking spaces.
1117.02s - 1120.52s |  Now, the other thing that we found, that for many trucks, the diagnostic port is also
1120.52s - 1124.84s |  left on all the time, which means that it can continually spread, even while the driver
1124.84s - 1129.32s |  is sleeping in one of those large sleeper trucks.
1129.32s - 1130.56s |  So this is fixed, right?
1130.56s - 1135.32s |  This ability for us to drive up alongside of a truck that's using these popular ELD
1135.32s - 1140.52s |  devices, reflash it, and then control the vehicle, causing it to speed up, slow down,
1140.52s - 1143.12s |  spread a worm, something like that is fixed.
1143.12s - 1145.44s |  Well, IO6 responded great.
1145.44s - 1150.94s |  They went ahead and they pushed out a patch to fix these issues, and they overall responded
1150.94s - 1153.24s |  well to the vulnerability report.
1153.24s - 1158.74s |  But these vulnerabilities arose from government-mandated, self-certified devices that lacked sufficient
1158.74s - 1160.14s |  security standards.
1160.14s - 1165.18s |  So we argue that since government regulators have little incentive to get security right,
1165.18s - 1167.70s |  the problem is not fixed until that changes.
1167.70s - 1168.50s |  Thank you.


url: https://www.youtube.com/watch?v=kWSP4F5dxTw
title: DEF CON 32 - DriverJack Turning NTFS and Emulated ROFs into an Infection - Alessandro Magnosi
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=kWSP4F5dxTw",
  "title": "DEF CON 32 - DriverJack Turning NTFS and Emulated ROFs  into an Infection - Alessandro Magnosi",
  "description": "This article reassesses complex cyberattack tactics, focusing specifically on existing security measures and emerging weaknesses. We begin our investigation by examining initial methods of deployment in contemporary attacks, including those that focus on simulated read-only filesystems and NTFS vulnerabilities. Since the improvements made to the Windows security architecture in 2011, which include the enforcement of Driver Signature Enforcement (DSE) and Hypervisor-protected Code Integrity (HVCI), the nature of cyber threats has changed, requiring new ways to carry out attacks.\n\nOur research presents a new method that takes advantage of previously uncovered weaknesses in emulated filesystems, allowing attackers to covertly install and maintain harmful programs. In addition, we uncover new NTFS vulnerabilities that enable attackers to conceal their presence and sustain persistence within victim systems. The study also investigates alternate methods for delivering and executing malware in usermode. In addition, we discuss several Indicators of Compromise (IOCs) to identify and detect these tactics.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2832,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.59s - 8.07s | This text was transcribed using whisper model: large-v2

 Okay. Hi there. Thanks a lot for sticking out with us. Today I'm going to speak around
8.07s - 14.35s |  about driver jack, which is an unusual technique to load the driver on Windows 11, abusing
14.35s - 23.07s |  NTFS features and CDFS bug, I'd say. So, just before starting, a few words about me. I'm
23.07s - 28.95s |  Alessandro Magnozzi. I work for BSI, British Standards Institute. I mainly do research,
28.95s - 36.39s |  but like a huge part of my daily business is consulting in adversary simulation, device
36.39s - 42.03s |  security and appsec. I go on internet with the name Kletz Virus. You can reach me out
42.03s - 50.91s |  on GitHub or Twitter. Like, feel free to reach out. Now, just before starting, I'm going
50.91s - 57.43s |  to just give a bit of information about this project. This project was started in 2022
57.43s - 64.35s |  with Jonas Lake from Secret Club. Um, we started working on a POC to abuse ISOs to
64.35s - 68.99s |  load malicious drivers on Windows. Then we completely forgot about that for at least
68.99s - 74.27s |  one year because I was working on other stuff. And then in 2023, I had an engagement that
74.27s - 81.51s |  supported the development of this technique a bit further. Now, the engagement was a bit
81.55s - 88.87s |  um, like it was an OT engagement and uh, the main um, the main uh, aim of this OT engagement
88.87s - 96.27s |  was to deploy a kernel rootkit on an OT workstation. Now, regardless of the engagement, the
96.27s - 102.11s |  engagement was pretty well uh, and we found ourself in a situation where we could tamper
102.11s - 110.11s |  um, ISO files that were distributed to machines via an update catalog. Uh, so this gave us
110.11s - 117.59s |  a motivation to read, resume the uh, research that we were doing in 2022 and we tried to
117.59s - 122.23s |  understand if we could develop it further. Now, we didn't know exactly what to expect
122.23s - 126.95s |  from the malware that we were generating. Uh, we just need, we just know that we wanted
126.95s - 131.15s |  something to backdoor an installer, present on an ISO and then we want to weaponize it
131.15s - 136.75s |  in a, the best way possible. Of course, ISOs have been weaponized for years right now for
136.75s - 141.43s |  their ability to uh, to bypass multi W but this was not really what we wanted to do. We
141.43s - 146.87s |  want, we didn't want to just provide an ISO to our uh, customer. We had in the position of
146.87s - 153.11s |  weaponize an I, an ISO. Uh, and then we just wanted to execute some code and like deploy
153.11s - 159.51s |  some vectors around, I don't know if you uh, if you uh, are aware uh, always aware about the
159.51s - 164.11s |  um, what StackSnap was doing back in 2011 but we wanted to achieve something like
164.11s - 170.19s |  backdooring DLL on different softwares to intercept communication, intercept code going and
170.19s - 177.39s |  arriving from PLCs and doing stuff like that with uh, using side loading with hooking or uh,
177.39s - 184.17s |  DLL proxying on uh, certain specific DLL used by this kind of software. And the addition, and
184.17s - 188.91s |  the additional thing that we wanted to achieve was deploying a kernel driver on these boxes.
188.91s - 195.99s |  Now the uh, we started and one example of the ISOs that we end up backdooring was step 7
195.99s - 202.13s |  installation media and the reason for this is that it's naturally deployed by using ISO files
202.13s - 209.63s |  and it's pretty difficult to backdoor because um, step 7 use, utilized a back, a bootstrap to
209.63s - 215.07s |  uh, launch the installer. Meaning that um, meaning that it actually performs an integrity
215.07s - 219.75s |  check on the content of the disk before actually launching the installer and it has 2
219.75s - 225.85s |  layer of checks so you need to, you need, you need to, if you want to um, uh, execute malicious
225.85s - 230.93s |  code using the installer, you need to find a way to not tamper with any existing DLL and any
230.93s - 235.93s |  existing executable on the disk. Um, talking about deploying the Windows uh, rootkit, a
239.19s - 244.61s |  Windows rootkit um, usually when you need to deploy a rootkit on Windows, a kernel rootkit, a
244.85s - 249.15s |  kernel driver on Windows, what you end up doing is you call create service, you create a
249.15s - 254.43s |  service for the service driver and then you start the service with the driver. Of course one
254.43s - 260.33s |  requirement for this is that the driver file that you are loading needs to be on disk. Um, now
260.33s - 265.33s |  this can be done manually by manually placing uh, a registry key in the file system and then
268.33s - 273.47s |  calling anti-load driver to load the driver. This is a bit more stealth uh, way of loading a
273.47s - 278.11s |  driver and it's uh, in, in the name for this the thing is Windows log event evasion because it
278.11s - 282.65s |  doesn't generate the event that is usually created when you create a service and start the
282.65s - 289.65s |  service. But of course there is something else that uh, that sticks up. So like there, there is
289.65s - 293.99s |  a every time you, you load the driver regardless if you're using the serve, the start service,
293.99s - 298.99s |  the create service or you use directly the anti-load driver uh, function. Uh, you generate uh,
299.59s - 304.59s |  an event uh, which is the load driver event that is a sysmon event and an event 6 that provides
307.83s - 312.03s |  all the information about the driver you be loaded. So even if it's more stealthy uh, there is
312.03s - 317.03s |  still this that's the, that, that, that appears on, on as an event on the Windows log. So we
319.17s - 324.17s |  wanted a technique that would help us bypass this event load driver as well. Uh, and so we
325.17s - 330.17s |  ended up creating 4 uh, 4 libraries framework. I mean 2 of them are the core of this
332.87s - 339.51s |  presentation which is IOCDFS, IOCDFS lib and driver jack uh, that will be abused to load a
339.51s - 344.41s |  driver on Windows. The other 2 are collateral projects. They were not supposed to be part of
344.41s - 350.69s |  the project. They, they just are RPC exec. I will just talk about it briefly. RPC execs is a
350.69s - 355.69s |  less common way to execute on Windows uh, on local or remote processes without requiring uh,
358.79s - 364.69s |  RX memory to be allocated in target process. And interleaver is uh, it became a sort of P
364.69s - 370.73s |  manipulation library um, that we cannot share completely but I will share a simple block
370.73s - 376.71s |  which is coupling P. You can find coupling P which is coupling preserve on my GitHub page.
376.73s - 382.17s |  Now coupling P is a short version of interleaver. It doesn't manipulate completely the uh, the P
382.17s - 387.17s |  file but it, it's an extension to what Nick Lenders implemented back in 2000, 20, 20? I don't
390.15s - 396.45s |  remember exactly. Uh, so coupling is a framework that takes uh, target DLL, clone the export
396.45s - 401.45s |  address, the export address table and uh, include it in uh, DLL that you developed. Uh, now
401.67s - 406.67s |  this is used usually for DLL side loading using the DLL main function as uh, main entry point
410.41s - 416.41s |  for the DLL. Now the problem is that this process is destructive so if you have some exports in
416.41s - 422.79s |  your payload DLL, these will be erased. So coupling P just solves the problem and it just
422.79s - 428.03s |  preserved the existing export address table and just add the forwards afterward. That's it.
428.05s - 433.65s |  Not, not, not, not really a, not really a difficult project. Uh, RPC proxy invoke instead or
433.65s - 438.65s |  RPC exec is uh, general library that we implemented to as I said is to execute code on local
440.93s - 446.87s |  or remote processes. Uh, it's, it's uh, borrowed by browser exploitation. It abuses the
446.87s - 451.87s |  NDR server call to, to execute arbitrary calls. Uh, it doesn't require RX memory and we
452.61s - 457.61s |  also implemented in a way that it doesn't require a valid RPC binding handle for uh, for
460.69s - 466.39s |  execution. This is, this, there is a reason for this. We wanted something that we could use to
466.39s - 472.23s |  execute arbitrary calls in any server, even in any service, in any processes, even if it
472.23s - 478.61s |  wasn't actually using RPC and we wanted to avoid maintaining, like we wanted to be able to
478.65s - 485.15s |  erase tracks if we wanted and using this technique we can load RPC, initialize it remotely,
485.15s - 491.05s |  execute our stuff, our stuff and then just get rid of RPC RT4 completely by freeing the
491.05s - 496.07s |  library and no traces will remain in the service. The process. Uh, the code is there. There
498.07s - 504.37s |  are also some demos around um, that you can check. It's just for functionality. The project
504.37s - 511.17s |  code is implemented and it has some not limitation but is implemented nerfed. Uh, meaning
511.17s - 517.41s |  that it's not using for example uh, code pattern search for uh, for locating the required
517.41s - 523.49s |  uh, the required entry point in RPC RT4. RPC RT4 changes over time a lot so you need to
523.49s - 527.49s |  adjust it to depending on your version, on your Windows version or you need to implement
527.49s - 532.93s |  yourself the code that actually do the pattern searches. Previous research. So when it
532.93s - 539.73s |  comes to the core of the research or loading a driver on Windows, you have a few ways to
539.73s - 543.81s |  load a valid driver or an unsigned code on Windows to execute unsigned code on Windows.
543.81s - 548.51s |  You can either, actually there are four. So the first one was implemented by Gabrielle
548.51s - 554.05s |  Landau not long ago uh, by exploiting a new vulnerable class that is false file immutability.
554.05s - 557.75s |  I didn't put it in the slides just because it wasn't available when I started doing this
557.75s - 562.55s |  research but go check it out because it's an incredible research. Uh, but the standard
562.57s - 567.51s |  way to uh, load unsigned code on Windows are either you, it's not unsigned, you, you load
567.51s - 574.49s |  signed code so you have a kernel driver that you want to load, you uh, join the um, you
574.49s - 581.13s |  join the um, Microsoft developer program. Microsoft sign your own driver and you're
581.13s - 586.13s |  good to go. You can use a fake signature so before 2015 Microsoft allowed um, kernel drivers
587.13s - 592.13s |  signed with uh, with a valid code signing certificate and cross signed by an EV uh, CA
595.43s - 600.41s |  certificate to load on Windows. So if you have a certificate that was expired before or
600.41s - 607.01s |  issued before 2015 and you have a leaked EV CA certificate, you can still use, you can
607.01s - 612.01s |  still set up your own uh, fake uh, timestamp server and you can back sign one of these
612.31s - 618.97s |  drivers and you can uh, generate a signature that is expired so signed with an expired
618.97s - 625.31s |  certificate but still valid to load on Windows. Uh, the, the third and last technique was
625.31s - 630.89s |  uh, using a vulnerable driver. Now as you can understand, we didn't have, we didn't have
630.89s - 637.53s |  any kernel driver uh, on the developer program. We didn't have any EV CA certificate leaked
637.55s - 642.15s |  and unknown that we can, that we could use so we went to the route of uh, using a
642.15s - 648.49s |  vulnerable driver to load our unsigned code. Now of course, we then started the research
648.49s - 654.83s |  to one for abusable vulnerable drivers and we found 4 of them, 2 of them we just uh, report
654.83s - 660.87s |  to the vendors because they were not useful to us. 2 of them we kept them. Um, now usually
660.87s - 665.27s |  when you want to load unsigned code on Windows, you search for of course there are a lot of
665.31s - 668.59s |  vulnerabilities affecting vulnerable drivers. Buffer overflow, user after free, there are a
668.59s - 673.99s |  lot, not just this that I, that I um, that I included here. But usually what you want is to
673.99s - 679.79s |  have a stable, a stable physical memory read write, virtual memory read write or for example
679.79s - 686.07s |  uh, unprotected MSR access. Um, MSR stands for model specific register. Now the first, this
686.07s - 693.07s |  was abused a lot in 2018, 2020. So when you have and it appears when you have an unco-
693.11s - 700.11s |  an unrestricted code uh, call to uh, WR uh, MSR. So there is a specific model specific
700.11s - 703.85s |  register on Windows which is the uh, well actually not on Windows, it's not specific to
703.85s - 708.85s |  Windows but it's the IA uh, 32 L star that contains on Windows the pointer to um, the system
712.39s - 719.23s |  call dispatch function. So on, before KPTI was introduced uh, this points to KI system call
719.27s - 724.27s |  64. After KPTI mitigation uh, this points to KI system call 64 uh, shadow but regardless this
726.97s - 733.71s |  points to a dispatch function that is responsible to switch to um, that is responsible to
733.71s - 739.65s |  switch to um, from user mode to kernel mode and execute and dispatch to the relevant system
739.65s - 745.23s |  call uh, handler on kernel side. Now if you have an unrestricted call to and you can
745.23s - 750.43s |  override this register, what you can do is you can weaponize it to point to your user
750.43s - 755.43s |  defined uh, handler and this is abused in MSR exec by Xerox uh, from back engineering uh,
758.91s - 765.91s |  magnificent tool to be honest. Um, and this literally implements its own uh, dispatch
765.91s - 770.91s |  function that swap to kernel mode using the swap JS uh, instruction. Uh, disables maps map
771.81s - 776.81s |  and executes arbitrary code uh, stored in a user mode buffer. Uh, afterward it uses ROP to
782.55s - 787.55s |  sorry, it uses ROP to uh, restore maps map and restore the IA uh, L 32 L star. Now this, the
793.93s - 798.67s |  other, the other vulnerable pattern that we have is arbitrary physical memory access. Now uh,
798.69s - 804.67s |  usually when uh, this, this presents itself in two forms. Either a call, a restricted call to
804.67s - 810.61s |  ZW map your sec uh, map your section or that can map whatever physical address in a linear
810.61s - 816.45s |  address or by using mmap IO space. Now the vulnerable pattern that we found the most was
816.45s - 821.85s |  this. It's abusable, it's less abusable than ZW map your section because these actually
821.85s - 827.33s |  provide uh, access that uh, you can't specify the access right so you can't specify read
827.35s - 832.85s |  write uh, instead of read. And this usually is used for privilege escalation. So if you have a
832.85s - 838.83s |  pattern that like this, so you have a call to mmap IO space, IO allocate MDL and then mm, mm
838.83s - 844.23s |  build MDL for non-page pool and then mmap lock page specific, specify cache. You have a
844.23s - 851.07s |  pattern where you can actually uh, allocate page memory, page pool memory, sorry, non-page
851.07s - 856.61s |  pool memory in a user mode buffer and using a technique known as proc scanning you can
856.63s - 862.69s |  identify e-process structure in the non-page pool and swap tokens around to achieve uh,
862.69s - 869.27s |  privilege escalation. And then there is the prints of all other vulnerabilities uh, arbitrary
869.27s - 873.71s |  virtual read, arbitrary kernel virtual uh, memory read write. This presents itself in a lot
873.71s - 879.81s |  of different ways. Can be a mem move, a mem copy, a ZW write virtual memory, can be a
879.81s - 885.79s |  direct pointer assignment uh, it can be whatever. Now this is used for a lot of different
885.83s - 891.53s |  stuff uh, let alone bypass DSC for example or just mapping arbitrary stuff in memory, in
891.53s - 898.17s |  kernel memory. And this is heavily abused by tools like ADMapper or KDU to load your driver
898.17s - 904.55s |  in memory. Now of course Windows doesn't like this uh, so they started introducing a lot of
904.55s - 911.19s |  different mitigations. Since 2018 there was the introduction of uh, KBDI after the
911.19s - 916.63s |  Spectrum Meltdown uh, attack. Uh, then they started introducing VBS, virtualization
916.63s - 922.67s |  based security and started enforcing HVCI. After the HVCI they introduced KDP which we will
922.67s - 929.07s |  see. And then they implemented the Microsoft uh, driver block list and afterward they
929.07s - 934.55s |  started introducing support first for kernel chat, control enforcement, enforcement
934.55s - 939.55s |  technology that uh, neutralize, neutralizes ROP based attack. And then in like weeks ago uh,
942.55s - 948.93s |  they announced that Windows 11 24H2 will support uh, Intel VTRP, redirection protection
948.93s - 953.93s |  that kills another black class that we will gonna see in like now. So VBS is uh, is
957.41s - 962.27s |  really, is really tough for uh, for exploiting vulnerable drivers because HVCI want to
962.27s - 967.27s |  prevents you from abusing a vulnerable driver to load your VTL0 rootkit in memory. Now how
970.73s - 975.75s |  it works, well you have now the Windows low is, is, is runs on top of the hypervisor and uh, it
979.15s - 985.59s |  divides the, divides the, the, the trust level into trust level, the VTL1 and VTL0. Now your
985.59s - 990.59s |  own kernel runs in VTL0. Now this is the guest uh, operating system, the guest operating
992.63s - 999.03s |  OS and what it, what it, what it, what it does is that this uses a normal uh, page structured
999.03s - 1003.97s |  approach to, for address resolution to map a physical address into a linear address. So you
1003.97s - 1008.97s |  have your CR3, you have your um, you have your uh, PML4 entry, then you have your uh, page
1012.01s - 1016.89s |  directory pointer entry, then you have your page directory entry, the page table entry and
1016.89s - 1021.65s |  then finally you have your, your physical address. This physical address though is a guest
1021.67s - 1027.11s |  physical address, meaning that there is another layer, second layer access resolution that is
1027.11s - 1032.11s |  translates a guest physical address into a real physical address that is managed entirely by, by
1035.05s - 1040.05s |  the hypervisor. Uh, using extended page tables. Now what is the problem for us? Is that before
1043.79s - 1048.79s |  this was introduced, page protection was kernel based. So when you had control of kernel, you
1049.57s - 1055.47s |  could do literally anything. So if you had a virtual, if you had a virtual read write, you
1055.47s - 1060.55s |  could literally locate the digi options for example, that is the global variable and like
1060.55s - 1065.79s |  managing the driver signature enforcement and you could just override it. You could nullify
1065.79s - 1071.09s |  it, load your unsigned code and then restore it of course because it, even though it was
1071.09s - 1076.09s |  possible to modify it, it was still protected by kernel patch guard. Um, KPP, kernel page
1076.77s - 1081.77s |  protect, kernel, yeah, patch guard. Uh, but now, now it's different because now the
1084.71s - 1089.71s |  enforcement is done and hypervisor level. Now HVCI does two things and in together with KDP
1093.55s - 1099.39s |  that's a lot of problems. Like HVCI enforces that any page is either writable or executable,
1099.39s - 1104.39s |  can be bought. So this is designed to um, to avoid you from writing your own code and
1106.69s - 1112.13s |  kernel memory and then execute it. So and now this protection is enforced on hypervisor level
1112.13s - 1118.23s |  meaning that you, even if you have your fantastic read write primitive, uh, you can't change
1118.23s - 1122.81s |  the protection of a page because even though you are changing the protection of the page on
1122.81s - 1128.11s |  the first level address translation, this memory protection does not propagate to the second
1128.11s - 1133.89s |  level address translation and it's there that the protection is enforced. So if you have read
1133.95s - 1138.63s |  write, it's gonna be read write even if you change the protection on VTL zero. And if it's
1138.63s - 1144.59s |  read execute, it's gonna be read execute even if you try to change the protection on VTL zero.
1144.59s - 1150.87s |  And with KDP you have another problem because certain area of memory, data section of
1150.87s - 1157.45s |  memory, are protected by this KDP that enforces that the page is read only. So for example
1157.45s - 1162.11s |  G option is protected that way. So now even if you have an arbitrary read write and the
1162.13s - 1166.47s |  page should be read write, it's actually read only so even if you have it, you can't change
1166.47s - 1173.97s |  G options to zero anymore. So what is the strategy around this? Well, luckily someone very
1173.97s - 1178.99s |  smart, smarter than me of course, uh, developed a technique which is called page remapping
1178.99s - 1184.73s |  and page remapping attack exploited um, it's not a bug, it's like a limitation of KDP. KDP
1184.73s - 1189.73s |  doesn't enforce how pages on the guest are translated to pages on the host system. So
1192.47s - 1198.95s |  meaning that not enforcing that, what I can do, one possible thing I can do is I can copy
1198.95s - 1203.95s |  over my con, the content I want to modify to another page. I can modify the um, the page
1206.75s - 1211.75s |  structures on VTL zero to make it point to a read write page on the hypervisor level. And
1214.39s - 1220.19s |  this will effectively make my page read write. And I can modify then the content. So
1220.21s - 1225.21s |  Satoshi Sanda developed a proof of concept and use it, used a null byte page to nullify DSC
1229.13s - 1234.13s |  in exact this way. Now this is also usable for executing arbitrary code. Um, and we have
1237.67s - 1244.61s |  two main strategies for executing arbitrary code even if HBCI is enabled. So this depends
1244.63s - 1249.63s |  a lot on the um, this depends a lot on the uh, Intel CPU level. So if you have, if you have
1252.57s - 1258.51s |  any CPU that is before Tiger Lake, before 11 generation, you can still use ROP because this
1258.51s - 1263.25s |  kind of CPU doesn't, do not support chat. So you can use kernel forge. Kernel forge is a
1263.25s - 1268.25s |  technique implemented firstly by Crash and also discussed by Conor McGar uh, in his, in a
1268.31s - 1273.31s |  blog post. And he uses a thread and a dummy event to modify the kernels, the, the thread, the
1277.35s - 1284.35s |  thread kernel stack uh, at run time. Meaning that it will replace frame on kernel side of the, of
1284.35s - 1290.83s |  a thread to make it execute a ROP chain on return. Executing arbitrary code. And on, if
1290.83s - 1297.33s |  instead you have uh, uh, CPU that is before 12 generation, you can use the page remapping
1297.35s - 1302.35s |  attack as I said uh, that abuses MULK. Now why before 12 generation? I can say, actually I
1304.73s - 1310.73s |  should say a CPU before 12 generation and before Windows and a version of Windows before 24
1310.73s - 1315.73s |  H2 because as I said uh, Windows 11 24 H2 and uh, supports Intel BTRP that is a killer
1319.67s - 1325.31s |  exactly for this kind of attack, for page remapping attack. So it avoids any user from being
1325.33s - 1330.33s |  able to redirect a page from VTL zero to remap to another page in the, in the OS system.
1333.77s - 1340.27s |  Now and what about if we have something, what about if we have something uh, more? Um, I
1340.27s - 1345.41s |  actually, I actually, I'm actually exploring some other technique for trying to bypass HVCI
1345.41s - 1350.81s |  but currently these are the only way I uh, thought that large pages could also be used for
1350.81s - 1355.83s |  this kind of thing but apparently it's not gonna, it's not really working. So, but we still,
1358.79s - 1364.97s |  even if we can do stuff, we still need to load a vulnerable driver to execute any of these
1364.97s - 1371.07s |  strategies. So if we want to load a vulnerable driver we need to be aware that there is
1371.07s - 1375.15s |  something called driver block list that will probably prevent us from loading a known
1375.15s - 1380.55s |  vulnerable driver on Windows. Now the driver block list is a black list and of course it
1380.55s - 1386.09s |  has some problems that were identified by Will Dorman and Yarden Shafir another researcher. The
1386.09s - 1392.49s |  block list by itself is, is just a collection of ashes and uh, file names and file version that
1392.49s - 1397.17s |  are supposed to be not loaded on Windows and if the driver block list is enabled it will
1397.17s - 1402.17s |  prevent normal uh, normal vulnerable drivers to be loaded but it has a measure flow. The
1402.61s - 1407.61s |  coverage is ridiculous. So uh, I, I made a bit of, a little script to check how many uh, how
1412.25s - 1419.25s |  many drivers were blocked from the load driver projects. Uh, this just check the um, the ashes
1419.25s - 1425.09s |  but it's, it's, it's really, it's really ridiculous. The coverage is really ridiculous. And also
1425.09s - 1430.63s |  it can be disabled by admin. Uh, of course when we bypass the block list we need to be aware
1430.63s - 1435.53s |  that there is also the CRL, the CRL. So even if a driver is not in the block list it doesn't
1435.53s - 1440.51s |  mean that the certificate is still valid. So there are other, there are other, there are, there
1440.51s - 1447.63s |  are other things that may prevent us from loading uh, uh, a vulnerable driver on Windows. And
1447.63s - 1452.53s |  now to the meat of this presentation, what can we do to load a malicious uh, vulnerable driver
1452.53s - 1457.97s |  on Windows using this like unusual technique? So let's talk about a bit about the anti-object
1458.83s - 1464.91s |  manager. So the anti-object manager is a subsystem on Windows that provide access to resources
1464.91s - 1471.25s |  uh, using uh, name value approach. It's not entirely correct but it's the most, it's the most
1471.25s - 1478.49s |  accurate the, the simplification. Uh, it provides access to these objects using a unified API
1478.49s - 1483.49s |  and uh, it like every object is, is, is uh, it can be indexed by uh, using a name, can be
1483.49s - 1488.49s |  recovered using a name. And these names are uh, categorized in uh, in categories that we call
1492.63s - 1497.63s |  namespaces. Now uh, you probably already seen the uh, object manager in WinObject, SysInternals
1500.77s - 1505.11s |  and you can see a graphical representation of the object manager. So you have all these
1505.11s - 1510.11s |  objects with the type associated and uh, you have the name categorized in namespaces. Now
1510.71s - 1515.71s |  usually uh, when you, this is actually used um, this categorization is used because any
1518.71s - 1524.25s |  namespace is as a certain accessibility. So if I want for example to make uh, an object
1524.25s - 1529.25s |  available in to the Win32 layer, I usually use a sim link that connect the global, which is the
1531.95s - 1536.97s |  global um, namespace to the specific object I want to, I want to connect it with. And this is what
1537.19s - 1542.19s |  you usually do even with drivers uh, for example. Now the empty object manager uh, is in uh, of
1549.90s - 1554.90s |  course uh, provides access to object to other subsystem like the IOManager, the process
1554.90s - 1560.68s |  manager, the memo, the memory manager, et cetera. And whenever, whenever an object of type
1560.68s - 1565.68s |  file is uh, is, is, is accessed by the IOManager, the IOManager will immediately check the
1566.14s - 1571.14s |  file object and will dispatch it to the relevant driver that is meant to handle that, that
1574.40s - 1579.40s |  specific file object. Now the NTFS driver manage the NTFS file system. What kind of file
1581.98s - 1586.98s |  system is the NTFS file system? So the NTFS uh, NTFS is a complex file system. Uh, it was
1588.72s - 1593.06s |  always designed by Microsoft for extensibility and to support different kind of other file
1593.10s - 1598.78s |  systems like FAT32 et cetera. And the main, the main thing that I want you to memorize for
1598.78s - 1604.48s |  now is that every file on Windows is a set of attributes of course and every file has at least
1604.48s - 1609.08s |  one stream associated. So every file on Windows is actually, can actually be referred to as a
1609.08s - 1614.08s |  triple. It's, it's tripled. Triple, triple. So um, so and um, and usually you have oh, I don't
1614.28s - 1619.28s |  know what I'm saying. So usually you have the file name, the stream type uh, the stream name
1622.62s - 1626.62s |  and the stream type. Every file has at least one stream. So if you specific, if you create a
1626.62s - 1631.46s |  file with just the file name, you are immediately, it means that the other, the stream name
1631.46s - 1637.80s |  and the stream type are defaulting back to something. For files is the data stream and for
1637.80s - 1642.80s |  directories you have the index allocation stream. But they are usually always a triple. Um,
1644.60s - 1649.04s |  now another thing I want you to memorize is the concept of reparse points. Because this was
1649.04s - 1655.42s |  meant for extensibility, uh, NTFS supports a lot of type of reparse point. The main and
1655.42s - 1660.48s |  common, the most common reparse points that you will see in NTFS are three. Although there
1660.48s - 1665.50s |  are like 20 or 30 different reparse tags. So reparse types. So reparse point types. So the
1668.46s - 1672.96s |  main, the most common are junction points that points directory that links directory to
1672.98s - 1679.02s |  directories. Uh, mount point that links directories to drives to, to mounted drives and
1679.02s - 1684.26s |  symbolic links that link files to other files. So this is not to be confused with link file.
1684.26s - 1690.10s |  Link file are regular files. They have a data stream and they are just regular files. They
1690.10s - 1696.54s |  need to be parsed to access to another location on the file system. Uh, indeed symbolic
1696.56s - 1703.26s |  links are an NTFS features. Meaning that they are just, they are just literally linked on
1703.26s - 1709.84s |  NTFS. They link directly on NTFS uh, to another file. And usually a reparse point is always a
1709.84s - 1714.54s |  reparse tag. Which in this case is symbolic link. And are reparse, reparse data that will
1714.54s - 1719.54s |  actually point to the real file that is pointed to. Now about CDFS. CDFS is a way more um, is a
1720.26s - 1725.26s |  way simpler file system. It's, it just, it just comprises uh, root directory and then it
1731.26s - 1736.30s |  has directory and, and then there's directory entries and file entries that are associated
1736.30s - 1743.40s |  and are always parsed from the root directory. Is um, is an implementation of the ISO uh,
1743.40s - 1748.42s |  9667s and 960 and um, the important thing is that the CDFS file system probe, the CDFS file
1754.62s - 1761.46s |  system uh, is also uh, also apply, applies to optical disk as much as applies to ISO files. So
1761.46s - 1767.50s |  ISO files are a beautiful implementation of this CDFS file system. Now just to give a bit of
1767.50s - 1772.94s |  difference to the NTFS. Of course CDFS does not support reparse point, does not support a lot
1772.94s - 1777.28s |  of things that are supported by NTFS, but also it has a completely different threat model. So
1777.28s - 1784.12s |  NTFS supports rich permissions. So it has an AC, an ACL and the ACL is associated with
1784.12s - 1789.50s |  different AC entries, access control entries which define what, what can be done on each
1789.50s - 1795.40s |  file by each user in the system. For CD file system this is not a problem because the
1795.40s - 1801.24s |  content on a CD is supposed to be, is supposed to be immutable. So everyone has access to a
1801.24s - 1807.68s |  file system. If you mount a drive, anyone, an admin, a regular user, anyone has access to the
1807.68s - 1814.48s |  mounted files, to the files on the mounted drive. And yeah, as I said before, the CDFS driver as
1817.32s - 1822.36s |  much as NTFS driver communicates with the IO manager, the IO manager have a, the, has a
1822.36s - 1827.36s |  request to access a file and after passing through the filter manager, it provides access to the
1828.02s - 1833.02s |  required NTFS or CDFS driver um, accordingly to what is the device driver associated with the
1837.10s - 1844.10s |  file object. Now when you load an ISO on Windows, what it, what it's, the CDFS driver will
1844.10s - 1849.10s |  automatically load the content of this uh, ISO file using the CD common read. Now one thing
1852.10s - 1856.72s |  that I want to stress out here is that an ISO file in comparison with a CD, with an optical
1856.72s - 1861.72s |  CD, an ISO file uh, is mapped in uh, physical memory somewhere. So somewhere this ISO file is
1865.22s - 1870.22s |  mapped in memory. Uh, so this creates some problems and we'll see what exactly. So when you
1872.36s - 1877.36s |  try to access a file, what you end up doing is you end up calling the NTCC copy read, copy read.
1877.52s - 1882.52s |  Now this points to a file object, we will describe the file object and just exploring a bit with
1888.02s - 1894.16s |  where this, where this file object were located, we started noticing that the physical address
1894.16s - 1900.20s |  associated with this file object were always the same. So if you remap one of this file object in
1900.20s - 1905.20s |  a read write page and you overwrite the content of this file object, the file object will be
1906.18s - 1911.18s |  will flush the uh, content of the modified file back to the physical memory where the ISO was
1914.36s - 1919.36s |  loaded. This means that it's not read only at all. And so we developed this IOCDFS lib that you
1922.84s - 1927.84s |  can use to uh, just modify any content on any ISO file that was mounted in the system. Now I
1928.82s - 1933.82s |  want to, I want to specify this doesn't work for CD, real CD drive. It just works for ISO files
1938.42s - 1943.42s |  and the reason is potentially that it's because they are mapped on physical memory when they are
1945.70s - 1950.70s |  loaded the first time. Of course for caching. Indeed they are more uh, it's easier to get a file
1951.04s - 1956.04s |  on, on an ISO in, in comparison with uh, with a CD. Now I'm not gonna go through this but there
1960.84s - 1967.08s |  are some limitation on what you can change on the file. So if you overwrite over the file uh,
1967.08s - 1973.42s |  sides uh, the real file sides, not the file sides on disk but the, the virtual sides, it's the
1973.42s - 1979.46s |  change is not gonna, it's not gonna appear. So you can, you can, you can change less but you
1979.46s - 1985.82s |  can change more. And if you write, you try to write over the file on, over the file sides on
1985.82s - 1992.80s |  disk, you end up actually breaking some stuff. So your program will crash probably um, and
1992.80s - 1996.54s |  you're gonna have problems. So these are the margin tolerance where, where, where you can
1996.54s - 2004.18s |  actually replace the file. Now, but it, this is cool but it's abusable. Now yeah it's abusable,
2004.18s - 2008.92s |  there are some use case scenario where we can actually abuse it uh, for a lot of different
2008.94s - 2015.22s |  means. But one of the means is hide the fact that we have a driver on an ISO for example. We can
2015.22s - 2020.22s |  load an encrypted blob on an ISO and then we can just modify it after the ISO was emulated. So
2024.56s - 2030.12s |  we found another thing that we could abuse and this is um, I don't know how much it's, this is
2030.12s - 2035.14s |  known but like if we have a file on disk and we try to link, we try to use the same name to, to
2035.16s - 2040.16s |  create a link, of course the file is gonna say no, I'm not gonna use this name because it's
2044.14s - 2049.14s |  already here. But for some reason if we specify the link name with a stream name associated to
2052.68s - 2057.68s |  it, it will create a reparse point for the file. So this will create a reparse point for the
2057.68s - 2063.82s |  file that will overshadow the data stream that is present on the file on disk. Now this means
2063.84s - 2069.28s |  that at this, at this time after I created the reparse point, the file or and the the original
2069.28s - 2074.28s |  file, the original ATXT is still there but it's not gonna be, no one is gonna be able to find it
2076.12s - 2081.12s |  unless I delete the reparse point. And this is abusable. Why? Because well I can create an ISO
2084.56s - 2090.36s |  and I can use this as trusted installer, I need to elevate my privilege as trusted installer and I
2090.38s - 2095.38s |  can use this to redirect the, a file, a driver file on C, Windows system 32 to something that is
2100.02s - 2107.34s |  on the ISO for example. But this has a problem, the driver, of course the driver file, the driver
2107.34s - 2113.68s |  location, the image loaded is gonna be, is gonna show that I'm loading something bad. So I be a
2113.68s - 2118.68s |  bit more smart, a bit smarter, I create another ISO and this point I will use a coherent
2122.46s - 2127.46s |  directory structure. So now I, and I, I place W, of course I can place whatever driver I want here,
2129.70s - 2134.70s |  here for example there is WinIO. And I do the same thing but still I have a problem because when I
2139.50s - 2145.44s |  load the driver it still say okay this sounds correct but there is still, I mean it's still
2145.44s - 2150.84s |  saying listen you are loading from an ISO file, you're not loading from the system blue
2150.84s - 2155.52s |  directory, you're loading from just an external drive. You're trying to fool me, you didn't
2155.52s - 2163.48s |  manage to though. Then uh this is just to show that the file is still there, so if I, if you
2163.48s - 2168.02s |  delete the reparse point, the original file is still there. Okay just to, just to prove the
2168.02s - 2173.02s |  point. But then we notice another thing, so a direct NTFS link is not enough to bypass to fool
2176.00s - 2180.70s |  the, the load driver event. But then we notice another thing, if we go to the empty object
2180.74s - 2185.74s |  manager we notice that every driver is actually loaded not using C Windows system 32 but is
2188.14s - 2193.14s |  loaded using system root. System 32 driver and the name of the driver. What is this system
2195.42s - 2200.42s |  32? The system 32 is a symbolic link and not an, not an NTFS symbolic link, it's an NT
2202.56s - 2208.90s |  symbolic link uh that is pointing to the device that I use for booting. In my case is device
2208.90s - 2213.90s |  RDS volume 3. But it's pointed to by the boot device, right? But this means and if I inspect
2217.00s - 2223.18s |  the boot device, I notice that I can actually delete this symlink. So this is actually a
2223.18s - 2229.92s |  permanent symlink, meanings that it's been artificially created to have a ref count of 1.
2229.92s - 2236.42s |  But I can make it, I can as system I can make it temporary, load like artificially lowering the
2236.44s - 2241.82s |  ref count to 0 again and then I can delete it. So what can I, what can I do with this? I, I can
2241.82s - 2248.16s |  obtain system privileges, I can back up the original boot device, I can replace the boot device
2248.16s - 2253.76s |  symlink with the ISO and then I can restart the service and see what happens. And what happens
2253.76s - 2258.76s |  is that it works. But the driver load event still shows that I'm loading from an ISO so still I
2259.76s - 2267.58s |  wasn't able to fool it. And another problem is that if I inspect the driver in system
2272.72s - 2277.88s |  informer or a similar tool, I've noticed that the driver is showing for example a missing
2277.88s - 2285.34s |  description. It's showing stuff that indicates that I loaded a malicious, another driver. What
2285.34s - 2292.34s |  if we swap the drive letters? What if I do a drive swap for this is something that nobody will
2292.34s - 2297.40s |  ever think of doing and there is a reason for that. Because if you try to swap the drive
2297.40s - 2302.50s |  letters, your program, your, your system will probably crash at a certain point. There is
2302.50s - 2307.50s |  nothing, but if you do it for just a second and you keep everything consistent so you don't just
2310.14s - 2316.78s |  remove the letters, but you swap into other letters, it actually might work. So the, I'm not
2316.80s - 2321.86s |  showing the screen shot because I'm showing you a video afterward but the, the technique is
2321.86s - 2328.54s |  this. We mount an ISO with an encrypted blob, we just respect the directory structure, we
2328.54s - 2333.08s |  change the boot device to CD-ROM, we swap drive letters, we load the driver, we restore
2333.08s - 2337.98s |  immediately the drive letters, we restore the boot device and then we can at, at that point we
2337.98s - 2346.74s |  can use, we can abuse the driver that has loaded the memory even if we unmount the ISO file.
2346.74s - 2352.76s |  Now what about using other techniques? Well I, I can use other techniques uh to, to load the
2352.76s - 2359.12s |  malicious driver uh but in this case for example I can use uh all the partition that is
2359.12s - 2364.14s |  assigned to the transactional file system. It's not supposed to be accessible by any user, it's
2366.60s - 2373.10s |  not supposed to be writable, but we discovered that if you access this kind of location with
2373.10s - 2378.64s |  the additional, with, with the, with the, with the required permissions, in this case backup
2378.64s - 2385.98s |  intent, say restore, say backup privilege, a maximum file, maximum allowed as uh, as um, as
2385.98s - 2391.22s |  access right, you can actually override this. You can actually access these locations and you
2391.22s - 2396.56s |  can actually write files on them. So and this is a proof of course where I actually am
2396.56s - 2403.54s |  writing, I'm writing on uh the transactional file system uh locations. Is there any benefit? I
2403.54s - 2409.54s |  don't see any benefit in doing it. Uh it can just give you an additional way of exploiting the
2409.54s - 2414.54s |  same vulnerability in, in other ways, not using an ISO. So let's demo it. So Windows 11, HVCI is
2417.62s - 2422.62s |  enabled. Uh I have a simple load of a driver and I hope uh, I hope it actually, because this
2430.41s - 2435.41s |  doesn't actually, oops. Oops. I did a mistake. Okay. So it doesn't show, I don't know how to
2440.79s - 2449.89s |  make play. Like it doesn't show the right, uh huh. Okay. Now it seems it works. Yeah. So okay,
2456.19s - 2461.19s |  here we are seeing that we are targeting the AALP SSI GPO is uh an Intel driver and we are
2462.19s - 2467.19s |  loading our driver, we are switching everything and we're loading the driver. Now the driver has
2469.29s - 2474.79s |  been loaded, the name is that and if you can see, honestly I would, I would challenge to spot
2474.79s - 2480.51s |  the difference. The description is the right one but and if you try to point to the what, what
2480.51s - 2485.51s |  file was loaded, it will actually open the right directory but indeed we loaded another. You
2486.51s - 2491.51s |  can, you can actually spot it from the sides. From the sides. It's 28 kilobyte which is the
2495.41s - 2503.34s |  sides of WinIO. And you can see also from the hash, that is the same hash of WinIO which is a
2503.34s - 2508.24s |  vulnerable driver that is not currently blocked by Microsoft block list. We can do another
2508.24s - 2516.45s |  attempt, this time on Windows, I don't know if there is anything I'm showing. Yeah. I'm, I'm
2516.47s - 2521.47s |  proving that is WinIO here. So you will see that there is the WinIO handle uh showing up in
2523.51s - 2530.08s |  devices and when I will get there, bit of fate. So we have WinIO loaded. Now when I unload the
2536.92s - 2543.46s |  driver that is not unloadable usually, WinIO disappears. So it was WinIO all along. But it
2544.38s - 2549.38s |  doesn't show up anywhere practically and we fooled the driver loader into thinking that we
2554.26s - 2559.26s |  actually loaded a driver on C Windows system 32 as, as, as it was normal. Now on Windows
2563.50s - 2568.50s |  10 or when HDCI is not enabled, we can just strictly integrate it with KDU for example. Same
2569.38s - 2574.38s |  technique, same driver as base uh for exploitation. I still need to, no. Come on. Yes. So
2587.01s - 2592.01s |  still driver jack is executing, arrives. It overwrites the content in memory because the driver
2594.15s - 2599.15s |  is encrypted as I said on the ISO. And then it just loads the drive and straight executes
2602.09s - 2606.53s |  KDU. The vulnerable driver was already loaded because we loaded to the driver, with the
2606.53s - 2611.53s |  driver jack technique. The name is WinIO and we can execute our unsigned code on Windows. Now
2615.14s - 2620.94s |  of course if you want to execute with HVCI enabled, you need to use one of the other thing that
2620.94s - 2625.94s |  I showed before. Candleforge, uh Malk, or unless if, if, or, or you can use, or you can just
2626.94s - 2631.94s |  disable HVCI all together. So the full chain that we used was we weaponized the step 7
2636.98s - 2641.98s |  installation media. Um in, in this way initially we used that child process immediately because as
2644.02s - 2649.02s |  I said uh the set up of the step 7 installation media uses multiple process to install. So we
2649.02s - 2654.02s |  could blend in with an additional process. We rewrite and execute an additional file so we,
2658.82s - 2665.06s |  there was no malware on the ISO except of a minimal DLL use for site loading. And then what we
2665.06s - 2671.40s |  do is we use driver jack, we, we execute uh we install the full candle rootkit. Uh we were
2671.40s - 2677.44s |  targeting Windows 10. HVCI was not a problem in this case. And, and then we just keep going
2677.44s - 2682.44s |  with additional, with additional compromise step. So portability, we have integration with
2684.84s - 2689.84s |  KDU uh if HVCI is disabled. If it's enabled and you have uh inter-K chat not supported you can
2692.14s - 2697.14s |  use Candleforge as I said. If it's um, if HVCI is HVCI is HVC- oh my gosh. If, if hypervisor
2702.26s - 2707.42s |  protected code, enforced code, code integrity is enabled and you don't have Intel VT
2707.44s - 2712.44s |  but you have inter-K chat can use mark. Otherwise, well, the, the best chance so far uh is to
2714.64s - 2719.64s |  just uh disable code integrity and ask for a reboot. Um because there is no currently, there is
2722.98s - 2728.72s |  not currently a technique. As I said, I, I mistakenly believe that you could actually abuse
2728.72s - 2734.96s |  large pages for it. I'm still trying to check it if, if it's possible but it doesn't look like
2735.00s - 2740.00s |  it's working fine. And as key takeaways, I mean you can download the box uh the the for
2742.84s - 2747.84s |  driver jack is, is already, is already public. You can, you can go and take a look. Um for like
2750.38s - 2756.88s |  detection, as detection advice, I would always try to detect if uh someone is escalating
2756.88s - 2762.26s |  privileges to system or trusted installer using no means. Uh monitor for drive letter change
2762.30s - 2767.30s |  to just prevent this trick from uh bypassing detection. Uh of course monitor for changes in
2770.20s - 2775.80s |  the anti-object manager especially for global links. Uh keep your hardware up to date is very
2775.80s - 2781.94s |  important because as, as we've seen, the more we go to modern CPUs et cetera, the, the more
2781.94s - 2788.52s |  difficulties to exploit this kind of bugs. And then, and then there is the one of the detection
2788.52s - 2794.08s |  opportunity which is the probably best is when there is a drove, a driver load event, implement
2794.08s - 2799.36s |  an hash cross check. So there is an hash present on the driver load event. The only thing you
2799.36s - 2805.10s |  need to do is going on the file list, on the file path that is was, that was loaded, perform
2805.10s - 2810.94s |  like calculate the check at run time and then compare the, the hashes. The hashes is are not
2810.94s - 2816.68s |  possible to fool. So uh if the hashes are not matching it means that something happened that
2816.70s - 2821.70s |  was bad. So another driver was loaded in place of the original one. And that's it. Thanks a
2824.28s - 2825.78s |  lot for, for coming.


url: https://www.youtube.com/watch?v=edM1SvSz6pc
title: DEF CON 32 - If Existing Cyber Vulns Magically Disappeared, What Next - Dr Stefanie Tompkins
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=edM1SvSz6pc",
  "title": "DEF CON 32 - If Existing Cyber Vulns Magically Disappeared, What Next - Dr  Stefanie Tompkins",
  "description": "The DEF CON community challenges the status quo, bringing a diversity of perspectives and ideas to identify hidden problems and solutions. While DARPA lays claim to the origin of the ARPANET/internet, vast communities of people with different interests created its novel components. The DARPA Cyber Grand Challenge helped launch the field of vulnerability detection and remediation and numerous DARPA Cyber Fast Track program performers continue to contribute to DEF CON.\n\nWhat if current vulnerabilities all magically disappeared overnight and critical infrastructure were \u201csafe and secure\u201d for the time being. What would come next?\n\nIn this talk, Dr. Stefanie Tompkins will discuss the value of the hacker community and many of the contributions that have come from it, as well as the growth and synergy of the two communities. She\u2019ll also explore the question of what comes next.\n\nFor a deeper dive into the real-world impacts of DARPA cyber technologies, Dr. Renee Wegrzyn, the inaugural director of the Advanced Research Projects Agency for Health (ARPA-H), will join Stefanie and a moderator. They will discuss efforts that impact DEF CON areas of interest and inform ARPA-H work, from Cyber Fast Track to current work focused on securing and defending hospitals and the health tech ecosystem from cyberattacks.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2687,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

1.55s - 28.35s | This text was transcribed using whisper model: large-v2

 twenty seconds. So, my name's Stephanie Tompkins. I'm the director of a little organization
28.35s - 32.95s |  called DARPA. That stands for Defense Advanced Research Projects Agency. I'm really thrilled
32.95s - 37.19s |  to be here talking to you today. Uh, what I want to do is talk to you about what keeps
37.19s - 43.17s |  me up at night. So, when I talk to people about DARPA, it turns out most of them know,
43.17s - 47.31s |  if they've ever heard of us at all, most of them know what we're famous for. Um, that
47.31s - 54.55s |  would be things like, uh, the internet. Uh, stealth technology. Um, maybe a little more
54.55s - 60.47s |  obscure, but the actual creation of material science as an academic discipline, from which
60.47s - 65.47s |  things like semiconductors and alloys and things like that all sort of arose. So, lots
65.47s - 71.35s |  of really big things. Um, they're also super aware that, um, the first word in DARPA is
71.35s - 75.19s |  defense, right? So, we work for the Department of Defense. We spend a lot of time thinking
75.23s - 81.27s |  about national security. So, when people ask me, uh, what keeps me up at night, I'm pretty
81.27s - 87.91s |  sure they're expecting one of two things. A huge military risk area, and, and there are
87.91s - 92.05s |  certainly plenty of them. I think you've heard a number of them already today. Um, or some
92.05s - 100.03s |  really massive technological gap. Truthfully, what keeps me up at night the most is the
100.03s - 105.77s |  fact that there are probably amazing national security ideas out there that we are just
105.77s - 111.81s |  not hearing. Because the way DARPA works, our ideas are coming in at us and we are
111.81s - 116.75s |  trying things from sort of a bottoms-up process over and over and over again, missing the
116.75s - 123.43s |  idea that is going to change the world. That's terrifying. So, um, you know, one thing I
123.43s - 128.17s |  know is that there are many, many communities out there, uh, across the country, across
128.17s - 134.53s |  this world, um, that have amazing ideas, extraordinary expertise, and an in-depth way at
134.53s - 140.83s |  looking at problems that collectively we at DARPA just might not be, uh, um, aware of. And
140.83s - 145.37s |  I should say, you know, so we understand there's some barriers to entry to that. I'm going
145.37s - 149.17s |  to talk about that. But I, I think it's actually worth pointing out that this particular
149.17s - 153.79s |  community and DARPA, um, have quite a history of working together. Um, probably more than
153.79s - 160.63s |  most people realize. So, um, take the internet. I talked about DARPA in the internet. The
160.63s - 167.13s |  truth is what DARPA actually did was we created something called, uh, the ARPANET. And it's
167.13s - 172.77s |  in no small part this community that helped graduate the ARPANET into the internet, um,
172.77s - 178.97s |  that we know and love or don't love on any given day, um, uh, today. So the original
178.97s - 185.43s |  ARPANET, uh, think about this. It was basically designed so that one specialized computer
185.43s - 189.97s |  could talk to another specialized computer in a different part of the country. Uh, remember
189.97s - 194.01s |  back then computers were the size of refrigerators or entire rooms and they cost a whole lot
194.01s - 198.85s |  of money. So it didn't make a lot of sense to be redundant, um, with everybody having
198.85s - 203.73s |  the same capabilities. And the original ARPANET was also really focused on being able to,
203.73s - 209.09s |  uh, be resistant to disruptions. Uh, and so that led to things like packet switching.
209.09s - 214.61s |  So TCPIP, um, which was a huge radical change from this sort of circuit based technology
214.65s - 219.81s |  that were running communications back then, think, uh, you know, basically telephone calls.
219.81s - 225.45s |  Oh, and by the way, I should mention, the very first thing typed into the ARPANET was
225.45s - 232.33s |  meant to be login. They got L, they got O, and then the system crashed. Just remember
232.33s - 237.13s |  that because I'm going to come back to that part later. Um, but no, so thinking about
237.13s - 242.17s |  the transformation of the ARPANET into the internet, it was a lot of poking and prodding
242.17s - 246.89s |  at strengths and weaknesses, um, in the system, identification of vulnerabilities, coming
246.89s - 252.05s |  up with, uh, solutions, improvements, all of that from, you know, communities like this
252.05s - 258.97s |  one, but this one in particularly, which ultimately led to, um, the transformation into the internet
258.97s - 263.49s |  and into something which I think most of us will agree fundamentally changed how this
263.49s - 270.33s |  world, our entire world works, um, lives and communicates. Now that type of transformation
270.33s - 277.29s |  is what DARPA is all about. We're focused on making really big bets, um, on high risk,
277.29s - 281.69s |  you know, new technologies, things that we think are fundamentally going to be revolutionary
281.69s - 286.61s |  and disruptive and game changing, right? Those are all overused words, but they are words
286.61s - 291.01s |  that we live and breathe and we actually mean them when we talk about that. So DARPA, it's
291.01s - 296.33s |  not about making something 5% better or 10% better or even 50% better. It's about making
296.33s - 300.81s |  it 5,000 times better or it's about saying the thing that we want to make better. We're
300.81s - 304.13s |  just going to get rid of it altogether and we're going to move to an entirely different
304.13s - 308.21s |  solution space. Maybe we're going to create new problems, but we're essentially moving
308.21s - 314.41s |  entirely out of the domain of the problem that might feel too hard to solve. Now, um,
314.41s - 320.25s |  I should point out that sometimes the timing isn't right or sometimes we were just wrong
320.25s - 325.77s |  or we failed. We set these massive audacious goals and we didn't meet them. The truth is
325.77s - 331.01s |  that should happen a lot because if we're succeeding at all our goals, it means we are
331.01s - 336.05s |  not doing our job. Um, and we are not taking the big risks, which is what we have actually
336.05s - 341.49s |  been chartered to do. And for what it's worth, um, sometimes we learn a lot more from our
341.49s - 345.69s |  failures or as much from our failures as we do from our successes. And so we celebrate
345.69s - 350.37s |  our failures. Um, but when we do succeed, our belief is that those successes should
350.37s - 355.41s |  be fundamentally changing the world. And one of the things I actually find amazing is when
355.41s - 360.21s |  we look back on those things where we were successful as the movement from this is utterly
360.21s - 369.41s |  impossible to, okay, maybe, but probably not to, well, of course it's inevitable. And how
369.41s - 375.49s |  did we can't even imagine what life was like before. So I'll give you a few, um, a few
375.49s - 383.45s |  additional examples, uh, miniaturized, uh, GPS. So every time you use a GPS enabled device,
383.45s - 391.57s |  that was DARPA, uh, graphical user interfaces, DARPA, uh, the mouse, who knew the mouse would
391.57s - 398.21s |  become so ubiquitous, or maybe you don't use a mouse, but you use a touchscreen, both DARPA
398.21s - 403.69s |  voice recognition and Siri in particular, love it or hate it. We will accept responsibility.
403.69s - 411.23s |  Um, accelerometers, the wireless capabilities at the core of today's smartphones and tablets.
411.23s - 419.27s |  We kicked off the self-driving car industry, brain machine interfaces. So, um, those are
419.27s - 423.71s |  the, the, all things that link back to major DARPA investments. And a lot of those are
423.71s - 428.87s |  things that you have probably heard about. Um, what might be a little less well known
428.87s - 432.99s |  are the more recent interactions that we have had with this community in particular. So
432.99s - 438.91s |  I'm going to ask for a show of hands. How many of you have used Nmap? Okay. That's a
438.91s - 443.79s |  lot of hands. Right. So DARPA was actually instrumental there. Um, exploring ways to
443.79s - 450.23s |  map and learn from an environment containing 4 billion IP addresses to one of 340 trillion,
450.23s - 460.87s |  so IPv4 to IPv6. How about HackRF? Right? Okay, so the creation of a $340 transmit and
460.87s - 465.71s |  receive software defined radio, um, completely lowering the barrier to entry for hackers
465.75s - 471.31s |  and being really transformative in how we interact, um, with spectrum. Um, how about
471.31s - 477.71s |  Onion Routing? Uh, the underpinnings of Tor. Onion Routing was developed actually by the
477.71s - 482.55s |  Navy, but as part of a DARPA program. And the team then decided to release that tech,
482.55s - 487.27s |  that technology open source. Um, it's now used by millions of people every day, helping
487.27s - 492.67s |  to give people a voice all around the world. Or how about that, uh, car hacking? The one
492.67s - 496.57s |  that made the news a few years back? Maybe more than a few years back. I'm, I'm feeling my
496.57s - 500.41s |  age. Uh, but remember when Charlie Miller and Chris Vlachek demonstrated they could
500.41s - 504.81s |  remotely hack a car while the reporter was still inside? Yeah, that was DARPA and that
504.81s - 509.81s |  freaked a lot of people out. And now automobile companies have entire teams dedicated to
509.81s - 514.49s |  worrying about things like that. Now if you actually just look at DEF CON alone, between
514.49s - 520.13s |  2011 and 2014, about 10% of all of the talks could be traced back to just one DARPA
520.15s - 526.65s |  program. Cyber Fast Track, what we call CFT. So I think it's no surprise when you hear that
526.65s - 532.13s |  history to think that we believe we absolutely need to continue to work with you, um, and
532.13s - 537.97s |  hear from you. It's why I'm here. So, uh, I'm gonna go back to those very first couple
537.97s - 544.41s |  letters typed into the internet, right? So L-O crash. Um, it was a memory corruption. Same
544.41s - 548.81s |  old software defect that we have been repeatedly living with. Um, why are so many of the
548.83s - 552.83s |  security vulnerabilities still found around today? Um, really just variations on the same
552.83s - 559.21s |  theme, themes. Uh, I mean code and data corruption, buffer overflows and memory manipulation,
559.21s - 563.61s |  command interjections when, uh, user input is treated as a command, um, instead of
563.61s - 568.31s |  information. And even though many exploits are exquisitely written, they're still
568.31s - 572.05s |  ultimately taking class, uh, advantage of the very same classes of software defects that
572.07s - 580.07s |  we've been living, um, with forever. So what if, uh, all of the classes of security
580.07s - 585.57s |  vulnerabilities, um, or maybe we can appropriately just call them software defects, what if
585.57s - 590.71s |  they all just disappeared tomorrow? You can suggest that that is a DARPA question and it is
590.71s - 595.29s |  one that we are working on and we would love more help in. But the question I want to ask
595.29s - 600.13s |  you is let's imagine that that happens. What's next? Cause that's really the DARPA
600.17s - 605.75s |  question. The adversary doesn't just pack up their bags and quit. Um, we will always have a
605.75s - 610.81s |  mission to complete. So maybe you are the ones with the magic idea, um, about how we can
610.81s - 616.13s |  make all the cyber vulnerabilities disappear overnight. But maybe you have also imagined
616.13s - 622.53s |  the problem we would face when all of them go away. Um, and the bottom line is I mean it
622.53s - 627.13s |  when I say that I'm really worried about what you might be imagining because if we're
627.13s - 631.97s |  not hearing about that we are completely missing out on being able to really make those
631.97s - 638.17s |  big bets and hopefully change the world. So we want you to have the opportunity, um, to
638.17s - 643.21s |  solve really big problems. We want you to be able to share your seemingly crazy ideas,
643.21s - 647.93s |  things that others have missed. Maybe because you're a seer, uh, maybe because you can
647.93s - 651.99s |  identify a problem that no one else can, you know it intimately and you can actually
651.99s - 657.83s |  envision some thread of a, of a, of an actual solution. So when you have a problem that's
657.83s - 661.77s |  hugely important to you, something that you probably had to duct tape and work around
661.77s - 666.03s |  forever to the point that you almost forget that it's there. Um, but you have a glimmer of
666.03s - 670.95s |  an idea on how to fix it. Um, there's a, there's a pretty good chance that that idea, um,
670.95s - 674.95s |  should be important to us and we need to hear from you. We know that you're likely the
674.95s - 680.51s |  best people to both identify and to help solve the problem and we want to enable you. Okay,
680.51s - 686.51s |  so if you've ever tried to work with the government before, um, I recognize that
686.51s - 692.47s |  that's not always really easy and we're easier than most, but still not necessarily
692.47s - 696.31s |  trivial. Um, so we spend a lot of our time trying to figure out how to lower those
696.31s - 700.11s |  barriers to entry and we do a lot of experimentation, not just in science and
700.11s - 705.59s |  technology, but in business. So we've demonstrated before, um, that we can make these
705.59s - 711.51s |  barriers go away. Um, and the, you know, I mentioned the cyber fast track or CFT program,
711.51s - 719.39s |  uh, who here remembers CFT? Okay. A few people, but actually for those that don't, let me
719.39s - 724.59s |  point out. So it was a two year experiment. During that time we had about 500 proposals
724.59s - 730.11s |  come from people in this community, 130 of which were accepted and funded. The program
730.11s - 735.31s |  manager is someone a lot of you, um, know or at least have heard of much. Um, he turned
735.31s - 742.83s |  around decisions on those proposals within 24 hours and within a week we had funds, um,
742.83s - 749.11s |  at the teams in order to actually start working immediately. Mudge also, um, acted as an ambassador
749.11s - 752.75s |  and he made sure that the government respected the culture of the community, um, and that
752.75s - 757.63s |  there was full transparency. After CFT, um, opened the doors to innovative partnerships
757.63s - 763.91s |  like this, DARPA actually continued to engage. And so, um, a number of years ago now we had,
763.91s - 769.59s |  uh, the cyber grand challenge also at DEF CON. And this week we are doing the semifinals
769.59s - 775.59s |  of the AI cyber challenge, AICC. And additionally, a lot more people from this community, um,
775.59s - 781.03s |  have come to DARPA or been, been working behind the scenes with DARPA. Um, so all of them
781.03s - 785.83s |  have really helped shape our ideas and in a lot of ways fundamentally shape what DARPA
785.83s - 790.27s |  is and how we go about doing our mission, you know, in a way that we wouldn't have recognized
790.27s - 796.23s |  maybe 10 or 15 years ago. So, uh, we've proved that it's possible for the government or at
796.23s - 802.95s |  least DARPA, um, to move faster than the commercial sector, uh, and to, and to, while still taking
802.95s - 808.07s |  those really big, bold transformative risks, um, that are part of our mission. So we have
808.07s - 812.75s |  continued that tradition of experimentation, lots and lots more business experimentation,
812.75s - 817.99s |  a lot of different ways to interact much more quickly and much more easily. Um, in some
817.99s - 822.07s |  ways, maybe so many different ways that that in itself has become kind of an interesting
822.07s - 827.03s |  conundrum to sort of figure out what the easiest path is. So, um, we have an organization called
827.03s - 831.03s |  DARPA Connect and if anybody is struggling with working with DARPA or you're not quite
831.03s - 836.23s |  sure where to start, um, all you have to do is, you know, search for DARPA Connect. Think
836.23s - 842.43s |  of it as a one-stop help desk. Like how do I find a program manager at DARPA? How do
842.43s - 847.19s |  I read one of their, their, their, their documents for our calls for proposal, which we try to
847.19s - 851.83s |  write as simply as possible, but which are always burdened with a whole lot of sort of
851.83s - 856.07s |  official terms and conditions that you might be a little worried about. Uh, DARPA Connect
856.07s - 860.59s |  is there to help. They, they're going to provide custom coaching to help with just about any
860.59s - 865.15s |  aspect of engaging with us or with other parts of the defense department. Because, you know,
865.15s - 868.19s |  if it's not us, there's a good chance that what you're talking about should be heard
868.19s - 872.39s |  by somebody, um, somebody else. You know, we've also got some experiments going on and
872.39s - 878.23s |  how to very rapidly get people with great ideas, um, intersecting into the classified
878.23s - 882.79s |  problem space because we have a chicken and egg problem there where defining the problem
882.79s - 886.83s |  and finding the solutions keep going past each other because you sort of have to already
886.83s - 891.83s |  have one in order to have the other. Um, so, you know, the bottom line is you absolutely
891.83s - 896.75s |  don't have to be a major defense contractor to work with us. Uh, at least 30% of our budget
896.75s - 901.95s |  goes to small, uh, to small businesses and non-traditional organizations. Um, another
901.95s - 906.71s |  20% goes to universities. We really tend to have the, the fundamental thing that we look
906.71s - 913.51s |  for is the idea. And we want to make sure that we can hear that idea as quickly as possible.
913.51s - 916.87s |  So I know we still have a lot to learn. The world is changing rapidly, um, but I think
916.87s - 920.63s |  we're moving in the right direction there. And if we're not, I want to hear from you
920.63s - 926.19s |  as to what we can be doing better. Uh, okay. So you, I say over and over again that, uh,
926.19s - 931.11s |  we want to hear your ideas. Who is this we, right? We, um, at DARPA, when I say that,
931.11s - 935.43s |  that means our program managers. DARPA is made up at any moment in time of about a hundred
935.43s - 942.39s |  program managers. They come to us from all walks of life, from this community, from companies,
942.39s - 947.91s |  from other parts of the government, from universities, from many, many different technological sectors.
947.91s - 952.59s |  And they come to DARPA because they think they can change the world. And, um, that's
952.59s - 956.71s |  a pretty deeply uncomfortable state to be in. I mean, it's a lot of responsibility.
956.71s - 959.75s |  And one of the things we find works best to DARPA is that right around the time you start
959.75s - 965.11s |  feeling comfortable, we kick you out. Um, we have a constant cycle, um, of new ideas
965.11s - 968.35s |  and new people. And so that itself can be a little intimidating. You want to talk to
968.35s - 972.71s |  a program manager, but they're, they're constantly cycling in. That's where DARPA connect can
972.71s - 977.99s |  help, um, find the program manager, tell them about your idea. Think about, you know, what
977.99s - 981.99s |  keeps you up at night, what keeps them up at night and look for those opportunities,
981.99s - 986.83s |  um, where we can then make a major investment and do something really transformative together.
986.83s - 991.31s |  Um, so when you reach out to a program manager, all you have to worry about is the problem
991.31s - 996.71s |  that you care about. Let us worry about connecting it to the bigger national security questions
996.71s - 1003.39s |  or to the rest of the government. Um, don't, don't ask them to tell you what to do, right?
1003.39s - 1007.47s |  I mean, seriously, I can't imagine that most of you would, but it does happen. You tell
1007.47s - 1013.27s |  them, um, where you think these missing opportunities and, um, and problems might be. And we really
1013.27s - 1019.51s |  can't wait to hear from you. Okay. So understandably, I'm really passionate about talking about
1019.51s - 1023.91s |  DARPA. I could probably do it all day. Um, but let's just leave it that, that DARPA is
1023.91s - 1032.15s |  pretty awesome, but, um, we are simply the original ARPA. There are actually, um, quite
1032.15s - 1036.39s |  a number of extraordinary organizations that had been arising around the country, um, and
1036.39s - 1042.35s |  around the world that follow a very similar model and the ecosystem is expanding. Um,
1042.35s - 1045.87s |  so I'm really excited that I'm going to be joined here on stage for a little fireside
1045.87s - 1051.91s |  chat by the inaugural director of one of my very favorite ARPAs, ARPA-H, ARPA for health.
1051.91s - 1055.23s |  We all care about health. So I think you're likely to be, uh, I'm interested in what she
1055.23s - 1060.51s |  has to say. And also, uh, I will be joined by much who has very recently returned to
1060.55s - 1087.36s |  DARPA as our chief information officer. So welcome Renee and much. Yeah. All right. Are
1087.36s - 1103.01s |  these, I think it's on. Yep. Oh, there we go. Okay. All right. So it turns out, you
1103.01s - 1107.33s |  know, we all know each other and we've talked to each other, you know, kind of in a, these
1107.33s - 1111.09s |  kind of bilateral conversations. We've never had a chance for the three of us to chat and
1111.09s - 1116.69s |  it turns out we have questions. Um, so we're hoping to sort of enjoy sitting in. We, we
1116.77s - 1121.49s |  are dying to learn a few things from each other. Um, and I am going to kick off with,
1121.49s - 1126.41s |  uh, something that I am sort of embarrassed that I don't really know much. Like we were
1126.41s - 1130.85s |  actually program managers, um, at the same time. I have no idea what made you take that
1130.85s - 1142.35s |  job to actually come work for DARPA. Yeah, sure. We'll just swap like that. Thanks. It's,
1142.35s - 1146.39s |  it's the sharing amongst agencies already. Tech transition in, in progress right in front
1146.39s - 1151.19s |  of your very eyes. Um, well that's a, that's an interesting one. I thought you were going
1151.19s - 1157.23s |  to ask why I, I decided to rejoin. But, but, um, the, uh, the joining. You rejoined because
1157.23s - 1163.11s |  we like overwhelmed you. We were desperate to have you back. But yeah, but the first
1163.11s - 1167.83s |  job and the first. Yeah, the, the, the first one was, um, well, I mean I had been working
1167.83s - 1173.75s |  in technology. I was doing the loft. Um, you know, I had been around folks, uh, who were
1173.75s - 1180.29s |  interacting with DARPA. There was a good academic and hacker community and program managers
1180.29s - 1187.05s |  that we kind of knew. And, um, I was also in, uh, I ended up in a government, uh, contracting,
1187.05s - 1193.51s |  uh, organization. Uh, I won't, uh, name them. And I was looking at things saying, you know,
1193.51s - 1198.69s |  we can, we can do better. Uh, I'm seeing the same ideas coming in over and over again.
1198.69s - 1202.53s |  And some of them I'm seeing are from this community, but not being presented by this
1202.53s - 1209.23s |  community and not being performed by this community. And wouldn't they be the best to
1209.23s - 1215.27s |  do the work because they know the problem, you know, most intimately. Um, and I also
1215.27s - 1220.53s |  wanted to be an ambassador. Uh, I had done this throughout the loft, uh, the first Senate
1220.53s - 1228.79s |  testimony. Um, we won't talk about, uh, many of the others. Um, and, uh, it was a bi-directional
1228.79s - 1232.75s |  one, you know, because I had a good relationship with people in the government where I was
1232.75s - 1237.95s |  like, oh, I see rays of light. I was, you know, I'm critical of a lot of, uh, the government,
1237.95s - 1244.19s |  but I also, you know, want to, uh, give kudos and encourage where I see positive actions
1244.19s - 1250.39s |  going. Um, and then I also wanted to make sure that this community wasn't viewed as
1250.39s - 1256.03s |  just like a resource to pull from. Um, but that this community that we should be a resource
1256.03s - 1262.75s |  to this community as well. Um, what I fell in love with was the fixed term. Uh, the fact
1262.75s - 1267.07s |  that it was like you were fired as soon as you were hired because you're only there for
1267.19s - 1272.79s |  four years, uh, at most. So you better sprint and the things you're dealing with are of
1272.79s - 1279.51s |  such magnitude. And if you stop sprinting, you know, you'll have wasted your time. You'll
1279.51s - 1285.11s |  have missed an opportunity to potentially have changed the world for the better. Um,
1285.11s - 1289.43s |  or you'll have missed the opportunity to take a big chance at an agency that's much more,
1289.43s - 1294.91s |  you know, risk tolerant and acceptant, uh, so that, you know, it's okay to fail. We're
1294.91s - 1300.11s |  going to learn from the failure. So that combination was just like, okay, I, I can't
1300.11s - 1304.63s |  pass this up. Let's give this a try. So that was a huge honor then. And it's a huge honor
1304.63s - 1311.67s |  to rejoin. Um, I wrote a bunch of these down cause so many people sent me in questions,
1311.67s - 1318.11s |  uh, and I wanted to make sure we, we, uh, caught some of these. So, uh, I'm not the
1318.11s - 1323.35s |  only one who was at DARPA. You were at DARPA also, you were at another, uh, ARPA that,
1323.35s - 1329.23s |  uh, I have, uh, relationships with as well. Um, two questions. I'll ask them one at a
1329.23s - 1336.23s |  time. What's, what do you view as the Delta or the differences between ARPA-H and DARPA?
1336.23s - 1342.39s |  Yeah. Oh, right. Yeah. Pass it. I'll pass it back. Um, so I love hearing your origin
1342.39s - 1347.51s |  story to becoming a program manager. And, uh, I do think that's where a lot of the similarities
1347.51s - 1352.83s |  lie. So when I became a program manager, it was also the same sense of urgency to solve
1352.83s - 1357.71s |  a problem and not having an outlet for it. And so, uh, what brought me to DARPA was,
1357.71s - 1362.67s |  was really around genome editing technologies. And this is dating myself here over a decade
1362.67s - 1367.29s |  ago where these were brand new technologies, um, that had a lot of off target effects and
1367.29s - 1371.23s |  unexpected consequences. Um, and that was the first time I came to DEF CON actually
1371.23s - 1374.79s |  was to engage with this community, thinking about DNA as a programming language and what
1374.79s - 1379.51s |  are other ways that you can be, um, preventing misuse, but creating tools to make sure we
1379.51s - 1383.55s |  can get this into the real world. And so giving this back to the people is, is, is
1383.55s - 1387.67s |  such an important part, I think, of what ARPAs do. And so when there was an opportunity to
1387.67s - 1392.51s |  come back to government and, and lead and launch the first ARPA for health, um, with
1392.51s - 1398.95s |  that spirit of adopting that, you know, DARPA bravado, but taking that model and really
1398.95s - 1404.31s |  pursuing our mission, which is to accelerate better health outcomes for everyone. So we
1404.31s - 1409.31s |  stole directly the first eight Heilmayer questions from DARPA. So this is, you know, what's the
1409.35s - 1413.23s |  problem you're trying to solve? How's it done today? What's new in your approach? And then
1413.23s - 1418.75s |  some tactics around, you know, cost, um, how long will it take and what are your milestones?
1418.75s - 1422.99s |  We've added a few questions, um, at ARPA-H. This is one of the differentiators. It's so
1422.99s - 1427.79s |  important in healthcare that we are creating tools that are cost effective, that people
1427.79s - 1433.03s |  can actually afford and that they are accessible to communities, whether it's urban, rural,
1433.03s - 1437.63s |  regardless of your demographics, but then having a customer experience in mind. And
1437.67s - 1441.75s |  so our program managers can't launch a program unless they've thought about who's the end
1441.75s - 1446.31s |  user. As a patient, we've all had negative experiences with the healthcare sector. And
1446.31s - 1452.23s |  so how would you redesign with a human centered approach, that entire process, or as a
1452.23s - 1456.55s |  doctor, um, you know, what I've learned that the OR is sacred. And if you're going to
1456.55s - 1460.87s |  introduce something into the operating room, you need that doctor as a partner, um,
1460.87s - 1465.43s |  developing those capabilities with you. And so, um, we're really trying by design to build
1465.43s - 1470.07s |  that into a lot of what we're doing, um, at ARPA-H. And, you know, Stephanie said that we
1470.07s - 1474.31s |  had, you all have about a hundred program managers. We're at about 20. Uh, we're still
1474.31s - 1478.95s |  growing. So, uh, that's also an open call to think about what are some of those big
1478.95s - 1483.71s |  problems in health, um, at the intersection of, uh, some of the cyber and, and data
1483.71s - 1486.43s |  capabilities is certainly an area that we really want to grow out.
1486.43s - 1492.11s |  I don't know where we're getting the hum or feedback from. So the second one is, I
1492.11s - 1496.79s |  understand the connection on like the biohacking village. I understand the weird
1496.79s - 1504.63s |  machines, uh, uh, Emmanuel LaFroy and, and Sergey Bratis at all. Um, and, and that
1504.63s - 1512.39s |  relationship, but this is normally a predominantly cyber, uh, conference. So ARPA-H
1512.39s - 1514.83s |  and cyber, can you give me a little elaboration there?
1516.35s - 1520.55s |  Yeah. So, you know, when, when coming back to our mission to accelerate better health
1520.59s - 1524.23s |  outcomes for everyone, people really associate health outcomes typically with
1524.39s - 1530.19s |  diagnostics or therapeutics, but actually a hospital shutting down and, uh, because
1530.19s - 1534.95s |  of a ransomware attack or whatever vulnerability may be exploited actually
1534.99s - 1539.11s |  immediately impacts patient outcomes as well. And so if we're being true to our
1539.11s - 1544.47s |  mission, we are really, um, leaning into the, the cyber capability as well. Um, but
1544.47s - 1547.71s |  this is an area where healthcare does not have a lot of strengths. We don't have the
1547.71s - 1552.27s |  workforce that a national security workforce has. Um, so we hired a program
1552.27s - 1556.39s |  manager, uh, back a little over a year ago, Andrew Carney, um, who had been really
1556.39s - 1561.11s |  thinking about programs that, that he can be moving into in this space. Um, and so
1561.11s - 1566.87s |  when Stephanie called me this spring to tell me about the AI, uh, CC challenge, um,
1566.95s - 1572.47s |  it was just such a great opportunity to play to both agencies' strengths. Um, the
1572.51s - 1576.91s |  ability of a DARPA to launch a grand challenge for our agency to learn, but also
1576.91s - 1580.95s |  operate at that intersection. Um, and really Stephanie, it, you know, I learned so
1580.95s - 1584.99s |  much in that call about the challenge, um, where it's been and where it's going. And
1584.99s - 1588.15s |  I think it'd be fun if you wanted to share some of that with the audience today.
1588.55s - 1592.99s |  Oh, sure. Yeah. So the AI cyber challenges is even for DARPA, it's been moving
1592.99s - 1597.75s |  really, really fast. So I should point out like DARPA starts 40 or 50 new DARPA
1597.75s - 1602.19s |  programs a year. Obviously a lot of them don't succeed. Um, when we're looking for
1602.19s - 1605.87s |  those really major breakthroughs, but typically our programs are around, you know,
1605.87s - 1610.31s |  we lay out a hypothesis, we lay out a goal, we call for proposals, and then we fund
1610.31s - 1615.95s |  people with the coolest and craziest ideas. But sometimes problems are, they just
1615.95s - 1619.35s |  don't lend themselves to that structure. Sometimes we need to issue a global
1619.35s - 1624.87s |  challenge. Um, and we want to have teams from all over the country, like working in
1624.87s - 1628.43s |  so many different ways. Like we don't want to over specify the solution space. Um,
1628.43s - 1631.35s |  the first time we did that was something called the DARPA grand challenge. You
1631.35s - 1635.83s |  remember I mentioned, um, our role in the, uh, on the, uh, self-driving car
1635.83s - 1639.59s |  industry. The DARPA grand challenge was all about self-driving cars and it was a
1639.59s - 1643.15s |  race. And we spent a lot of time worrying about like the finish line and how to
1643.15s - 1646.87s |  score, like who was going to, how do we know who actually won? It turns out in
1646.87s - 1651.47s |  that first year, not a single car made it across the finish line. And some of them
1651.47s - 1655.23s |  were on fire. They rolled over, all kinds of crazy stuff happened. So when I say we
1655.23s - 1658.51s |  embrace failure, we do, we do embrace failure. Um, because we went back out the
1658.51s - 1663.99s |  next year and we did it again. Um, and, and that challenge idea is sometimes the
1663.99s - 1669.59s |  right way to structure certain, certain questions. And the AICC, the AI cyber
1669.59s - 1673.91s |  challenge kind of grew around the confluence, a couple of different
1673.91s - 1678.43s |  questions. Um, one was, you know, we were, we were like everybody else. We were
1678.43s - 1683.83s |  looking at this wave of large language models, um, and dominating the
1683.83s - 1687.23s |  conversation. And a lot of the conversation was like all of the terrible
1687.23s - 1691.11s |  things that could happen. And so part of what we wanted to ask is the classic
1691.11s - 1695.39s |  contrarian question. It's like, how do you harness them in ways that we have some
1695.39s - 1699.27s |  confidence in the outcomes for good? And what can we do as quickly as possible?
1699.27s - 1703.63s |  Because we also want to learn. Um, we were having some conversations with people
1703.63s - 1707.15s |  about fundamental national security vulnerabilities. And one was actually a
1707.15s - 1711.75s |  conversation with Ann Neuberger, who was just up here about infrastructure and
1711.75s - 1716.19s |  all of the software vulnerabilities there. So now here's another thing about
1716.39s - 1721.35s |  DARPA. We do not tell our program managers what programs to run. We hire
1721.35s - 1727.47s |  them and they come and tell us what needs to happen. What I can do sometimes
1727.47s - 1732.99s |  is throw out into the atmosphere of DARPA a question and say, if anyone has
1732.99s - 1737.59s |  ideas, this could be really important. And so we threw this question out there,
1737.61s - 1741.83s |  large language models, national infrastructure, lots of looming national
1741.83s - 1746.95s |  security questions. Um, and one of our program managers, Perry Adams, came in
1746.99s - 1750.71s |  like within a couple of weeks and she's like, I got an idea, but we need to do a
1750.71s - 1754.43s |  challenge. We need to do this thing where we're actually looking at harnessing
1754.43s - 1758.67s |  the large language models and finding and repairing vulnerabilities in national
1758.71s - 1764.51s |  national infrastructure as quickly as possible. Um, okay. Maybe unsurprising
1764.51s - 1768.79s |  given the level of talent among our program managers. Um, less than a year
1768.79s - 1771.79s |  after she, so, so actually a couple of months after she had the idea, she was
1771.79s - 1775.83s |  here at DEF CON announcing the kickoff. So that was one year ago. And then not
1775.83s - 1779.51s |  too many months after that, she got, got pulled in by other parts of the national
1779.51s - 1783.35s |  security community, sort of by name. She needed, she was needed for a bigger
1783.35s - 1788.23s |  mission. So we had to find someone else equally amazing. And that was Andrew
1788.23s - 1793.07s |  Carney. And then I, and he worked for an A. Um, so we said, is it, is it actually
1793.11s - 1797.23s |  like against the law for us to share an amazing program manager? And the more we
1797.23s - 1800.23s |  talked about it, the more we talked about the fact that the infrastructure
1800.23s - 1804.71s |  question is one that hits almost every community from one direction or another.
1804.87s - 1808.47s |  So Renee talked about the healthcare side of it. And we have also been talking
1808.47s - 1814.07s |  to our counterparts at ARPA for energy about the power grid or ARPA for, for
1814.31s - 1816.59s |  infrastructure within the department of transportation.
1823.41s - 1826.33s |  I feel like I'm at a Cuban embassy. Bad joke.
1830.35s - 1832.19s |  Okay. We can all still breathe. This is good.
1832.39s - 1838.07s |  So anyway, we, so the AICC challenge. So Andrew took over. He's been awesome. Um,
1838.19s - 1842.03s |  the, the semifinals are, are sort of underway at this moment. We've had some
1842.03s - 1846.47s |  amazing teams. I suspect some of you were out here in the audience. Thank you, uh,
1846.47s - 1850.79s |  for, for putting you are all into, uh, into that challenge. And, and I have no
1850.79s - 1854.31s |  idea where the results are. I am dying, uh, to see, and we're really looking
1854.31s - 1860.79s |  forward to, to hearing that. But that's the, that's the AICC story. Um, and
1860.91s - 1864.11s |  uh, I think that's the, does that cover what you're, you were looking for? I
1864.11s - 1867.03s |  think it's sort of why this community, I think that's kind of obvious, right?
1867.87s - 1874.23s |  So, um, that actually, you know, we've talked about many, many intersections in
1874.23s - 1878.51s |  this community, um, and the ARPAs. Uh, and, and I think maybe one of the people
1878.51s - 1882.15s |  who can best answer my next question, you know, Mudge is you, what advice would
1882.15s - 1886.07s |  you give, uh, to members of this community on working with organizations
1886.27s - 1890.67s |  like ours? Um, so I, I, I don't know how many of you out there, uh, remember
1890.67s - 1896.03s |  the loft. Uh, I know that most of the really technical folks are over at H.D.
1896.03s - 1901.03s |  Moore's SSH, uh, talk right now. But when I was running the loft, which was this
1901.03s - 1906.03s |  very early, what we like to call ourselves hacker think tank. Um, uh, but
1906.03s - 1908.95s |  that was the Senate testimony of shutting the internet down in 30 minutes
1908.95s - 1913.95s |  using the internet. And, and, and, and, and, and, and, and, and, and, and, and,
1913.99s - 1916.19s |  and the other Senate testimony of shutting the internet down in 30 minutes
1916.19s - 1921.19s |  using BGP attacks. Um, was we had all of these ideas and solutions and thought
1922.63s - 1928.51s |  they were really critical, but we looked at places to like figure out we only needed
1928.51s - 1932.01s |  a small amount of funding, you know, in order to do this and there were too many
1932.01s - 1936.27s |  barriers to do it. Um, and that was again back towards the question of why
1936.27s - 1941.85s |  did I join ARPAs? I wanted to remove some of those barriers. And actually a lot
1941.85s - 1947.37s |  of the barriers weren't as big as I thought. And so the advice that I could
1947.37s - 1953.49s |  give to anybody who wants to work on a problem is first off don't try and go in
1953.49s - 1958.53s |  and solve like a government problem. Bring a problem that you're passionate
1958.53s - 1964.21s |  about in your community and it's not just your idea that you know we're
1964.21s - 1969.03s |  looking for. You're probably the one that's been obsessing about it, knows the
1969.03s - 1974.15s |  most nuances about it, have thought about it the most that you've probably got one
1974.15s - 1978.19s |  of the better shots at the solution and you're probably one of the you know the
1978.19s - 1986.31s |  best options to actually perform on it. So how do you you know cross that chasm?
1986.31s - 1994.79s |  You know the first one is the PMs. So as Stephanie mentioned we don't tell the
1994.79s - 1999.31s |  PMs what to do. You know they come in with a general idea or a bunch of ideas.
1999.31s - 2004.27s |  Call them up. They're on the web page. You know they're public servants. We're
2004.27s - 2008.35s |  all public servants up here. Get 30 minutes or 60 minutes of their time if
2008.35s - 2014.07s |  they if they can through the through one of their assistants or schedulers and
2014.07s - 2019.11s |  don't ask you know tell them here's the thing that's been driving me nuts that's
2019.11s - 2024.03s |  been eating our lunch in our community for so long. Here's you know how I
2024.03s - 2029.51s |  quantify why this is just like bleeding us dry and the solutions in place
2029.51s - 2035.95s |  aren't going to converge and here's you know here's my crazy idea with some data
2035.95s - 2040.91s |  points showing that now and with the you know current technology you know might
2040.91s - 2045.99s |  be the right time to do it. And then the other one is when you go to those what
2045.99s - 2049.07s |  they're called broad agency announcements the BAA's what Stephanie
2049.07s - 2053.31s |  was referencing which you know it's a few pages of what you know maybe
2053.31s - 2059.67s |  somebody's looking for and then like a whole bunch of government ease you know
2059.67s - 2067.79s |  you can you can look through those find those five pages use connect and it's
2067.79s - 2072.87s |  not as difficult as possible. If it is difficult or are some of the new ways
2072.87s - 2078.71s |  we've lifted from what we learned from CFT from what we've learned from RFT the
2078.75s - 2083.71s |  different fast tracks and everything and you're still getting stuck somewhere
2083.71s - 2088.63s |  because you can't fly across country to go to an industry day or there's not an
2088.63s - 2093.11s |  announcement from a PM that's directly in line with your idea that doesn't
2093.11s - 2098.11s |  matter tell us where you get stuck tell us what barrier it is how far you went
2098.11s - 2105.55s |  tell us some ideas on how to remove it because we actually have more ability
2105.55s - 2111.55s |  and just might not know that that's a barrier precluding a lot of people from
2111.55s - 2118.43s |  participating and and playing and then the last part is if it's not already
2118.43s - 2122.99s |  some like oh here's an announcement of a program that came out and my thing
2122.99s - 2127.27s |  doesn't really fit in it call the PM's anyway there are these things called
2127.27s - 2133.39s |  office BAA's which are for a whole bunch of other ideas and when you're talking
2133.55s - 2138.31s |  to the PM the PM's aren't allowed to say like oh yes you know this is what I want
2138.31s - 2144.47s |  or yes I will fund your idea or anything thinking everything has to be very equal
2144.47s - 2149.19s |  very open very fair but you can listen for some words that might give you a
2149.19s - 2153.43s |  hint that they're interested such as you know if you wanted to you know spend
2153.43s - 2157.55s |  some time and propose or write up something I'd be interested you know I'd
2157.55s - 2161.79s |  have the interest to read that and consider it you know and look at it so
2161.79s - 2165.71s |  you know if you hear something like that that probably means you have an
2165.71s - 2170.35s |  aligned PM and you know go for it if you hear somebody saying like that doesn't
2170.35s - 2174.55s |  really fit in with what I'm doing you know then maybe you know you couldn't
2174.55s - 2178.07s |  you know look for the next PM or look for the next area so there aren't as
2178.07s - 2182.59s |  many barriers as possible we're trying to remove as many make use of the PM's
2182.59s - 2188.11s |  call tell us where we can do better and make sure it's solving something that
2188.11s - 2193.19s |  matters to you and gives back to your community and your interest we'll figure
2193.19s - 2197.55s |  out if it's something that the DOD has also they will have that problem also
2197.55s - 2201.19s |  even if they don't know about it and that's where DARPA comes into play but
2201.19s - 2206.95s |  we should be a resource to the community and you know any parts of the government
2206.95s - 2211.15s |  shouldn't be in my personal opinion going around and just take take take
2211.15s - 2214.03s |  this looks like a neat community take take take you know what ideas do you
2214.03s - 2217.79s |  have for us it should be bi-directional and it should be in the areas that are
2217.79s - 2223.63s |  naturally aligned neither group trying to change the other into you know a mold
2223.63s - 2228.59s |  of what it expects it to be stay who you are I don't want you to change I want
2228.59s - 2232.31s |  you to keep growing in the direction that you're already growing and the same
2232.31s - 2235.79s |  way you know I do you know there are plenty of ways for the government to
2235.79s - 2240.51s |  change but that's not the game that we're playing right here you know I
2240.51s - 2244.43s |  think you might you really highlight a lot of the roles that a PM has and
2244.43s - 2249.07s |  finding that PM champion is such a key part of I think being successful at an
2249.07s - 2253.91s |  ARPA but one of the roles of a PM is is often to coach the community I've
2253.91s - 2258.43s |  learned over time so how should you be thinking about the problem at ARPA-H a
2258.43s - 2262.75s |  lot of people don't know what even DARPA is and in the healthcare sector so it's
2262.75s - 2266.79s |  having folks think about what does that future look like 10 15 years from now
2266.79s - 2271.39s |  and how should you be thinking about that problem for us we don't have the
2271.39s - 2274.99s |  Department of Defense as our ultimate second buyer we're we're almost
2274.99s - 2278.75s |  exclusively reliant on industry so we have it we have a different challenge at
2278.75s - 2282.51s |  ARPA-H but we have to help industry think about where we should be going and
2282.51s - 2287.15s |  so from your perspective where should how should industry be thinking about
2287.15s - 2291.51s |  cyber and in general where are we going and and how should they be thinking
2291.51s - 2299.35s |  about the path that we're on so and I'm gonna have a similar one back to you for
2299.35s - 2303.71s |  industry I think industry you know this is gonna be much and this is gonna be
2303.71s - 2307.35s |  the whole like well it's why we hired him we knew he'd go off the rails at
2307.35s - 2312.31s |  some point I think the industry is perfectly happy in this perverse steady
2312.31s - 2317.17s |  state situation where we are because you know the the vulnerabilities we keep
2317.17s - 2320.99s |  writing vulnerabilities faster than we can fix them it's not so much that the
2320.99s - 2325.59s |  adversary has gotten so amazing it's that you know like wow well we're
2325.59s - 2329.79s |  producing software more and more rapidly and with the same classes of
2329.79s - 2333.95s |  vulnerabilities over and over and over again so there's not an incentive
2333.95s - 2338.87s |  structure really in place for them to you know go change something if they're
2338.87s - 2344.11s |  not the one owning the cost of fixing it that's us the customers or the end users
2344.11s - 2348.51s |  but it is someplace where like if DARPA went in and magically made everything go
2348.51s - 2353.91s |  away you know I'd be fascinated to say like okay hey why are we throwing all
2353.99s - 2358.99s |  those crashes that we can't turn into RCEs in our fuzzing on the ground it
2358.99s - 2363.91s |  could be that they're actually even more valuable than remote code because if the
2363.91s - 2368.19s |  system turns off at just the right time it can turn back on without leaving
2368.19s - 2373.51s |  permanent damage isn't that kind of one like the the dreams of cyber that like
2373.51s - 2376.87s |  you know you look at look at a drone I don't care about taking over the drone I
2376.87s - 2380.43s |  just would rather it not drop something bad on me right now so let's turn that
2380.43s - 2386.55s |  thing off or you know if I wanted to look at all of the software as a service
2386.55s - 2391.59s |  look at all of AWS or GCE or anything else it's a systems of systems of
2391.59s - 2397.39s |  systems with wild layers of redundancy in different ways and upsetting one part
2397.39s - 2401.95s |  of the system causes it to reroute and change in different ways that might be
2401.95s - 2408.23s |  invisible to the end user but might be very advantageous to either a defender
2408.23s - 2414.47s |  or an attacker so it's this what is the larger system is it side channels is it
2414.47s - 2418.91s |  the fact that it moves into a different realm are you looking at it from like
2418.91s - 2423.07s |  two layers higher than you ever thought of before or are you looking at it three
2423.07s - 2428.83s |  layers lower because your phone has like 35 different CPUs and operating systems
2428.83s - 2434.67s |  and shells inside of it etc so what happens if you know the adversary gets a
2434.67s - 2439.59s |  turn and why don't we figure out that turn first and like you know let's box
2439.59s - 2451.39s |  them in so my final question to the two of you is you're both in charge of
2451.39s - 2459.51s |  agencies with really broad mandates well I'll just say broad areas of interest
2459.67s - 2470.91s |  and execution and challenges two parts to this question one even how broad they
2470.91s - 2475.51s |  are what's something further outside of that realm that you're like this is
2475.51s - 2478.83s |  relevant and we should probably be considering that this might be within
2478.83s - 2486.27s |  our domain and then two if it was just you Stephanie or Renee I get to call her
2486.27s - 2493.67s |  Stephanie as opposed to you Tyro or dr. Tom I'm gonna beat that out of you at
2493.67s - 2501.03s |  some point oh yeah yeah is a what is it you personally if there were no
2501.03s - 2506.79s |  boundaries is something that you're just like I would love to entertain or go
2506.79s - 2512.83s |  after this particular you know bizarre problem that nobody else seems to see
2512.83s - 2522.25s |  but I see it coming around the corner so maybe back to where we started on DNA
2522.25s - 2526.57s |  as a programming language so if we look 10 or 15 years from now we don't have a
2526.57s - 2530.65s |  program on this I would love to find somebody excited about this but you know
2530.65s - 2534.61s |  thinking about large language models every gene has a beginning a middle and
2534.61s - 2538.17s |  an end there's contacts to those sentences there's predictions we can do
2538.17s - 2544.01s |  and we don't have a lot of control of that biological domain we're through
2544.01s - 2547.33s |  gene editing through other genetic therapies we're just starting to do
2547.33s - 2551.73s |  create the tools that that we can control and manipulate genes we can
2551.73s - 2556.69s |  measure genes at scale and to do so in a cost-effective manner but how are we
2556.69s - 2560.29s |  thinking about predicting that obviously for good but at the same time you know
2560.29s - 2565.81s |  preventing malicious use of those technologies and I am so excited we have
2565.81s - 2569.41s |  some little investments at our page looking at this now we have a program
2569.41s - 2573.45s |  called apex that's focused on using generative AI to create you know new to
2573.45s - 2578.17s |  this Earth's sequences that could be antigens to take all the other viruses
2578.17s - 2582.17s |  that we don't yet have vaccines for off the table or to create you know new
2582.17s - 2586.01s |  sequences to make new medicines and diagnostics and so I'm really excited to
2586.01s - 2590.85s |  unlock that moving forward I'd love to hear what you are focused on Stephanie
2590.85s - 2596.21s |  well I mean I'll take the bait I'll ask your second question first I mean if it
2596.21s - 2600.05s |  was just me I would be working on supply chain challenges my training I'm
2600.05s - 2603.85s |  actually a geologist I know where the raw materials come from I know where
2603.85s - 2606.77s |  they don't come from and I know all of the vulnerabilities in that really
2606.77s - 2610.89s |  complex system that the world depends on but you know what there's a whole point
2610.89s - 2615.13s |  about DARPA and ARPA is it actually like what I think is really exciting isn't
2615.13s - 2617.49s |  that important it's what our program managers tell us it's what the
2617.49s - 2621.81s |  communities are telling us an example of one that I'm particularly fascinated
2621.81s - 2625.65s |  right now actually has to do with the future of quantum computing it is still
2625.65s - 2629.13s |  pretty much on the knife's edge as to whether this is going to be one of the
2629.13s - 2635.61s |  most transformative things for humanity ever or utterly useless and while lots
2635.61s - 2639.05s |  of people are working on quantum computing not a lot of people are asking
2639.05s - 2643.65s |  those hard questions as to how we will actually know which side of the fence
2643.65s - 2647.97s |  the technology is going to fall so we're really trying to address that kind of
2647.97s - 2653.05s |  question and the bottom line is that there is no shortage of massively hard
2653.05s - 2657.29s |  problems to solve and amazing technological opportunities so I am very
2657.29s - 2661.05s |  cleverly going to bring this back to our original point which is the ideas
2661.05s - 2665.81s |  are going to come from people like you and we really hope that you aren't shy
2665.81s - 2670.89s |  about telling us what you think they are so and how to solve them exactly yeah
2670.89s - 2679.21s |  with your ideas and you as the performer hopefully 32 seconds to spare so thank
2679.21s - 2683.21s |  you again for your time and your attention thanks everybody


url: https://www.youtube.com/watch?v=TUbpJ-voI8Y
title: DEF CON 32 - Fireside Chat - The Dark Tangent and DNSA Anne Neuberger
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=TUbpJ-voI8Y",
  "title": "DEF CON 32  - Fireside Chat - The Dark Tangent and DNSA Anne Neuberger",
  "description": "This fireside chat will feature an in depth conversation between DNSA Neuberger and Dark Tangent on a variety of cybersecurity and emerging technology topics such as artificial intelligence and quantum computing. DNSA Neuberger has served in a variety of senior intelligence and cybersecurity roles within the National Security Agency, including Director of NSA\u2019s cybersecurity organization and Deputy Director of NSA\u2019s intelligence operations. She has also held multiple positions at the Department of Defense and the private sector, and now leads development of the Biden Administration\u2019s policies on cybersecurity and emerging technologies from the White House. She and DT will delve into the latest and most pressing issues in these domains that concern the White House and how hackers can influence tech-related discussions to improve policy and operational outcomes.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2483,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 5.00s | This text was transcribed using whisper model: large-v2

 Okay, while they're trying to figure out microphone four, I'm going to just give you a little bit of background.
5.00s - 15.02s |  At the federal level, there's stuff happening all the time. And so the best laid plans always fall apart.
15.02s - 22.02s |  And so we were fully prepared for Anne to graciously turn down our invitation this year.
22.02s - 29.02s |  And surprise, she didn't. Everything worked out this year. All the stars aligned for Anne to attend,
29.02s - 34.02s |  which is really awesome, because if you've been following DEF CON for a while,
34.02s - 39.02s |  we've had speakers from CISA, speakers from NSA, speakers from other agencies.
39.02s - 48.02s |  But we have never had a speaker in the White House, you know, Deputy National Security Advisor, cyber.
48.02s - 55.02s |  It's just the people are very busy. So I'm really, I'm really excited you made it.
55.02s - 64.02s |  And so we've got some topics we're going to talk about, but I think really it's an opportunity for us to hear Anne's perspective.
64.02s - 72.02s |  And then for Anne to kind of tell us her perspective from sitting in her position, where she sees things going.
72.02s - 77.02s |  And then hopefully we'll have an interesting conversation and we can all learn a bit.
77.02s - 81.02s |  So let's see, do they have the, are you set up now?
81.02s - 86.02s |  Folks hear me now? We're actively working on it. We just tested it.
86.02s - 89.02s |  They're working on it still. OK.
89.02s - 95.02s |  Standard tech challenges in our lives.
95.02s - 106.02s |  So maybe I'll, since you can't speak, I have the advantage. This is purely accidental.
106.02s - 112.02s |  I guess I'll start with maybe a second topic. I was going to, we were going to bring up the different teams.
112.02s - 116.02s |  But since it requires a little bit of me speaking, I'll do it now.
116.02s - 123.02s |  One of the things I've been noticing for a number of years, and I've spoken about it, is this idea of sort of a, there's sort of a team rule of law,
123.02s - 130.02s |  a sort of team authoritarian or team autocrat, whatever you want to say.
131.02s - 137.02s |  There's a group of undecided nations that are being influenced by rule of law nations.
137.02s - 140.02s |  We're trying to get them on our side.
140.02s - 150.02s |  Authoritarians are trying to bargain with these undecided countries, wherever they may be, Africa, Central America, trying to get them on their side, see the world through their lens.
150.02s - 154.02s |  And what's happening is we're going through sort of a slow motion sorting process.
154.02s - 156.02s |  Are you on our side? Are you on their side?
157.02s - 163.02s |  And with tech, that's sort of accelerating. Are you picking our tech stack or their tech stack?
163.02s - 166.02s |  Are you letting them into our app store or their app store, right?
166.02s - 175.02s |  And you can sort of see this sorting at a tech level happening in Russia right now, with due to the Ukrainian war, not going so well right now for Russia.
175.02s - 178.02s |  A lot of videos are on YouTube.
179.02s - 187.02s |  Russia is now tallying their tech industries, filter YouTube, slow it down, move everybody over to our YouTube, right?
187.02s - 195.02s |  So the Russian government is sorting the Russian citizens into picking the Russian tech stack.
195.02s - 198.02s |  And I think this is becoming more explicit.
198.02s - 207.02s |  And so that means we're in a sorting war kind of, and we should probably be engaged and we should think about it and not make it easy for our adversaries to sort our friends away.
207.02s - 215.02s |  And that means that, you know, we don't have to agree with all of our rule of law friends, partners, allies.
215.02s - 219.02s |  It's sort of like you're on a team. That's why it's called a team.
219.02s - 226.02s |  You don't always agree with your teammates. You don't always play the sport the same way, but you're all working sort of together.
227.02s - 237.02s |  And anyway, so one of my questions to Anne, once we got going and her microphone was working, was going to be about, you know, how do you think about this?
237.02s - 241.02s |  I'm sure you use different language. I'm sure at the national level they have different concepts.
241.02s - 249.02s |  But as an outsider, it's sort of, it seems like something's going on internationally and in tech, and we don't want it to happen to us.
249.02s - 252.02s |  We want to have a seat at the wheel.
252.02s - 255.02s |  So are they got you going yet?
256.02s - 259.02s |  Nothing working. I'll just give you my mic.
263.02s - 265.02s |  I found the microphone.
268.02s - 269.02s |  Yeah, I'll be right over here.
270.02s - 272.02s |  Hey, I'm going to do this, folks.
273.02s - 275.02s |  Move the microphone up a little bit.
278.02s - 282.02s |  This is a community that knows whatever it takes to get the job done.
283.02s - 284.02s |  So first, it's wonderful to be here.
285.02s - 293.40s |  The year I come is this year. So that bottle is a good challenge.
294.40s - 300.40s |  It's wonderful to be here. Jeff noted why I was here. I'm really here because we need this community.
301.40s - 307.40s |  Whether we think about the CrowdStrike incident, which showed us gaps in digital resilience.
307.40s - 314.40s |  Whether we look at the hacks we see from the Iranians and the Russians against water infrastructure, power infrastructure in the United States.
314.40s - 324.40s |  Or frankly, whether we look at on any given week, I get a call from our situation room with a ransomware attack, usually by folks based in Russia, that disrupts the hospital.
325.40s - 330.40s |  When a hospital is disrupted, that's canceled medical services, that's ambulances turned away.
331.40s - 335.40s |  It's impact on real people, particularly in communities where there's only one hospital.
336.40s - 344.40s |  As we live really, really digital lives, the disruption in those lives touches people every single day.
345.40s - 350.40s |  Kids at school, people who really need hospital medical services, and all around the world as well.
351.40s - 354.40s |  So being here is a privilege to have a chance to talk to this community.
355.40s - 360.40s |  We're trying to make this cozy, and talk to this community. So it's wonderful to be here.
361.40s - 364.40s |  So, you mentioned CrowdStrike.
365.40s - 379.40s |  And so, you're sitting at the job, and you get messages saying, oh no, airports are down, and trends, all these things are happening because of the CrowdStrike problem.
380.40s - 381.40s |  But you don't know it's the CrowdStrike problem yet.
382.40s - 383.40s |  Thank you.
383.40s - 389.40s |  Doesn't that look a lot like the preparatory moves that China might make before going for Taiwan?
390.40s - 395.40s |  Like you're disrupting air traffic, you can't have military transport authority going.
396.40s - 400.40s |  In those unknown moments, what's going through your head?
401.40s - 407.40s |  How do you quickly realize, no, no, it's a mistake, it's not a preparatory move?
408.40s - 416.40s |  Because it seems like, well, the tech industry has gotten us to a point now where bad deployment can look a lot like the prelude to an invasion.
417.40s - 418.40s |  That's not a place you want to be in.
419.40s - 423.40s |  And you know, it's really interesting, because there's two parts to my job.
424.40s - 430.40s |  Which is really the reason the President, my job has been the first time that in the White House, they have somebody who works in the National Security Council.
430.40s - 437.40s |  And the National Security Council typically focuses on, as it sounds, national security threats, who focuses on cyber and emerging tech.
438.40s - 440.40s |  And really the reason was the question you just asked.
441.40s - 442.40s |  Because there's two parts to every problem.
443.40s - 444.40s |  One is us, and one is them.
445.40s - 447.40s |  And us is, how is this attack successful?
448.40s - 452.40s |  And how do we quickly assess the impact and accelerate recovery?
453.40s - 457.40s |  Because we can't have disruption of the most important things in Americans' lives.
457.40s - 459.40s |  The second part is them.
460.40s - 461.40s |  Who is the actor?
462.40s - 465.40s |  Is it a criminal, is it a country, or a set of criminals, a set of countries?
466.40s - 471.40s |  And then our goal overall is, how do we respond to deter the next attack?
472.40s - 473.40s |  And that's really hard in cyberspace.
474.40s - 476.40s |  First, because attribution is often hard.
477.40s - 484.40s |  Second, because, okay, so if Russia-based ransomware attackers disrupted a hospital chain, right?
484.40s - 492.40s |  Ascension Health, a number of months ago, multiple hospitals across multiple states, took them almost six weeks to recover from that ransomware attack.
493.40s - 494.40s |  What's the deterrence?
495.40s - 500.40s |  From an individual perspective, right, there isn't law enforcement cooperation today between the U.S. and Russia.
501.40s - 507.40s |  From an infrastructure perspective, we've done takedowns of infrastructure, often with partners around the world.
508.40s - 512.40s |  They're temporary. There's so much vulnerable infrastructure that attackers can use in the second round.
512.40s - 513.40s |  And what's driving it?
514.40s - 516.40s |  It's often cryptocurrency and getting paid.
517.40s - 520.40s |  In 2023 alone, there's $1.3 billion paid in ransoms.
521.40s - 529.40s |  And we can talk at length about cryptocurrency and what we see it enabling from money laundering to sanctions evasions in the North Korean context.
530.40s - 534.40s |  But it's really hard when you start unpacking the problem and you say, how do you deter it?
535.40s - 538.40s |  And this actually played out just this week, folks may have seen, at the U.N.
539.40s - 541.40s |  There's a global discussion on a new U.N. cybercrimes treaty.
542.40s - 543.40s |  It would be the first one ever.
544.40s - 558.40s |  And navigating both civil society and human rights groups who say, anything you do enables authoritarian governments to stop somebody traveling and say, hey, do you have the password to that system?
558.40s - 570.40s |  On the other hand, you have countries like the United States, the U.K., Australia, Singapore, countries around the world that want to partner and work together because these are problems that have no borders.
571.40s - 578.40s |  So to your point, bringing that together, the us and the them, comes together in the case of each time an incident happens.
578.40s - 583.40s |  So with CrowdStrike, I happen to have been out of Washington.
584.40s - 585.40s |  So my phone rings at 4 a.m.
586.40s - 587.40s |  It's a situation room.
588.40s - 589.40s |  They're like, hi, we need to notify you of an incident.
590.40s - 591.40s |  My first call was the CEO.
592.40s - 597.40s |  And as soon as he walked through what had happened, we knew it could only be either an insider or whatever.
598.40s - 599.40s |  So you woke up George.
600.40s - 601.40s |  I think George was up.
602.40s - 603.40s |  Already awake.
604.40s - 605.40s |  He was already well awake.
605.40s - 609.40s |  But our first question always is in the middle of an incident, the us question.
610.40s - 612.40s |  What's the impact and how do we recover as fast as possible?
613.40s - 615.40s |  The second question is, who did it and what do we do about it?
616.40s - 617.40s |  Because what's most important is that we recover.
618.40s - 619.40s |  Right.
619.40s - 624.40s |  So having that quick ability to get to the source quickly allied your concerns that it was anything else, right?
625.40s - 632.40s |  So that tight connection between the need for the tight connection between private industry and government, right, you need to have a really good Rolodex.
632.40s - 636.40s |  Because when something goes wrong, you need to literally get there in minutes.
637.40s - 643.40s |  And it raised, honestly, it raised questions for all of the software industry because there are many.
644.40s - 650.40s |  And all of us who've coded and deployed know when we see something like this happen, the first thing we say is, there but for the grace of God, go I.
651.40s - 658.40s |  So I think in that case, it raised real questions about testing, about rollback and what's possible, what's not.
658.40s - 664.40s |  About testing across an ecosystem between different companies, the cooperation that enables that.
665.40s - 672.40s |  So I think that's the kind of things we're now working on with companies to say, given our lives run on this digital infrastructure,
673.40s - 680.40s |  we need to have confidence that when there are updates, they're staged, they're properly tested, and they can be rolled back if something goes wrong.
681.40s - 687.40s |  It's super fascinating because far enough back in time, I think it was maybe not after Slammer worm,
688.40s - 693.40s |  but Microsoft wanted to move a bunch of these drivers out of the kernel.
694.40s - 697.40s |  Not give access to developers, right? Ring zero or maybe ring one.
698.40s - 705.40s |  And the pushback from Europeans were that was anti-competitive, market forces argument.
706.40s - 710.40s |  And from antivirus vendors, it was also anti-competitive.
711.40s - 713.40s |  You'll keep your stuff in the ring zero, it'll be faster, more performant.
714.40s - 716.40s |  Our stuff will be at a disadvantage.
717.40s - 722.40s |  So Microsoft relented and then decades later, it blows up in their face.
723.40s - 727.40s |  And now the same governments are saying, why are you allowing them to do this in ring zero?
728.40s - 732.40s |  Why can one vendor destroy the entire operating system and everybody else?
733.40s - 738.40s |  And so it almost seems like the regulators now are starting to become more educated or more nuanced.
739.40s - 742.40s |  Maybe they can understand the impacts of some of their market forces.
743.40s - 745.40s |  Market force demands carry the day.
746.40s - 749.40s |  Arguments around markets carry the day, but now there's arguments around security.
750.40s - 752.40s |  And they have maybe more weight now.
753.40s - 756.40s |  And so now you can make a better trade-off, right?
756.40s - 762.40s |  So you find yourself maybe the security argument being having more weight in these discussions?
763.40s - 764.40s |  It does.
765.40s - 770.40s |  Or is this commerce just roll in there and say, no, you know, commerce dictates everything.
771.40s - 778.40s |  You know, on the positive side, more and more governments and people see that policy has to move, not at the speed of tech.
779.40s - 782.40s |  It would be ideal if it moved at the speed of tech, but at least much, much faster.
783.40s - 787.40s |  So things that we considered five years ago or 10 years ago are totally changed, right?
788.40s - 792.40s |  I was walking around and I really encourage folks to visit the DARPA's AI Cyber Challenge booth.
793.40s - 800.40s |  Now when we launched the DARPA AI Cyber Challenge a year ago with DARPA, what was so exciting was to say, let's be candid.
801.40s - 803.40s |  Folks on offense are already a step ahead.
804.40s - 806.40s |  Because on offense, you have to find one vulnerability to exploit.
807.40s - 810.40s |  On defense, you constantly have to be managing a pretty broad space.
810.40s - 820.40s |  And particularly when I think of us on the government side, when I think about DOD, we have weapons programs or weapons, think submarines, satellite systems for sure that were launched 30 years ago.
821.40s - 828.40s |  They're facing a modern adversary that they never considered when they built the risk models, frankly, when they built and deployed the encryption.
829.40s - 835.40s |  We're in a very different world just in terms of high-performance computing advancements and encryption we may have launched 30 years ago in a satellite.
836.40s - 842.40s |  So the core goal I think we have to consider on defense is tech is our helper.
843.40s - 844.40s |  Tech is our partner because it's so much harder.
845.40s - 858.40s |  So for example, what's so cool and I don't know where it is now, but when I passed earlier, the AI Cyber Challenge, the teams had found three vulnerabilities in open source code that you would imagine has been fuzzed, has been checked, etc.
859.40s - 865.40s |  And not only that, they built a patch for at least one of them when I passed using AI models.
866.40s - 886.40s |  That's remarkable because if that can bring tech to the defensive fight, to the securing fight, potentially that could change that offense-defense dynamic, which is really tough for all of us who want to build and deploy technology that's underpinning our lives, our militaries, our banks every single day.
887.40s - 890.40s |  So that's kind of maybe a good tie-in.
891.40s - 893.40s |  So you've got two parts to your title, right?
894.40s - 897.40s |  Maybe two hats, emerging technology and security.
898.40s - 901.40s |  So when you were speaking just then, I was thinking, ah, emerging technology, AI.
902.40s - 904.40s |  But you also have to wear your security hat, right?
905.40s - 906.40s |  Are they ever in conflict?
909.40s - 910.40s |  You know, it's interesting.
911.40s - 914.40s |  So I've had the privilege of both running offensive and defensive cyber operations.
915.40s - 918.40s |  Now I have to stand and be closer.
919.40s - 920.40s |  Sorry about that.
921.40s - 922.40s |  We'll get this.
923.40s - 925.40s |  So I started to say, you heard Jeff's question.
926.40s - 928.40s |  I've had the privilege of both running offensive and defensive operations.
929.40s - 942.40s |  So we try very much from a defensive perspective to bring that offensive mindset to say, what's the easiest way and what's the most persistent way that an adversary might try to get into the system and how do we defend against that?
942.40s - 947.40s |  And I think in the emerging tech area, when I think about where we spend a lot of our time.
948.40s - 954.40s |  So next week NIST will be announcing the first post-quantum cryptography formal standards that are going for fixed standardization.
955.40s - 956.40s |  That's exciting, right?
957.40s - 960.40s |  Cryptography is the root of almost everything that we do in cybersecurity.
961.40s - 968.40s |  And one of the main ways asymmetric cryptography is at risk if somebody can build a cryptographically relevant quantum computer.
968.40s - 971.40s |  We think that's six to ten years off.
972.40s - 978.40s |  But it's a massive risk because that kind of key exchange underpins so much of security when we're shopping.
979.40s - 982.40s |  Right, and now they're talking about the store now, decrypt later.
983.40s - 988.40s |  So even if it's six to ten years from now, it's not really six to ten years on the most sensitive.
989.40s - 990.40s |  On information you care about.
990.40s - 991.40s |  Right.
992.40s - 998.40s |  So when those standards are, when NIST announced them next week, the cool part of our jobs is then saying,
999.40s - 1001.40s |  okay, who are the core companies who are already testing?
1002.40s - 1006.40s |  Apple's testing, Google's testing, Amazon, and some of them have done deployments already of post-quantum cryptography.
1007.40s - 1008.40s |  Let's get that out first.
1009.40s - 1013.40s |  Let's get that deployed because frankly, as we know as cryptography, the algorithms are often the easiest part.
1014.40s - 1017.40s |  It's the implementation where there's often errors that can be exploited.
1017.40s - 1020.40s |  So that's where the emerging tech part of the job comes together.
1021.40s - 1027.40s |  Similarly, when we think about AI, there's so much opportunity for AI to help us on the defensive side,
1028.40s - 1031.40s |  and there's so much opportunity for AI to help on the offensive side.
1032.40s - 1034.40s |  The first step of either one is finding vulnerabilities.
1035.40s - 1037.40s |  Whether you then go to patch them or you go to exploit them,
1038.40s - 1042.40s |  we want to be on the defensive side that the most sensitive systems,
1042.40s - 1046.40s |  we have teams like everyone here helping us as the Cyber Challenge is doing,
1047.40s - 1050.40s |  to actually use generative AI to find and patch.
1051.40s - 1053.40s |  And that's what's exciting and that's where there's opportunity.
1054.40s - 1058.40s |  The part that I find fascinating with AI and this potential promise
1059.40s - 1066.40s |  is that you can spend an insane amount of money trying to train AI to auto-patch, auto-secure software.
1067.40s - 1069.40s |  And you think about it and you're like, really, who's going to spend that much money?
1069.40s - 1073.40s |  And then you realize, CrowdStrike outage, $10 billion in loss.
1074.40s - 1080.40s |  For $10 billion, you could probably do a lot of training AI to auto-rewrite insecure code,
1081.40s - 1086.40s |  run it against GitHub, and lift the entire ocean of the planet's baseline security
1087.40s - 1089.40s |  from just one outage equivalent in value.
1090.40s - 1094.40s |  And so when I start thinking about it that way, I realize that
1095.40s - 1101.40s |  I would rather spend the money doing that than patching broken CrowdStrike systems.
1102.40s - 1108.40s |  And so is there a role in government to say, okay, DARPA or whoever,
1109.40s - 1112.40s |  let's do more of that faster. Let's try to auto-patch faster
1113.40s - 1117.40s |  because it seems like the market is not going to spend $10 billion on its own,
1118.40s - 1120.40s |  but maybe in partnership, maybe in this consortium,
1121.40s - 1122.40s |  maybe if there's some government seed funding,
1122.40s - 1126.40s |  there is a way where government can start and the industry can finish.
1127.40s - 1130.40s |  I mean, do you think, am I off base? Is that even a role of government?
1131.40s - 1133.40s |  I think that's absolutely the role of government.
1134.40s - 1136.40s |  So I'll give an example, you know, really two that we'll talk about.
1137.40s - 1138.40s |  And then I want to come back to the cost thing.
1139.40s - 1141.40s |  So one program that we launched a year ago,
1142.40s - 1146.40s |  really building on and copying an idea that came from Singapore and Finland
1147.40s - 1148.40s |  is called the Cyber Trustmark Program.
1148.40s - 1150.40s |  So when somebody's shopping for a baby monitor,
1151.40s - 1154.40s |  or to be honest, my dread, which is a connected home security system,
1155.40s - 1158.40s |  there's no way to know, is this product cyber safe?
1159.40s - 1161.40s |  Has it been tested against any cybersecurity standard?
1162.40s - 1163.40s |  Does the vendor patch it?
1164.40s - 1166.40s |  What kind of vulnerability testing did this vendor do?
1167.40s - 1170.40s |  And we know that companies say, look, we're willing to do the extra work,
1171.40s - 1172.40s |  but we'd love to be able to differentiate ourselves.
1173.40s - 1175.40s |  And on the consumer side, a mom who's shopping for a baby monitor,
1175.40s - 1179.40s |  she's worried about folks hacking in and looking at or listening to her kid.
1180.40s - 1182.40s |  But how does she know if a product is safe?
1183.40s - 1186.40s |  So we launched a program a year ago called the Cyber Trustmark,
1187.40s - 1188.40s |  which is a labeling program.
1189.40s - 1192.40s |  Essentially, any products, things connected, smart TVs, baby monitors,
1193.40s - 1194.40s |  home security systems, Nest thermostats,
1195.40s - 1198.40s |  that meets the government standard and gets tested for it,
1199.40s - 1200.40s |  because just companies saying our product is good
1201.40s - 1202.40s |  probably doesn't work for many consumers.
1203.40s - 1204.40s |  They want to know, was it tested?
1205.40s - 1206.40s |  Can have a label.
1207.40s - 1208.40s |  It's called the Cyber Trustmark.
1209.40s - 1210.40s |  We launched it a year ago.
1211.40s - 1212.40s |  It had to go through a whole bunch of legal processes.
1213.40s - 1214.40s |  Half of this is always implementation.
1215.40s - 1217.40s |  And as of Friday, it's live on the Federal Register.
1218.40s - 1220.40s |  And companies like Amazon said they'll, on their websites,
1221.40s - 1222.40s |  they'll note labeled products at the top.
1223.40s - 1226.40s |  Best Buy said that they'll have their folks in stores train people.
1227.40s - 1230.40s |  And companies from Samsung to Google to LG
1231.40s - 1232.40s |  said they'll be submitting their products to be tested.
1232.40s - 1235.40s |  So that's a great example of where we in government are not saying,
1236.40s - 1237.40s |  well, we're mandating this.
1238.40s - 1239.40s |  We're saying, you know what?
1240.40s - 1241.40s |  There's an ecosystem of people who want to bring in more secure tech
1242.40s - 1243.40s |  to their homes, their schools, their offices.
1244.40s - 1245.40s |  Companies who say, look, we get it.
1246.40s - 1247.40s |  We'd rather build a more secure product.
1248.40s - 1250.40s |  We'd rather commit to patching it and not just leaving it there.
1251.40s - 1253.40s |  And then government, which is saying, okay,
1254.40s - 1255.40s |  where we're trusted is when we have a standard
1256.40s - 1257.40s |  and where we do the testing.
1258.40s - 1259.40s |  So that's an example of, to your point,
1259.40s - 1261.40s |  fitting up where we try to create the ecosystem.
1262.40s - 1263.40s |  And it's frankly one of the projects at the White House
1264.40s - 1265.40s |  I'm the most excited about.
1266.40s - 1267.40s |  Because it took a lot of work to launch.
1268.40s - 1269.40s |  But now we can say, here's the ecosystem.
1270.40s - 1271.40s |  Companies, please submit their products to be tested.
1272.40s - 1273.40s |  If you're shopping, start asking for it
1274.40s - 1275.40s |  and let's see where it goes.
1276.40s - 1277.40s |  Yeah, it's a super interesting example
1278.40s - 1280.40s |  because just like food labels or other things,
1281.40s - 1282.40s |  you can always have a new standard, right?
1283.40s - 1284.40s |  It's the Trustmark 1.1.
1285.40s - 1286.40s |  It's the Trustmark 1.2.
1287.40s - 1288.40s |  You can constantly improve it.
1289.40s - 1290.40s |  There's no static point in time, right?
1291.40s - 1292.40s |  It's the 2025 version.
1293.40s - 1295.40s |  But it also is really embarrassing
1296.40s - 1299.40s |  in that it points out, like, this is not a new idea, right?
1300.40s - 1301.40s |  Trustmark type ideas.
1302.40s - 1303.40s |  We've been wanting this for decades.
1304.40s - 1305.40s |  People, I mean, I started my career in like 98
1306.40s - 1308.40s |  and we were talking about this in 99.
1309.40s - 1310.40s |  So it's taken a long time.
1311.40s - 1313.40s |  Why did the industry not do this themselves, right?
1314.40s - 1316.40s |  This feels like the industry can handle it,
1317.40s - 1318.40s |  but they couldn't.
1319.40s - 1320.40s |  They didn't.
1321.40s - 1322.40s |  They had decades to do it.
1323.40s - 1324.40s |  So it felt like the government, right?
1325.40s - 1327.40s |  Like the government doesn't want to get into the game,
1328.40s - 1330.40s |  but sometimes it has to get into the game, right?
1331.40s - 1332.40s |  And to your point, it's also really cool
1333.40s - 1334.40s |  because as you look around the room,
1335.40s - 1336.40s |  there are so many people here from different backgrounds.
1337.40s - 1338.40s |  And I have to say, you know,
1339.40s - 1340.40s |  labeling idea really appealed to me
1341.40s - 1342.40s |  because as you heard at the beginning, I keep kosher.
1343.40s - 1344.40s |  Well, how do I know if something's kosher
1345.40s - 1346.40s |  when I'm stopping in the store?
1347.40s - 1348.40s |  There's a label.
1349.40s - 1351.40s |  It was tested against a particular kosher standard.
1352.40s - 1355.40s |  So to be honest, we've seen that work,
1356.40s - 1358.40s |  how that ecosystem works, and you copy it and do it here.
1359.40s - 1361.40s |  But I want to come back to your point about cost and benefit
1362.40s - 1364.40s |  because we had this debate in another area of policy,
1365.40s - 1366.40s |  which is paying ransoms.
1367.40s - 1370.40s |  And the question we often get is, you know,
1371.40s - 1374.40s |  I mentioned $1.3 billion paid in ransoms.
1375.40s - 1376.40s |  Why are ransomware attacks increasing?
1377.40s - 1378.40s |  Well, they're profitable.
1379.40s - 1380.40s |  They make a lot of money.
1381.40s - 1382.40s |  So the question is, as governments,
1383.40s - 1384.40s |  what should we do about that?
1385.40s - 1386.40s |  Should we ban ransom payments
1387.40s - 1389.40s |  as part of incentivizing, frankly, companies to say,
1390.40s - 1391.40s |  why don't you put the money in at the beginning
1392.40s - 1393.40s |  and improve cybersecurity?
1394.40s - 1396.40s |  But then folks argue, what are you going to do
1397.40s - 1398.40s |  when a hospital gets hit?
1399.40s - 1400.40s |  And they say, well, if I pay this $5 million ransom,
1401.40s - 1402.40s |  I can recover faster.
1403.40s - 1404.40s |  So we've had this debate.
1405.40s - 1406.40s |  And where we came out and ideas on this
1407.40s - 1408.40s |  is we decided to take a pause.
1409.40s - 1411.40s |  But really, the construct we were talking about
1412.40s - 1415.40s |  was saying, could you announce that you were considering
1416.40s - 1417.40s |  putting in controls on ransoms?
1418.40s - 1419.40s |  So that would incentivize folks to take cybersecurity.
1420.40s - 1421.40s |  I am all for blocking ransom.
1422.40s - 1423.40s |  I hate paying ransoms.
1424.40s - 1425.40s |  And I would love if the government would mandate
1426.40s - 1428.40s |  no paying ransoms, just so you set a standard.
1429.40s - 1430.40s |  And it's funny, since I'm spending a lot of time
1431.40s - 1432.40s |  in Singapore, they're so small,
1433.40s - 1434.40s |  so they can do things very quickly.
1435.40s - 1437.40s |  And so they also can make decisions
1437.40s - 1438.40s |  like can't pay ransom.
1439.40s - 1440.40s |  And their view is like, America's too big,
1441.40s - 1442.40s |  the ship's sailed, they can never do it.
1443.40s - 1444.40s |  Cats out of the bag, can't do it.
1445.40s - 1446.40s |  We have an option.
1447.40s - 1448.40s |  It hasn't gotten that bad yet in Singapore.
1449.40s - 1450.40s |  Maybe we can do it.
1451.40s - 1452.40s |  We don't think they can do it.
1453.40s - 1454.40s |  And I tell them, it's like, hey, it's not all or nothing.
1455.40s - 1456.40s |  You don't have to do the whole country or nothing.
1457.40s - 1458.40s |  The federal government can just say,
1459.40s - 1461.40s |  hey, the federal agencies can't pay a ransom.
1462.40s - 1464.40s |  And you learn, oh, now these other critical industries
1465.40s - 1466.40s |  can't pay ransom.
1467.40s - 1468.40s |  You can do this in bite-sized chunks.
1469.40s - 1470.40s |  You don't have to get sucked into
1471.40s - 1472.40s |  it doesn't work in my edge case.
1473.40s - 1476.40s |  It's like, no, we can do this in steps and learn.
1477.40s - 1479.40s |  And if you know hospitals are going to be really hard,
1480.40s - 1481.40s |  decide that later.
1482.40s - 1483.40s |  Start with the easier cases, right?
1484.40s - 1486.40s |  So yeah, I just, I hope the conversation
1487.40s - 1488.40s |  doesn't get sucked into an all or nothing.
1489.40s - 1490.40s |  So that's the way you would approach it.
1491.40s - 1492.40s |  Yeah, you just identify the ones
1493.40s - 1494.40s |  you have most control over first.
1495.40s - 1496.40s |  It's the easiest to defend, easiest to explain.
1497.40s - 1500.40s |  Work your way through it because you want to,
1501.40s - 1503.40s |  I hate that we're giving money and fuel
1504.40s - 1506.40s |  to our adversaries to get better.
1507.40s - 1508.40s |  What I don't like is if you say,
1509.40s - 1510.40s |  oh, hospitals, they can pay ransoms.
1511.40s - 1512.40s |  Well, guess who's going to get hit?
1513.40s - 1514.40s |  All the hospitals because they know
1515.40s - 1516.40s |  that's their safe revenue source.
1517.40s - 1518.40s |  You don't want to give them the roadmap.
1519.40s - 1522.40s |  But the other thing that is frustrating is
1523.40s - 1526.40s |  most ransoms can be sourced back mostly to Russia.
1527.40s - 1528.40s |  And so it feels like at some level
1529.40s - 1531.40s |  it's a nation to nation problem.
1532.40s - 1534.40s |  It's not me as a small business owner problem, right?
1535.40s - 1537.40s |  Because if you can convince Russia to crack down on it,
1538.40s - 1539.40s |  that's probably 70% of the problem.
1540.40s - 1541.40s |  And so, oh, if it's a 70% problem,
1542.40s - 1544.40s |  my government needs to get involved in that, right?
1545.40s - 1547.40s |  Because if it's really them trying to exercise power
1548.40s - 1551.40s |  and influence us, us banning it,
1552.40s - 1553.40s |  they're going to still try to influence us
1554.40s - 1555.40s |  and do other things, you know?
1555.40s - 1557.40s |  And so their objective hasn't changed.
1558.40s - 1560.40s |  Maybe the way they approach it will.
1561.40s - 1564.40s |  But anyway, sorry, I just have this big ransomware thing.
1565.40s - 1566.40s |  It really bothers me.
1567.40s - 1568.40s |  Because you watch ransomware groups
1569.40s - 1570.40s |  hack into ransomware groups and leak it.
1571.40s - 1572.40s |  They say they delete it.
1573.40s - 1574.40s |  How do you verify they've deleted it?
1575.40s - 1576.40s |  You don't know.
1577.40s - 1578.40s |  There's this whole false sense that we paid them off
1579.40s - 1580.40s |  and we're okay.
1581.40s - 1582.40s |  It's, no, you're not okay.
1582.40s - 1584.40s |  Once you empower the ransomware industry,
1585.40s - 1587.40s |  and it is an industry, it's becoming a lobbying group.
1588.40s - 1589.40s |  Well, I'm the insurance company
1590.40s - 1591.40s |  that specializes in paying ransom.
1592.40s - 1594.40s |  Oh, well, I'm the ransomware negotiator specialist group.
1595.40s - 1596.40s |  Oh, I am the rating agency
1597.40s - 1599.40s |  for which ransomware groups are credible.
1600.40s - 1602.40s |  So really, you're rating ransomware groups now.
1603.40s - 1604.40s |  An ecosystem is built of special interests
1605.40s - 1607.40s |  that want to perpetuate the ransomware payment industry,
1608.40s - 1609.40s |  the Bitcoin bros, whatever.
1610.40s - 1611.40s |  It's going to get metastasized
1612.40s - 1614.40s |  and it's going to be here as an industry interest.
1616.78s - 1617.78s |  We're bringing Jeff in to help us work ransomware policy.
1618.78s - 1619.78s |  Oh, my gosh.
1620.78s - 1621.78s |  Sorry, I'm going to get more wine.
1622.78s - 1623.78s |  Jesus Christ.
1630.60s - 1631.60s |  Sorry.
1632.60s - 1633.60s |  Would you like some more?
1634.60s - 1635.60s |  Okay.
1636.60s - 1637.60s |  Sorry, that's just a raw issue for me.
1642.79s - 1643.79s |  Just be blessed.
1647.93s - 1648.93s |  Yes, thank you.
1649.93s - 1650.93s |  Okay, so that was it.
1650.93s - 1651.93s |  What's your take on your reaction?
1652.93s - 1654.93s |  You know, I think it's very true
1655.93s - 1656.93s |  that as we look at the ransomware problem,
1657.93s - 1658.93s |  there's three ways we have to look at it.
1659.93s - 1660.93s |  The first I mentioned earlier is the us way.
1661.93s - 1662.93s |  We've seen, for example,
1663.93s - 1664.93s |  that companies that just back up their data
1665.93s - 1666.93s |  and keep them offline
1667.93s - 1668.93s |  can recover faster than those who pay a ransom.
1669.93s - 1670.93s |  So getting companies to back up,
1671.93s - 1672.93s |  getting them to test,
1673.93s - 1674.93s |  getting that in place.
1675.93s - 1676.93s |  And frankly, in addition to that,
1677.93s - 1678.93s |  we've launched some free programs at the White House
1678.93s - 1679.93s |  for folks who we know have fewer resources.
1680.93s - 1682.93s |  Whether they're the nation's 1,800 rural hospitals,
1683.93s - 1684.93s |  we now have a free program training them,
1685.93s - 1686.93s |  getting them cybersecurity tech.
1687.93s - 1689.93s |  Similar for schools with less than 2,500 kids.
1690.93s - 1691.93s |  Because we recognize that for them,
1692.93s - 1693.93s |  it's probably not a matter of will.
1694.93s - 1695.93s |  It's probably a matter of skill and capability.
1696.93s - 1697.93s |  So that's a big part of it.
1698.93s - 1699.93s |  The second part of that is to say,
1700.93s - 1701.93s |  what can we do to make it riskier,
1702.93s - 1703.93s |  costlier, and harder?
1704.93s - 1705.93s |  That's disrupting infrastructure around the world.
1706.93s - 1707.93s |  Frankly, it's naming people
1708.93s - 1709.93s |  who have conducted these attacks.
1710.93s - 1711.93s |  You may have seen just recently,
1712.93s - 1713.93s |  the State Department named and put out
1714.93s - 1715.93s |  a $10 million bounty for this was Iranian actor.
1716.93s - 1717.93s |  I'm all for that.
1718.93s - 1719.93s |  I'm all for the naming.
1720.93s - 1721.93s |  Who conducted attacks against water systems.
1722.93s - 1723.93s |  And we see that folks don't like to be
1724.93s - 1725.93s |  shouted out in that way.
1726.93s - 1727.93s |  And then the final one is things we can do
1728.93s - 1729.93s |  to take the fight to them.
1730.93s - 1731.93s |  Those are things I can't talk about here.
1732.93s - 1733.93s |  But those are things we think through carefully as well.
1734.93s - 1735.93s |  I'll know that we're bringing 70 countries together
1736.93s - 1737.93s |  at the end of September.
1738.93s - 1739.93s |  From all over the world.
1740.93s - 1741.93s |  From Vietnam to Ghana to Nicaragua
1742.93s - 1743.93s |  to everybody's affected by ransomware.
1744.93s - 1745.93s |  And frankly, actors live around the world.
1746.93s - 1747.93s |  Money moves all around the world
1748.93s - 1749.93s |  through crypto infrastructure.
1750.93s - 1751.93s |  So we bring countries together
1752.93s - 1753.93s |  for things like classes on blockchain analysis.
1754.93s - 1755.93s |  Classes on regulatory approaches
1756.93s - 1757.93s |  for them on how to secure their hospitals.
1758.93s - 1760.93s |  To help them and also to make it a global fight.
1761.93s - 1762.93s |  So these are really exciting opportunities.
1763.93s - 1764.93s |  We have a bunch of companies coming
1765.93s - 1766.93s |  to also talk about what they'd like to do
1766.93s - 1767.93s |  with other governments around the world
1768.93s - 1769.93s |  in terms of disruptions and takedowns.
1770.93s - 1771.93s |  So that's the way we approach it.
1772.93s - 1773.93s |  Because it is a hard problem.
1774.93s - 1775.93s |  And it's a hard problem when you have countries
1776.93s - 1777.93s |  harboring people conducting attacks.
1778.93s - 1779.93s |  And those are the government-to-government
1780.93s - 1781.93s |  conversations we have to say,
1782.93s - 1783.93s |  this isn't acceptable.
1784.93s - 1785.93s |  And here's what we want to do about it.
1786.93s - 1787.93s |  And it's beyond just a criminal enterprise
1788.93s - 1789.93s |  and it's actually coordinated at a government level.
1790.93s - 1791.93s |  Then it becomes a government,
1792.93s - 1793.93s |  a much bigger government problem.
1794.93s - 1795.93s |  And I just want to go back to your point
1796.93s - 1803.93s |  when I joined this Homeland Security Advisory Council
1804.93s - 1808.93s |  years ago when Janet Napolitano was the secretary.
1809.93s - 1810.93s |  And I remember I was talking to some people
1811.93s - 1812.93s |  and I said, how come we don't name our adversaries?
1813.93s - 1814.93s |  Everybody knows China's coming after us.
1815.93s - 1816.93s |  Everybody knows these things are going on.
1817.93s - 1818.93s |  The industry, we've known about it for years.
1819.93s - 1820.93s |  The government never names our adversaries.
1821.93s - 1822.93s |  Why is that?
1823.93s - 1824.93s |  And some of the people are like,
1824.93s - 1825.93s |  that's really interesting.
1826.93s - 1827.93s |  I wonder, yeah, let's,
1828.93s - 1829.93s |  well, not six months later, nine months later,
1830.93s - 1831.93s |  not because of me, but six or nine months later,
1832.93s - 1833.93s |  we named China.
1834.93s - 1838.93s |  And once the government names somebody for an act,
1839.93s - 1840.93s |  it actually gives permission to companies,
1841.93s - 1845.93s |  oh, okay, it's just not my paranoid, crazy security guy.
1846.93s - 1847.93s |  My government is saying it.
1848.93s - 1849.93s |  It lends a certain amount of credibility.
1850.93s - 1851.93s |  So by just naming them,
1852.93s - 1853.93s |  even if you do nothing more than name them,
1854.93s - 1855.93s |  companies can say,
1856.93s - 1857.93s |  oh, well, we really don't want to maybe do business with them
1858.93s - 1860.93s |  or we have to scrutinize employees hired from there
1861.93s - 1862.93s |  or contracts or whatever.
1863.93s - 1864.93s |  It gives permission for the companies
1865.93s - 1866.93s |  and it gives the people in the risk groups
1867.93s - 1868.93s |  something they can point to to say,
1869.93s - 1871.93s |  this is why I'm asking you about our exports to Russia
1872.93s - 1874.93s |  because they are involved in these kinds of activities.
1875.93s - 1876.93s |  And so you might not even realize
1877.93s - 1878.93s |  the benefit you're doing
1879.93s - 1880.93s |  by giving permission for people in these companies
1881.93s - 1882.93s |  to actually say those names out loud
1882.93s - 1883.93s |  in a different context.
1884.93s - 1887.93s |  And it doesn't cost you a whole new government program.
1888.93s - 1890.93s |  That's why I'm a big fan of naming.
1891.93s - 1892.93s |  You don't even have to necessarily shame them.
1893.93s - 1894.93s |  It's kind of, you know.
1895.93s - 1896.93s |  We know who you are and we can find out who you are,
1897.93s - 1898.93s |  whether a person or a country.
1899.93s - 1900.93s |  And we're telling all of our friends
1901.93s - 1902.93s |  that you're no fun to play with, right?
1903.93s - 1904.93s |  Got to figure out how to adapt that part.
1905.93s - 1906.93s |  Yeah, yeah.
1907.93s - 1908.93s |  We're taking all of our marbles and going home.
1909.93s - 1911.93s |  I've got this other interesting,
1912.93s - 1913.93s |  I want to drop this on you now
1914.93s - 1915.93s |  because I'm curious on your thoughts.
1916.93s - 1918.93s |  So maybe a year ago or so,
1919.93s - 1921.93s |  Microsoft writes this report
1922.93s - 1925.93s |  about Russia attacking their Azure infrastructure
1926.93s - 1927.93s |  in their cloud.
1928.93s - 1929.93s |  Ukraine has some assets in Azure.
1930.93s - 1931.93s |  Microsoft writes this great report,
1932.93s - 1933.93s |  releases some IOCs,
1934.93s - 1935.93s |  talks about what they're seeing in their infrastructure
1935.93s - 1940.93s |  and in years, it brought to light,
1941.93s - 1942.93s |  it illustrated this point that,
1943.93s - 1944.93s |  first off, it reinforced the belief
1945.93s - 1946.93s |  that if you're a cloud provider,
1947.93s - 1950.93s |  you inherit the risk models of all of your customers.
1951.93s - 1952.93s |  If Ukraine is a customer,
1953.93s - 1954.93s |  their risk model is now your risk model.
1955.93s - 1956.93s |  So these cloud providers have to be prepared
1957.93s - 1958.93s |  to defend against every single client's risk model,
1959.93s - 1960.93s |  which is crazy.
1961.93s - 1963.93s |  But it also means only the largest super hyperscalers
1963.93s - 1966.93s |  can really perform at that level.
1967.93s - 1968.93s |  The second is,
1969.93s - 1973.93s |  Russia's attacking Ukraine on Microsoft infrastructure,
1974.93s - 1975.93s |  which might be in the United States,
1976.93s - 1977.93s |  might be elsewhere.
1978.93s - 1979.93s |  So that means you're battling,
1980.93s - 1981.93s |  you're doing battle on Microsoft infrastructure.
1982.93s - 1983.93s |  I'm going to keep repeating that
1984.93s - 1985.93s |  because in air, sea, land, and space,
1986.93s - 1987.93s |  you shoot down an airplane,
1988.93s - 1989.93s |  the sky is still there,
1990.93s - 1991.93s |  you sink the ship, the ocean's still there,
1991.93s - 1993.93s |  blow up the tank, the earth is still the earth.
1994.93s - 1995.93s |  But you fight in cyberspace,
1996.93s - 1997.93s |  and it will change,
1998.93s - 2000.93s |  and it will not be the same tomorrow.
2001.93s - 2003.93s |  And you fight Microsoft on Microsoft territory,
2004.93s - 2005.93s |  they'll just change it on you tomorrow.
2006.93s - 2007.93s |  Right?
2008.93s - 2009.93s |  So my instinct is you're probably not going to win
2010.93s - 2011.93s |  against the guy,
2012.93s - 2014.93s |  the company that controls your territory,
2015.93s - 2016.93s |  your domain.
2017.93s - 2018.93s |  It's not your domain, it's their domain.
2019.93s - 2020.93s |  You're just a guest.
2021.93s - 2022.93s |  Don't be surprised if all your stuff
2023.93s - 2024.93s |  gets deleted tomorrow, right?
2025.93s - 2026.93s |  That's super fascinating.
2027.93s - 2028.93s |  But it leans me to believe
2029.93s - 2032.93s |  there's no unconflicted parties now.
2033.93s - 2035.93s |  Like, Microsoft can't be neutral.
2038.66s - 2039.66s |  It's sort of this great sorting.
2040.66s - 2041.66s |  You're being sorted.
2042.66s - 2043.66s |  You're being picked into sides.
2044.66s - 2045.66s |  You're either pro-Microsoft or anti-Microsoft.
2046.66s - 2047.66s |  If you're pro-Microsoft,
2048.66s - 2049.66s |  that means you're probably anti-Russia
2050.66s - 2052.66s |  because Russia's attacking Microsoft.
2053.66s - 2054.66s |  Like, I didn't want to necessarily
2055.66s - 2056.66s |  have to make that decision,
2057.66s - 2058.66s |  but I'm being forced to make that decision, right?
2059.66s - 2060.66s |  And these conflicts are sorting us,
2061.66s - 2063.66s |  our tech stacks, our cloud providers.
2064.66s - 2066.66s |  I mean, how do you think about territory?
2067.66s - 2068.66s |  Or how do you think about
2069.66s - 2070.66s |  it's no longer just a sales platform, right?
2071.66s - 2072.66s |  It's a domain.
2073.66s - 2075.66s |  And everybody's conflicted now.
2076.66s - 2080.66s |  These are really the toughest questions now
2081.66s - 2082.66s |  because we have the laws of war
2083.66s - 2084.66s |  and the civil wars
2085.66s - 2086.66s |  where people wear uniforms,
2087.66s - 2088.66s |  or if not, they pretend to.
2089.66s - 2090.66s |  They dress in civilian clothes
2091.66s - 2092.66s |  and there are rules for that.
2093.66s - 2094.66s |  And there's borders, right?
2095.66s - 2096.66s |  There's the border of the war
2097.66s - 2098.66s |  and then there's folks in the homeland.
2099.66s - 2100.66s |  And in digital war,
2101.66s - 2102.66s |  those borders don't exist.
2103.66s - 2104.66s |  The attribution is far harder.
2105.66s - 2106.66s |  And the role of private companies
2107.66s - 2108.66s |  is also different
2109.66s - 2110.66s |  because we traditionally had
2111.66s - 2112.66s |  a defense industrial base, right?
2113.66s - 2114.66s |  And for all intents and purposes,
2115.66s - 2117.66s |  their sole or vast majority customer
2118.66s - 2119.66s |  was militaries, right?
2120.66s - 2121.66s |  The U.S. militaries
2122.66s - 2123.66s |  and frankly our allies' militaries.
2124.66s - 2125.66s |  And now you see
2126.66s - 2127.66s |  when the evening before
2128.66s - 2129.66s |  Russia's invasion of Ukraine,
2130.66s - 2131.66s |  they disable an American commercial satellite company.
2132.66s - 2133.66s |  Why?
2134.66s - 2135.66s |  Because one of its customers
2136.66s - 2137.66s |  was the Ukrainian military
2138.66s - 2139.66s |  and they wanted to disrupt
2140.66s - 2141.66s |  Ukrainian soldiers' ability to communicate.
2141.66s - 2142.66s |  And now to the Russians,
2143.66s - 2144.66s |  they were combatant in the war.
2145.66s - 2146.66s |  So those questions of
2147.66s - 2148.66s |  what's the border?
2149.66s - 2150.66s |  General Maksony talked about
2151.66s - 2152.66s |  the Chinese cyber attacks
2153.66s - 2154.66s |  against infrastructure in the United States.
2155.66s - 2156.66s |  We used to think that was the homeland.
2157.66s - 2158.66s |  In prior wars,
2159.66s - 2160.66s |  we have two oceans on either side of this country.
2161.66s - 2162.66s |  It was really hard to cross that
2163.66s - 2164.66s |  with submarines, planes.
2165.66s - 2166.66s |  In digital space,
2167.66s - 2168.66s |  vulnerabilities at home
2169.66s - 2170.66s |  impact what can be done on the battlefield.
2171.66s - 2172.66s |  And what offensive cyber options
2173.66s - 2174.66s |  do we have for this?
2175.66s - 2176.66s |  My question always is,
2177.66s - 2178.66s |  okay, I'll tell you what they are,
2179.66s - 2180.66s |  but let's talk about the next step.
2181.66s - 2183.66s |  Our own digital infrastructure's vulnerabilities
2184.66s - 2185.66s |  actually shape and limit
2186.66s - 2187.66s |  what we can do offensively
2188.66s - 2189.66s |  because we know we're very vulnerable.
2190.66s - 2191.66s |  Think about the United States
2192.66s - 2193.66s |  versus China on a great firewall.
2194.66s - 2195.66s |  Think about the United States
2196.66s - 2197.66s |  and our civil liberties and privacy
2198.66s - 2199.66s |  which we deeply, deeply value.
2199.66s - 2200.66s |  The US government doesn't monitor
2201.66s - 2202.66s |  US network space.
2203.66s - 2204.66s |  China has a massive firewall
2205.66s - 2206.66s |  and monitors and defends
2207.66s - 2208.66s |  Chinese IP space.
2209.66s - 2210.66s |  So it's an asymmetric battle
2211.66s - 2212.66s |  in digital space.
2213.66s - 2214.66s |  So those factors,
2215.66s - 2216.66s |  where are the borders?
2217.66s - 2218.66s |  Who is a combatant?
2219.66s - 2220.66s |  And what are the roles of companies
2221.66s - 2222.66s |  providing services to militaries?
2223.66s - 2224.66s |  Another great example,
2225.66s - 2226.66s |  Taiwan is an island.
2227.66s - 2228.66s |  In the event of a conflict,
2229.66s - 2230.66s |  it has gone up significantly
2231.66s - 2232.66s |  in the last year.
2233.66s - 2234.66s |  A number of them could be
2235.66s - 2236.66s |  just anchor drags,
2237.66s - 2238.66s |  not malicious at all.
2239.66s - 2240.66s |  As occurred after the Houthis
2241.66s - 2242.66s |  struck a ship in the Red Sea,
2243.66s - 2244.66s |  the ship was sailing unevenly
2245.66s - 2246.66s |  and dragged an anchor
2247.66s - 2248.66s |  along the bottom of the Red Sea
2249.66s - 2250.66s |  and cut communications
2251.66s - 2252.66s |  to several big parts of Africa
2253.66s - 2254.66s |  for quite a period of time.
2255.66s - 2256.66s |  That wasn't malicious
2257.66s - 2258.66s |  unless you consider the Houthi
2259.66s - 2260.66s |  which is probably
2261.66s - 2262.66s |  satellite resilience
2263.66s - 2264.66s |  to a cable cut and telecommunications
2265.66s - 2266.66s |  so that it's not isolated.
2267.66s - 2268.66s |  It needs to think about
2269.66s - 2270.66s |  which commercial satellite companies
2271.66s - 2273.66s |  can we rely on in a conflict
2274.66s - 2275.66s |  and then which can be resistant
2276.66s - 2277.66s |  to advanced electronic warfare
2278.66s - 2279.66s |  and resistant to jamming.
2280.66s - 2281.66s |  So there's a lot that now
2282.66s - 2283.66s |  in the context of technology
2284.66s - 2285.66s |  moving much more quickly
2286.66s - 2287.66s |  than traditional military weapons
2287.66s - 2288.66s |  and that's a war that we have to think about
2289.66s - 2290.66s |  because there's a reason
2291.66s - 2292.66s |  we want to have civilians and combatants.
2293.66s - 2294.66s |  They lead to the points you made, Jeff,
2295.66s - 2296.66s |  about a way to attribute,
2297.66s - 2298.66s |  a way to hold people accountable
2299.66s - 2300.66s |  if they're not following the laws of war.
2301.66s - 2302.66s |  So these are the kinds of things
2303.66s - 2304.66s |  which the conflict in Ukraine
2305.66s - 2306.66s |  and more broadly,
2307.66s - 2308.66s |  conflicts around the world
2309.66s - 2310.66s |  are really showing us.
2311.66s - 2312.66s |  I'll give another example.
2313.66s - 2314.66s |  One of the things we worked on in NATO
2315.66s - 2316.66s |  was NATO had had a policy
2317.66s - 2318.66s |  that was to the level of a kinetic attack,
2319.66s - 2320.66s |  a physical attack,
2321.66s - 2323.66s |  where NATO members will come behind an ally.
2324.66s - 2328.66s |  Well, when Albania was cyber-attacked by Iran
2329.66s - 2330.66s |  and their entire government was disrupted,
2331.66s - 2332.66s |  the question really was
2333.66s - 2334.66s |  what could NATO members
2335.66s - 2336.66s |  quickly get there to help Albania recover
2337.66s - 2338.66s |  and we'd stood up a capability
2339.66s - 2340.66s |  just where countries say,
2341.66s - 2342.66s |  hey, I'll offer vulnerability analysis,
2343.66s - 2344.66s |  I'll offer incident response,
2345.66s - 2346.66s |  I'll offer attribution
2347.66s - 2348.66s |  to help a country in digital space.
2349.66s - 2350.66s |  That kind of cooperation,
2351.66s - 2352.66s |  how do allies actually work together
2353.66s - 2354.66s |  is also really new
2355.66s - 2356.66s |  and it also helps control conflict earlier,
2357.66s - 2358.66s |  make it less likely that folks
2359.66s - 2360.66s |  will escalate as they respond.
2361.66s - 2362.66s |  So these are the kind of things
2363.66s - 2364.66s |  we're thinking through.
2365.66s - 2366.66s |  Okay, so I would love to keep talking to you
2367.66s - 2368.66s |  for hours and go through that model
2369.66s - 2370.66s |  but we're out of time
2371.66s - 2372.66s |  so I'll give you any closing thoughts,
2373.66s - 2374.66s |  your first time out at DEF CON,
2375.66s - 2376.66s |  anything that you would,
2377.66s - 2378.66s |  any recommendations,
2379.66s - 2380.66s |  anything you'd like to share.
2381.66s - 2382.66s |  Absolutely.
2383.66s - 2384.66s |  So first, I feel really privileged
2385.66s - 2386.66s |  to be here with everyone here.
2387.66s - 2388.66s |  It looks like I'm so enjoying my time here.
2389.66s - 2390.66s |  Folks often ask me,
2391.66s - 2392.66s |  why are you in government?
2393.66s - 2394.66s |  Government's slow,
2395.66s - 2396.66s |  government, I'm told,
2397.66s - 2398.66s |  can be bureaucratic.
2399.66s - 2400.66s |  Who knows?
2401.66s - 2402.66s |  And I often think to myself,
2403.66s - 2404.66s |  my dad came here as a refugee,
2405.66s - 2406.66s |  my grandparents came as refugees
2407.66s - 2409.66s |  and I know that I have freedom to be me.
2410.66s - 2411.66s |  Things I want to say,
2412.66s - 2413.66s |  how I want to worship,
2414.66s - 2415.66s |  who I want to talk with
2416.66s - 2417.66s |  is a tremendous privilege
2418.66s - 2419.66s |  as we see looking around the world
2420.66s - 2421.66s |  and freedoms aren't free.
2422.66s - 2423.66s |  We, defending that,
2424.66s - 2425.66s |  working to ensure that we use the power,
2426.66s - 2427.66s |  the skill, the talents
2428.66s - 2429.66s |  that's represented in this room
2430.66s - 2431.66s |  to ensure that folks around the world
2432.66s - 2433.66s |  can rely on the medical service
2434.66s - 2435.66s |  in their digitally connected hospitals,
2435.66s - 2436.66s |  in their digitally connected power systems
2437.66s - 2438.66s |  and frankly just being able to
2439.66s - 2440.66s |  communicate around the world.
2441.66s - 2442.66s |  Our digital systems are not resilient enough
2443.66s - 2444.66s |  for everything that relies on them
2445.66s - 2446.66s |  and we can make it that way.
2447.66s - 2448.66s |  When we think about, for example,
2449.66s - 2450.66s |  so many things here,
2451.66s - 2452.66s |  using the abilities you have,
2453.66s - 2454.66s |  using the generative AI tools we see there
2455.66s - 2456.66s |  to, when we find vulnerabilities,
2457.66s - 2458.66s |  use them to patch them.
2459.66s - 2460.66s |  There's so much ability here
2461.66s - 2462.66s |  and frankly, as tech continues to be
2463.66s - 2464.66s |  a part of our lives,
2465.66s - 2466.66s |  really using the force for that good
2467.66s - 2468.66s |  is a partnership I hope
2469.66s - 2470.66s |  everybody here will think about.
2471.66s - 2472.66s |  If anybody's interested in talking further,
2473.66s - 2474.66s |  I'm available.
2475.66s - 2476.66s |  Thank you for all you do every day
2477.66s - 2478.66s |  and looking forward to be back at DESCOM
2479.66s - 2480.66s |  with another bottle of wine next year.


url: https://www.youtube.com/watch?v=WGXNimCkDOE
title: DEF CON 32 - Changing Global Threat Landscape - Rob Joyce, The Dark Tangent
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=WGXNimCkDOE",
  "title": "DEF CON 32 - Changing Global Threat Landscape - Rob Joyce, The Dark Tangent",
  "description": "Rob Joyce, former NSA and White House cyber official, will engage with Dark Tangent to analyze the evolving state of global cyber threats. Their discussion will explore the impact and potential of artificial intelligence, assessing how AI is reshaping the cybersecurity landscape and what it means for the future of global security.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2640,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

9.74s - 14.74s | This text was transcribed using whisper model: large-v2

 who went to sleep last night? Okay, most of you. Good. Um,
21.08s - 24.08s |  hey, so I want to, uh, thank you for coming to one of the first
24.08s - 26.78s |  sessions of the day. Um, there's more of you here than I
26.78s - 30.26s |  expected, um, which is really cool. If you don't remember
30.26s - 33.06s |  anything that happens here, that's okay. We're recording it
33.06s - 37.86s |  and we'll release all that stuff for free later. So I want to
37.86s - 41.32s |  have a fireside chat with Rob Joyce, um, probably most
41.32s - 46.26s |  famously known, um, for memeing the Russians. No, I'm kidding.
46.26s - 49.36s |  Rob has a really long history of a distinguished service for the
49.36s - 52.84s |  United States and, uh, and so I want to first have, he's just
52.84s - 55.14s |  going to talk a little bit about where you're coming from, what
55.14s - 57.94s |  you've done, and then we've got some questions and, and the
57.94s - 60.94s |  concept is we'll have a conversation. Hopefully you'll
60.94s - 64.52s |  learn something and then, uh, depending on how things go, we
64.54s - 69.78s |  might have some Q and A. Sounds like a plan? Ready to do this?
69.78s - 72.58s |  All good, Jeff. Okay, go for it, Rob. Hey, good morning
72.58s - 77.56s |  everybody. So, Rob Joyce, I just retired in March after 34 years
77.56s - 81.02s |  at the National Security Agency. So that was a career where I
81.02s - 86.04s |  came st- thank you. So, wild ride, interesting and exciting.
88.54s - 92.78s |  I started there as a technical engineer, um, worked my way up
92.80s - 97.28s |  to operational things, um, like during the Iraq war, I was the
97.28s - 101.24s |  Iraq issue manager, worked counter-terrorism, back and
101.24s - 105.08s |  forth across NSA where we have two missions. One is signals
105.08s - 109.48s |  intelligence, that's to produce the foreign intelligence against
109.48s - 113.46s |  the adversaries to understand plans, intentions, capabilities,
113.46s - 117.52s |  threats, um, and that's a very traditional intelligence
117.52s - 122.94s |  mission. But we also have a second side where you, you work
122.94s - 127.72s |  to protect the national security systems and those are systems
127.72s - 130.86s |  that carry classified information, war fighting,
130.86s - 133.42s |  command and control, or intelligence. And so those are
133.42s - 136.66s |  the most sensitive networks of the United States government.
136.66s - 141.00s |  And so the, the dual nature of NSA, both playing offense and
141.00s - 144.44s |  defense kind of gives you a unique mindset. It really sets
144.46s - 151.04s |  you up to, to think about, um, you know, how, uh, an offensive
151.04s - 156.04s |  nation state would come at you. And by playing both offense and
156.04s - 159.34s |  defense, you know, the, the old adage of it takes a thief to
159.34s - 162.78s |  catch a thief changes the way you approach both defense and
162.78s - 165.12s |  offense. And I found it fairly fascinating.
165.12s - 168.86s |  And, um, NSA is not known to be the easiest of places to
168.86s - 172.76s |  survive. So just the number of years you served must mean you
172.78s - 176.12s |  have some secret skill to survive in a bureaucratic,
176.12s - 179.38s |  technical, competitive, you know, aggressive kind of
179.38s - 180.56s |  environment.
180.56s - 184.50s |  So I don't know how many of you ever read the book soul of a new
184.50s - 190.80s |  machine. It's a 1980s book about the, the, uh, the PDP 11
190.80s - 194.84s |  designers up in the Boston research triangle. I read that
194.84s - 197.10s |  years ago and there was something in there that stuck
197.10s - 200.04s |  with me where people didn't focus on the next job. You
200.06s - 203.04s |  focused on the one you were in. And if you played a good game,
203.04s - 205.20s |  it was like pinball. You got a free game, you got to play
205.20s - 209.34s |  again. And that was kind of my focus. I enjoyed the jobs I was
209.34s - 214.48s |  in, had multiple careers and jobs across those 34 years. Um,
214.48s - 219.18s |  but it was very much focused on, have a good idea, um, talk
219.18s - 222.58s |  about that idea and bring something to the, to the effort.
222.58s - 224.78s |  And then you get to do new, bigger, better.
224.78s - 228.86s |  And how do you organizationally, so normally in an organization
228.88s - 234.02s |  that's very flat, um, you intern all over the place and you have
234.02s - 237.66s |  an idea of what's going on, but when everything is siloed, how
237.66s - 240.10s |  do you know that you're just, you come up with a great idea.
240.10s - 243.56s |  It wasn't done five years ago, you know, or it's not ongoing
243.56s - 247.50s |  now. So before you can even propose a good idea, you don't
247.50s - 251.14s |  maybe even have the information to, yeah, it inside the fence
251.14s - 254.44s |  line, there's a lot of sharing. So, you know, everybody there
254.44s - 258.24s |  has a clearance doesn't matter if you, um, you know, work the
258.26s - 262.34s |  janitorial staff, the technical staff, the language staff, the
262.34s - 266.00s |  cybersecurity teams, everybody has the same clearance. You may
266.00s - 269.14s |  get some special accesses and some is compartmented, but
269.14s - 272.60s |  overall, you know, it, it, it's important to understand the
272.60s - 275.58s |  greater mission and what, what we're trying to achieve. And so
275.58s - 276.58s |  you do get some opportunities.
276.58s - 279.52s |  Okay. So it's not just everybody in their one area, but oblivious
279.52s - 283.96s |  to what else is, yeah. Um, okay. So then, then you got your, uh,
283.96s - 286.16s |  big assignment, you went to Europe.
286.18s - 290.72s |  Yeah. So I got to represent NSA in the, uh, U.S. embassy in
290.72s - 294.72s |  London. So, um, being the cryptologic representative to the
294.72s - 300.32s |  UK and in that, um, you know, it was awesome until COVID hit. So
300.32s - 304.14s |  when you're a liaison and you're representational, not a lot of
304.14s - 308.00s |  interesting things happen when you're in a total COVID lockdown.
308.00s - 308.20s |  Yeah.
308.70s - 312.08s |  And so did you gain a different appreciation of what, what the
312.08s - 314.28s |  view from the outside is looking back at America?
314.38s - 314.64s |  Yeah.
314.66s - 316.46s |  So our partners or allies or?
316.62s - 319.70s |  I don't care if you're at a company or a government agency, when
319.70s - 324.76s |  you represent yourself to your partners, your customers, um, you,
324.86s - 327.50s |  you understand different things about the way the organization
327.50s - 330.30s |  functions and, and what it looks like from, from the outside.
330.30s - 330.68s |  Definitely.
330.68s - 336.72s |  Yeah. So, um, so then you come back to the States and then you
336.72s - 337.98s |  were in charge of?
338.28s - 340.08s |  The cybersecurity directorate.
340.12s - 342.82s |  So cybersecurity directorate, which is most famous for its
342.82s - 343.46s |  Twitter handle.
344.06s - 350.24s |  Yeah, I did, you know, even, even before going to the UK, I had a
350.24s - 351.64s |  true Twitter presence.
351.72s - 355.12s |  I worked, um, to kind of engage, right.
355.12s - 359.76s |  That's where a lot of the InfoSec timely information is popping out.
360.28s - 362.28s |  And, uh, I built a following.
362.34s - 366.96s |  I had probably more positive and beneficial interactions with that
366.96s - 369.92s |  Twitter handle than the official NSA handles.
369.94s - 373.50s |  So the public affairs chief came to me one day and said, we want to
373.50s - 375.30s |  give you an official NSA handle.
375.94s - 378.70s |  And I told them, hell no, not even know, but hell no.
378.70s - 382.54s |  Cause that means the lawyers get to decide what I can put out there.
382.54s - 385.06s |  I'd have to go through the pre-publication review.
385.34s - 388.98s |  Our public affairs officers would be pushing things at me to push out
388.98s - 392.54s |  there and, and it just wasn't a reasonable idea.
393.06s - 395.50s |  So when they didn't expect me to say no.
396.02s - 398.70s |  So they went away and thought they argued with the lawyers.
398.70s - 402.16s |  They came back with a four page document for me to sign that said,
402.16s - 404.76s |  you can have a official handle.
405.00s - 409.60s |  You don't have to go through pre-pub review, but anything bad that happens
409.60s - 412.40s |  is on you and you know, the nooses around your neck, right?
412.40s - 412.52s |  Right.
412.52s - 416.36s |  Is it a one paragraph and like four pages of rope to hang yourself?
416.40s - 416.88s |  Yes.
416.96s - 420.84s |  And, and I said, I'm already doing that right with my private one.
420.84s - 424.40s |  So, so I agreed, I signed up, I started putting out some things
424.40s - 426.28s |  continued with edgy memes.
426.34s - 429.46s |  Um, you know, Jeff talked about, you know, a couple of times taunting
429.46s - 433.78s |  the Russians, things like that, but it was cybersecurity awareness
433.78s - 437.14s |  month where they came to me with this public affairs idea of all
437.14s - 439.30s |  the boring stuff they were going to talk about in October.
439.66s - 443.82s |  And, um, I, I just couldn't stomach it.
444.26s - 448.66s |  And so, uh, in a little act of defiance, I made a meme, the sweating
448.66s - 452.54s |  guy with the two buttons and it said memes or cybersecurity awareness.
453.00s - 456.80s |  And I, I pushed that out and it got good response and pickup.
456.84s - 458.24s |  And I said, I can do this.
458.24s - 461.36s |  You know, cybersecurity awareness month is 30 days.
461.36s - 465.16s |  I can engage with 30, 31 more, 30 more memes.
465.60s - 471.60s |  Um, I did not understand how hard it is to come up with 30 good ideas
472.24s - 474.20s |  because, you know, I wasn't doing them at work.
474.20s - 478.36s |  I was doing them at home after hours and I'd get home at seven
478.36s - 479.88s |  or eight at night, burnout.
479.96s - 481.44s |  I'd come up with an idea.
481.58s - 482.58s |  I'd make a meme.
482.90s - 486.02s |  I'd get up in the morning and ready to post it at 5 a.m.
486.02s - 490.86s |  before I was going in the skiff and I'd look at it and I'm going, holy crap.
490.86s - 492.78s |  I think that was a good idea last night.
492.78s - 496.20s |  Yeah, I can't put this on an official NSA Twitter account.
496.22s - 498.62s |  And so we'd get something a little more benign.
499.06s - 503.26s |  Um, but I learned that first year it was a lot of work and I had a couple
503.26s - 509.46s |  people who informally helped, but the next year, um, I just kept, uh, a
509.48s - 513.88s |  running log whenever I had an idea and started building up a year's stack.
513.92s - 514.28s |  Yeah.
514.32s - 514.56s |  Yeah.
514.76s - 518.40s |  So I had material banked up and, uh, it went much better last year.
518.72s - 520.68s |  And, uh, so did you pass the torch?
520.84s - 524.64s |  You know, are they going to, is there a meme worthy successor?
524.72s - 527.48s |  Well, Dave Luber is now the CSD director.
527.80s - 531.64s |  He's debating about whether memes are CSD or memes are Rob.
531.96s - 535.96s |  So I will certainly come out with, uh, some memes in October.
535.96s - 538.28s |  We'll see whether NSA, or maybe a head to head.
538.64s - 538.96s |  Yeah.
538.96s - 540.52s |  We could be complimentary.
540.52s - 541.86s |  There's not a competition.
542.26s - 542.42s |  Yeah.
542.42s - 543.50s |  I think that's fantastic.
543.50s - 547.78s |  Um, when I hear that story, I think about the dilemma that we have
547.78s - 549.98s |  sort of in cybersecurity versus hacking.
550.58s - 556.06s |  Um, so in hacking, you get to hack when you feel like hacking, right?
556.06s - 561.78s |  It's when you are, um, opportunistically the stars align and you're inspired
561.78s - 565.58s |  and you hack and it's great, uh, in InfoSec, you have to be professionally
565.62s - 567.18s |  sort of creative all the time.
567.18s - 568.10s |  You're on the clock.
568.56s - 570.00s |  It's your page, you know, paycheck.
570.76s - 574.88s |  And I, I remember the.com days as we came into this era, some people
574.92s - 576.44s |  can't be professionally creative.
576.44s - 577.36s |  That's not who they are.
577.58s - 578.64s |  And other people can.
579.08s - 581.24s |  And I remember reading a story about this.
581.24s - 584.72s |  It was, I'm not the first to ever even think of this Disney animators.
584.72s - 589.48s |  When animation went from a craft to an industry, the same thing
589.48s - 593.32s |  happened, professional illustrators, animators versus not.
593.96s - 594.24s |  Okay.
594.24s - 594.92s |  So let's kick it off.
594.92s - 596.66s |  I've got to, there's a bunch of stuff going on.
596.66s - 599.68s |  I think the first, just most topical thing, top of mind,
599.68s - 600.68s |  cause it's just so recent.
601.00s - 605.84s |  It's it's like hack and leak Trump's complaining that somebody is coming
605.84s - 610.36s |  after him, dumping his emails like this happens every election cycle now.
610.44s - 610.76s |  Yeah.
610.76s - 612.44s |  What what's old is new, right?
612.44s - 615.32s |  And so if you haven't followed, because you're in the DEF CON bubble,
615.68s - 620.04s |  um, they announced, uh, in the last 24 hours that the Trump campaign
620.04s - 624.68s |  was hit with a hack and journalists started receiving material, internal
624.70s - 626.24s |  communications to the campaign.
626.70s - 627.26s |  And.
628.10s - 631.90s |  You know, the assumption is that we are in a cycle again with
631.90s - 634.06s |  hack and leak already starting.
634.14s - 636.58s |  And, you know, there's, there's various opinions and
636.58s - 638.06s |  conjecture about who it is.
638.46s - 641.82s |  Um, you know, being here and not in the know, I, you know, I'm not
641.82s - 645.54s |  going to take, uh, take a guess at that, but you know, the, the
645.54s - 647.62s |  ones we've seen in the past, right.
647.62s - 651.14s |  We've certainly seen the Russians involved in hack and leaks
651.14s - 652.78s |  and focused on our campaigns.
653.04s - 654.60s |  We've also seen the Iranians.
654.60s - 658.42s |  There was a lot of work in the, uh, in the previous election
658.42s - 663.96s |  cycle to pre bunk, meaning to debunk in advance before it came out.
663.96s - 668.36s |  Some Iranian material focused on the campaigns and China has also been
668.36s - 670.16s |  involved in some of the activities.
670.16s - 675.16s |  They've been a little more careful and, and, uh, um, cautious in that space,
675.48s - 680.24s |  but it is very clear and starting this early, it's, um, it's pretty surprising.
680.24s - 680.52s |  Right.
680.78s - 684.46s |  I can't imagine buckle up for October because I think we're in for a wild ride.
684.46s - 684.62s |  Yeah.
684.62s - 684.82s |  Yeah.
684.82s - 687.06s |  The October surprise is coming early.
687.42s - 689.78s |  That you, some, you mentioned pre bunking.
689.78s - 693.86s |  I'm really disappointed that, that, that pre bunking is not terribly effective.
693.86s - 696.54s |  You know, the studies show it doesn't work as well as we'd hoped.
696.82s - 699.70s |  So we're still searching for tools to deal with this
699.70s - 701.52s |  information or dismal information.
701.52s - 702.26s |  It's yeah.
702.34s - 705.60s |  One of the harder challenges is, you know, the Russians used to be
705.60s - 708.18s |  awesome at creating disinformation.
708.56s - 712.88s |  They would create whole storylines that, that would take people down a path.
713.28s - 718.52s |  Now, unfortunately they don't have to, they, their MO today is to pick divisive
718.52s - 724.64s |  issues that have people already pre loaded on both sides and just amplify the stuff
724.64s - 726.52s |  that's naturally coming out of those communities.
726.56s - 728.28s |  They'll just keep loading up both sides.
728.44s - 728.64s |  Yes.
728.64s - 730.02s |  Like they don't have to pick a side.
730.20s - 733.08s |  And so I get frustrated when people tell me like, but why would the
733.08s - 736.84s |  Russians like support though the liberals in France or whatever?
736.94s - 738.94s |  It's like, you know, they, they support everybody.
739.18s - 740.74s |  They just try to get everybody to fight.
741.22s - 741.38s |  Yeah.
741.74s - 744.58s |  Cause they want the perception of chaos or real chaos, right?
744.74s - 748.14s |  They, they introduce it well, but I think don't they, they also come.
749.22s - 750.46s |  There's a boomerang effect, right?
750.46s - 753.62s |  We saw that a little bit with COVID when they started fueling the anti COVID
753.62s - 756.50s |  stuff for the West and then it blows up and now there's an anti COVID movement
756.50s - 760.10s |  in Russia and it's like, it comes back now, I think some of it when they try to
760.10s - 762.02s |  take some of the technical issues, right?
762.32s - 767.56s |  Often it's often it's, um, you know, more domestic and they seem successful with
767.56s - 767.80s |  those.
767.84s - 768.20s |  Yeah.
768.40s - 768.68s |  Yeah.
768.72s - 772.24s |  Well, they must have to have a way of preventing it from coming back at them.
772.84s - 774.64s |  And you can see that in the APTs, right?
774.64s - 777.44s |  If it's a Cyrillic keyboard setting, don't infect.
778.08s - 783.08s |  Um, so I've got to figure out a way to have two keyboards plugged in or add,
783.08s - 784.92s |  maybe just add Cyrillic as a language pack.
784.92s - 785.28s |  You can.
785.40s - 785.68s |  Yeah.
785.68s - 786.48s |  And that does work.
786.68s - 787.20s |  Uh, it works.
787.20s - 789.72s |  And then Chinese and then I should just load them all.
791.40s - 791.76s |  Yeah.
792.68s - 793.04s |  Okay.
793.24s - 798.48s |  So then, um, so the, one of the countries you mentioned China, I mean, they're,
798.60s - 799.80s |  they're having a moment.
799.82s - 802.16s |  They're, um, they're getting pretty aggressive.
802.68s - 802.88s |  Yeah.
802.92s - 808.56s |  Um, you know, not just volt typhoon, but I don't emotionally, it was like, okay,
808.56s - 809.44s |  it's espionage.
809.44s - 812.80s |  You're doing recon, you're stealing secrets, which sucks.
813.68s - 817.88s |  But now it's like, you're preparing the battlefield and that's not so cool.
818.46s - 822.46s |  And so we're pulling their stuff out as fast as we can possibly pull it out.
822.46s - 824.06s |  And it's going in as fast as we can find it.
824.06s - 828.34s |  And it's, it's, it doesn't seem like there's much public awareness about like
828.34s - 832.26s |  how warm, not hot, how warm this effort is.
832.26s - 835.74s |  And, and you've seen it probably much longer and can maybe contextualize
835.74s - 836.62s |  it better for us.
837.06s - 837.30s |  Yeah.
837.30s - 842.22s |  So the, the, the reference Jeff's making is to a camp series of campaigns that
842.22s - 846.38s |  are coming at the U S if you look for volt typhoon in some of the media
846.38s - 851.04s |  references going back, um, as much as two years now where we've been chasing
851.04s - 856.16s |  this, um, hacking activity, mostly living off the land technology where they're
856.16s - 859.84s |  not bringing malware, but they're bringing techniques to gain access to
859.84s - 864.08s |  networks, but it is the networks themselves that they're gaining access
864.08s - 865.72s |  to, which is the differentiator.
866.20s - 871.52s |  There's a set of them that are military related things that we would need to
871.52s - 875.96s |  respond to a crisis in, um, you know, in the Asian hemisphere.
876.44s - 880.84s |  Um, so if China, Taiwan were to kick off, um, you know, what would we have to do?
880.84s - 884.84s |  We'd have to move a lot of troops and material all the way from the
884.84s - 886.88s |  West over into that theater.
887.08s - 890.12s |  We would stage and go through Hawaii and Guam.
890.12s - 894.72s |  And so there's, there's implementation of hacks into critical
894.72s - 896.44s |  infrastructure in Hawaii and Guam.
897.02s - 900.60s |  You can say that's, you know, military preparations, but this
900.60s - 902.40s |  campaign goes farther than that.
902.46s - 906.02s |  It goes all the way back to domestic us where the critical
906.02s - 911.58s |  infrastructures like transportation, aviation, pipelines, electricity
911.94s - 915.46s |  are all being targeted with the same set of living off the land techniques.
915.78s - 919.74s |  And the intent there is not to disrupt the military, but
919.74s - 921.82s |  to create societal panic, right?
921.86s - 925.90s |  There's, there is, there's language for that when you're trying to
925.90s - 928.98s |  induce panic in a society and that's terrorism, right?
928.98s - 934.00s |  This prepositioning literally is with the intent of being able to execute
934.00s - 935.88s |  terrorism against the U S population.
935.88s - 943.52s |  So we've moved, um, far down the rabbit hole in this work where, um, you know,
943.52s - 948.80s |  there's, there's set up for great power competition and preparations for conflict.
949.36s - 955.48s |  It kind of sucks when you're, you're in this kind of a contest and we don't
955.48s - 958.72s |  necessarily ascribe to those kind of rules, right?
958.72s - 960.38s |  We don't really behave that way.
960.42s - 964.06s |  I'm hoping that we're breaking in and stealing all their secrets, but we're
964.06s - 965.82s |  not stealing their corporate secrets.
966.38s - 969.62s |  And it just feels like it's an uneven matchup, right?
969.74s - 970.70s |  It definitely is.
970.70s - 973.78s |  And, you know, that's one of the challenges is, you know, we're a
973.78s - 975.90s |  society, a rule of law society.
976.26s - 979.66s |  So, um, you know, one of the things the military does, we have a cyber
979.66s - 984.02s |  command, but they are bound by the law of armed conflict and that law of
984.02s - 988.50s |  armed conflict says you're not going to create generic pain and suffering
988.50s - 990.24s |  to a civilian population.
990.52s - 994.64s |  So things like a water plant and an aviation, general civilian
994.64s - 1000.12s |  aviation, um, electric grid, those are off limits because of the, the, the
1000.12s - 1002.80s |  broad nature and the unfocused.
1002.96s - 1007.32s |  And it's, it's, I guess China is very much, you know, dual use early days,
1007.32s - 1012.24s |  Russia, you know, single use, but now that the world's dual use, you really
1012.24s - 1017.56s |  have to spend time, I bet de-conflicting like multi-tenant in a structure or
1017.56s - 1019.18s |  building or a network stack, right?
1019.18s - 1021.78s |  How do you, you have to have a whole team that does nothing, but.
1022.54s - 1022.74s |  Yeah.
1022.74s - 1026.26s |  When, when I joined NSA, you know, the world was simple.
1026.26s - 1027.42s |  It was the cold war.
1027.42s - 1034.02s |  It was bipolar tensions, Russia, us, and the Russian things that we cared
1034.02s - 1039.06s |  about were these bespoke military communications, bespoke government
1039.06s - 1044.02s |  devices, and now, you know, the world's on Microsoft windows, the, the world
1044.16s - 1050.40s |  on all of these major us branded, um, infrastructure between switches and
1050.40s - 1052.52s |  routers and firewalls and other things.
1052.92s - 1057.00s |  And so, yeah, it is definitely a dual use, um, world we've entered.
1058.08s - 1060.08s |  So, um, so what do we do?
1060.08s - 1062.64s |  I mean, are the politicians sort of up to speed or are we
1062.64s - 1063.80s |  organized the right way?
1063.80s - 1068.26s |  Do you think, is it, do we need a new revolution or new way of, uh, you
1068.26s - 1072.00s |  know, virtualization, like, what are your thoughts on how do we navigate
1072.10s - 1074.14s |  besides just keep pulling their stuff out?
1074.90s - 1078.14s |  Well, I think one of the big tools in the tool belt is
1078.14s - 1080.26s |  this continuous engagement, right?
1080.26s - 1084.50s |  You'll, you'll hear general Nakasone was here, you know, as former director
1084.50s - 1090.22s |  NSA, he pushed this idea of continuous engagement that, you know, if you, if
1090.22s - 1094.30s |  you think about a soccer field, um, you know, it's not a great strategy if
1094.30s - 1099.10s |  the opposing team gets to shoot unlimited, um, shots on your goal.
1099.44s - 1102.64s |  Um, and you just have to play defense continuously and try
1102.64s - 1103.92s |  to stop each and every kick.
1104.28s - 1108.80s |  The idea that you've got to be out there and, you know, and attacking
1108.80s - 1112.84s |  into, um, the far end of the field and bringing the pressure back to them
1113.08s - 1119.04s |  so that you use multiple tools to go and take away their implants, take
1119.04s - 1123.68s |  away their infrastructure, um, reveal their, their tools and intent, right?
1123.68s - 1125.62s |  That's one of the superpowers of NSA.
1125.96s - 1130.52s |  I mentioned that, you know, the, there's the intent by China to create
1130.52s - 1136.18s |  societal panic, that that intent is not something you find on an
1136.18s - 1138.44s |  incident response activity, right?
1138.46s - 1144.38s |  That's an intelligence policy, um, uh, development where you understand
1144.38s - 1149.48s |  them giving commands, orders, resources to execute this command.
1149.76s - 1152.92s |  And that's where the public private partnership is really important
1152.94s - 1156.90s |  because, you know, the hyperscale cloud providers, the operating system
1156.90s - 1162.06s |  vendors, the, uh, the, the internet backbone, um, providers, they are
1162.06s - 1167.32s |  going to see the activity, um, and they actually are in a better position
1167.32s - 1168.86s |  to do something about it, right?
1168.86s - 1174.58s |  To do that community defense, to clean the pipes, to challenge some of this.
1175.02s - 1181.14s |  But you need the, the connection to that intent and you need the community
1181.14s - 1186.08s |  to come together because no one element in that, in that ecosystem really.
1186.36s - 1186.84s |  I'm curious.
1186.84s - 1189.76s |  How do you, how do you, um, when you were inside, how do you
1189.76s - 1192.80s |  view open source intelligence?
1192.84s - 1196.52s |  There's just an unlimited of different feeds you could spend all of your
1196.52s - 1198.48s |  budget buying different threat feeds.
1199.00s - 1203.80s |  Um, maybe give some people a way of thinking about how to orient to this
1203.92s - 1209.40s |  unlimited amount of potential intelligence and is it useful, you know, what do you.
1209.50s - 1212.14s |  Yeah, it, it's absolutely useful.
1212.22s - 1219.58s |  Um, you know, because it's available and, and, um, you can get it through
1219.58s - 1224.46s |  open source places, that's not where the special sauce of NSA is applied.
1224.82s - 1225.06s |  Right.
1225.06s - 1229.06s |  But there's some point where you've got to bring together the ability to know
1229.06s - 1234.58s |  things that are knowable in the outside with that special intelligence that you
1234.58s - 1237.84s |  can only get from classified techniques.
1237.94s - 1242.82s |  And so, um, you know, we actually started an organization, the
1242.82s - 1247.62s |  cybersecurity collaboration center to bring the classified material out into
1247.62s - 1253.50s |  industry where they could then find more examples of the tradecraft techniques,
1253.50s - 1254.98s |  intrusions, or other things.
1255.42s - 1259.18s |  Um, and they quite frankly are the ones who can do something about it.
1259.46s - 1264.30s |  So, uh, a lot of work to connect in that unclassified space where industry works.
1264.78s - 1265.78s |  Yeah, that's fantastic.
1265.80s - 1270.04s |  Now, is that a widespread bottle or is that kind of unique to the U S or are we
1270.04s - 1273.36s |  sort of taking pages out of other countries playbooks because we're not the
1273.36s - 1277.32s |  only ones under pressure, there's a lot of other countries being targeted as well.
1277.56s - 1282.00s |  And so I, I'm guessing that's almost like this ecosystem of experimentation of like,
1282.00s - 1285.72s |  you know, if I eat garlic, does it keep the Chinese away, you know, instead of
1285.72s - 1290.68s |  the vampire, if I, you know, only route my packets through this, you know, what
1290.68s - 1293.40s |  are people trying is it's, it's gotta be massive experimentation.
1293.50s - 1293.74s |  Yeah.
1293.74s - 1298.26s |  So, so there's a lot of, um, international collaboration, cooperation,
1298.26s - 1303.26s |  cybersecurity is really a cross cutting issue that a lot of people can rally
1303.26s - 1308.22s |  behind, but at the same time, the U S is unique in that, you know, you look at the
1308.22s - 1312.78s |  technologists that gather at places like DEF CON, you look at the power of the
1312.78s - 1317.70s |  Valley, you look at the major hyperscale cloud providers are U S right.
1317.90s - 1322.34s |  So there, there is a responsibility to get the American industry involved
1322.56s - 1325.92s |  because they're global multinational companies and they're the ones who can
1325.92s - 1330.48s |  actually make sea change, but you know, we've got friends and allies, you, you
1330.48s - 1336.68s |  look at the UK has the, um, national cybersecurity center and they, um, have
1336.68s - 1340.32s |  a lot of like-minded ideas and there's things that they innovate and, and flow
1340.32s - 1344.56s |  over here and there's things we do, they copy, you know, Israel is another example
1344.56s - 1350.88s |  of, you know, dense, um, technical capable organization and somebody that's under
1350.90s - 1355.38s |  threat, quite frankly, a lot of the time, um, from their Iranian conflicts.
1355.38s - 1359.62s |  So, um, you know, we learn from them because they're in the tactical
1359.62s - 1361.26s |  knife fight each and every day.
1361.90s - 1366.58s |  There's, um, there's this, I guess, interesting alignment, uh, worrying
1366.58s - 1369.86s |  alignment over the last year or two with, with Russia and China getting
1369.86s - 1371.40s |  closer and closer together.
1371.82s - 1376.34s |  Um, so I'm wondering if you'll, if they'll, do they share these kinds of
1376.34s - 1379.78s |  techniques in your experience or do they, when, when countries get close to each
1379.80s - 1384.04s |  other, they still keep these capabilities separate and they just kind of support
1384.04s - 1385.56s |  each other, but they never merge.
1385.88s - 1392.48s |  Yeah, I, I think, um, you know, there's still, well, there's, there's common
1392.48s - 1394.28s |  reasons for them to get together.
1394.72s - 1396.68s |  Um, they still distrust each other a lot.
1396.92s - 1401.24s |  And so we don't see the kind of collaboration that you do, um, like
1401.24s - 1402.58s |  with the five eyes countries.
1402.68s - 1407.76s |  So you wouldn't see like coming, coming in from, let's say a Russian kind of IOC
1408.26s - 1410.86s |  signature, but really it's on behalf of.
1411.78s - 1412.06s |  Yeah.
1412.62s - 1416.14s |  Don't believe you'd see that unless somebody is adopting tools to do false
1416.14s - 1418.78s |  flags and, you know, change the scent.
1418.90s - 1421.86s |  Because I'm curious, because in China that's, you know, they, they do have
1421.86s - 1424.18s |  their sort of rule of law rule of the party.
1424.62s - 1427.50s |  And in Russia, there's this big connection between the sort of
1427.50s - 1429.06s |  organized crime in the state.
1429.06s - 1432.54s |  I mean, you can't really sometimes tell which is which right.
1432.62s - 1435.82s |  And so those two models aren't really compatible.
1435.82s - 1436.58s |  I don't think.
1436.72s - 1441.08s |  I don't think the, the Chinese leadership would be cool with this, you know, arms
1441.08s - 1444.52s |  distance criminals really running the show.
1444.60s - 1451.96s |  And so it makes me think that, um, ransomware and a lot of these, uh, highly
1452.00s - 1456.88s |  technical, sophisticated, uh, crime operations seem to be mostly coming from
1456.88s - 1458.18s |  Russia, right?
1458.18s - 1459.88s |  They're not really coming from China.
1460.48s - 1460.68s |  Yeah.
1461.36s - 1465.52s |  There, there is a set of China, um, that's active in it.
1465.66s - 1472.58s |  Um, so if any of you saw the ISUN leaks, there was a company called ISUN got
1472.58s - 1474.58s |  hacked and their data was dumped.
1474.94s - 1480.30s |  It was really an interesting kind of case study into the Chinese ecosystem.
1480.74s - 1486.50s |  They have a lot of independent companies who hack on their own, but then market
1486.50s - 1490.54s |  the things that they gather back to the Chinese government so they don't get
1490.54s - 1494.68s |  direct direction, they may get direction to build tools and infrastructure, but
1494.70s - 1497.30s |  then those tools and infrastructure become dual uses.
1497.30s - 1498.30s |  They run their own ops.
1499.02s - 1503.90s |  Um, we don't see kind of the same ecosystem happen in the, in the Russian
1503.90s - 1507.46s |  space where they do leverage the criminal ecosystem.
1507.98s - 1512.74s |  Um, but in both cases, they provide this safe haven.
1513.10s - 1518.98s |  They know the, uh, the, the players, they, um, they enable the players in that
1518.98s - 1523.34s |  they certainly don't constrain them, but they also interact with them in different
1523.34s - 1523.70s |  ways.
1524.00s - 1524.20s |  Yeah.
1524.20s - 1528.56s |  It's curious because you can watch what kind of prosecutions, uh, or news
1528.56s - 1530.52s |  coverages are happening in Russia or China.
1530.52s - 1534.08s |  And you can see in the States, you'll see prosecutions from computer crime all
1534.08s - 1534.62s |  the time.
1535.28s - 1538.82s |  Um, and maybe it's just not reported the same way there, but it just, it definitely
1538.82s - 1542.42s |  seems like the types of crimes that are getting reported or, or publicly talked
1542.42s - 1546.96s |  about are quite different, which makes you think that either they don't care or
1546.96s - 1551.24s |  they're using it, you know, for recruitment or training or something's going on.
1551.24s - 1551.84s |  That's different.
1552.44s - 1552.72s |  Yeah.
1552.86s - 1559.14s |  Um, then those nation States do treat their hacker element as, you know, uh, a
1559.14s - 1564.26s |  national asset and they use them differently, but there's the spectrum that
1564.26s - 1567.38s |  goes from the very official nation state.
1567.46s - 1572.66s |  You know, you work for the military, the Intel service, some special branch of the
1572.66s - 1578.82s |  government to do intelligence operations or cyber operations in advance all the
1578.82s - 1583.68s |  way down through this quasi, I know and understand it's going on.
1584.04s - 1589.16s |  I either task it or I just accept the benefits of it all the way down to, um,
1589.20s - 1590.04s |  last couple of years.
1590.04s - 1594.78s |  The interesting one is, um, some of the hacktivist space where you get inspired
1594.78s - 1599.40s |  by a national requirement and take action.
1599.78s - 1604.02s |  I'm thinking, you know, the, the Russian hackers to Ukraine, the Ukrainian hackers
1604.02s - 1608.68s |  to Russia, um, some of the Israel, um, Hamas, Palestine.
1608.80s - 1613.80s |  Yeah, this is, is this, it seems to me to be pretty unique that a country would
1613.80s - 1618.96s |  basically turn to the public and say, okay, hack on our behalf, go get them.
1619.32s - 1622.36s |  And, and I'm going to tell an NSA story cause it's unclassified.
1622.80s - 1628.60s |  Um, years ago there was this, uh, uh, a meeting with the industry and folks
1629.46s - 1634.26s |  that NSA was hosting and part of it was sort of the, uh, I think it was called
1634.26s - 1637.02s |  like cyber red Dawn was sort of the theme.
1637.42s - 1643.42s |  And the idea was, is there, they were exploring the concept, could there ever
1643.42s - 1644.78s |  be a sort of cyber red Dawn?
1644.78s - 1646.70s |  And if so, what would we do about it?
1647.26s - 1654.74s |  And, um, and my, my observation was, well, if there is a cyber red Dawn and we're
1654.74s - 1659.00s |  under attack, all the Microsoft employees are not going to go run to the hills and
1659.00s - 1659.76s |  take up guns.
1659.92s - 1662.36s |  They're going to run to Microsoft to defend the networks, right?
1662.36s - 1665.44s |  The people that understand their networks are going to defend their networks.
1665.88s - 1669.32s |  And then is the president going to get on television and say like network
1669.32s - 1675.20s |  operators that know iOS 3.2 0.5, uh, point to these IP address ranges, go, you
1675.20s - 1679.72s |  know, these people that understand Nokia go, how would that work?
1679.72s - 1684.08s |  And what's, you know, um, so I really lauded them for the, the, the thinking
1684.08s - 1688.98s |  of it, but, you know, in, in the end, I'm so curious on, like, they're just going to
1688.98s - 1689.98s |  create noise, right?
1689.98s - 1695.66s |  How do you, unless it's a big public campaign just to embarrass them, like,
1695.66s - 1697.10s |  look, I got into a radio station.
1697.26s - 1700.30s |  I don't see them actually having an effect, right.
1700.30s - 1702.18s |  Beyond a public relations effect.
1702.22s - 1702.54s |  Yeah.
1702.54s - 1706.34s |  So, you know, in, in our world, again, I go back to that country.
1706.34s - 1707.62s |  We're a rule of law.
1708.00s - 1714.16s |  You're not going to see the U S, um, you know, tasking people to independently
1714.60s - 1717.52s |  take up arms, cyber arms for the government, right?
1717.52s - 1721.28s |  The, the idea of letters of mark and reprisal, all of those things.
1721.64s - 1728.14s |  When I led tailored access operations, which was the hackers of NSA, we literally
1728.14s - 1732.92s |  only used NSA civilians on keyboard in military, um, on keyboard.
1733.32s - 1735.04s |  We would not use contractors.
1735.06s - 1740.14s |  There's different organizations have different rules, but that nation state
1740.14s - 1746.98s |  intrusion into another nation sensitive network is so risky that you've got to
1746.98s - 1748.36s |  own that, right?
1748.36s - 1755.46s |  If it goes bad, literally you could see a state department official, the state
1755.46s - 1757.10s |  department getting demarched.
1757.10s - 1761.74s |  You could see a white house press secretary or a senior official having to
1761.74s - 1764.78s |  address the fallout consequences of a hack gone bad.
1765.22s - 1770.62s |  And so if I'm controlling it at that level inside our operations, we're
1770.62s - 1774.54s |  certainly not going to ask people to go up and take up cyber arms on our behalf.
1774.94s - 1779.82s |  But the interesting space in this hacktivist motivational thing is we are
1779.82s - 1786.14s |  also seeing Intel services kind of take official government action, but cloak
1786.14s - 1791.30s |  themselves and create disinformation that it's being done by activists to kind of
1791.30s - 1796.08s |  create the fog of war and shed the, shed the attribution a little bit from
1796.08s - 1797.56s |  nation state capabilities.
1798.48s - 1801.80s |  Do you ever see, um, in the hacktivist, do you see the useful idiots being
1801.80s - 1802.72s |  employed a lot?
1803.72s - 1804.36s |  Absolutely.
1804.36s - 1810.08s |  It, it ranges from that, you know, useful idiot through tasking to no, we'll do it
1810.08s - 1811.60s |  and pretend to be an activist group.
1811.84s - 1812.32s |  Oh man.
1812.48s - 1817.96s |  So, um, there's another group that, um, it's much smaller, uh, the super
1818.02s - 1823.02s |  empowered individual and the super powered individual really kind of came to
1823.02s - 1828.10s |  light at the beginning, um, of the Ukraine, the invasion of, by Russia of
1828.10s - 1833.90s |  Ukraine, where the community got really distraught and wanted to get involved.
1833.90s - 1837.58s |  They wanted to do something right, but not necessarily a call to arms, go attack
1837.82s - 1838.30s |  Russia.
1838.30s - 1842.86s |  It was much more like, oh no, what can I do in my position where I'm sitting?
1843.18s - 1845.42s |  And you saw all kinds of community responses.
1845.44s - 1849.92s |  Um, I think the Mongo DB community said, you know, we've got this community
1849.92s - 1854.20s |  platform, but we're just, we just, let's have the, the Russian projects move away.
1854.20s - 1854.48s |  Right.
1854.48s - 1856.28s |  You have a year to move away your projects.
1856.28s - 1857.44s |  We just, we don't want them here.
1858.16s - 1863.76s |  Um, you saw different companies responding to, uh, sanctions that were coming.
1864.88s - 1872.40s |  So if you were, I don't know, Eugene Kaspersky in a super empowered individual,
1872.40s - 1875.00s |  he could order softer updates, right?
1875.00s - 1879.42s |  If he has had a bad day and wants to order an update to delete everybody's
1879.86s - 1882.34s |  data, he could write same thing.
1882.34s - 1886.70s |  Elon Musk, if he wants to turn down off Starlink, cause he's having a bad day
1886.70s - 1891.18s |  online, he's super empowered to wreck the U S foreign policy, right?
1891.18s - 1892.82s |  This, this is fairly new.
1893.30s - 1895.70s |  It's not a giant board of a corporation.
1895.70s - 1896.78s |  It's not Boeing.
1897.30s - 1899.46s |  It's one guy or gal.
1900.26s - 1902.98s |  So how do you even deal with that?
1903.72s - 1909.60s |  Yeah, I, I think we've got to look at the resiliency of our networks and, and the,
1909.96s - 1912.32s |  the system of systems we've created, right?
1912.68s - 1918.24s |  I think CrowdStrike was a wake up call that, you know, it was not a decision
1918.24s - 1923.16s |  made, but an accident that then had massive repercussions, right?
1923.16s - 1927.12s |  So, you know, that all the people who are looking at creating mischief on the
1927.12s - 1929.28s |  internet are now studying that.
1929.28s - 1930.56s |  What are those choke points?
1930.58s - 1937.46s |  What are those ways in that if I cause pain at that point amplifies and magnifies
1937.46s - 1939.18s |  the effect I can have throughout.
1939.62s - 1943.94s |  And so that's, that's a place a super empowered individual could do something,
1944.22s - 1950.34s |  but it's also a place where the, the, the pressure of a hack or even the accident
1950.74s - 1952.94s |  could, uh, could ripple through our systems.
1953.38s - 1955.22s |  Well, and it also could work in reverse.
1955.22s - 1958.98s |  I mean, I remember this is years ago, but there's this guy, Larry, who ran
1959.00s - 1964.48s |  SpamHouse and it's like, well, if you anger Larry, I mean, this is an example,
1964.48s - 1968.52s |  but if you angle angry Larry and he puts you in this black hole list, you just
1968.52s - 1969.20s |  don't get email.
1970.32s - 1972.08s |  So, you know, don't piss off Larry.
1972.64s - 1980.08s |  Um, so with these super empowered individuals, I think there's a, um,
1980.36s - 1984.32s |  there's another element coming in, which is like either personal responsibility
1984.38s - 1989.18s |  or liability, and we're starting to see sanctions, right?
1989.22s - 1994.46s |  Uh, enter the field as a new tool, new option in a sort of a diplomatic tool belt.
1994.90s - 1999.30s |  And, um, the example I always bring up is, uh, there's a skirmish on the
1999.30s - 2001.98s |  border between China and India.
2002.50s - 2004.98s |  There's loss of life on both sides.
2005.30s - 2010.86s |  India is really upset, but instead of engaging in more armed conflict, they
2010.86s - 2012.66s |  go and ban Tik Tok from their app store.
2013.64s - 2017.60s |  And, uh, and Tik Tok says, Oh no, that's $6 billion in revenue.
2017.60s - 2018.24s |  We're doomed.
2019.16s - 2020.88s |  And China says, we'll retaliate.
2021.12s - 2021.96s |  We'll ban.
2023.00s - 2026.80s |  Oh, there's no Indian apps because we don't allow them in the app store in China.
2027.48s - 2028.76s |  It's asymmetric, right?
2028.76s - 2030.68s |  They, they didn't have a method to respond.
2030.68s - 2034.52s |  And so I think now there's also a new tools emerging in the toolbox
2034.52s - 2036.36s |  that didn't exist a few years ago.
2036.78s - 2041.20s |  Are those, how do you, do you ever get involved in the discussions about no,
2041.22s - 2042.46s |  no, select this tool.
2042.70s - 2042.98s |  Okay.
2042.98s - 2043.18s |  Yeah.
2043.18s - 2045.26s |  We'll hack it if you want us to, but you should maybe really
2045.26s - 2046.70s |  try this other option first.
2046.74s - 2051.78s |  Yeah, no, uh, my first response in a lot of the policy discussions, right.
2051.78s - 2055.24s |  When, when I was at the white house or when we're talking to the white house
2055.24s - 2060.30s |  in, in operational space is usually the best response to a hack is
2060.30s - 2061.86s |  not to hack straight back.
2062.10s - 2062.42s |  Right.
2062.42s - 2065.86s |  The, the answer of I'll bring a bigger cyber stick to somebody
2066.18s - 2067.96s |  is usually not the answer.
2068.34s - 2074.62s |  Um, the U S has a whole quiver of different tools and it ranges from
2074.70s - 2080.30s |  sanctions to financials, um, to name and shame, to diplomatic pressures,
2080.30s - 2083.68s |  to indictments, to all of these other things.
2083.70s - 2088.78s |  And, you know, it, it, it needs to be this tapestry of a solution.
2089.20s - 2093.86s |  Um, there is no one thing that is going to make, um, you know, the
2093.86s - 2098.00s |  Chinese PLA say, Ooh, you know, that was too hard.
2098.00s - 2105.78s |  I'm going to stop and, and just, uh, make my, my, my hacking entities go away.
2105.78s - 2107.44s |  We're done with hacking forever.
2107.78s - 2108.06s |  Right.
2108.06s - 2112.04s |  So you've got to get to the point where you add that friction, the
2112.04s - 2115.26s |  continuous engagement, so they can't be as successful all the time.
2115.78s - 2119.74s |  But you also want to do some things to think about the decision makers, right.
2120.38s - 2124.42s |  Everybody in those official structures has a boss all the way
2124.42s - 2125.74s |  up to the leader of the country.
2126.22s - 2130.06s |  And if their hacking operations are bringing pain to the people who are
2130.06s - 2135.54s |  their bosses, whether it's, Hey, I gave you, you know, this massive pile
2135.54s - 2141.14s |  of money and you failed, or I gave you the authority to do this hack and
2141.14s - 2143.04s |  you got caught and embarrassed me.
2143.04s - 2148.38s |  And now, you know, our ambassador is responding to a Dimarsh or, you
2148.38s - 2152.86s |  know, we've been called out for this global campaign of hacking critical
2152.86s - 2158.70s |  infrastructure and, and, you know, it is, it is disparaging us in the world's
2158.70s - 2163.46s |  eyes and causing us, you know, uh, reputational problems, those things
2163.46s - 2168.46s |  stack up to where the authorities constrict, the money constricts the,
2168.50s - 2174.18s |  the chain of command, um, is much more involved and adds bureaucracy into that
2174.18s - 2177.94s |  space, you want to add the friction, but in the end, you've got to get to
2177.94s - 2179.78s |  human beings who make decisions.
2180.02s - 2183.74s |  And there's a lot of tools for those human beings, um, to stop.
2184.54s - 2185.98s |  So, um, I want to go back.
2185.98s - 2189.58s |  We were talking about, uh, a mutual friend, Tony Sager.
2189.82s - 2194.86s |  Um, and I use this quote, Tony said, I don't know how many decades ago, but
2194.86s - 2200.82s |  he said that, um, you can't, you can't defeat your opponent one-on-one because
2200.82s - 2204.78s |  there's just the population disparity between, um, different countries.
2205.10s - 2206.30s |  So you have to automate.
2206.78s - 2210.34s |  And so we try to automate as much of everything we can.
2210.34s - 2213.30s |  We, we look at everything, we create automation, we try to automate everything
2213.30s - 2218.54s |  we could possibly automate, and then we try to automate the rest because
2218.54s - 2220.02s |  there's just not enough humans.
2220.34s - 2221.46s |  And that was a long time ago.
2221.86s - 2224.30s |  Tell us, tell me about your, your thoughts around automation, automated
2224.30s - 2226.98s |  defense, like how do you free up your operators?
2227.22s - 2231.26s |  Like, what do you think the highest useful purpose of a human is in this
2231.30s - 2235.62s |  chain and how much of it can be automated away to let them focus on that truly
2235.62s - 2237.26s |  human aspect?
2237.26s - 2238.90s |  Is it the risk reward?
2238.90s - 2241.38s |  Like you need a human to make this decision or?
2242.06s - 2242.34s |  Yeah.
2242.38s - 2245.38s |  What I've found is the, the humans are the creative element.
2245.58s - 2249.94s |  They're going to find the new and novel thing that slips through the cracks.
2250.38s - 2256.06s |  And whether it's the, the, the criminals innovating or whether it is the, um, the,
2256.06s - 2260.78s |  the, the defenders innovating, it's going to be the case where, you know, that
2260.78s - 2263.66s |  innovation is going to move the needle and change things.
2263.66s - 2269.90s |  But I do think we are at, um, we're at an inflection point right now where, um,
2270.06s - 2274.74s |  you know, generative AI, large-scale machine learning, um, is just going to
2274.74s - 2276.66s |  increase the pace and speed.
2277.22s - 2281.78s |  As you've looked over the last several years, the time from knowledge of a
2281.78s - 2287.30s |  vulnerability and a POC hitting the internet to the amount of exploitation
2287.30s - 2289.78s |  has just shrunk and shrunk and shrunk.
2290.26s - 2296.02s |  And, you know, I also think we talked early about the Chinese living off the
2296.02s - 2298.54s |  land campaign in Volt Typhoon.
2298.94s - 2304.78s |  Um, we're going to need machine learning to baseline what is normal and find the
2304.78s - 2310.14s |  anomalous things because of the stealth and quietness of those activities.
2310.50s - 2316.58s |  So, um, you know, I believe that the automation is going to start to address
2316.94s - 2322.74s |  the machine speed attacks and we're both going to see the, the ratcheting on
2322.74s - 2327.62s |  either side, um, moving towards speed and scale needing that automation.
2328.98s - 2329.34s |  Okay.
2329.34s - 2333.06s |  So we've got, um, if I'm reading this right, well, we have 11 minutes left.
2333.06s - 2333.66s |  Is that correct?
2333.66s - 2334.14s |  Everyone?
2335.22s - 2335.66s |  Five.
2335.66s - 2337.58s |  Oh, well then let's take one question.
2343.14s - 2343.38s |  Yep.
2343.38s - 2344.66s |  You got to get closer to the microphone.
2398.33s - 2399.65s |  Do you want to kind of repeat the question?
2400.17s - 2405.65s |  So, so I'll, I'll summarize a bit of what I heard, which is, Hey, there's a lot of
2405.65s - 2410.13s |  different organizations in the U S that are part of the puzzle for cybersecurity.
2410.53s - 2417.57s |  And, you know, whether it's DHS, CISA, FBI, NSA, um, DOD, you know, where are the
2417.57s - 2422.61s |  lanes, who's the orchestrator and, you know, how does the change in the political
2422.61s - 2426.01s |  environment, especially, you know, if we have a new administration change all of
2426.01s - 2428.49s |  that, so we have been getting better.
2428.49s - 2432.17s |  I won't say it's perfectly solved and all the gears are in, in complete
2432.17s - 2436.37s |  synchronicity, but you know, there's strengths and weaknesses in each of the
2436.37s - 2440.25s |  agencies and we're starting to get a rhythm where we know how to play to those
2440.25s - 2440.89s |  strengths.
2440.97s - 2446.53s |  Um, and you'll see things like campaigns where we have multiple agencies involved
2446.53s - 2451.61s |  in that, you know, FBI doing domestic stuff with their legal authority with DOJ,
2451.97s - 2458.37s |  um, combined with cyber command doing some extra outside the U S activity to do
2458.37s - 2463.49s |  takedowns in conjunction with FBI doing the internal U S CISA working with
2463.49s - 2468.09s |  industry and doing that campaign to synchronize the things that are across,
2468.17s - 2473.77s |  uh, the, the, the civilian infrastructure and then NSA lending technical expertise
2473.77s - 2476.45s |  and foreign intelligence, um, into that mix.
2476.45s - 2480.53s |  And, and we're getting better and learning over time on how we do those.
2481.01s - 2486.25s |  Um, the, the national cyber director was created to kind of be that band
2486.29s - 2488.05s |  conductor across all of them.
2488.45s - 2495.17s |  And so, um, you know, we've got that, that, that apex, um, in reality, you know,
2495.21s - 2500.13s |  a lot of the, the activity today, um, is ground up.
2500.49s - 2506.49s |  And, and when I say that, I mean, one agency has either a special, um, insight,
2506.49s - 2510.57s |  a special relationship, a team that's been working, and then they start to bring
2510.57s - 2514.81s |  the players in that can collaborate and add to that mix.
2515.17s - 2521.65s |  And then, you know, the, the, the, uh, ONCD and others then do the convening
2521.65s - 2526.45s |  to bring us all around the execution and synchronization, um, that, that,
2526.45s - 2533.73s |  because the roles are enshrined in statue and law and policy, um, you know,
2533.73s - 2535.81s |  we'll continue throughout administrations.
2535.81s - 2541.53s |  The nice thing about, um, cybersecurity, it's something that's fairly bipartisan.
2541.93s - 2547.13s |  Um, everybody can get behind the need to stop foreign adversaries into our spaces.
2547.45s - 2553.57s |  So, um, I, I am, uh, optimistic that the trajectory continues the biggest
2553.57s - 2557.77s |  shortcoming, and I heard an ask about the shortcoming I see today is, you know,
2557.77s - 2563.21s |  the scope and scale of the threats against the resources and, you know, the
2563.21s - 2567.97s |  innovation that comes, um, from the attackers into the vulnerability space.
2568.33s - 2573.65s |  And you see a lot of effort into, we've got to get to the point where we do the
2573.65s - 2576.49s |  things we know matter, right?
2576.49s - 2578.85s |  We've got to get on two factor authentication.
2578.85s - 2583.01s |  We've got to get companies, um, building more secure software.
2583.01s - 2587.81s |  We've got to get out of some of the memory unsafe languages and get the core
2587.81s - 2593.01s |  technologies over into things that, uh, that are defendable and defensible.
2593.33s - 2597.65s |  And then, um, you know, we've got to, we've got to build the staffs and teams.
2597.65s - 2602.77s |  And I think Jeff, to your question about automation, you know, the, the scope and
2602.77s - 2608.53s |  scale is so hard on some of these threats and, you know, having a big enough team to
2608.53s - 2613.77s |  defend 24 seven and who wants to work that graveyard shift in the middle of the night
2613.77s - 2617.37s |  on a holiday, you know, automation helps take the pressure off some of that.
2617.37s - 2619.65s |  So I like the trajectory we're on.
2619.69s - 2620.77s |  It is a journey though.
2620.77s - 2624.29s |  It is a long journey and we're just, um, we're, we're on the path.
2625.33s - 2625.65s |  All right.
2625.65s - 2626.25s |  Thank you, Rob.
2626.25s - 2627.45s |  Thank you for your service.
2627.57s - 2631.21s |  Thank you everyone for being here and we'll see you around the con.
2631.77s - 2632.21s |  Appreciate it.
2632.25s - 2632.65s |  Thanks.


url: https://www.youtube.com/watch?v=PmqvBe1LSZc
title: DEF CON 32 - Defeating EDR Evading Malware with Memory Forensics - Case, Sellers, Richard, et al.
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=PmqvBe1LSZc",
  "title": "DEF CON 32 - Defeating EDR Evading Malware with Memory Forensics - Case, Sellers, Richard, et al.",
  "description": "Endpoint detection and response (EDR) software has gained significant market share due to its ability to examine system state for signs of malware and attacker activity well beyond what traditional anti-virus software is capable of detecting. This deep inspection capability of EDRs has led to an arms race with malware developers who want to evade EDRs while still achieving desired goals, such as code injection, lateral movement, and credential theft. This monitoring and evasion occurs in the lowest levels of hardware and software, including call stack frames, exception handlers, system calls, and manipulation of native instructions. Given this reality, EDRs are limited in how much lower they can operate to maintain an advantage. The success of EDR bypasses has led to their use in many high-profile attacks and by prolific ransomware groups.\n\nIn this talk, we discuss our research effort that led to the development of new memory forensics techniques for the detection of the bypasses that malware uses to evade EDRs. This includes bypass techniques, such as direct and indirect system calls, module overwriting, malicious exceptions handlers, and abuse of debug registers. Our developed capabilities were created as new plugins to the Volatility memory analysis framework, version 3, and will be released after the talk.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2627,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.62s - 10.90s | This text was transcribed using whisper model: large-v2

 Okay, thank you all for coming to my presentation.
10.90s - 13.84s |  For those who I haven't met before, my name is Andrew Case.
13.84s - 19.38s |  I am a core developer on the Volatility Memory Analysis Project and also the Director of
19.38s - 23.14s |  Research at Vellect City.
23.14s - 28.54s |  At Vellect City, we do a significant amount of incident response and malware analysis
28.54s - 33.46s |  and as part of our research workflow and being on the research team there, we make sure that
33.74s - 38.30s |  for all the malware techniques that we see during our attacks and that we see other vendors
38.30s - 42.96s |  reporting about, any type of malware technique, any attacker toolkit that's really being used
42.96s - 47.80s |  in the wild, we want to make sure that we have a complete understanding of it and also
47.80s - 52.34s |  that we can automatically detect it during our investigations.
52.34s - 57.94s |  To ensure that we meet that goal and meet that reality, we very often perform very targeted,
57.94s - 62.52s |  very specific deep dives on specific techniques that we see the malware using, that we see
62.52s - 67.28s |  attackers using, and then we make sure that we document all the different techniques,
67.28s - 70.84s |  all the different tools that use it, whether they're private tools from threat groups,
70.84s - 76.22s |  whether it's some open source tool that has implemented it, and then we make infected
76.22s - 77.22s |  machines with it.
77.22s - 81.16s |  So we make our infected virtual machines, we make sure all the techniques are active,
81.16s - 85.52s |  we do the deepest memory forensics research we know how to do, which we have most of the
85.52s - 89.60s |  volatility developers at Vellect City, so that's pretty deep, and then we do talks like
89.60s - 91.36s |  this where we publish it.
91.36s - 95.00s |  For one of the latest research projects that we did, that's what I'm going to be talking
95.00s - 101.56s |  to you about today, we looked at all the ways that EDRs were being evaded by real malware.
101.56s - 106.82s |  Because what we noticed in our investigations is that we're working in enterprises, they're
106.82s - 111.66s |  trying to do security correctly, they have EDRs, they have them configured, they're listed
111.66s - 116.80s |  as active on these machines, but over and over again, as we were doing memory forensics,
116.80s - 122.20s |  we were finding very potent malware in the same processes where the EDRs supposedly were.
122.20s - 126.16s |  So obviously we wanted to figure out why that disconnect was happening, and through our
126.16s - 131.64s |  memory forensics work, we wanted to be able to detect it automatically as well.
131.64s - 136.88s |  Because as you'll see as we go through the slides, normally when malware bypasses EDRs,
136.88s - 138.30s |  it's not every process.
138.30s - 142.92s |  It's just the process or the two processes where the malware is running out of directly
142.92s - 145.72s |  or where it's injected code into.
145.72s - 150.88s |  So if you detect the EDR evasion, then you also directly detect the malware.
150.88s - 154.36s |  And so this has allowed us to do very scalable work.
154.36s - 159.16s |  And at Vilexity, where we're dealing in many investigations with dozens, hundreds, thousands
159.16s - 164.56s |  of memory samples, we don't have time, and it would obviously not be very time efficient,
164.56s - 167.00s |  to manually look at anything to start.
167.00s - 171.40s |  So we want a set of techniques that will at least say, hey, out of these 100 memory samples,
171.40s - 173.76s |  these are the five you really need to focus on.
173.76s - 175.28s |  And that's where we target our research.
175.28s - 177.12s |  We don't want a lot of false positives.
177.12s - 179.24s |  We don't want algorithms that take forever to run.
179.24s - 182.84s |  We just want to find the malware so that we can deep dive it.
182.84s - 186.24s |  And then as you can probably guess by the title and the fact that all this research
186.24s - 191.90s |  was done with volatility, we're going to be looking for that malware in memory.
191.90s - 195.48s |  If you haven't seen memory forensics before, or maybe you've never looked at a memory sample
195.48s - 200.30s |  yourself, the reason why there's this whole industry now around memory forensics and why
200.30s - 206.34s |  it's so vital to incorporate it in your investigations is that when you look at the real attacks
206.34s - 210.62s |  in the wild, when you look at the malware that's going to be used in environments where
210.62s - 214.22s |  the attackers don't want to get caught, where the EDRs are, where there's actually security
214.22s - 217.58s |  teams, that malware is going to be memory only.
217.58s - 219.94s |  It's not going to touch the file system.
219.94s - 222.94s |  Anything that traverses the network is going to be encrypted.
222.94s - 226.98s |  So if you don't get a memory sample, then you just threw all the evidence away.
226.98s - 230.74s |  If you walk up to that compromised machine and you turn it off, as soon as that machine
230.74s - 233.94s |  shuts down, the evidence is gone forever.
233.94s - 239.30s |  And what I have highlighted here on the slide is just an interesting report from Microsoft.
239.30s - 245.82s |  There's hundreds of reports like this that companies have published.
245.82s - 249.50s |  But I like this one because in two sentences, it really summarizes why we spend so much
249.50s - 251.10s |  time doing memory.
251.10s - 252.10s |  This was Microsoft.
252.10s - 253.42s |  It was really interesting.
253.42s - 258.26s |  It was basically a spyware company out of Australia that was being used to target some
258.26s - 263.02s |  high-level people, and Microsoft burned the whole company to the ground in one report.
263.02s - 266.94s |  They burned every piece of malware that company had, all the capabilities.
266.94s - 271.14s |  And as I have highlighted in red here with the screenshot, over and over again, Microsoft
271.14s - 277.18s |  made the point to say that where the evasion is, where the real payloads are, are in memory.
277.18s - 281.58s |  And if you look at what these payloads are capable of, it's key logging, it's screenshots,
281.58s - 286.34s |  it's recording the microphone, recording the webcam, exfiltrating files, everything
286.34s - 291.58s |  that allowed this spyware to operate against politicians, journalists, all these people,
291.58s - 292.66s |  it was memory only.
292.66s - 296.34s |  So traditional disk forensics isn't going to get you anywhere, and you need to know
296.34s - 300.58s |  how to efficiently do memory forensics to even make sense of the data and detect the
300.58s - 303.82s |  malware in the first place.
303.82s - 308.98s |  So as part of our research project, when we first broke down how EDRs are monitoring system
308.98s - 312.50s |  activity, the first three have been around a while.
312.50s - 317.86s |  Kernel callbacks is where EDRs or antivirus inside the kernel, so from their driver, they
317.86s - 323.14s |  can register to say that that callback will be notified every time a process starts or
323.14s - 325.94s |  a thread starts or a DLL gets loaded.
325.94s - 333.30s |  EDRs will also monitor activity through two of the newer interfaces, so ETW and AMSI.
333.30s - 339.74s |  ETW is where kernel drivers can receive a wide range of system activity from processes,
339.74s - 344.50s |  also other parts of the kernel, and then AMSI, if you go to other DEF CON talks, Black Hat
344.50s - 350.26s |  talks, it gets mentioned a lot, because at this point, what AMSI does is it lets Defender,
350.26s - 355.82s |  so Windows Defender, as well as all the EVs, AVs and EDRs, they get to register to say
355.82s - 360.54s |  before a PowerShell script runs, before a macro runs, before all these scripting languages
360.54s - 366.06s |  where traditional reversing doesn't work and there's a lot of obfuscation, those antivirus
366.06s - 369.22s |  engines and the EDR engines get to scan the scripts.
369.22s - 372.98s |  If they say they are malicious, then the scripts get blocked.
372.98s - 378.06s |  And then what we'll really be focusing on with this talk is the last one, which is system
378.06s - 379.46s |  call monitoring.
379.46s - 384.00s |  And we'll have some pictures for that to make sure everyone is on the same page.
384.00s - 389.02s |  And so when we broke down the bypasses, even, not even just like your really sophisticated
389.02s - 394.06s |  threat groups, every ransomware family at this point, the half-decent ones, the first
394.06s - 398.22s |  thing they do is load a kernel driver through bring your own vulnerable driver, and they
398.22s - 401.98s |  disable all the EDR callbacks and the AV callbacks.
401.98s - 406.78s |  At that point, the ransomware can inject code, start new processes, and those systems are
406.78s - 408.10s |  blind.
408.10s - 413.80s |  For event tracing and AMSI, there are dozens and dozens of papers on how to disable these,
413.80s - 417.50s |  and it's essentially a modern part of what you see in real investigations.
417.50s - 422.46s |  But what we noticed, and as we'll see here on the next slide, is when we get to system
422.46s - 425.26s |  call monitoring, we had no way to detect this.
425.26s - 430.26s |  So before this research effort, with memory forensics, with volatility, you could very
430.26s - 435.42s |  quickly determine that callbacks had been unregistered, that ETW had been tampered with,
435.42s - 437.10s |  that AMSI had been tampered with.
437.10s - 439.86s |  Again, these are going to point you right to the malware.
439.86s - 444.94s |  But the system call monitoring that EDRs use, and it's one of the best ways they get visibility
444.94s - 447.74s |  on the system, there was no way to detect this.
447.74s - 451.90s |  And so in our investigations, we were having to do a lot of manual work to find it, to
451.90s - 456.04s |  unravel it, and that just doesn't work for the scale that we operate at.
456.04s - 460.58s |  We need automated ways.
460.58s - 466.46s |  And the reason that the system calls are so critical to EDRs is the idea with system calls
466.46s - 470.10s |  is this is your boundary from process memory to the kernel.
470.10s - 473.10s |  So this diagram here are the Windows internals book.
473.10s - 478.26s |  You have your processes running, your web browser, your office application, whatever
478.26s - 484.02s |  it is that the process is running in user land or user mode, it's all the same thing.
484.02s - 488.88s |  Besides manipulating their own memory, whenever they want to access a resource on the system,
488.88s - 492.86s |  so they want to read or write a file, they want to read or write a network packet, anything
492.86s - 497.30s |  beyond manipulating their own memory, they have to ask the operating system to do it.
497.30s - 501.26s |  Because obviously you don't want your random notepad process writing directly to the hard
501.26s - 507.02s |  drive or you don't want notepad writing directly to the ring buffer of your network driver.
507.02s - 514.74s |  So for processes that want to talk to network devices and request those operations, reading
514.74s - 519.54s |  a file, writing a file, interacting with the network, it has to go through a system call.
519.54s - 524.14s |  And that system call is going to change the execution context into the kernel, which is
524.14s - 526.30s |  obviously the most privileged part.
526.30s - 531.24s |  It has full access to the operating system itself, to other drivers, to other hardware.
531.24s - 536.24s |  What you're seeing on the right side of this slide is the arrow that breaks down between
536.24s - 539.90s |  process memory and the kernel where the system calls happen.
539.90s - 542.32s |  You're seeing a stack trace of that here.
542.32s - 545.90s |  When you look at a stack trace, you want to start at the bottom to make sense of it.
545.90s - 550.48s |  So in the beginning, what these lines or these rows here with the U, this is in user land
550.48s - 552.56s |  or again process memory.
552.56s - 555.30s |  You can see that the Edge browser is running.
555.30s - 558.68s |  It eventually gets to this call, ZW create file.
558.68s - 562.88s |  Your system calls will, in almost all cases, start with ZW.
562.88s - 566.92s |  And then you can see this is sysinternals monitoring the call stack.
566.92s - 571.12s |  It eventually, when this system call is made, it jumps into the kernel file.
571.12s - 573.34s |  And this K means we're in kernel memory.
573.34s - 578.92s |  So this last call, the ZW, whatever that particular system call is, that is the last boundary
578.92s - 580.84s |  before we jump in the kernel.
580.84s - 586.24s |  And the reason we're focusing on this background so much is this is where your EDRs live.
586.24s - 590.64s |  Because if you look at this slide, what we're seeing, I'll explain in more detail in a second,
590.64s - 593.72s |  but on the left is the normal system call handler.
593.72s - 596.40s |  So this is what you get with Windows by default.
596.40s - 600.76s |  In this case, the slide is showing ZW protect virtual memory.
600.76s - 603.12s |  So another system call on Windows.
603.12s - 606.60s |  On the left is the normal flow that's going to reach the kernel.
606.60s - 609.36s |  On the right is an EDR that has hooked it.
609.36s - 615.16s |  So EDRs that want to monitor what processes are doing on the machine by injecting code
615.24s - 620.36s |  into every process, hooking the system call functions of interest, it has complete control
620.36s - 623.96s |  over what that process is doing right before it makes the system call.
623.96s - 628.84s |  So if it wants to look for suspicious parameters, if it wants to log out what files are being read,
628.84s - 633.44s |  what parts of the registry are being interacted with, by hooking that lowest level function,
633.44s - 636.12s |  the EDR has full visibility.
636.12s - 641.40s |  And so as we'll see here in a second, what malware wants to do is make its system calls
641.40s - 644.84s |  without EDRs interfering or detecting it.
644.84s - 648.56s |  But some background real quick while we're on a nice slide with a picture.
648.56s - 654.24s |  What we're seeing here, again on the left, is the normal system call handler that jumped.
654.24s - 655.40s |  We're going to go back.
655.40s - 659.04s |  So what we see on the left is the normal system call handler.
659.04s - 661.28s |  And there's a few things to keep in mind.
661.28s - 666.56s |  First off, when you have the NT version of a function and then the ZW prefix version,
666.56s - 670.48s |  it's the same exact function, but one's in user land, one's in the kernel.
670.48s - 672.24s |  So we're seeing that here.
672.24s - 677.80s |  The second thing is from regular C code or C++ code, when you call a function,
677.80s - 680.52s |  the parameters are sent in certain registers.
680.52s - 683.00s |  We're going to focus on 64-bit machines.
683.00s - 687.64s |  And besides RCX and R10, they're exactly the same.
687.64s - 690.96s |  The weird thing is with Windows, when you make a system call,
690.96s - 694.84s |  your second parameter needs to be an R10 instead of RCX.
694.84s - 697.36s |  So this has to get updated in those paths.
697.36s - 701.48s |  And then EAX or RAX has to hold the system call number.
701.48s - 706.12s |  So for all the hundreds of system calls that Windows has for a particular version,
706.12s - 708.28s |  each system call has its own number.
708.28s - 711.44s |  And if you look at these handlers, they all look exactly like this,
711.44s - 717.12s |  except this number changes, because that is the index into the system call table at runtime.
717.12s - 721.24s |  And then we have a quick check to see what system call path is supported.
721.24s - 724.16s |  And then to make that transition to kernel mode,
724.16s - 726.52s |  we're either going to use the system call instruction,
726.52s - 729.80s |  or if we're on an older processor, older version of Windows,
729.80s - 732.00s |  we're going to make the int2e call.
732.00s - 736.48s |  So again, this is on the left is what we would expect on a regular machine
736.48s - 738.08s |  where you don't have EDRs.
738.08s - 741.08s |  And then if you look on the right here, instead of all this code,
741.08s - 743.20s |  make eventually calling system call,
743.20s - 747.76s |  we just have a jump out to an unknown region, which is going to be the EDR.
747.76s - 751.52s |  And then when malware calls something like protect virtual memory here
751.52s - 755.52s |  or create file on the previous slide, the EDR has full control of that.
755.52s - 759.16s |  It's going to kill the ransomware before it can launch any payloads.
759.16s - 761.60s |  It's going to kill all the code injection techniques.
761.60s - 765.32s |  And so if you have a decent EDR and it's not being tampered with,
765.32s - 768.84s |  it's going to stop all these regular malware techniques from functioning.
768.84s - 771.04s |  But like I said, we constantly do investigations
771.04s - 774.04s |  where there's very potent malware on the machine.
774.04s - 776.32s |  There's supposedly EDR on the machine.
776.32s - 787.54s |  But when we dig into the infected processes, the EDR has been nullified.
787.54s - 789.46s |  So what we're going to do for the rest of the talk
789.46s - 792.30s |  is look at all of the bypasses that we found.
792.30s - 793.82s |  Like I said, in our own investigations,
793.82s - 796.30s |  there's a bunch of open source tools that do it as well.
796.30s - 798.26s |  And then how we can detect them.
798.26s - 800.70s |  The first one goes by a couple different names,
800.70s - 804.38s |  module unhooking, system call unhooking, API unhooking.
804.38s - 809.22s |  The basic idea here is the malware is going to unhook the system call handlers.
809.22s - 812.50s |  And the end goal is when malware starts running
812.50s - 816.70s |  and they're in a process that EDRs have all the system calls in this hook form,
816.70s - 818.82s |  it wants to get it back to the original form
818.82s - 822.70s |  so that the EDR is blind to what's going on.
822.70s - 826.18s |  The way this works, and this PowerPoint keeps jumping a lot.
826.18s - 831.18s |  The way this works, this is a screenshot from a very recent report,
831.18s - 834.06s |  from a very recent report maybe two or three months ago
834.06s - 837.70s |  of malware that did this to then spread across a huge network.
837.70s - 843.62s |  And the basic idea is where system calls are implemented in memory is NTDLL.
843.62s - 847.30s |  So the first DLL that loads in every process is NTDLL.
847.30s - 851.22s |  That has all of those system call handlers, one per system call.
851.22s - 852.98s |  And that's what the EDRs hook.
852.98s - 856.26s |  They put the jump instruction, it goes directly to the EDR code.
856.26s - 858.78s |  And then like I said, the EDR can evaluate the parameters
858.78s - 860.82s |  before the system call is made.
860.82s - 862.10s |  So you can see it in the steps here.
862.10s - 863.82s |  This report was really nice.
863.82s - 868.58s |  What this malware did is it read the clean copy of NTDLL from disk.
868.58s - 871.46s |  So that copy on disk is what Microsoft published.
871.46s - 873.90s |  That does not have any EDR hooks present.
873.90s - 876.22s |  So it reads NTDLL from disk.
876.22s - 880.38s |  It finds where those system call handlers are in their clean state on disk.
880.42s - 882.94s |  And it just overwrites all the EDRs hooks.
882.94s - 885.62s |  And now the malware can call any system call at once
885.62s - 887.82s |  with whatever malicious parameters it wants,
887.82s - 890.06s |  any malicious end goal that it has.
890.06s - 892.98s |  And even though the EDR is technically loaded in that process,
892.98s - 895.18s |  its code is never going to be activated.
895.18s - 896.82s |  And so when we look at ransomware and we're like,
896.82s - 898.26s |  how can it inject code?
898.26s - 899.78s |  How is it encrypting all the files?
899.78s - 901.42s |  How is it elevating privileges?
901.42s - 904.10s |  It's because the EDR has no idea what's going on.
904.10s - 907.94s |  And this is one of the many ways that we'll talk about how it happens.
907.94s - 911.90s |  So again, you go from the state where every process on the machine
911.90s - 913.82s |  has their system calls hooked.
913.82s - 917.18s |  The malicious code, the malware is going to run in its own process
917.18s - 919.82s |  or it's going to inject code into a victim process.
919.82s - 922.86s |  And in that victim process or the malware's own process,
922.86s - 927.54s |  the system call handlers will be reverted back to where they were on disk.
927.54s - 930.46s |  But all the other processes will have the hooked form.
930.46s - 933.14s |  So what we realized is instead of trying to figure out
933.14s - 936.38s |  the 50 different variations for module unhooking,
936.38s - 942.18s |  we could just use data in memory to tell us where the malware is.
942.18s - 947.46s |  So what our new volatility plugin does is it enumerates every process.
947.46s - 951.22s |  It reads the bytes of all the system call handlers that the EDRs
951.22s - 953.38s |  or that the malware often targets.
953.38s - 955.54s |  And then we just compare the implementations.
955.54s - 957.66s |  And as you'll see here in a couple of slides,
957.66s - 961.06s |  what we can do is say you have 100 processes running.
961.06s - 963.50s |  99 of them have one implementation.
963.50s - 967.02s |  And this one process on its own has a different implementation.
967.02s - 970.02s |  The 99 are the ones where the EDR is still active.
970.02s - 974.66s |  And that one kind of outlier process is the one that the malware is unhooked.
974.66s - 976.78s |  And so we like, when we do this type of research,
976.78s - 980.54s |  we like to make experiments that can be repeated by anyone else.
980.54s - 982.86s |  Obviously, not everyone works at Valexity
982.86s - 985.98s |  and has access to our infected samples from the wild.
985.98s - 989.06s |  So we come up with experiments using open source tools
989.06s - 991.18s |  where you can recreate this on your own
991.18s - 993.30s |  and you can test it in your own environment.
993.30s - 996.26s |  So a very nice tool for testing EDR,
996.26s - 999.82s |  a very nice open source tool for testing EDR bypasses
999.82s - 1001.46s |  is called SilentStrike.
1001.46s - 1003.90s |  So this is an open source EDR,
1003.90s - 1007.02s |  and it was actually developed just to test these bypasses
1007.02s - 1009.02s |  and then see if you could detect them.
1009.02s - 1013.38s |  The way SilentStrike works is it hooks NT Protect virtual memory.
1013.38s - 1016.34s |  This is one of the main functions that malware needs
1016.34s - 1018.10s |  to perform code injection
1018.10s - 1020.86s |  and also to try to keep that code injection stealthy.
1020.86s - 1023.26s |  And so what this open source EDR does
1023.26s - 1024.86s |  is it hooks that function.
1024.86s - 1027.22s |  If it gets called where the region's going to become
1027.22s - 1029.02s |  readable, writable, and executable,
1029.02s - 1030.66s |  the EDR says you can't do that,
1030.66s - 1033.58s |  and that stops a lot of different code injection techniques.
1033.58s - 1036.06s |  So for our experiment, what we did
1036.06s - 1040.10s |  is we took a base Windows 10 install, so no EDR.
1040.10s - 1042.26s |  With SilentStrike, you can tell it
1042.26s - 1044.38s |  to create individual processes
1044.38s - 1047.46s |  that it will then treat as an EDR and protect.
1047.46s - 1050.34s |  So we started a notepad and we started a WordPad.
1050.34s - 1053.06s |  At this point, they have SilentStrike active in it,
1053.06s - 1055.02s |  which is your EDR.
1055.02s - 1057.02s |  We then took a memory sample.
1057.02s - 1060.94s |  After that, we ran R77, which is an open source rootkit
1060.94s - 1062.94s |  that does this module unhooking,
1062.94s - 1065.98s |  and we unhooked the notepad process.
1065.98s - 1067.94s |  And then we took a second memory sample.
1067.94s - 1071.34s |  So we have the state before and after the malware ran.
1072.34s - 1073.86s |  And with our new plugin,
1073.86s - 1077.30s |  so unhook system calls to volatility three,
1077.30s - 1079.26s |  what it's saying here is what we do
1079.26s - 1080.90s |  is we enumerate all the functions.
1080.90s - 1081.82s |  The slide is cut.
1081.82s - 1084.38s |  There's probably like 50 functions we actually check.
1084.38s - 1085.98s |  But the idea is we're saying,
1085.98s - 1088.06s |  for these processes down here,
1088.06s - 1089.86s |  there's no distinct implementations.
1089.86s - 1093.74s |  So every process inside of that memory sample
1093.74s - 1095.62s |  had the same version of the function.
1095.62s - 1098.46s |  And then the two that we started under SilentStrike,
1098.46s - 1101.94s |  their NT protect virtual memory, had the EDR's view.
1101.94s - 1104.82s |  This is before we ran R77.
1104.82s - 1108.70s |  We then ran the R77 rootkit on the machine.
1108.70s - 1111.50s |  We unhooked notepad, and you can see it removes
1112.18s - 1113.34s |  from distinct implementations.
1113.34s - 1115.70s |  It's been reverted back to the base form.
1115.70s - 1116.94s |  So then we took this plugin,
1116.94s - 1120.42s |  ran it across the many hundreds of memory samples
1120.42s - 1122.82s |  that we have to test our code on.
1122.82s - 1125.34s |  And the only place this plugin fired
1125.34s - 1128.74s |  was either traditional API hooking or EDR unhooks.
1128.74s - 1131.14s |  And so there's no false positives with this.
1131.14s - 1133.06s |  If the EDR's hooked every process,
1133.06s - 1134.74s |  it doesn't make sense that it would skip one
1134.74s - 1136.26s |  or that one should be reverted.
1136.26s - 1141.01s |  This directly tells you where the malware's running.
1141.01s - 1144.77s |  We then started looking into other ways to read NTDLL.
1144.77s - 1146.69s |  So you saw it in the screenshot before
1146.69s - 1148.29s |  from that malware report.
1148.29s - 1151.61s |  And I walked you through where for unhooking to work,
1151.61s - 1155.29s |  the malware needs access to a clean copy of NTDLL,
1155.29s - 1157.45s |  which normally you can just read from disk,
1157.45s - 1159.13s |  but there was several EDR vendors
1159.13s - 1160.57s |  that started detecting that.
1160.57s - 1162.49s |  Because why would some random process
1162.49s - 1166.25s |  need to read NTDLL as a file and parse the section?
1166.25s - 1167.61s |  The only reason to do that
1167.61s - 1170.33s |  is to unhook the EDR out of memory.
1170.33s - 1173.45s |  So this made it harder for that malware to operate.
1173.45s - 1177.13s |  It can't read NTDLL from disk or it's going to get caught.
1177.13s - 1180.57s |  So we saw some malware samples and some open source tools
1180.57s - 1184.33s |  that abused suspended processes to get the clean copy.
1184.33s - 1186.89s |  If you've ever investigated process hollowing,
1186.89s - 1188.37s |  whether you were writing code for it
1188.37s - 1190.21s |  or you were trying to detect it,
1190.21s - 1192.73s |  creating suspended processes is the first step
1192.73s - 1194.57s |  of every process hollowing technique.
1194.57s - 1197.05s |  So we'll see that we catch some of those as well
1197.05s - 1198.49s |  as kind of a side effect.
1198.53s - 1200.69s |  But the idea for EDR bypasses
1200.69s - 1204.53s |  is the malware will create a suspended process.
1204.53s - 1206.37s |  The idea with a suspended process
1206.37s - 1208.89s |  is that the only thing that's going to load
1208.89s - 1212.09s |  is the application executable and NTDLL.
1212.09s - 1215.29s |  It's kind of like a half created process at that point.
1215.29s - 1219.93s |  Once the EXE and NTDLL are mapped into the process,
1219.93s - 1222.13s |  then at that point, the parent process,
1222.13s - 1224.89s |  the one who created the process gets control back.
1224.89s - 1226.29s |  So then what the malware does
1226.29s - 1228.41s |  is it just reads from its child process,
1229.21s - 1230.85s |  the clean NTDLL out of memory.
1230.85s - 1233.21s |  The EDR doesn't see a suspended process
1233.21s - 1235.05s |  until it actually starts running.
1235.05s - 1237.93s |  So this puts a clean copy of NTDLL in memory.
1237.93s - 1240.09s |  The malware doesn't have to go read it from disk.
1240.09s - 1241.61s |  And so obviously we wanted to be able
1241.61s - 1243.13s |  to detect this as well.
1244.57s - 1246.53s |  So we did some reverse engineering
1246.53s - 1248.49s |  and read some preexisting reports
1248.49s - 1250.89s |  on what happens with suspended processes.
1250.89s - 1252.41s |  Like I said, we see it a lot
1252.41s - 1253.33s |  because you have to do this
1253.33s - 1255.69s |  if you want to create a hollowed process.
1255.69s - 1257.65s |  But what you have in kernel memory
1257.69s - 1260.77s |  is for every process, you have an E-process structure.
1260.77s - 1262.69s |  For every thread, you have an E-thread
1262.69s - 1264.29s |  or a K-thread structure.
1264.29s - 1267.37s |  When that process gets created in the suspended state,
1267.37s - 1269.85s |  every process starts with one thread.
1269.85s - 1272.41s |  And when you create the thread suspended,
1272.41s - 1274.41s |  its suspense count goes to one,
1274.41s - 1276.85s |  which tells the operating system not to run it.
1276.85s - 1279.29s |  Normally, if you just create a process in the normal way
1279.29s - 1281.25s |  or you double-click it on your desktop,
1281.25s - 1283.01s |  the suspend count's gonna be zero.
1283.01s - 1284.97s |  And as soon as that process can get scheduled,
1284.97s - 1286.77s |  its threads are going to run.
1286.77s - 1289.85s |  But what we saw in every piece of malware that we had
1289.85s - 1292.81s |  and every open-source tool we had access to that did this,
1292.81s - 1294.77s |  when they create the suspended process
1294.77s - 1297.13s |  just to read the clean NTDLL,
1297.13s - 1299.29s |  they're never going to run that child process.
1299.29s - 1301.21s |  They are just getting that into memory
1301.21s - 1304.41s |  to get access to the clean system call handlers.
1304.41s - 1306.09s |  So this was pretty easy.
1306.09s - 1307.21s |  We wrote a plugin.
1307.21s - 1308.89s |  Volatility could already enumerate
1308.89s - 1310.65s |  every thread of every process.
1310.65s - 1312.89s |  And then we just added an extra step to say,
1312.89s - 1316.09s |  does that thread have a suspend count greater than zero?
1316.09s - 1319.33s |  Running it across our large data set of memory samples,
1319.33s - 1322.33s |  the only false positive we had, which was pretty random,
1322.33s - 1325.41s |  is this work folder shell DLL inside of Edge
1325.41s - 1326.69s |  makes suspended threads.
1326.69s - 1327.69s |  We don't know why.
1327.69s - 1330.09s |  So we just added that to the list of ones
1330.09s - 1331.09s |  we don't print out.
1331.09s - 1334.01s |  And besides that, we didn't have a single false positive.
1334.01s - 1335.45s |  And then, like I said, at Vlexity,
1335.45s - 1338.09s |  we have hundreds and hundreds of memory samples
1338.09s - 1340.45s |  in different states that we test these things on.
1340.45s - 1342.21s |  And quite a few of the samples
1342.21s - 1344.57s |  that we know have process hollowing in them,
1344.57s - 1346.81s |  they were detected, too, because if you're
1346.81s - 1348.85s |  familiar with that technique, the idea
1348.85s - 1351.13s |  is you create a process in a suspended state,
1351.13s - 1354.53s |  you overwrite the code, and then you let that new process run.
1354.53s - 1357.57s |  And so not only is this plugin picking up all the EDR
1357.57s - 1361.77s |  bypasses, we generically caught a bunch
1361.77s - 1371.69s |  of different process hollowing techniques as well.
1371.69s - 1375.41s |  At Black Hat Europe, maybe two years ago now, three years ago,
1375.41s - 1377.21s |  there was a really cool white paper
1377.21s - 1380.29s |  and talk on a project called Dirty Vanity.
1380.29s - 1382.49s |  The idea was they tested against basically
1382.49s - 1385.69s |  every commercial EDR they could get their hands on.
1385.69s - 1388.45s |  And the idea is they wanted to be able to do code injection
1388.45s - 1391.85s |  into a victim process without the EDRs catching them.
1391.85s - 1394.17s |  And if you're familiar with this, to do code injection,
1394.17s - 1396.01s |  there's five or six APIs you have
1396.01s - 1397.87s |  to call to make that work.
1397.87s - 1400.61s |  And if you call all those in a row and you're injecting,
1400.61s - 1403.01s |  the end result is you're going to inject into your victim
1403.01s - 1407.45s |  process any half-decent EDR, any enterprise-level EDR
1407.45s - 1409.09s |  is going to catch that.
1409.09s - 1411.69s |  So what was really interesting about Dirty Vanity
1411.69s - 1414.97s |  is they instead created clone processes or a forked process
1414.97s - 1417.05s |  if you're more familiar with Linux.
1417.05s - 1419.73s |  So the idea with a clone or a forked process
1419.73s - 1422.19s |  is your process is running.
1422.19s - 1424.61s |  You create a clone of your own process.
1424.61s - 1426.61s |  So that child process you created
1426.61s - 1428.57s |  has your same exact state.
1428.57s - 1430.41s |  So then what Dirty Vanity did is they
1430.41s - 1433.33s |  called the first couple APIs from the parent.
1433.33s - 1435.19s |  And then they create the clone, which
1435.19s - 1437.29s |  has the same exact state as the parent.
1437.29s - 1440.13s |  And they called the final set of APIs from the child.
1440.13s - 1442.53s |  So the end result is they're still injecting code
1442.53s - 1444.17s |  into the victim process.
1444.17s - 1446.21s |  But none of the EDRs that they tested
1446.21s - 1449.61s |  were able to detect the calls going across the process
1449.61s - 1450.49s |  boundary.
1450.49s - 1452.87s |  So obviously, we wanted to be able to detect this
1452.87s - 1456.01s |  from a memory forensic standpoint.
1456.01s - 1457.83s |  So while we were looking into what
1457.83s - 1460.05s |  it means to clone a process in Windows,
1460.05s - 1463.61s |  the real internal state, we saw that what Windows does when
1463.61s - 1466.91s |  it's setting up that clone is it makes a suspended thread.
1467.03s - 1469.43s |  So that child that's being cloned into
1469.43s - 1471.39s |  has its first thread suspended.
1471.39s - 1475.03s |  And with Dirty Vanity, it never restarted the child process
1475.03s - 1477.63s |  or the initial thread of the child process.
1477.63s - 1480.43s |  So the plug-in that we had detected it right away.
1480.43s - 1481.91s |  And if you're interested in this,
1481.91s - 1483.55s |  I have it cited here at the bottom.
1483.55s - 1485.47s |  We found this thing called the Definitive Guide
1485.47s - 1486.87s |  to Process Cloning on Windows.
1486.87s - 1490.95s |  It's like 40 pages of APIs and data structures and background.
1490.95s - 1492.59s |  But it pretty much told us exactly
1492.59s - 1495.79s |  what we needed to know on top of what we saw with reversing.
1497.63s - 1501.55s |  We made a memory sample that was infected with Dirty Vanity.
1501.55s - 1504.39s |  And as you can see, we're running our suspended threads
1504.39s - 1505.31s |  plug-in.
1505.31s - 1508.87s |  It's telling us that inside of the fake EXE process, which
1508.87s - 1511.27s |  is what Dirty Vanity calls itself if you just
1511.27s - 1513.31s |  compile it straight from GitHub.
1513.31s - 1518.63s |  And then it's saying that this process ID, 6752, this thread,
1518.63s - 1522.53s |  it is suspended or suspend count is greater than 0.
1522.53s - 1525.15s |  And then if you look at PSTree in volatility,
1525.15s - 1528.07s |  so this is drawing out the parent-child relationship
1528.07s - 1532.79s |  of processes, you can see that the original fake EXE
1532.79s - 1535.55s |  has a child called fake EXE.
1535.55s - 1540.43s |  So this is that process that was created through cloning.
1540.43s - 1541.51s |  So this is the parent.
1541.51s - 1545.11s |  This is where Dirty Vanity will call the first couple APIs.
1545.11s - 1548.01s |  It then forks or clones off a child process
1548.01s - 1552.43s |  where it will call the remaining APIs, bypassing the EDR.
1552.43s - 1554.63s |  But what you can see volatility picking up on
1554.63s - 1557.91s |  is the child's always going to have its main thread suspended.
1557.91s - 1559.89s |  And so we pick up on that right away.
1559.89s - 1561.51s |  You would then run PSTree would probably
1561.51s - 1564.11s |  be the next thing if this was a real investigation.
1564.11s - 1566.03s |  You would figure out the parent that
1566.03s - 1568.27s |  created the suspended process.
1568.27s - 1571.51s |  And then you can see here what it does in demo mode.
1571.51s - 1573.75s |  So if you don't have an EDR you're targeting,
1573.75s - 1575.67s |  Dirty Vanity will run command shell
1575.67s - 1578.63s |  with some shellcode that makes a pop-up on the screen
1578.63s - 1580.23s |  or prints it to the terminal.
1580.23s - 1583.03s |  So you see that here as well, that child process.
1583.03s - 1585.03s |  But through the new plugin, you see exactly
1585.03s - 1586.79s |  which process is malicious.
1586.79s - 1594.47s |  You can then do your normal memory forensics workflow.
1594.47s - 1596.53s |  As you've been seeing in the slides,
1596.53s - 1598.37s |  the previous techniques that we looked
1598.37s - 1602.09s |  into for bypassing the system call handlers
1602.09s - 1604.15s |  relied on overwriting code.
1604.15s - 1605.53s |  And you might have been thinking,
1605.53s - 1608.73s |  especially if you've done debugging before or low level
1608.73s - 1610.89s |  programming before, the idea that you're
1610.89s - 1613.43s |  going to overwrite NTDLL, the entire thing
1613.43s - 1616.21s |  or certain functions at runtime, is a bit unsafe.
1616.29s - 1617.81s |  Because you can imagine if you're
1617.81s - 1620.85s |  overwriting 30 or 40 functions code in memory,
1620.85s - 1623.41s |  if any other thread is using that function
1623.41s - 1625.21s |  or a system call was just made and you're
1625.21s - 1627.49s |  waiting for user LAN to return again,
1627.49s - 1629.65s |  you just blew away the code that was technically
1629.65s - 1631.11s |  running on the CPU.
1631.11s - 1632.25s |  So malware does it.
1632.25s - 1634.49s |  It generally works, but it's a bit unsafe.
1634.49s - 1636.25s |  And then the other thing you could imagine
1636.25s - 1638.57s |  is EDR could just check for its hooks.
1638.57s - 1641.45s |  If it hooked 40 or 50 system call handlers
1641.45s - 1643.77s |  and then it checks in whatever frequency later
1643.77s - 1645.45s |  and its handlers are overwritten,
1645.45s - 1648.53s |  it knows that there is malware inside of that process.
1648.53s - 1651.81s |  So this led to what was some really interesting research
1651.81s - 1653.05s |  on the open source side.
1653.05s - 1656.41s |  And like I said, we saw it in private malware as well.
1656.41s - 1657.81s |  So there were alternative methods
1657.81s - 1660.61s |  developed where the code is not overwritten.
1660.61s - 1662.69s |  The malware, as you'll see, can still
1662.69s - 1664.33s |  make its malicious system calls.
1664.33s - 1668.01s |  It can still do any system calls at once with any parameters.
1668.01s - 1669.81s |  But we're not overwriting code.
1669.81s - 1673.85s |  So inside of NTDLL, in that EDR protected process,
1673.85s - 1677.21s |  the original implementation that the EDR gave is the same.
1677.21s - 1678.53s |  The hooks are present.
1678.53s - 1682.37s |  The EDR would get control if the real system call was used.
1682.37s - 1684.95s |  But malware is just going to avoid those code paths.
1684.95s - 1686.41s |  So we'll look at the different ways
1686.41s - 1689.97s |  they do that and the ways we can detect it.
1689.97s - 1692.69s |  The first one we looked at were direct system calls.
1692.69s - 1694.89s |  So the malware authors realized that,
1694.89s - 1699.09s |  why do I need to call the system call handler inside of NTDLL?
1699.09s - 1701.13s |  You saw that a system call handler is only
1701.13s - 1702.85s |  five or six instructions.
1702.85s - 1704.61s |  Why don't I just do that myself?
1704.61s - 1707.85s |  So rather than going through NTDLL, which the EDR is hooked,
1707.85s - 1710.13s |  I'm just going to set up the registers that are needed,
1710.13s - 1712.93s |  and I'm going to make the syscall instruction on my own.
1712.93s - 1714.97s |  And again, the EDRs that are trying
1714.97s - 1716.81s |  to catch you through system call hooks,
1716.81s - 1718.49s |  they are blind to you because you're not
1718.49s - 1720.49s |  going through their hooked code.
1720.49s - 1724.77s |  The problem with this, and there was a very interesting series
1724.77s - 1727.49s |  of posts by Elastic that I have cited at the end,
1727.49s - 1730.17s |  this is where they started doing call stack examination.
1730.17s - 1731.89s |  Elastic does this really well.
1731.89s - 1734.77s |  There's some open source implementations of it also.
1734.77s - 1738.05s |  But the idea is, if you were making a system call
1738.05s - 1741.05s |  instruction, or you're calling the system call instruction
1741.05s - 1744.13s |  outside of NTDLL, so you're in some random DLL
1744.13s - 1746.69s |  that you've injected, or you're in a shellcode region,
1746.69s - 1749.17s |  your EDR in kernel mode can see that.
1749.17s - 1750.97s |  And then it's going to say, why is a system
1750.97s - 1753.33s |  call being made from a random shellcode region that
1753.33s - 1756.41s |  wouldn't normally happen on a running machine?
1756.41s - 1758.85s |  And then the other downside to this, as we'll see,
1758.85s - 1761.37s |  is you have to know where the system call indexes are.
1761.37s - 1763.37s |  So like I said, there's hundreds of system calls
1763.37s - 1765.81s |  per release of Windows, and the indexes
1765.81s - 1767.09s |  change almost every time.
1767.09s - 1768.97s |  The indexes are not guaranteed.
1768.97s - 1771.29s |  If you're writing normal, legitimate code,
1771.29s - 1772.89s |  you shouldn't care about the indexes.
1772.89s - 1775.25s |  You just call the higher level API,
1775.25s - 1777.23s |  and the operating system does the work for you.
1777.23s - 1779.53s |  But in this case, where you want to make the system call
1779.53s - 1782.53s |  yourself, and you don't want to use the normal APIs
1782.53s - 1784.29s |  because the EDR has hooked them, you
1784.29s - 1788.93s |  have to be able to get that index value to put into EAX.
1788.93s - 1793.09s |  So if we look at the way that this has evolved over time,
1793.09s - 1796.21s |  the first tool that made this popular is called dumpERT.
1796.21s - 1797.21s |  It's an open source tool.
1797.21s - 1798.41s |  It's still on GitHub.
1798.41s - 1800.73s |  It has a very nice companion blog post.
1800.73s - 1803.97s |  And as you can see, for every system call
1803.97s - 1806.07s |  it wants to make available to the malware,
1806.07s - 1807.97s |  it has to put that little stub itself.
1807.97s - 1812.65s |  It has to update R10, update EAX with the very specific index
1812.65s - 1814.73s |  for the very specific system call.
1814.73s - 1817.17s |  Then it can call system call in return.
1817.17s - 1818.79s |  And at this point, you can make those,
1819.15s - 1820.43s |  but if you look at the code, this
1820.43s - 1823.27s |  is hard-coded to one version of Windows 7,
1823.27s - 1825.67s |  one release under Service Pack 1.
1825.67s - 1829.47s |  This is not something you could use in generic malware.
1829.47s - 1832.73s |  So instead, what we want to be able to have is where,
1832.73s - 1834.83s |  that is very loud, instead we want
1834.83s - 1838.07s |  to make it where system calls can be resolved dynamically.
1838.07s - 1841.35s |  So instead of your malware having what would literally
1841.35s - 1844.39s |  be hundreds of hard-coded system call tables
1844.39s - 1846.39s |  for different versions of Windows,
1846.39s - 1849.43s |  we want to find those indexes dynamically.
1849.43s - 1852.83s |  The first implementation of this is called Hell's Gate.
1852.83s - 1854.87s |  Almost every technique has gate in the name,
1854.87s - 1856.91s |  which makes it kind of annoying to remember.
1856.91s - 1858.75s |  So the first one is Hell's Gate.
1858.75s - 1862.19s |  In this case, what it did is it parsed NTDLL on disk,
1862.19s - 1863.71s |  kind of like we talked about before.
1863.71s - 1867.23s |  But instead of overwriting pre-existing code or the EDR's
1867.23s - 1870.23s |  code, it's just parsing NTDLL on disk,
1870.23s - 1872.95s |  and then it's dynamically resolving the numbers.
1872.95s - 1875.43s |  Because, for example, let's say in this case
1875.43s - 1878.15s |  it wants to call a ZW open process.
1878.15s - 1879.83s |  Instead of having to know beforehand
1879.83s - 1884.07s |  that on Windows 7 Service Pack 1, the index is 23 hex,
1884.07s - 1886.39s |  it can just load NTDLL.
1886.39s - 1889.59s |  It can call get proc address for ZW open process.
1889.59s - 1892.15s |  It can do some automated disassembly on the code,
1892.15s - 1894.89s |  and it can read out the index dynamically.
1894.89s - 1895.99s |  So this was Hell's Gate.
1895.99s - 1898.03s |  You can see the code here on the right.
1898.03s - 1900.51s |  Instead of being hard-coded to a certain number,
1900.51s - 1903.67s |  it has a little API wrapper that you use as a programmer.
1903.67s - 1905.07s |  You prep the system call.
1905.07s - 1907.19s |  That's going to fill in this global variable.
1907.19s - 1910.03s |  And then when it comes time to make the system call,
1910.03s - 1912.59s |  it will fill in the number correctly for you.
1912.59s - 1916.55s |  The problem with this, like I said, is most decent EDRs,
1916.55s - 1919.47s |  I'm not going to say certain vendors, but most decent EDRs,
1919.47s - 1922.87s |  if random code is reading NTDLL and parsing the P header
1922.87s - 1924.51s |  and all of that, the EDR is going
1924.51s - 1926.43s |  to flag on it because it's just not something
1926.43s - 1928.55s |  legitimate code would do.
1928.55s - 1930.95s |  So this led to even more gates.
1930.95s - 1934.15s |  There is Tataras Gate, which initially there
1934.19s - 1936.51s |  was some detections and some YARA rules that
1936.51s - 1940.75s |  were put out to detect this code pattern that's very hard-coded
1940.75s - 1943.05s |  and this code pattern that's very hard-coded.
1943.05s - 1946.03s |  All it did was make it a little more difficult to where
1946.03s - 1947.79s |  those naive patterns would break.
1947.79s - 1949.95s |  It put some no-op instructions.
1949.95s - 1952.67s |  It put some other instructions that didn't have a side effect.
1952.67s - 1955.43s |  But remember, you're in the system call handler path.
1955.43s - 1957.67s |  So you can't add a bunch of junk instructions,
1957.67s - 1960.23s |  or you will kill performance on the machine.
1960.23s - 1962.79s |  In a real process, you're going to have thousands and thousands
1962.83s - 1964.23s |  of system calls running.
1964.23s - 1966.87s |  You cannot have where you put in a bunch of junk code
1966.87s - 1968.47s |  just to throw off a YARA rule.
1968.47s - 1970.63s |  So even adding a few extra instructions
1970.63s - 1972.91s |  will have a real impact on the system.
1972.91s - 1975.71s |  So like I said, Tataras Gate is just trying to make it where,
1975.71s - 1978.83s |  if all you have is a kind of brittle, basic YARA rule,
1978.83s - 1981.03s |  you will not catch those code patterns.
1981.03s - 1984.83s |  There was then Halos Gate, which was an interesting twist
1984.83s - 1987.15s |  on reading NTDLL from disk.
1987.15s - 1990.23s |  So these malware authors wanted to get away
1990.23s - 1992.61s |  from reading NTDLL from disk.
1992.61s - 1995.21s |  So instead, what they do is they kind of rely on the fact
1995.21s - 1998.13s |  that the EDRs aren't going to hook every system call.
1998.13s - 2000.25s |  They're just going to, the malware is only
2000.25s - 2001.97s |  going to unhook this, sorry, the EDR
2001.97s - 2005.41s |  is only going to hook the system calls that it wants to monitor.
2005.41s - 2008.01s |  So what Halos Gate does is it dynamically
2008.01s - 2010.13s |  goes through all the other system calls
2010.13s - 2013.37s |  that the EDR is not hooking, and then it just does some math.
2013.37s - 2015.45s |  It says, OK, I know the system call before it
2015.45s - 2017.49s |  and the system call after it are this number,
2017.49s - 2020.57s |  so the one in the middle, it can dynamically figure it out.
2020.57s - 2024.01s |  Again, this avoids reading NTDLL from disk.
2024.01s - 2025.81s |  And then there is a really cool technique
2025.81s - 2027.97s |  called address sorting.
2027.97s - 2030.65s |  One of the authors of this open source project
2030.65s - 2032.61s |  realized that all the system calls
2032.61s - 2034.89s |  are put in order alphabetically.
2034.89s - 2037.45s |  So if you just read the addresses of where they all
2037.45s - 2039.25s |  are, it's kind of the same idea.
2039.25s - 2041.65s |  You alphabetically sort them.
2041.65s - 2043.97s |  If the one that you're trying to use is hooked,
2043.97s - 2046.33s |  you just look at the one before it and you add one,
2046.33s - 2048.53s |  and now you know the index that you need.
2048.53s - 2050.21s |  And then even dealing with all of that
2050.21s - 2051.85s |  previously was kind of difficult.
2051.85s - 2054.61s |  There's a lot of assembly, a lot of low-level C code.
2054.61s - 2056.09s |  So there's this really nice project
2056.09s - 2058.09s |  called Sys Whisperers 2, and the 2
2058.09s - 2060.81s |  is important because the first version was not very good,
2060.81s - 2063.49s |  but the second version is very powerful.
2063.49s - 2065.85s |  This integrates with Visual Studio.
2065.85s - 2067.61s |  You call directly through this, and it
2067.61s - 2070.21s |  does all the nasty work in the background for you
2070.21s - 2073.17s |  to dynamically resolve those system call indexes.
2073.17s - 2075.77s |  So if you want to write code that bypasses EDRs,
2075.77s - 2078.21s |  you want to be able to make whatever system call you want
2078.21s - 2080.25s |  without being detected, all you have to do
2080.25s - 2083.53s |  is import the Sys Whisperers 2 into your Visual Studio
2083.53s - 2085.53s |  project, write your malware freely,
2085.53s - 2089.33s |  and it does all the hard work in the background for you.
2089.33s - 2091.13s |  So with all these different techniques
2091.13s - 2093.73s |  that make EDRs blind to what's happening,
2093.73s - 2095.75s |  we wanted to be able to detect this.
2095.75s - 2098.21s |  So we kind of already knew this before going into it,
2098.21s - 2102.17s |  but we did a large sweep across all of our Windows memory
2102.17s - 2104.61s |  samples, and for every version of Windows
2104.61s - 2107.45s |  going back to XP through the latest Windows 11,
2107.45s - 2109.69s |  there's only three DLLs that legitimately
2109.69s - 2111.01s |  implement system calls.
2111.01s - 2113.41s |  There's the NTDLL that I talked about,
2113.41s - 2118.13s |  Wow64 for 32-bit processes, and then Win32 is for the GUI,
2118.13s - 2120.61s |  so what you're seeing here on the screen with Explorer
2120.61s - 2122.29s |  and PowerPoint.
2122.29s - 2125.21s |  So the idea is through memory forensics,
2125.21s - 2127.49s |  if we find the instructions needed
2127.49s - 2129.21s |  to make a system call instruction
2129.21s - 2131.37s |  and set the parameters, and it's not
2131.37s - 2133.75s |  in one of those three DLLs, this is malware
2133.75s - 2137.85s |  trying to bypass the system.
2137.85s - 2140.05s |  And then, like I mentioned, it's some very, very cool
2140.05s - 2141.13s |  low-level work.
2141.13s - 2144.13s |  I threw this screenshot in literally last second,
2144.13s - 2147.69s |  like right before I sent these slides to DEF CON,
2147.69s - 2150.29s |  because there was a talk by a security vendor
2150.29s - 2151.61s |  as I was making the slides, right
2151.61s - 2153.77s |  as I was about to upload it, and I took this screenshot
2153.77s - 2155.37s |  and threw it in last second, because it
2155.37s - 2157.85s |  was talking about malware that was just used recently
2157.85s - 2160.41s |  in the last one or two months in real attacks,
2160.41s - 2162.73s |  and the malware was called DodgeBox,
2162.73s - 2165.29s |  and it's talking about how in every phase of the malware,
2165.29s - 2167.25s |  every component the malware had,
2167.25s - 2171.17s |  it did call stack spoofing, so bypassing the EDRs
2171.17s - 2173.33s |  to make it appear where those system calls,
2173.33s - 2175.17s |  so it's doing direct system calls,
2175.17s - 2177.61s |  making it appear where it came from the trusted binary,
2177.61s - 2179.89s |  so the ones we saw in the last slide, instead
2179.89s - 2181.29s |  of the malware itself.
2181.29s - 2183.89s |  And so it's this constant back and forth between EDRs
2183.89s - 2185.61s |  and malware, trying to figure out
2185.61s - 2188.17s |  that system calls are being made from the wrong spot,
2188.17s - 2190.57s |  but quite honestly, the EDRs are in a tough spot,
2190.57s - 2193.13s |  and usually the malware wins.
2193.13s - 2195.33s |  We don't have these problems with memory forensics.
2195.33s - 2198.37s |  We don't have to detect a system call the second it's made.
2198.37s - 2201.13s |  We're trying to find proof of code that can do that
2201.13s - 2203.45s |  or does that through memory forensics,
2203.45s - 2206.81s |  and so what we did is we used Capstone,
2206.81s - 2209.61s |  which is a very flexible disassembly library,
2209.61s - 2212.85s |  has Python support so you can use it directly in volatility,
2212.85s - 2215.37s |  and what we do is look for blocks of code,
2215.37s - 2219.81s |  so code pattern blocks where EAX gets updated,
2219.81s - 2222.93s |  that's your system call index, where R10 gets updated,
2222.93s - 2225.05s |  where one of the system call instruction happens,
2225.05s - 2226.53s |  and where there's a return.
2226.53s - 2228.77s |  We did a bunch of work so that simple things
2228.77s - 2232.41s |  like to Taurus gate with this no ops wouldn't bypass our code.
2232.41s - 2233.81s |  We're not doing pattern matching.
2233.81s - 2236.97s |  We're doing actual automated static disassembly,
2236.97s - 2239.61s |  and when we tested this on every implementation
2239.61s - 2243.03s |  that we had of this technique, our new plug-in direct system
2243.03s - 2244.39s |  calls detected it.
2244.39s - 2246.81s |  In this case, just to make it fit on a slide nicer,
2246.81s - 2249.29s |  this is Hell's Descent from Hell's Gate,
2249.29s - 2251.81s |  so this is where it's calling the system call
2251.81s - 2253.85s |  instruction on its own, and then
2253.85s - 2256.09s |  the plug-in saying, hey, inside of this process
2256.09s - 2259.33s |  executable with this PID, and it shows you right in memory
2259.33s - 2261.21s |  where that system call handler is.
2261.21s - 2263.57s |  So it's as simple as running this plug-in
2263.57s - 2265.49s |  across your potentially infected samples,
2265.49s - 2269.93s |  and it tells you right where the malware is.
2269.93s - 2272.59s |  And then with the indirect system calls,
2272.59s - 2275.81s |  the idea is instead of having that code pattern where you're
2275.81s - 2279.63s |  making syscall or int2e directly from your malware code
2279.63s - 2281.25s |  or your shell code, which again, you
2281.25s - 2283.45s |  have to do a bunch of call stack spoofing and things,
2283.45s - 2285.21s |  or the EDRs will see you.
2285.21s - 2289.27s |  The idea is you find the address of the syscall instruction
2289.27s - 2293.57s |  in NTDLL, but instead of calling the function of that,
2293.57s - 2295.53s |  you find where the syscall instruction is,
2295.53s - 2296.69s |  and you jump to it.
2296.69s - 2298.41s |  So you set the registers yourself.
2298.41s - 2300.13s |  You do all the prereqs yourself.
2300.13s - 2301.89s |  You jump to the syscall instruction.
2301.89s - 2304.51s |  It looks like it's coming from NTDLL,
2304.51s - 2306.77s |  and then depending on which EDR you have,
2306.77s - 2309.21s |  that EDR is going to think it's the real system call,
2309.21s - 2312.21s |  and then you've bypassed it.
2312.21s - 2315.53s |  So we wanted to be able to detect that as well.
2315.53s - 2318.29s |  And something that also gets used with this technique
2318.29s - 2321.13s |  are the exception handlers and the debug registers,
2321.13s - 2323.57s |  which is the last thing we cover in this talk.
2323.57s - 2326.25s |  So the idea is debug registers have been abused forever
2326.25s - 2327.05s |  by malware.
2327.05s - 2328.89s |  There was a Frack article in 2008
2328.89s - 2332.57s |  that's considered the first public documentation of it.
2332.57s - 2335.89s |  And the idea is by abusing debug registers,
2335.89s - 2338.21s |  you can get your exception handler called
2338.21s - 2339.89s |  at any point in time.
2339.89s - 2341.57s |  And then from your exception handler,
2341.57s - 2344.01s |  you're going to make the system call instruction,
2344.01s - 2347.49s |  and EDRs do not follow this well at all.
2347.49s - 2349.13s |  They don't expect malware to be running
2349.13s - 2351.65s |  inside of exception handlers.
2351.65s - 2353.49s |  So a cool open source project for this,
2353.49s - 2355.81s |  if you want to see it yourself, is called MutationGate.
2355.81s - 2357.53s |  It is on GitHub.
2357.53s - 2359.05s |  And you can see what it's doing.
2359.05s - 2362.09s |  It's adding a vectored exception handler.
2362.09s - 2364.23s |  So it's saying it wants to handle exceptions
2364.23s - 2365.53s |  in its process.
2365.53s - 2367.69s |  This is the function that's going to be called.
2367.69s - 2370.17s |  And then on its own, it sets a breakpoint
2370.17s - 2373.33s |  at this innocuous system call, nt draw text,
2373.33s - 2376.21s |  that has nothing to do with code injection or malware.
2376.21s - 2379.57s |  So the idea is this malware, this code injection,
2379.57s - 2382.21s |  this EDR bypass technique, will get called
2382.21s - 2383.97s |  whenever a breakpoint is set.
2383.97s - 2385.97s |  And then it explicitly sets a breakpoint
2385.97s - 2388.77s |  on where the system call instruction is
2388.77s - 2391.77s |  inside of this innocuous function.
2391.77s - 2394.21s |  So then in the implementation of it, what it does
2394.21s - 2397.09s |  is every time the malware wants to make a malicious system
2397.09s - 2400.53s |  call, it just calls nt draw text, which, again, you can't
2400.53s - 2402.25s |  do anything malicious with that.
2402.25s - 2404.69s |  And then the malware, the MutationGate,
2404.69s - 2408.29s |  it updates RAX right before the system call instruction
2408.29s - 2409.93s |  to be the real system call.
2409.93s - 2412.57s |  So your EDR is going to think, hey, this malicious code's
2412.57s - 2413.61s |  calling draw text.
2413.61s - 2415.53s |  It's going to write something on the screen.
2415.53s - 2417.33s |  But in reality, it's all the prereqs
2417.33s - 2420.88s |  you need for code injection.
2420.88s - 2422.40s |  So we wanted to detect this.
2422.40s - 2425.12s |  We didn't even have to do any major reversing for this.
2425.12s - 2427.84s |  There was two very nice blog posts on the topic
2427.84s - 2429.52s |  that we have referenced here.
2429.52s - 2432.60s |  And the only downside to this is legitimate software
2432.60s - 2434.64s |  uses exception handlers.
2434.64s - 2437.92s |  You don't want your software having an unhandled exception
2437.92s - 2439.56s |  and then crashing the machine.
2439.56s - 2441.52s |  So by having an exception handler,
2441.52s - 2444.48s |  you make it where your code gets to handle the exception,
2444.48s - 2446.72s |  and then you can cleanly exit.
2446.72s - 2449.36s |  So what we did is we, instead of just listing them
2449.36s - 2452.12s |  all out like some plugins do, we applied
2452.12s - 2456.04s |  very similar static disassembly to the function handlers.
2456.08s - 2457.92s |  We looked at all the malicious techniques.
2457.92s - 2459.96s |  We saw which registers they interacted with,
2459.96s - 2462.36s |  which actions they performed.
2462.36s - 2465.12s |  And so instead of just listing out every vector exception
2465.12s - 2467.80s |  handler, we apply the static disassembly,
2467.80s - 2470.20s |  and then we only list out the malicious ones.
2470.20s - 2472.52s |  And as you can see here, with our new plugin,
2472.52s - 2475.60s |  we're catching mutation gate generically right away
2475.60s - 2478.68s |  because of how it interacts with it.
2478.68s - 2482.26s |  There was also a cool project by Marcus Hutchins,
2482.26s - 2485.56s |  where he wanted to bypass EDRs in the same way.
2486.32s - 2488.36s |  Instead of the vectored exception handler,
2488.36s - 2492.96s |  he used the higher level one, the unhandled exception filter.
2492.96s - 2495.48s |  In this case, this is going to be the address of where
2495.48s - 2497.96s |  he has his exception handler called,
2497.96s - 2500.00s |  and then he's calling set thread context
2500.00s - 2501.92s |  on what's an invalid address.
2501.92s - 2505.00s |  So this is going to trigger the exception handler.
2505.00s - 2506.88s |  So what we did here was very similar.
2506.88s - 2510.52s |  We enumerate all the handlers, and then we make it.
2510.52s - 2512.16s |  This keeps jumping a lot.
2512.16s - 2513.80s |  We enumerate all the handlers.
2513.84s - 2516.60s |  We apply our static disassembly, and then in this case,
2516.60s - 2519.28s |  we find his malicious process generically
2519.28s - 2522.24s |  because the exception handler is doing things that you
2522.24s - 2524.88s |  would need to bypass an EDR.
2524.88s - 2526.28s |  And then with the debug registers,
2526.28s - 2528.44s |  the last thing we really show here,
2528.44s - 2530.56s |  if you're familiar with AMSI bypasses,
2530.56s - 2533.20s |  one of the things you need to do is one of the functions
2533.20s - 2536.40s |  you're probably going to tamper with is the scan buffer one.
2536.40s - 2538.48s |  In this case, they set a breakpoint on it,
2538.48s - 2541.52s |  and they make it where that function doesn't get any time
2541.52s - 2542.88s |  that function returns.
2542.88s - 2544.64s |  It returns that the code is OK.
2544.64s - 2546.56s |  So you can send whatever malicious PowerShell
2546.56s - 2550.08s |  you want through, whatever malicious macros that you have.
2550.08s - 2553.04s |  And with this code present, all of your EDRs
2553.04s - 2555.20s |  are forced to say, hey, yeah, this is clean,
2555.20s - 2557.84s |  and then it gets to execute on the system.
2557.84s - 2560.48s |  And you can see that here with our new plugin.
2560.48s - 2562.36s |  So with the vector exception handler,
2562.36s - 2563.84s |  we're catching it right away.
2563.84s - 2566.56s |  The project that implements what you're seeing on these slides
2566.56s - 2568.56s |  is called Patchless AMSI.
2568.56s - 2571.68s |  So we're not only catching its vector exception handler,
2571.68s - 2574.44s |  we're also catching its abuse of the debug registers
2574.44s - 2576.56s |  so that it can be called whenever
2576.56s - 2580.42s |  the code is going to get scanned by the AMSI subsystem.
2580.42s - 2581.92s |  So the end result of our project is
2581.92s - 2584.16s |  we documented and went through every single way
2584.16s - 2586.76s |  that EDRs get bypassed in user land,
2586.76s - 2588.68s |  and then we wrote a bunch of volatility plugins
2588.68s - 2590.24s |  to automatically detect it.
2590.24s - 2592.24s |  Two quick things before I break.
2592.24s - 2594.56s |  We wrote a 19-page white paper about this.
2594.56s - 2597.56s |  It should be on the DEF CON website by now or tomorrow.
2597.56s - 2599.32s |  Feel free to email me if not.
2599.32s - 2600.32s |  Also, the slides.
2600.32s - 2602.40s |  Don't try to take pictures of the next couple of slides.
2602.40s - 2604.08s |  These are all the references that you
2604.08s - 2606.68s |  were seeing with the numbers at the top of the slides.
2606.68s - 2608.04s |  We have like 45 references.
2608.04s - 2609.72s |  It was a huge research effort.
2609.72s - 2611.56s |  The slides are on the DEF CON website as well,
2611.56s - 2613.24s |  or email me if you can't find them.
2613.24s - 2616.40s |  But if you really want to understand in great detail,
2616.40s - 2619.36s |  read the paper, and then read all the references as well.
2619.36s - 2624.53s |  And again, thank you for coming to the talk.


url: https://www.youtube.com/watch?v=NyOhQ4ONAUA
title: DEF CON 32 - Digital Emblems-When markings are required, but you have no rattle-can - Bill Woodcock
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=NyOhQ4ONAUA",
  "title": "DEF CON 32 - Digital Emblems-When markings are required, but you have no rattle-can - Bill Woodcock",
  "description": "There are physical markings that are required under hundreds of different international laws, some governing transport of goods across national borders, some offering humanitarian protections on the battlefield, some seeking to protect the environment or genetic diversity\u2026 What they all have in common is that they\u2019re currently represented by visual marks applied to objects. Many of these processes are undergoing \u201cdigitalization,\u201d and becoming machine-readable, or electronically-signaled. A standards effort currently underway in the IETF seeks to create a common global marking protocol which would allow open-standards-based devices to scan, cryptographically validate, and display the digital versions of these marks. This session will relate the state of the standards effort, the scope of markings that have been considered thus far, and seek input on security or privacy vulnerabilities which may exist in the proposed standard.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2343,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.27s - 7.11s | This text was transcribed using whisper model: large-v2

 I'm going to be talking today about digital emblems and that is kind of a neologism.
7.11s - 12.03s |  So, I'll take a little bit of explaining what they are and why this is interesting
12.03s - 13.45s |  from a technical point of view.
14.41s - 17.71s |  This is basically reporting out of work that is happening
18.29s - 21.95s |  in the Internet Engineering Task Force that's building on top
21.95s - 26.41s |  of existing protocols, DNS, DNSSEC, and DAIN.
27.31s - 32.11s |  So, let's get started.
32.91s - 39.43s |  The idea behind digital emblems is that they will supplement or eventually maybe replace the
39.43s - 43.91s |  physical markings that are required on things under international law.
44.59s - 47.75s |  So, let's take a look at some examples of what those physical markings are.
48.43s - 54.87s |  Going sort of, you know, clockwise from the top right, see a press photographer
55.25s - 61.57s |  with the press marking, the thing with the orange background is ISO container marking,
61.65s - 65.55s |  which every ISO container out there has one of those on it, serial number,
65.55s - 67.99s |  and a lot of standardized information.
68.89s - 74.95s |  You've got some UN blue helmets, they're a marking that's recognized
74.95s - 81.25s |  under international Geneva Conventions specifically for peacekeepers.
81.37s - 87.07s |  The thing under that is four different chemical weapons components,
87.23s - 89.79s |  chemicals that are being shipped in a cardboard box.
90.47s - 94.93s |  Under that, there is the end of a wooden pallet.
95.23s - 99.31s |  Every piece of wood that crosses an international border has to be marked
99.87s - 105.37s |  to show how it's been freed of termites and stuff.
105.37s - 111.03s |  Next to that, there's a blue and white shield of UNESCO for a World Heritage Site
111.03s - 113.67s |  or World Heritage Artwork.
114.17s - 119.57s |  Next to that, every piece of radioactive material, every piece of radioactive fuel or waste
119.57s - 121.77s |  that crosses an international border has to be marked.
122.59s - 125.23s |  And then the orange bag there is a diplomatic pouch.
126.09s - 131.03s |  The Vienna Convention of 1961 on Diplomatic Relations says all
131.03s - 134.01s |  about how diplomatic pouches have to be handled.
134.01s - 137.17s |  They can't be delayed or inspected.
137.23s - 142.41s |  So, let's take a look at one of those in a little more detail.
142.41s - 149.73s |  This is the phytosanitary marking, the one that goes onto wood crates and pallets.
150.41s - 154.71s |  So, this is administered by the Food and Agriculture Organization.
154.71s - 158.63s |  That is an intergovernmental organization that is responsible
158.63s - 162.11s |  for the International Plant Protection Convention.
162.11s - 166.27s |  That is the body of law that requires this marking.
166.99s - 173.33s |  And then specifically, there's a particular law, the International Standard
173.33s - 177.43s |  for Phytosanitary Measures Number 15 requires this marking.
177.89s - 181.53s |  So, within that marking, you've got a country code, region code,
181.89s - 188.79s |  the treatment service provider license number, the person who did the treatment of the crate
188.79s - 195.63s |  or whatever, how the treatment was done, and then you've got some sort of serialization.
195.91s - 200.51s |  So, a thing to notice about this is this is a hot metal brand shoved
200.51s - 204.07s |  into a piece of wood with variable data on it.
205.33s - 207.87s |  Right? Hot metal brand, variable data.
208.59s - 209.27s |  We're engineers.
209.27s - 210.89s |  We know how to deal with variable data.
211.23s - 216.01s |  The hot metal brand part seems like it doesn't scale so well, though.
216.01s - 217.93s |  So, what are problems with physical markings?
219.23s - 223.09s |  It's really hard to tell whether a physical marking is being misused.
223.49s - 228.35s |  Did the person who put the physical marking on something, were they authorized to do that?
229.17s - 230.57s |  Does it still apply?
231.37s - 233.99s |  Was it marked and got scraped off?
233.99s - 236.51s |  Right? There are lots and lots of issues with physical markings.
237.01s - 243.89s |  But beyond that, typically they're not, they're meant to be human readable,
243.89s - 246.15s |  but they're not optimized for machine readability.
246.89s - 250.39s |  And then you can't actually apply them to something that's not physical.
250.39s - 257.47s |  So, digital data, you can't apply a physical mark to digital data and expect it to be readable.
257.89s - 261.59s |  You can apply it to the thing that holds the data, but not to the data itself.
261.99s - 267.03s |  And if, for instance, an attacker is coming in over the network,
267.41s - 269.75s |  they can't see the physical thing that they're attacking.
269.75s - 273.91s |  So, they can't see whether something, some mark's been stenciled on it.
275.35s - 277.59s |  And electronic services, right?
277.75s - 283.07s |  Not just data at rest or data in flight, but like an email server.
283.39s - 288.03s |  How would you mark that an email server was protected or licensed or whatever, right?
291.23s - 296.79s |  So, beyond that, when we start to get into cryptographic authentication,
297.11s - 303.31s |  we get this whole suite of additional capabilities around revocation and, you know,
303.35s - 309.99s |  things timing out and signature roles and all these kinds of things that we kind of take for granted
310.95s - 314.91s |  in cryptography, which, you know, people who do physical markings, you know,
314.91s - 319.75s |  they got a stencil and a rattle can and, you know, they don't have any of those tools.
320.31s - 322.95s |  So, how do we move forward?
322.99s - 325.59s |  What can we mark with digital emblem?
326.15s - 332.27s |  Right now, it's defined as people, places, things, data at rest, data in flight, and online services.
333.35s - 337.83s |  And, you know, throughout the rest of this talk and in the standards documents and so forth,
337.83s - 340.75s |  we just refer to all of that collectively as assets.
342.03s - 346.27s |  Because we're not trying to differentiate them in any way, right?
346.27s - 348.75s |  We want a standard that works with all of them.
351.59s - 356.39s |  There are a couple of non-goals, things that come up in conversation a lot with people
356.39s - 358.71s |  who are first looking at this problem space.
359.03s - 364.91s |  So, people look at the protective emblems, particularly like that UNESCO emblem
365.27s - 369.47s |  that gets put on, for instance, a church in Ukraine, right?
370.59s - 372.75s |  And then the Russians come along and blow up the church.
373.15s - 376.71s |  And people say, well, that emblem didn't protect the church.
377.43s - 382.51s |  Just like if we put a digital emblem on a website, and somebody DDoS's the website.
383.39s - 385.75s |  Okay, it didn't protect the website.
386.23s - 389.59s |  But neither would a physical marking, right?
389.59s - 396.03s |  The physical marking or the digital marking, what it's doing is it's making the job
396.03s - 398.87s |  of a lawyer in the Hague easier, right?
398.87s - 404.27s |  If they want to prosecute somebody for a war crime, showing that the person was duly informed
404.27s - 408.03s |  that what they were doing was or about to do was a war crime before they did it
408.31s - 413.19s |  and did it knowingly and maliciously, right, that makes their job as a lawyer easier.
413.83s - 421.95s |  And then, you know, all the sort of just compliance markings, this is about ease of use, right?
421.95s - 425.11s |  It's about making the job of a customs inspector easier.
425.51s - 429.19s |  It's not going to do any magic, you know,
429.19s - 431.71s |  it's not going to do anything really differently than the physical marking.
431.95s - 433.47s |  It's just easier.
434.31s - 441.23s |  And then the other thing is a lot of people think, well, if you do this digital emblem
441.27s - 446.99s |  and you embody it in a QR code, somebody could just copy that QR code from one crate
447.23s - 451.19s |  to another crate and, oh, we've hacked the system, right?
451.55s - 453.59s |  But that's not how it works.
453.59s - 459.31s |  This is like saying if I copy the URL of a website onto another thing that I've hacked
459.31s - 462.63s |  the website, no, the website is still out there in the Internet.
463.11s - 465.31s |  The digital emblem is still out there in the Internet.
465.87s - 473.51s |  What's marked on the crate or the building or somebody's ID card is essentially just like a URL, right?
473.51s - 479.31s |  It's a label that the validator is going to go and check.
481.35s - 487.19s |  So the trick is not physically attaching it to the thing.
487.19s - 489.55s |  The trick is associating it with the thing.
489.55s - 494.23s |  So when somebody looks at it, they'll understand that, yes, this is the right thing.
495.51s - 498.15s |  So let's take a look at that a little bit more closely.
498.75s - 502.51s |  We've got an issuer, somebody who is creating digital emblems,
504.47s - 510.11s |  and they create a bundle of records that are the digital emblem, and then they sign it.
512.51s - 516.51s |  That gets attached to an asset through a description.
516.55s - 521.35s |  The description says, you know, this digital emblem applies to this person.
521.35s - 523.31s |  This digital emblem applies to this crate.
523.35s - 526.75s |  This digital emblem applies to this building or this vehicle.
529.03s - 541.39s |  And that description is going to be a serial number or a height or mass or location or time and place.
543.11s - 547.39s |  So a validator, somebody who wants to figure out whether this thing is legit,
547.87s - 555.19s |  is going to evaluate first the signature to make sure that the issuer is a legitimate issuer, right,
555.19s - 557.75s |  is who they're expecting.
558.99s - 565.15s |  And they're going to check the description to make sure that the asset is the thing described by the emblem.
567.33s - 568.93s |  So who are validators?
572.55s - 575.47s |  A lot of people really focus on the military uses.
575.47s - 578.75s |  So you can have a loitering munition that's sitting around up there,
579.07s - 585.19s |  and it's nighttime and you've got a convoy and, you know, one truck has the medical supplies.
585.67s - 589.35s |  And so that one is the one that's protected under the Geneva Conventions.
589.35s - 590.91s |  The other ones have ammunition.
590.91s - 592.07s |  They are not protected.
592.43s - 595.67s |  The loitering munition has to make a decision between these.
595.87s - 600.87s |  If it can make a decision based on something machine readable and cryptographically authenticatable,
601.15s - 605.15s |  it's going to make a much better decision than if it's up there in the dark trying to figure out
605.15s - 610.43s |  whether there's a marking on the side of a truck that it's looking at the top of, right?
611.67s - 616.03s |  But by and large, this is going to get used by customs agents, right?
616.03s - 623.19s |  99 times out of 100, it's going to be somebody scanning a cargo container or, you know, a crate or whatever.
624.99s - 628.11s |  So what problem is this mostly solving?
629.79s - 633.91s |  Proliferation of proprietary scanners.
634.39s - 640.27s |  So what's happening right now is these markings already exist and a lot more besides that.
640.91s - 644.35s |  And people are trying to digitize them.
644.39s - 649.59s |  People are trying to take these physical markings and create some digital workflow around them.
649.99s - 654.59s |  And so, you know, they come up with something and maybe it's kind of a hack
654.95s - 660.91s |  and it involves a scanner that some that a validator can use to point at the box or whatever
660.91s - 666.11s |  and, you know, press the button and look at the screen on the back and it says, yes, this is OK.
666.51s - 671.15s |  Or no, this is counterfeit goods or no, this has been tampered with or whatever.
672.59s - 675.95s |  So the problem is that customs agents are starting to get
676.23s - 679.27s |  more and more of these proprietary scanners stacking up.
679.27s - 683.11s |  So a shipment comes in, they have to go to the closet, rummage around,
683.11s - 688.23s |  figure out what the right scanner is, whether the battery is charged and then go scan the thing.
688.63s - 692.03s |  And this is just the tip of the iceberg, right?
692.03s - 695.35s |  This is just the first few organizations that have started to do this.
695.71s - 700.71s |  And, you know, these organizations are not happy about having to develop this themselves.
700.71s - 705.31s |  So you've got folks like Apple, folks like Cisco, folks like Nokia,
705.83s - 709.99s |  who are really concerned about counterfeit goods.
710.51s - 713.03s |  And they've got international law on their side.
713.03s - 716.83s |  WIPO administers, I think, 38 different international laws,
717.31s - 720.11s |  several of which are about counterfeiting.
721.79s - 727.63s |  So, you know, they can work with customs agents to identify
728.03s - 732.23s |  legitimate versus counterfeit goods, but their systems,
732.79s - 735.19s |  like each of those each of those companies I just mentioned,
735.19s - 737.51s |  each one has a completely different system for doing it.
737.51s - 740.11s |  Different physical scanner, different software, different everything.
740.63s - 743.51s |  So this is the main thing we're trying to solve, right?
743.51s - 746.59s |  We're trying to get an open standard that can be implemented
746.59s - 750.59s |  in open source software on open hardware cheaply.
751.23s - 753.87s |  Everybody can just make do with a single scanner
753.87s - 756.91s |  that will scan all of these different kinds of things.
758.11s - 761.47s |  So what's a digital emblem look like?
762.07s - 765.43s |  We've got in the top left there, the issuer,
766.95s - 770.07s |  bottom left, the asset, the validator over on the right.
771.03s - 776.07s |  The digital emblem is the set of records there that are in that green box.
776.67s - 782.87s |  And that's the binding first issuer to emblem and then emblem to asset.
782.87s - 786.07s |  So and this is just some examples, right?
786.07s - 789.63s |  There are actually a whole lot more different, very specific bindings
789.63s - 790.35s |  that are available.
790.35s - 793.91s |  So we've got a visual representation of the emblem, right?
794.23s - 797.35s |  If it's a diplomatic pouch from Cote d'Ivoire,
797.63s - 802.79s |  the Cote d'Ivoire national seal is going to be the visual representation.
803.55s - 806.19s |  We've got an identification of law.
806.19s - 807.75s |  Again, if it's a diplomatic pouch,
807.75s - 811.71s |  it's going to be the Vienna Convention of Diplomatic Relations, 1961.
812.03s - 813.63s |  We've got the contact information.
813.63s - 817.83s |  In this case, it would be the contact information of the logistics person
817.83s - 821.11s |  in the foreign ministry of Cote d'Ivoire,
821.11s - 823.99s |  who's responsible for administering their diplomatic shipments.
824.63s - 825.99s |  We've got handling flags.
825.99s - 828.11s |  Is there anything fragile here?
828.11s - 831.83s |  Does it need to be in the pressurized compartment of the airplane hold?
832.87s - 834.91s |  What should we do if,
835.63s - 838.95s |  you know, the handling conditions are violated?
839.79s - 842.43s |  We've got the issuer's cryptographic signature,
842.71s - 844.55s |  and then we've got third party signatures.
844.55s - 847.55s |  These are cross signatures to create a web of trust.
848.23s - 852.15s |  Let's say you're a customs agent and, you know, you get something
852.15s - 855.51s |  that comes in from Cote d'Ivoire foreign ministry.
856.07s - 860.99s |  And, you know, you have no idea whether they're legit or not.
860.99s - 863.07s |  You haven't heard of Cote d'Ivoire before,
863.07s - 865.75s |  but there are five different other signatures on there,
865.75s - 870.19s |  one from Guinea and one from Gambia and one from Niger, right?
870.43s - 873.79s |  All saying, yes, you know, this is this is a real foreign ministry
873.79s - 877.59s |  that we work with and recognize as being a legit country.
877.79s - 881.15s |  Right. So those cross signatures, that web of trust, just like in PGP,
881.35s - 884.03s |  it gives you some assurance that you're dealing with a real entity
884.03s - 889.63s |  and not like a typo squatter or somebody using a homograph in the label name.
891.19s - 895.59s |  So then on the asset, we've got a temporal and a spatial scope of validity.
896.39s - 900.59s |  Is this thing in the place it's supposed to be at the time it's supposed to be?
900.79s - 903.87s |  And so that's probably going to be a series of things, right?
903.91s - 906.99s |  And if it's on an airplane,
907.31s - 912.31s |  that's going to be a series of long, skinny polygons
912.99s - 916.87s |  covering the airplane flight, the projected airplane flight,
917.11s - 920.27s |  and then the airport at the destination
920.27s - 922.91s |  where it's going to be going through customs, for instance.
924.51s - 929.67s |  So that pairing of a bunch of locations and times
930.23s - 935.23s |  gives some idea of of when and where this thing should be accepted.
935.51s - 940.03s |  So to give a different example, let's say that we have a diplomatic envoy
941.03s - 946.15s |  whose mission is in Germany in twenty twenty five.
946.43s - 950.23s |  And yet they show up in Hungary in December of twenty twenty four
950.23s - 951.95s |  and they present their credential.
951.95s - 958.43s |  The you know, the immigration guy in Hungary can evaluate this and say,
958.43s - 962.19s |  OK, that's nice, but you're just a regular guy here, right?
962.51s - 967.71s |  Your diplomatic credential is valid next month in a different country.
968.11s - 970.67s |  Not right here, right now, right here, right now.
970.91s - 973.63s |  You're just coming in on your regular passport.
976.07s - 978.35s |  So then we've got a bunch of stuff,
978.35s - 980.87s |  you know, SI base units of size and weight.
980.95s - 983.75s |  You know, how big is this thing? How heavy is this thing?
985.23s - 988.79s |  And then the World Customs Organization is,
989.35s - 993.83s |  you know, the the international organization of customs agencies.
994.15s - 997.59s |  They've got all this stuff standardized and have for a long time
997.59s - 1003.83s |  for, you know, paperwork, you know, crate number three of a shipment of five.
1003.83s - 1005.75s |  Right. Stuff like that.
1005.75s - 1007.71s |  You know, how many barrels is it?
1009.47s - 1011.71s |  Standardized.
1012.15s - 1015.91s |  Packaging and so forth is all really well standardized already, right?
1015.91s - 1018.19s |  So we don't need to reinvent any of that
1020.43s - 1024.63s |  name, serial numbers, distinguishing marks and then external references.
1025.11s - 1028.95s |  What about a link to a photograph of the thing?
1029.31s - 1031.91s |  So you can look at a picture of it and say,
1032.07s - 1034.47s |  does that look like the thing in front of me? Right.
1034.47s - 1037.71s |  Does this look like the person in front of me? Pretty straightforward.
1038.63s - 1042.23s |  So then we get into the distribution side of this.
1042.59s - 1046.47s |  How do we communicate the digital emblem to the validator?
1046.47s - 1048.91s |  How does the validator find out about this thing?
1049.47s - 1052.31s |  So let's run through those.
1052.67s - 1055.67s |  For data at rest and data in flight.
1057.27s - 1060.75s |  For data at rest, there are kind of three possibilities, right?
1060.75s - 1065.35s |  Either the emblem encapsulates the data.
1065.43s - 1068.75s |  So we have the emblem and the data gets shoved inside the emblem
1069.47s - 1073.51s |  or the emblem and the data are sitting next to each other on some media.
1074.39s - 1079.31s |  Or the emblem gets shoved into the data and is encapsulated within the data.
1079.31s - 1081.39s |  Right. So those are our three possibilities.
1081.39s - 1084.63s |  And, you know, side by side is easy.
1084.63s - 1087.75s |  It's just like two files or whatever.
1087.75s - 1091.07s |  And then we've got different ways of doing encapsulation already.
1091.07s - 1092.79s |  Plenty of standards that we can use there.
1092.79s - 1097.71s |  MIME, which is used for email, is, for instance, a perfectly mature one.
1098.83s - 1101.91s |  For data in flight, this is going to be TLS, right?
1101.91s - 1103.75s |  I'm not a TLS expert.
1103.75s - 1105.03s |  Lots of people are.
1105.03s - 1106.95s |  This is going to be some sort of TLS thing.
1108.39s - 1109.83s |  In band network response.
1109.83s - 1112.23s |  We've already got this. Dane.
1112.23s - 1115.99s |  DNS, DNSSEC, Dane. Issue a certificate. Done.
1118.03s - 1120.87s |  Passive RF responders and active RF responders.
1120.87s - 1124.47s |  Again, RFID. Done. We just take what's already existing.
1125.59s - 1127.19s |  Active RFID beacon.
1127.19s - 1130.51s |  So this is something where you would query it and it would respond.
1130.71s - 1133.51s |  Oh, sorry. Sorry. Beacon.
1133.51s - 1135.07s |  This is like radio station.
1135.07s - 1138.03s |  It's just broadcasting the signal.
1138.31s - 1140.27s |  And you listen and you've got it.
1141.55s - 1144.35s |  So that could be just on some specific frequency
1144.35s - 1149.83s |  that the validator and the issuer both know is supposed to be used for this.
1149.83s - 1152.91s |  Or it could be spread spectrum or whatever. Who knows? Right.
1153.19s - 1156.63s |  This is one of those things that is going to be very specific
1156.63s - 1161.47s |  to the use case and the validator and the issuer for them to work out.
1161.47s - 1165.11s |  It doesn't really have anything to do with the the data model.
1166.11s - 1168.83s |  Passive optical marking.
1169.07s - 1173.59s |  This is the physical marking of the digital marking
1174.27s - 1176.19s |  that replaces the physical marking.
1176.19s - 1178.15s |  So that could be a QR code.
1178.15s - 1180.75s |  Right. Could be letters painted on the side of something.
1181.55s - 1183.83s |  Barcodes. Printed text.
1183.83s - 1187.51s |  It could be like an e-ink screen that displays the data.
1188.87s - 1190.67s |  Whatever. It just needs to be some way.
1190.67s - 1192.71s |  It's like communicating a URL. Right.
1192.71s - 1196.59s |  You just need to be able to get that label across so that the validator can check it.
1198.79s - 1200.99s |  Active optical transponder. Right.
1200.99s - 1205.31s |  This would be hypothetically like you blink the flashlight at them
1205.31s - 1207.71s |  and they blink the flashlight back.
1207.71s - 1212.83s |  Who knows? This is like if you build a matrix, this is a spot in the matrix.
1213.59s - 1216.51s |  I don't know if there's a use case for that or not.
1216.51s - 1217.91s |  Active optical beacon.
1217.91s - 1221.63s |  At first, I was thinking, you know, active optical beacon is going to do that.
1221.91s - 1225.31s |  And then I started talking with aviation folks and they were like, that's the one.
1225.31s - 1227.71s |  That's the important one that we're going to do.
1227.71s - 1231.59s |  So taking the navigation lights on an aircraft,
1231.59s - 1234.99s |  it turns out there's already a standard for modulating data on that.
1236.07s - 1239.91s |  It's a it's an 802.11 standard, just like Ethernet.
1240.27s - 1245.59s |  So you can modulate the data on existing navigation and hazard lights.
1246.43s - 1249.67s |  You could do the same thing on the light bar of an emergency vehicle.
1250.19s - 1255.59s |  Lighthouses, you know, anything where you've got some sort of light,
1255.59s - 1258.47s |  if you can modulate it fast enough, you can put data on it.
1258.83s - 1262.35s |  And that is an active optical beacon, which.
1263.03s - 1267.79s |  OK, cool. Active audio transponder.
1268.71s - 1273.15s |  You that's like Amazon Echo or whatever, you talk to it and it talks back to you.
1273.79s - 1276.15s |  Is there a use case? I don't know.
1276.15s - 1278.03s |  And active audio beacon.
1278.03s - 1281.63s |  So that's kind of like the optical one, right?
1281.63s - 1287.59s |  You could modulate data onto an existing sound source, right?
1287.59s - 1293.99s |  If that's a siren on a fire truck, for instance, you could modulate data onto that.
1294.95s - 1299.35s |  You could do this at audible frequencies or above or below audible frequencies.
1300.79s - 1305.87s |  You could do it steganographed into like background music, right?
1306.15s - 1307.83s |  All kinds of cool tricks you can do with this.
1309.03s - 1313.83s |  So we just run through a couple of interesting use cases that came out of,
1313.83s - 1316.59s |  like all the use case interviews at the beginning of the process.
1316.91s - 1322.87s |  So diplomatic pouches, this is one of the really obvious use cases.
1322.87s - 1327.15s |  And there are obviously a lot of foreign ministries out there shipping stuff around.
1329.07s - 1330.47s |  But let's talk through this.
1330.47s - 1334.35s |  So the law says that you can't delay or inspect it.
1334.75s - 1338.15s |  Right. Customs agent receives the diplomatic pouch.
1338.15s - 1340.67s |  It comes in. It's in with a lot of other stuff.
1341.07s - 1343.31s |  That one, they can't delay.
1343.51s - 1346.75s |  It can't sit around there and they can't inspect it.
1346.95s - 1350.23s |  They can look at the outside of it, but they can't open it up
1350.87s - 1353.59s |  and they can't weigh it and they can't X-ray it.
1354.43s - 1355.51s |  They're only allowed to look.
1356.63s - 1358.75s |  Passive optical inspection of the outside.
1358.95s - 1364.31s |  All right. So the problem here is that people smuggling contraband
1364.67s - 1368.83s |  know this and can mark their crate diplomatic pouch,
1368.83s - 1370.79s |  and that makes it illegal to inspect.
1370.79s - 1372.79s |  And yet they are smuggling contraband.
1373.75s - 1376.75s |  And they're not authorized by anybody due to that.
1376.75s - 1378.47s |  That is inherently illegal.
1378.47s - 1380.87s |  So the customs agent is in this dilemma.
1380.95s - 1381.79s |  What do they do?
1381.79s - 1387.11s |  They've got something marked diplomatic pouch, and yet it could contain contraband.
1387.35s - 1391.71s |  So if they can scan something on that and cryptographically verify
1391.71s - 1395.27s |  that it was shipped by the foreign ministry of Japan,
1395.91s - 1397.79s |  it can be entirely full of cocaine.
1397.79s - 1399.51s |  And it's not their problem.
1399.51s - 1401.31s |  It's the foreign ministry of Japan's problem
1401.31s - 1404.07s |  because it was under their authorization that it was shipped.
1404.43s - 1406.23s |  And we haven't inspected it.
1406.23s - 1408.27s |  We haven't looked inside. We haven't weighed it.
1408.27s - 1409.95s |  We have no idea whether it's cocaine or not.
1409.95s - 1412.27s |  Doesn't matter. Not our problem.
1412.27s - 1416.47s |  On the other hand, we scan it and we get an invalid scan.
1416.95s - 1418.43s |  Right. Doesn't validate.
1418.43s - 1421.11s |  We can go to town on it, open it up, whatever,
1421.39s - 1424.07s |  because it's not actually a diplomatic pouch at that point.
1424.47s - 1426.07s |  That was a false marking.
1426.07s - 1428.07s |  So we can't do that with physical marking.
1428.07s - 1429.67s |  There's just no way to tell.
1429.67s - 1432.19s |  We have to depend on all these other things, right?
1432.43s - 1435.35s |  We have to get on the phone with the foreign ministry of Japan
1435.67s - 1439.15s |  logistics people and hope that they also speak Swahili, right?
1440.11s - 1440.99s |  Good luck.
1441.79s - 1444.11s |  OK, so UNESCO.
1444.11s - 1447.79s |  This was a really interesting one because we'd done all of these interviews
1447.79s - 1450.35s |  with folks who wanted to attach a label to a thing.
1451.35s - 1454.39s |  We get to UNESCO and they're like, yeah, we've got all these artworks
1454.39s - 1459.55s |  to get shipped around between countries to, you know, exhibitions and stuff.
1459.55s - 1463.07s |  And then we've got these buildings and we've got whole neighborhoods
1463.07s - 1464.51s |  and so forth and neighborhoods.
1464.51s - 1465.23s |  It's no big deal, right?
1465.23s - 1468.59s |  Because you're just defining a polygon, right?
1468.59s - 1470.67s |  Just like that airplane flight, right?
1470.67s - 1473.03s |  We're defining a polygon and saying, yes, it's here now.
1473.03s - 1476.43s |  It's been here and it will continue to be here in the future, we hope. Right.
1477.43s - 1479.27s |  That's no problem.
1479.27s - 1482.59s |  But the artworks, it turns out that like a double digit percentage
1482.59s - 1486.59s |  of the artworks that are protected are in an unknown location
1486.71s - 1490.87s |  because they got stolen out of a museum that the
1491.87s - 1496.11s |  Mexican National Archaeology Museum in Mexico City
1496.11s - 1499.55s |  that got knocked over in like ninety six, ninety eight back then,
1499.55s - 1502.31s |  sometime a whole lot of that stuff still out in the wind.
1503.27s - 1505.87s |  There's the Iraqi National Cultural Museum,
1506.27s - 1509.43s |  thousands and thousands of pieces out there that were protected
1509.43s - 1511.91s |  or, you know, out there somewhere.
1512.23s - 1516.95s |  And so we need some way that a.
1518.23s - 1520.83s |  Law enforcement officer that a
1523.87s - 1527.79s |  auction house can check to see whether a thing
1528.15s - 1531.79s |  that came out of somebody's attic is actually a protected
1531.79s - 1533.99s |  cultural artifact that was stolen.
1534.63s - 1537.99s |  And so what we need is a digital emblem
1538.23s - 1541.99s |  that has a ton of external references to all the sort of known photographs
1541.99s - 1545.59s |  and data about that thing so that somebody who gets a hold of it
1545.59s - 1549.91s |  can be reasonably expected to reassociate it with the emblem.
1550.15s - 1553.15s |  So we've got a bunch of handling flags in there about like,
1553.15s - 1555.35s |  is the location of the object known?
1555.35s - 1556.75s |  Is the location of the emblem known?
1556.75s - 1558.27s |  Are they in the same place? All that.
1559.83s - 1563.23s |  Press press is interesting because we've we've talked about all these ones
1563.23s - 1567.71s |  where there's some authority that is associated with the body of law
1568.03s - 1571.71s |  or an authority that's allowed to ship something or whatever. Right.
1572.11s - 1574.31s |  But who are press people?
1574.31s - 1577.83s |  A press person is a person who's doing journalism
1578.35s - 1580.19s |  and is a noncombatant.
1580.19s - 1582.27s |  That's the definition of a press person.
1582.27s - 1583.83s |  If they're a combatant,
1583.83s - 1587.55s |  they no longer have the protections that a civilian would.
1589.15s - 1592.75s |  They may be doing journalism as a job, but now they're a combatant,
1592.79s - 1594.79s |  so they're not protected.
1595.43s - 1599.59s |  But fundamentally, there's no central agency that says you're a journalist
1599.59s - 1600.55s |  and you're not.
1600.55s - 1605.71s |  So there's nobody that can say, you know, we're the authentic source of this.
1605.71s - 1610.19s |  So we need a solution that journalists could do for themselves
1610.19s - 1615.19s |  or INSEE or CPJ could do on behalf of
1616.03s - 1618.95s |  journalists who are in dangerous situations.
1619.79s - 1625.59s |  CITES, so CITES is the the treaty organization
1625.59s - 1629.43s |  that oversees the body of law around endangered species.
1629.43s - 1633.19s |  So plants and animals that are globally recognized as endangered
1633.71s - 1637.19s |  all have to be shipped with all these markings any time they cross
1637.19s - 1639.11s |  national borders.
1639.59s - 1641.83s |  But if you've got an animal,
1642.19s - 1645.87s |  it's really important that the handling be done properly. Right.
1645.91s - 1649.87s |  So we've got to be able to communicate that in a fairly detailed way.
1650.11s - 1653.47s |  And it's really important that the communications channel back work
1653.79s - 1657.15s |  in case like the animal gets sick or whatever. Right.
1657.39s - 1658.39s |  Same thing's true of plants.
1658.39s - 1661.67s |  Of course, it's just a little bit less obvious.
1661.67s - 1665.07s |  And then aviation, aviation is interesting, a little bit like press, right?
1665.39s - 1669.83s |  You've got this no dual use thing where as long as there's no military
1669.83s - 1673.71s |  use of the aircraft, it's not carrying munitions.
1673.75s - 1676.91s |  It's not carrying troops, anything like that.
1677.19s - 1679.31s |  It's protected as a civilian thing.
1679.31s - 1683.71s |  And there's additional bodies of law under ICAO that that give it
1683.71s - 1686.71s |  additional protections beyond just what a regular civilian would have.
1688.23s - 1690.35s |  So we've got this question of
1690.79s - 1694.71s |  whether there's any military use of that aircraft.
1695.79s - 1697.79s |  But then there's also this interesting thing going on.
1699.59s - 1701.63s |  Like if you talk with Airbus folks,
1702.63s - 1706.23s |  they're starting to build RFID scanners into every opening
1706.23s - 1712.19s |  in the hull of an aircraft so that they can automatically create
1712.19s - 1717.11s |  a manifest of everything that's RFID tag that's going in and out of the aircraft.
1717.67s - 1723.07s |  Now, their idea of why this is important largely has to do with spare parts.
1723.11s - 1727.83s |  Right. So they've got these expert systems and reporting and so forth
1727.83s - 1730.51s |  on the aircraft about failures.
1730.87s - 1734.87s |  And the expert systems predict what spare parts are going to be necessary
1734.87s - 1735.99s |  to repair that failure.
1735.99s - 1741.95s |  So they're starting to do this manifest radio ahead thing where there's,
1742.43s - 1747.27s |  you know, can be relayed on to the airport that they're going to land at.
1747.75s - 1751.31s |  What parts the expert system thinks are going to be needed to turn
1751.31s - 1755.43s |  the aircraft around and get it in the air again so that the logistics
1755.43s - 1759.27s |  supply chain can get those parts to the gate with somebody qualified
1759.27s - 1762.27s |  to install them before the plane even lands.
1762.27s - 1765.23s |  Right. So they're minimizing the downtime of the aircraft.
1767.79s - 1771.23s |  But the thing is, if we've already scanned all these digital emblems
1771.23s - 1775.19s |  that are in the hold, you know, people coming in as passengers and so forth,
1775.19s - 1778.31s |  we can include that in that radio ahead manifest,
1778.55s - 1781.79s |  and that can get split out to customs and immigration
1781.79s - 1784.55s |  so that they know what the exception cases that are going to be coming
1784.99s - 1788.78s |  into them off that aircraft are.
1788.78s - 1790.02s |  So that was it.
1791.46s - 1794.30s |  Plenty of time for questions, if you guys want.
1794.42s - 1797.98s |  Got about 10 minutes again.
1797.98s - 1801.18s |  It's this is a standards efforts happening in the ITF.
1803.30s - 1806.26s |  Hypothetically, you could implement this a bunch of different ways.
1806.26s - 1807.94s |  You can invent new stuff.
1807.94s - 1812.98s |  But all the actual implementers at this point are doing it on top of DNS.
1813.02s - 1816.70s |  So DNS, DNSSEC for the cryptographic signatures,
1817.02s - 1820.78s |  DANE for the certificates, and then DE on top of that,
1820.78s - 1823.82s |  using existing record types almost exclusively.
1825.82s - 1829.10s |  So if anybody has questions, come up to the front mic.
1833.74s - 1846.94s |  QR codes and barcodes have like, you know.
1847.50s - 1849.06s |  Hey, hang on just a sec.
1849.06s - 1853.39s |  Can you guys hear him or is that mic on?
1853.39s - 1855.11s |  Yeah. OK.
1855.11s - 1857.83s |  Can you be loud because I'm I'm having a hard time.
1858.67s - 1860.63s |  QR codes and barcodes have been done.
1860.67s - 1863.35s |  Enough redundancy so they can play games with them.
1863.35s - 1866.15s |  And you can, for instance, put, you know, readable,
1866.15s - 1869.99s |  human readable text and pictures in them.
1870.43s - 1873.91s |  And so it looks like it could be a nice way of,
1874.99s - 1878.07s |  you know, putting labels that are both computer readable and
1879.27s - 1882.11s |  readable to a human in the field.
1882.11s - 1884.87s |  Has has that been discussed in this context?
1885.31s - 1890.59s |  So the there are essentially two ways that the digital emblem can get delivered.
1890.91s - 1893.83s |  The main way is sort of like a website would be
1894.23s - 1896.71s |  you're you're sort of reading the URL, the label.
1896.71s - 1899.39s |  In this case, it's going to be a DNS label.
1899.39s - 1903.27s |  And then you go do a lookup and you get the data and you evaluate the data.
1904.11s - 1907.39s |  So you know where to get that data based on the label
1907.83s - 1910.35s |  and you know what format to expect that data in.
1910.59s - 1913.47s |  So that per se is not really going to be the issue, right?
1913.47s - 1916.99s |  If you enter the right label, like if you have to retype it,
1917.79s - 1920.35s |  you better not mistype. Sure.
1921.43s - 1925.75s |  But the odds are, if you mistype, you're not going to get any sort of result.
1925.87s - 1928.63s |  Right. You're not going to I mean, you get an error. Right.
1930.43s - 1936.31s |  So with a QR code or a barcode or something or an RFID,
1938.31s - 1942.11s |  there's more of a potential for you scan something.
1942.11s - 1946.95s |  But the human being doesn't really know what it is that they've just scanned.
1947.23s - 1951.99s |  So, you know, somebody could affix a fake label over the real one
1951.99s - 1955.47s |  or replace it or whatever and misdirect them to the wrong place.
1955.47s - 1959.23s |  So that's where you start to get the need for the bindings.
1959.31s - 1962.59s |  Right. The validator is an expert, right?
1962.59s - 1963.63s |  They're a customs agent.
1963.63s - 1965.63s |  They're trained to evaluate this stuff.
1966.27s - 1968.83s |  Now you're just passing them more information.
1969.51s - 1973.07s |  And with the higher expectation
1973.07s - 1976.19s |  of of bandwidth there of more information,
1977.47s - 1981.39s |  it's going to give them more tools to do that evaluation. Right.
1981.71s - 1986.91s |  Whether the whether this is real or fake,
1987.31s - 1990.23s |  there's a higher bandwidth channel for them to work with.
1990.79s - 1994.19s |  So, you know, could you game it?
1994.19s - 1997.03s |  Probably. They're always clever hackers.
1997.03s - 2000.11s |  But building on top of a lot of existing work
2000.47s - 2003.03s |  that's already really well tested.
2004.03s - 2007.47s |  You know, we're doing sort of the minimal new work possible.
2008.39s - 2011.59s |  So you mentioned various encodings like MIME and such.
2011.59s - 2016.35s |  It makes me think of X509 and the richness of metadata
2016.35s - 2019.87s |  that can be represented in X509 for certificates.
2020.63s - 2025.87s |  Do you see different use cases forcing extensions onto validators
2026.23s - 2029.87s |  the way that descriptions are applied for other use cases?
2029.87s - 2031.87s |  Right now, you're really focused on customs.
2031.87s - 2033.35s |  Right. Customs officials.
2033.35s - 2038.75s |  And this problem that you mentioned of proliferation of proprietary scanners.
2039.31s - 2040.67s |  But what about like the U.S.
2040.67s - 2045.63s |  Cybertrust label for IOT devices that has metadata about those IOT devices?
2046.03s - 2048.31s |  Could that apply or would there be extensions?
2048.75s - 2054.71s |  So in the IETF, the way the politics work,
2054.71s - 2058.87s |  if you try and bite off something too large, it gets too many people's interest.
2059.11s - 2061.35s |  And then they all show up with their opinions.
2061.63s - 2063.39s |  And then nothing happens.
2063.39s - 2068.35s |  And so the constraining this to markings
2068.35s - 2072.59s |  required under international law is a constraint
2072.87s - 2076.19s |  that keeps people who are
2078.63s - 2081.59s |  interested in other things.
2081.59s - 2084.15s |  Often their silo instead of in this silo
2085.39s - 2089.35s |  or, you know, outside the tent, pissing out
2089.35s - 2092.59s |  rather than inside the tent, pissing in or I don't know.
2093.79s - 2096.71s |  But I mean, hypothetically, we get this work done.
2097.27s - 2101.27s |  And, you know, there's self-driving cars out there.
2101.43s - 2105.39s |  Wouldn't it be nice if the stoplight had a, you know,
2105.39s - 2108.51s |  official authorized by the city of Oakland, California?
2108.79s - 2111.03s |  You know, it's green right now.
2111.03s - 2114.11s |  And, you know, two seconds later, it's orange.
2114.11s - 2116.11s |  And two seconds after that, it's red.
2116.11s - 2117.95s |  Whatever. Right.
2117.95s - 2123.23s |  There are a zillion uses you can put something to once you have the tool.
2123.23s - 2126.67s |  Right. Once you standardize the tool, you've got all the libraries,
2126.67s - 2129.39s |  you've got all the open, you know, code.
2130.91s - 2132.03s |  There's a lot you can do.
2132.03s - 2135.75s |  So then then on the cryptographic side, you know, X509 and, you know,
2135.75s - 2139.91s |  different kinds of of encryption and and signing.
2141.23s - 2144.91s |  Again, we're trying to only add the little bit at the top,
2145.39s - 2147.47s |  not do any new crypto.
2147.47s - 2150.43s |  Right. All the crypto we're just inheriting out of DNSSEC.
2150.71s - 2153.55s |  And there are a lot of people who care about DNS security.
2153.79s - 2158.99s |  And a lot of people are working on, you know, post-quantum crypto for DNSSEC,
2159.91s - 2163.31s |  you know, elliptic curves that are not ones recommended by the NSA.
2163.87s - 2165.75s |  There's a lot of work going on there.
2165.75s - 2168.71s |  And if we try and do all that also.
2168.71s - 2170.95s |  It's just going to make everything more complicated.
2170.95s - 2175.35s |  One other thought or question on the loitering munition thing that you said,
2175.35s - 2177.67s |  I immediately thought, well,
2177.67s - 2182.99s |  someone's just going to mislabel their, you know, tank or other thing.
2182.99s - 2185.91s |  But I think that goes to the visual description integrity or something
2186.11s - 2190.47s |  there with with that and also the Hague piece that you mentioned
2190.67s - 2194.15s |  that the physical binding, you know, only goes so far.
2194.15s - 2196.83s |  Right. Like people will gain that.
2196.83s - 2198.15s |  Yeah. Yeah.
2198.15s - 2202.27s |  And one of the one of the things sorry, I didn't mention
2202.39s - 2207.51s |  if you've got a delivery mechanism that can actually deliver a lot of data,
2207.51s - 2212.75s |  like, you know, a big RFID can deliver, you know, many gigabytes of data.
2213.83s - 2217.75s |  You can take the whole thing and cram it in there.
2218.23s - 2223.87s |  And as long as the validator has cashed the root signatures,
2224.91s - 2227.59s |  then they can validate everything you hand them
2227.99s - 2232.43s |  based on following that signature chain, starting just with the root signature.
2232.87s - 2234.75s |  So you can do offline validation.
2234.75s - 2237.27s |  You don't need to be, you know, on the network.
2237.27s - 2241.55s |  So there there are a lot of people get very hung up on the military use cases
2241.55s - 2243.55s |  because they're kind of cool and fun.
2243.55s - 2249.19s |  And so a lot of people worry about covert inspection, right?
2249.19s - 2252.75s |  They want to be able to look at one of these things
2252.75s - 2256.39s |  without alerting anybody that they're looking and to do the validation
2256.39s - 2258.43s |  without alerting anybody that they're validating
2258.43s - 2261.59s |  because they don't want to warn people that they're about to attack something.
2261.95s - 2267.11s |  And so, you know, doing it this way gives you all of that already for free.
2267.11s - 2270.75s |  Right. Because you can hand over that data,
2270.95s - 2274.55s |  you know, on a beacon or whatever.
2275.55s - 2279.03s |  They can validate it using a single cash signature.
2280.19s - 2282.55s |  It's it's pretty robust.
2282.79s - 2285.19s |  I'm not sure if that covered your question, because honestly,
2285.19s - 2288.35s |  I can't actually hear more of the military use case.
2288.35s - 2291.95s |  And the first point that you said, it's a reiteration of your first
2291.95s - 2297.15s |  first point, basically, that it does nothing to honor the physical binding.
2297.63s - 2301.35s |  But military, you can gain the system because the crime
2301.35s - 2306.03s |  mislabel things in adversarial scenarios is where I was.
2306.07s - 2308.07s |  I think my brain was gone.
2308.07s - 2309.59s |  We can tell you what. Yeah.
2309.59s - 2313.91s |  Catch me after because I honestly can't hear a damn thing. Sorry.
2314.91s - 2318.11s |  And we're. Within a couple of minutes,
2318.11s - 2321.87s |  without a time right now, if there's one last question
2321.87s - 2324.55s |  and somebody can say it really loudly, we can do it.
2324.59s - 2327.91s |  Otherwise, let's call it.
2329.55s - 2331.47s |  Done a little bit early.
2331.59s - 2334.07s |  All right. Well, thank you all very, very much.
2335.19s - 2339.39s |  I guess you can see up there the URLs for the IETF documents.
2340.43s - 2340.87s |  Take care.


url: https://www.youtube.com/watch?v=H-bhmSwnRdY
type: video
author: DEFCONConference
ingestion_date: 2024-11-10
transcription_model: large-v2
chunking_status: completed
title:
DEF CON 32 - Exploiting the Unexploitable Insights from the Kibana Bug Bounty -  Mikhail Shcherbakov

content:
{
  "webpage_url": "https://www.youtube.com/watch?v=H-bhmSwnRdY",
  "title": "DEF CON 32 - Exploiting the Unexploitable Insights from the Kibana Bug Bounty -  Mikhail Shcherbakov",
  "description": "We explore case studies of exploiting vulnerabilities in modern JavaScript and TypeScript applications, drawing on experiences from participating in the Kibana Bug Bounty Program. It's not uncommon to encounter a vulnerability that appears unexploitable at first glance, or to be told by a triage team that the behavior is \"by design.\" So, what options does a security researcher have in such situations? And what primitives can be utilized to construct an exploitation chain with significant impact?\n\nOur study involves breaking out of properly isolated containers in scenarios where there is RCE-by-design. We will examine several Prototype Pollutions that crash an application in less than one second after exploitation and explore how these vulnerabilities can ultimately lead to critical RCEs. Furthermore, we introduce new primitives and gadgets that enable the achievement of RCE from Prototype Pollutions previously deemed unexploitable beyond DoS attacks.\n\nBy highlighting these methods, the talk aims to equip attendees with advanced techniques for exploiting complex vulnerability chains in JavaScript applications, as well as recommendations for proper defense and mitigations against them.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2750,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 7.00s | This text was transcribed using whisper model: large-v2

 My name is Mikhail Shcherbakov, and today I want to tell you a few stories about Kibana bug bounty.
8.00s - 14.00s |  This first part of the talk is about vulnerabilities that I found in Kibana,
14.00s - 23.00s |  and I combined only remote code execution vulnerabilities in this talk, just because of time limits.
23.00s - 27.00s |  A few words about me.
27.00s - 33.00s |  Now I am finishing my PhD studies at KTH University Stockholm,
33.00s - 41.00s |  and working on the thesis Code Reuse Attacks in Managed Programming Languages and Runtimes.
41.00s - 52.00s |  My main research interests are static code analysis, dynamic program analysis, and language-based security in general.
52.00s - 62.00s |  I participated in bug bounty programs of Microsoft, GitHub, some open source projects, and Elastic.
62.00s - 71.00s |  Today we will talk about Elastic bug bounty program, namely Kibana bug bounty program.
71.00s - 73.00s |  Who is Kibana?
73.00s - 84.00s |  Kibana is a part of popular ILCA stack that includes Elasticsearch, Logstash, and Kibana.
84.00s - 92.00s |  It is used for data visualization and real-time analysis.
93.00s - 104.00s |  Kibana is an open source project, all code is available, and it is possible to analyze statically or just make a manual review.
104.00s - 112.00s |  It is definitely a large project, probably one of the largest, it is written in TypeScript,
112.00s - 124.00s |  and they have an interesting bug bounty program with 3,000-7,000 rewards for critical vulnerabilities.
124.00s - 136.00s |  All of that makes Kibana a great target for bug hunters, and I contributed a lot last year in this program.
137.00s - 146.00s |  Before starting to tell about vulnerabilities in Kibana, I would like to say my thanks to Elastic Security team.
146.00s - 156.00s |  In my practice, in my experience, it is one of the best bug bounty programs that is managed by Elastic Security team.
156.00s - 169.00s |  Thank you guys for your work, and the main reason that I contribute a lot in this bug bounty is just a good experience of this work.
169.00s - 175.00s |  So, story number one, how it all began.
176.00s - 190.00s |  One year ago, in the last August, after DEFCON, I found that Elastic Bug Bounty started compiling for a new feature
190.00s - 200.00s |  that's called synthetic monitoring in the Kibana product that can be used for some dashboard.
200.00s - 210.00s |  The idea of the feature that you can set up some monitors for websites and see how the website is available
210.00s - 217.00s |  or some content was changed and make some reports based on such monitoring.
217.00s - 224.00s |  Okay, let's see how this feature looks like in practice.
224.00s - 231.00s |  In this main page of the Kibana, you can find synthetics, the feature that we discussed.
231.00s - 236.00s |  You can create new monitor to monitor some website.
236.00s - 244.00s |  You need to set the name of the monitor, location, when your agent will be run to make a request to the site.
244.00s - 249.00s |  And look, you can define some script.
249.00s - 253.00s |  So, it looks interesting.
253.00s - 258.00s |  We have some script editor and we can pass all the script here.
258.00s - 263.00s |  Let's check the documentation, how such scripts look like.
263.00s - 273.00s |  It's one of the examples, a simple script that's just open the example.org and check some element,
273.00s - 280.00s |  the text and the element and check that it equals to example domain.
280.00s - 285.00s |  Okay, but it looks like a JavaScript, right?
285.00s - 294.00s |  So, if you just replace the body of this method and write, for example, to run a reverse shell,
294.00s - 297.00s |  probably we can execute it.
297.00s - 302.00s |  But exactly this code doesn't work because of requiring.
302.00s - 309.00s |  If you did some JavaScript CTF, you probably already know about this problem.
309.00s - 315.00s |  You don't have a require in the scope, but you can bypass it for Node.js, for example.
315.00s - 331.00s |  You can use load, underscore load method in the process main module to load any module, including child process.
331.00s - 334.00s |  And you can run a reverse shell.
334.00s - 336.00s |  Let's see on the demo.
336.00s - 345.00s |  We paste this code, click on the run and see you have already connection from the reverse shell, from the agent.
345.00s - 353.00s |  We see the file system and the user on this agent, on the harebit engine.
353.00s - 359.00s |  You can see the harebit name of the user that we get.
360.00s - 363.00s |  That monitor any websites.
363.00s - 366.00s |  Okay, this is a remote code execution.
366.00s - 371.00s |  I think it's the simplest remote code execution that I reported.
371.00s - 375.00s |  And in the last August, I made a report.
375.00s - 384.00s |  The program, the company already finishing and it was the last days.
384.00s - 388.00s |  And also the rules for the post-exploitation was not clear.
388.00s - 392.00s |  And I decided, okay, I found it, I will report it and let's see.
392.00s - 397.00s |  We discount this report with Elastic security team in September.
397.00s - 401.00s |  And in October, they came back with the feedback.
401.00s - 407.00s |  Synthetics by design is arbitrary code execution as a service,
407.00s - 413.00s |  in which Elastic deploys a number of security features to prevent exploitation.
413.00s - 421.00s |  For successful exploit, someone would have to do something beyond getting a shell.
421.00s - 425.00s |  Okay, so it makes sense.
425.00s - 433.00s |  If you make such feature, probably you already isolated this code on the container.
433.00s - 437.00s |  And what they actually did.
438.00s - 446.00s |  Okay, we discussed it and I decided to continue exploitation of this container
446.00s - 450.00s |  and see what I can get in the end.
450.00s - 452.00s |  Where we are?
452.00s - 455.00s |  This is an isolated container.
455.00s - 462.00s |  After some investigation, I see that it's run in the Kubernetes cluster on Google Cloud Platform.
462.00s - 471.00s |  Probably it was managed Kubernetes cluster, but the details are not important here.
471.00s - 477.00s |  The first idea was to try to affect another client on the same container.
477.00s - 482.00s |  But the container was running per task.
482.00s - 486.00s |  So we don't have any persistent state.
486.00s - 493.00s |  After execution of the code that we injected, the container just restarted.
493.00s - 496.00s |  And no any client there.
496.00s - 499.00s |  Okay, try to escape the container.
499.00s - 504.00s |  It was secure configuration of up-to-date Kubernetes version.
504.00s - 507.00s |  So it looks like not possible.
507.00s - 511.00s |  Access to Google Cloud Platform metadata API?
511.00s - 512.00s |  No again.
512.00s - 517.00s |  So I think it's one of the first thing that they checked.
517.00s - 521.00s |  It looks like unexploitable case.
521.00s - 530.00s |  So we found remote code execution, but we cannot bypass the container isolation.
530.00s - 543.64s |  I continue investigated some things around and found the same Docker container for private Kubernetes cluster.
543.64s - 547.64s |  That means we can run it in the own Kubernetes cluster.
547.64s - 555.64s |  It makes threat model a little bit weak because we don't have exactly the same settings.
555.64s - 567.64s |  We can say if we can escape from container or affect some another services or features in the default configuration on the Kubernetes.
567.64s - 573.64s |  It looks like possible exploitation flaw.
573.64s - 582.64s |  And I also found that this container already have natural capabilities.
582.64s - 588.64s |  It means that we can send any raw package to the network.
588.64s - 590.64s |  Any package.
590.64s - 593.64s |  It means we can emulate any protocol.
593.64s - 598.64s |  For example, we can say send ARP packages.
598.64s - 605.64s |  I think you already understand my idea and get what I want to do.
605.64s - 614.64s |  Yeah, let's try to do ARP spoofing attack in 2024.
615.64s - 625.64s |  So our protocol allows to send some request to match IP address to the MAC address of any computer.
625.64s - 634.64s |  And for example, in the network, when Bob tried to connect to Mary and communicate by IP transport,
634.64s - 646.64s |  we can say to Bob that Mary is an attacker computer and say to Mary that Bob is an attacker computer and intercept the traffic between these two machines.
646.64s - 653.64s |  It's a simple, old, very old, old school attack.
653.64s - 657.64s |  But what about Kubernetes?
658.64s - 665.64s |  I already wanted to start to run Wireshark and investigate the traffic, what actually happens.
665.64s - 672.64s |  And found a nice blog post from Nir Chacko.
672.64s - 677.64s |  Attacking Kubernetes clusters throws your network plumbing.
677.64s - 694.64s |  So, he described the same idea of ARP spoofing to replace DNS server that available in the Kubernetes to the own DNS server.
694.64s - 710.64s |  And in this case, you can hijack any DNS request and send the request to the own web server instead of any available web server.
710.64s - 716.64s |  And the crucial component of this attack, this is this bridge.
716.64s - 720.64s |  Let's call it BR0 on this figure.
720.64s - 740.64s |  So, this bridge supports ARP protocol and has own ARP table that has any IP addresses and MAC addresses of the ports that run on the same node.
740.64s - 743.64s |  So, it looks like very restricted attack.
743.64s - 747.64s |  We can affect only ports on the same node.
747.64s - 758.64s |  But default network interface in Kubernetes allows us to exploit ARP spoofing.
758.64s - 760.64s |  Let's see on the demo.
760.64s - 768.64s |  So, the one of the idea to start this attack was to use some cloud environment.
768.64s - 774.64s |  I check Microsoft Azure and they allow us to use default Kubernetes.
774.64s - 776.64s |  So, you can see the console.
776.64s - 785.64s |  I already started attacker at victim ports and you can see that it's run on the same node in Kubernetes cluster.
785.64s - 792.64s |  It allows us to perform attack from the attacker to affect the victim.
792.64s - 800.64s |  First of all, we install proof of concept script and some additional dependencies on the attacker.
800.64s - 803.64s |  At the same time, we open the victim machine.
803.64s - 808.64s |  We will install KURL there to emulate some web requests.
808.64s - 811.64s |  Yeah, it's the console of the victim machine.
811.64s - 822.24s |  And after installation of the KURL, the idea that we try to get the data from the google.com.
822.24s - 831.24s |  After that, we start the attack and try to use own web server instead of the google.com.
831.24s - 837.24s |  So, now you see the usual, the valid response from the google.com.
837.24s - 839.24s |  And this is the attacker port.
839.24s - 849.24s |  We run DNS spoofing proof of concept that I found in that blog post.
849.24s - 854.24s |  I also improved it to use it on Azure.
854.24s - 857.24s |  By default, it did not support it.
857.24s - 860.24s |  And we start the attack here.
860.24s - 864.24s |  And now we do the same request.
864.24s - 871.24s |  And you can see that our web server responds instead of the google.com.
871.24s - 878.24s |  So, it's a classic DNS spoofing that we demonstrated in this demo.
878.24s - 883.24s |  And I updated the report to demonstrate this attack.
883.24s - 886.24s |  Elastic changed the report.
887.24s - 899.24s |  And a few days, one week ago, they rewarded with almost 4000 bounties for this attack.
899.24s - 905.24s |  Not bad for unexploitable case and very exotic attack.
906.24s - 916.24s |  And it was very interesting experience to try to use ARP spoofing in the real bug bounty case.
916.24s - 924.24s |  So, I missed a lot of the details of network configuration of the Kubernetes.
924.24s - 928.24s |  If you're interested in that, read the blog post.
928.24s - 930.24s |  I'm sure you'll enjoy it.
930.24s - 937.24s |  It's one of the best blog posts about Kubernetes networking that I was read.
937.24s - 941.24s |  The links, all links will be in the end of the presentation.
941.24s - 945.24s |  Let's see on another attacks.
945.24s - 956.24s |  The main topic in my PhD studies for last two years was server-side prototype pollution vulnerabilities.
956.24s - 958.24s |  We published three papers about that.
958.24s - 964.24s |  When we found, we implemented some tool chain to find prototype pollution vulnerabilities.
964.24s - 975.24s |  We found prototype pollution gadgets that allows us to exploit prototype pollution and achieve remote code execution attack.
975.24s - 982.24s |  In Node.js itself, in Deno, in NPM packages.
982.24s - 985.24s |  If you're interested in this, read the papers.
985.24s - 994.24s |  And I also give us some short introduction of our research and prototype pollution attack the last year on DEF CON.
994.24s - 1002.24s |  And many technical details of the gadgets that we found in Node.js itself in another talk on the Black Hat Asia.
1002.24s - 1013.24s |  And today I will tell you short introduction what the prototype pollution is, just to be on the same page.
1013.24s - 1020.35s |  So let's assume that we have a Node.js application.
1020.35s - 1024.35s |  We run some web server, you see index.js.
1024.35s - 1030.35s |  It's very simple web server that can handle two requests, update and backup.
1030.35s - 1033.35s |  For update request, we provide some arguments.
1033.35s - 1038.35s |  For backup request, we just trigger the backup of database.
1038.35s - 1040.35s |  Okay, it's all set up.
1040.35s - 1044.60s |  So we have attacker in this threat model.
1044.60s - 1048.60s |  It's any user that can send any request to the web server.
1048.60s - 1058.60s |  And if the attacker send such request with these parameters, and we have a handler for update request.
1058.60s - 1064.60s |  The handler in the first line create empty object.
1065.60s - 1075.60s |  And run time in the same time, create empty object with the built-in property proto that points to the object prototype.
1075.60s - 1081.60s |  That contains a lot of function like toString, valueOf that we can reuse.
1081.60s - 1090.60s |  So it's like inheritance implementation for JavaScript and TypeScript.
1091.60s - 1103.60s |  In the second line, you can see that we read the property from the object that specified in the argument org.
1103.60s - 1105.60s |  This is the proto.
1105.60s - 1109.60s |  It means we get a reference to this object.
1109.60s - 1123.60s |  In the last line of the code, we assign a value from details to another property of the prototype, the property shell.
1123.60s - 1132.60s |  So we read the proto, we assign value calc in the shell, and we get it in the prototype.
1132.60s - 1136.60s |  This code pattern is called prototype pollution.
1136.60s - 1143.60s |  Because we pollute, we add some property or replace some property in the object prototypes itself.
1143.60s - 1147.60s |  Let's assume that we have such code for backup handler.
1147.60s - 1154.60s |  This function try to run the backup script, this one.
1154.60s - 1163.60s |  And use the shell from the options and default shell if the shell is undefined.
1164.60s - 1169.60s |  In our case, shell is undefined and it will be used default shell.
1169.60s - 1172.60s |  Okay, it's very common pattern in the JavaScript.
1172.60s - 1179.60s |  But what actually happens if we trigger this handler after prototype pollution?
1179.60s - 1185.60s |  We create options that points to the same object prototype.
1185.60s - 1197.60s |  We read the shell and the runtime lookups for the shell property in the prototype chain and reads the polluted shell property.
1197.60s - 1210.60s |  And the exec command run a calculator because we get a calc in the shell, in the cmd variable at the end.
1210.60s - 1221.60s |  Okay, this is prototype pollution and remote code execution that we can achieve by prototype pollution in the end.
1221.60s - 1227.60s |  And this code pattern is called a gadget, prototype pollution gadget.
1227.60s - 1237.60s |  Let's start the story too about prototype pollution and remote code execution based on that.
1238.60s - 1241.60s |  So, I tried to use SilentSpring.
1241.60s - 1254.60s |  It's our first research on the prototype pollution, the toolchain that we implemented based on the CodeQL to detect prototype pollution vulnerabilities in Kibana.
1254.60s - 1264.60s |  So the first attempt CodeQL terminated by timeout because of too large database that I tried to analyze.
1265.60s - 1274.60s |  I implemented a script that rerun CodeQL for subfolders if the analysis is timed out.
1274.60s - 1281.60s |  And this script reported 77 cases in the application itself.
1281.60s - 1285.60s |  I will add the script in the same repository if you're interested.
1285.60s - 1286.60s |  You can find it there.
1286.60s - 1288.60s |  Try to play with that.
1289.60s - 1298.60s |  So, we get 44 server-side cases including some false positive testing code.
1298.60s - 1307.60s |  And today I will show you a couple cases from these that was exploited.
1309.60s - 1317.60s |  So, the first case, this is prototype pollution pattern that was detected in the config parser.
1317.60s - 1327.60s |  The config parser take some YAML document, main config of the Kibana when you restart Kibana.
1327.60s - 1342.60s |  And after the parsing it also tried to expand dot-separated names in this YAML config to such nested object.
1343.60s - 1350.60s |  So, a.b becomes a object that contains nested object with property b.
1350.60s - 1354.60s |  So, very simple idea.
1354.60s - 1359.60s |  But the code that does it is vulnerable to prototype pollution.
1359.60s - 1364.60s |  First of all, it take a key like ab in our case, split it by the dot.
1364.60s - 1371.60s |  So, we get array a and b and call walk function.
1371.60s - 1386.60s |  In the walk function we get the first key a and read the value of the a and call walk recursively.
1386.60s - 1388.60s |  So, okay.
1388.60s - 1399.60s |  And for the next case, if we have a last case, vary the b, case becomes empty array now.
1399.60s - 1404.60s |  And we assign the value to the b.
1404.60s - 1410.60s |  So, it's absolutely the same pattern that I've shown you before in the prototype pollution.
1410.60s - 1417.60s |  And such payload leads to prototype pollution vulnerabilities in this case.
1417.60s - 1426.60s |  So, we can add any property and we control the value of the polluted property.
1426.60s - 1428.60s |  Good.
1428.60s - 1441.60s |  I found it and also Elastic Cloud Enterprise, it's an on-premise version of the ILCA stack,
1441.60s - 1444.60s |  provides web UI to edit Kibana YAML.
1444.60s - 1448.60s |  It means we can edit it with admin privileges.
1448.60s - 1457.60s |  So, we need some high-level privileges, but we can do this attack through the web.
1457.60s - 1468.68s |  Attacker can store any payload in Kibana and restart Kibana to load all configs.
1468.68s - 1475.68s |  The problem here that Kibana crashes immediately after prototype pollution, of course,
1475.68s - 1482.68s |  because other code does not expect some properties, some additional properties in the object prototypes.
1482.68s - 1494.68s |  It happens before we get started web server.
1494.68s - 1503.98s |  We cannot send any other request to trigger any gadget.
1503.98s - 1512.98s |  It means we can only control the prototype pollution point.
1512.98s - 1519.98s |  And it's some difficulty with that because nothing dangerous happened between restarting Kibana
1519.98s - 1525.98s |  and prototype pollution triggering and the crash of the application.
1525.98s - 1535.98s |  It just tried to load some modules, tried to load configs, prepare some caches.
1535.98s - 1542.98s |  Nothing dangerous like starting new process or evaluate some function.
1542.98s - 1546.98s |  And the attack looks like unexploitable.
1546.98s - 1553.98s |  So, you can achieve denial of the service, but if you are administrator and you restart Kibana,
1553.98s - 1555.98s |  it's nothing actually.
1555.98s - 1558.98s |  What we can do in this case?
1558.98s - 1563.98s |  Let's see what Kibana did before the crash.
1563.98s - 1566.98s |  It tried to load some modules.
1566.98s - 1575.98s |  It would be nice if we have a gadget in the require call that loads modules.
1575.98s - 1581.98s |  Because the require, it will read the code that it loads from the module.
1581.98s - 1589.98s |  And if we can replace the module to the own code, we can get remote code execution before the crash.
1589.98s - 1591.98s |  That's a nice idea.
1591.98s - 1602.98s |  And we already found the gadget in the require when we worked on the first paper, Silent Spring, that I mentioned today.
1603.98s - 1611.98s |  Actually, we can run any malicious JS file through the prototype pollution.
1611.98s - 1616.98s |  Let's see on the require gadget how it works.
1616.98s - 1622.98s |  So, let's assume that we have the same prototype pollution from the first example.
1622.98s - 1629.98s |  And we can trigger and pollute some property main in the object prototype.
1630.98s - 1638.98s |  We can pollute one more property environment and trigger or handle backup.
1638.98s - 1643.98s |  Handle backup has only one line, a require to the some module.
1643.98s - 1651.98s |  And when require tries to load the module bytes, it has such code.
1652.98s - 1654.98s |  It do a load config.
1654.98s - 1671.42s |  And for load config, this function returns the parsed JSON, like this one, with all properties from the config.
1671.42s - 1679.42s |  But some package JSON, the configuration file, does not have main.
1679.42s - 1684.42s |  In this case, the default behavior should be get index JS.
1684.42s - 1690.42s |  But we have main read expression here.
1690.42s - 1697.42s |  And it tries to read the main that we polluted before from the object prototype.
1697.42s - 1705.42s |  It means we can read any JS file that exists in the system.
1706.42s - 1712.42s |  And it's some limitation for the require gadget, but we combine it with another attack.
1712.42s - 1723.42s |  If we can find some JS file that, for example, start new process, do child process exec, we can combine it with another function.
1723.42s - 1731.42s |  And npm JS, actually, when we load it, starts new process.
1731.42s - 1735.42s |  It does such code.
1735.42s - 1737.42s |  It executes spawn function.
1737.42s - 1744.42s |  These two arguments, not executable process and some arguments.
1744.42s - 1752.42s |  And the implementation on the spawn function, we have another gadget.
1752.42s - 1759.42s |  Let's try to read property shell and nth from the options.
1759.42s - 1765.42s |  And options was empty, undefined.
1765.42s - 1768.42s |  It means it becomes an empty object.
1768.42s - 1774.42s |  And when we read nth here, we read it from the empty object.
1774.42s - 1779.42s |  And we actually read the value from the prototype.
1780.42s - 1781.42s |  Okay.
1781.42s - 1783.42s |  That's the idea of the require gadget.
1783.42s - 1789.42s |  The problem is that this gadget has been fixed by Node.js team.
1789.42s - 1793.42s |  And I already knew this when I found it.
1793.42s - 1798.42s |  And in parallel, I worked on some other tool, some dynamic analysis.
1798.42s - 1799.42s |  It's called gHunters.
1799.42s - 1803.42s |  I described it in the last paper that we published.
1803.42s - 1808.42s |  And that will be presented in using security in a few days, next week.
1809.42s - 1819.42s |  And working on that tool, I investigated require gadget and the fix.
1819.42s - 1822.42s |  And the require gadget looks like this.
1822.42s - 1825.42s |  So, the code that we already saw.
1825.42s - 1827.42s |  We have a load config.
1827.42s - 1832.42s |  So, we have such code that read package JSON.
1832.42s - 1835.42s |  Try to parse it by JSON parse.
1835.42s - 1841.42s |  And JSON parse is an object that has an object prototype in the chain.
1841.42s - 1845.42s |  And it tried to read the main property.
1845.42s - 1854.42s |  And at that moment, it can read the polluted property if we already polluted main in the object prototype.
1854.42s - 1856.42s |  So, this gadget.
1856.42s - 1858.42s |  And Node.js team fixed it.
1858.42s - 1861.42s |  So, the fix looks like this.
1861.42s - 1870.42s |  They wrote some filter on properties that actually read this list of properties exactly from the object itself.
1870.42s - 1873.42s |  Does not check it in the prototype chain.
1873.42s - 1880.42s |  So, it means we cannot affect reading on the main property anymore after that fix.
1880.42s - 1889.42s |  But at some moment, gHunters start detect the require gadget again.
1889.42s - 1892.42s |  In the new version of the Node.js.
1892.42s - 1896.42s |  And I double checked all experiments.
1896.42s - 1900.42s |  And I see that require detected again and again for some cases.
1900.42s - 1905.42s |  And I start to see on this fix more closely.
1905.42s - 1909.42s |  And it has another gadget.
1909.42s - 1911.42s |  I will zoom in.
1911.42s - 1913.42s |  You can see.
1913.42s - 1916.42s |  Exactly in these slides.
1917.42s - 1920.42s |  We have this if statement.
1920.42s - 1924.42s |  If JSON is undefined, the function returns false.
1924.42s - 1929.42s |  The function loadConfig returns false.
1929.42s - 1932.42s |  ParseJSON becomes a false.
1932.42s - 1935.42s |  And we try to read the main from the false.
1935.42s - 1940.42s |  JSRuntime in this case tried to box primitive type, boolean type.
1940.42s - 1944.42s |  And add object prototype in the prototype chain.
1944.42s - 1947.42s |  And we again can read the main.
1947.42s - 1951.42s |  But from the false, actually.
1951.42s - 1954.42s |  So, it's new gadget.
1954.42s - 1957.42s |  And when I figure out it.
1957.42s - 1969.42s |  So, I add the payload for the require in the original Kibana YAML file.
1969.42s - 1973.42s |  And it allows us to exploit this prototype pollution.
1973.42s - 1978.42s |  And achieve remote code execution.
1978.42s - 1983.42s |  So, this vulnerability did not get a high score.
1983.42s - 1986.42s |  Because it required high privileged user.
1986.42s - 1990.42s |  But still it's almost 4,000 bounces.
1990.42s - 1994.74s |  Let's see on the next story.
1994.74s - 1998.74s |  About prototype pollution and remote code execution.
1998.74s - 2003.74s |  Another case that was reported by our script.
2003.74s - 2007.74s |  SilentSpring Node.js queries.
2007.74s - 2012.74s |  Was a prototype pollution in some handler.
2012.74s - 2014.74s |  Web handler.
2014.74s - 2016.74s |  So, it's very simple prototype pollution.
2016.74s - 2019.74s |  You can see we create empty object.
2019.74s - 2024.74s |  It means this object has the prototype points to the object prototype.
2024.74s - 2028.74s |  And we have this line of the code.
2028.74s - 2033.74s |  If namespace is __prot__.
2033.74s - 2037.74s |  And the key is the key controlled by the attacker.
2037.74s - 2039.74s |  That's all.
2039.74s - 2042.74s |  And the value also can be controlled by the attacker.
2042.74s - 2046.74s |  It means we can add any key with controlled value to the object prototype.
2046.74s - 2048.74s |  Very simple.
2048.74s - 2051.74s |  You don't even need a script to find it.
2052.74s - 2056.43s |  Okay.
2056.43s - 2060.43s |  So, when I started working on this script.
2060.43s - 2062.43s |  The question, we need to find a gadget.
2062.43s - 2064.43s |  We worked on the Dusty.
2064.43s - 2068.43s |  It's another project that detected 49 gadgets.
2068.43s - 2073.43s |  Leading to remote code execution in NPM packages.
2073.43s - 2078.43s |  We took 1,000 popular NPM packages.
2078.43s - 2083.43s |  And run dynamic analysis that try to instrument the package.
2083.43s - 2087.43s |  And investigate what the flows can lead to.
2087.43s - 2091.43s |  Read the properties from the prototype.
2091.43s - 2094.43s |  And can lead to remote code execution in NPM.
2094.43s - 2102.43s |  And one of the package that has gadget was NodeMailer.
2102.43s - 2107.43s |  And Kibana uses this gadget to send emails.
2107.43s - 2114.43s |  So, the idea, we have some send mailer transport that's optional.
2114.43s - 2118.43s |  But you also can pollute some option to enable it.
2118.43s - 2127.43s |  And it has some options that's by default empty.
2128.43s - 2135.43s |  And if we have path in the options.
2135.43s - 2139.43s |  The path of the run program that should be send mailer.
2139.43s - 2143.43s |  And args will be read from the options object.
2143.43s - 2145.43s |  And prototype in our case.
2145.43s - 2147.43s |  And send to the spawn function.
2147.43s - 2149.43s |  Okay.
2149.43s - 2151.43s |  So, it means we can inject any command.
2151.43s - 2158.43s |  And execute, start any process on the victim machine.
2158.43s - 2165.86s |  But the problem that delete handler creates the application.
2165.86s - 2169.86s |  In less than one second after the prototype pollution.
2169.86s - 2172.86s |  So, it's also becomes immediately.
2172.86s - 2176.86s |  Because some code in the end of the handler, of the same handler.
2176.86s - 2179.86s |  Does not expect the property, some additional property.
2179.86s - 2182.86s |  And throw exception that's not handled correctly.
2182.86s - 2184.86s |  And we get denial of the service.
2184.86s - 2189.86s |  That's not much interesting for such vulnerability.
2189.86s - 2192.86s |  So, it looks like unexploitable.
2192.86s - 2194.86s |  Denial of the service.
2194.86s - 2199.86s |  I could not say that it's interesting impact that we want to show.
2199.86s - 2204.86s |  But if we try to emulate some race condition.
2204.86s - 2209.86s |  By sending a lot of gadget triggered request in parallel.
2209.86s - 2213.86s |  And one prototype pollution triggered request between them.
2213.86s - 2220.86s |  We can try to get the situation that gadget triggered request.
2220.86s - 2227.86s |  Will be in the small time exactly after the prototype pollution request.
2227.86s - 2231.86s |  Let me explain it based on the script.
2231.86s - 2233.86s |  On the exploit script.
2234.86s - 2240.86s |  So, we can implement such race condition exploit on the bash.
2240.86s - 2242.86s |  Or any other language.
2242.86s - 2244.86s |  So, the idea.
2244.86s - 2249.86s |  We send 20 requests that trigger a gadget first.
2249.86s - 2254.86s |  And after that we send the request that trigger a prototype pollution.
2254.86s - 2260.86s |  And after that we send 50 requests that trigger a gadget again.
2260.86s - 2270.86s |  And this ampersand means that all of these commands will be executed in parallel.
2270.86s - 2273.86s |  So, we send a lot request.
2273.86s - 2277.86s |  Let's see how it works in the demo.
2277.86s - 2281.86s |  So, I run it from my laptop.
2281.86s - 2284.86s |  Through the Wi-Fi.
2285.86s - 2294.86s |  And first of all I start some payload that created email connector.
2294.86s - 2302.86s |  That we need to know to send the request to trigger node mailer package.
2302.86s - 2311.86s |  So, we change in this or exploit SH script this connector.
2312.86s - 2315.86s |  And run the exploit script.
2315.86s - 2321.86s |  And I started this webpage to see which request we will get.
2321.86s - 2323.86s |  So, I did not run a reverse shell.
2323.86s - 2329.86s |  I just sent a request to this webpage.
2329.86s - 2335.86s |  You can see that five requests will be successfully received.
2335.86s - 2346.86s |  It means that five cases will be for so short time that were executed before the crash.
2346.86s - 2350.86s |  So, this attack was run from the Wi-Fi.
2350.86s - 2358.86s |  You can get more interesting, I guess, if you run it on the same server in the same network like in cloud or some places.
2359.86s - 2360.86s |  Okay.
2360.86s - 2367.86s |  This attack give me biggest bounty that I got from the Elastic.
2367.86s - 2371.86s |  And not only this prototype pollution that I reported was exploited.
2371.86s - 2374.86s |  This case was closed a few days ago.
2374.86s - 2377.86s |  I did not have time to edit in the presentation.
2377.86s - 2380.86s |  And also we don't have much time.
2380.86s - 2384.86s |  And another case that was reported also.
2384.86s - 2388.86s |  This is a chain that leads to account takeover.
2388.86s - 2392.86s |  Maybe I will do it in the next presentation.
2392.86s - 2393.86s |  Let's see.
2395.86s - 2405.86s |  As a bonus part, I want to explain some advanced technique for the prototype pollution.
2405.86s - 2409.86s |  When we pollute the objects in the prototype, not the prototype itself.
2412.86s - 2423.86s |  When I understood this trick, it allows me to report few new vulnerabilities that I actually thought unexploitable before.
2423.86s - 2425.86s |  Let's see on the example.
2425.86s - 2431.86s |  We have a prototype pollution from our original example.
2431.86s - 2433.86s |  Very simple code that we already know.
2433.86s - 2434.86s |  We have a gadget.
2434.86s - 2443.86s |  The gadget read options and check the property runner.
2443.86s - 2447.86s |  So the options empty object by default.
2447.86s - 2457.86s |  And if the runner is defined, we read paths and arcs and spawn a new process for that.
2457.86s - 2462.86s |  So it means we need to pollute a runner in the object prototype.
2462.86s - 2463.86s |  So like this.
2463.86s - 2471.86s |  So we add a runner with this object as a value.
2471.86s - 2472.86s |  Okay.
2472.86s - 2479.86s |  And after that we trigger handleback, of course, to trigger a gadget.
2479.86s - 2488.86s |  What if this prototype pollution does not allow us to control the value?
2488.86s - 2494.86s |  For example, it's some object with predefined identifier or another properties.
2494.86s - 2496.86s |  We cannot control it.
2496.86s - 2499.86s |  Or it's empty array.
2499.86s - 2502.86s |  Array does not have any properties.
2502.86s - 2503.86s |  Right?
2503.86s - 2507.86s |  So it looks like unexploitable.
2507.86s - 2509.86s |  At least for such gadget.
2509.86s - 2512.86s |  Maximum we can get denial of the service.
2512.86s - 2517.86s |  But what if we have such code?
2517.86s - 2518.86s |  It's fixed.
2518.86s - 2520.86s |  I call it fixed prototype pollution.
2520.86s - 2529.86s |  We check that org does not equal a proto and execute this code only for that.
2529.86s - 2532.86s |  It cannot lead to prototype pollution.
2532.86s - 2539.86s |  But we can combine these two code snippets.
2539.86s - 2546.86s |  So it's absolutely safe code separately from this one.
2546.86s - 2549.86s |  But what we can do together with these components?
2549.86s - 2552.86s |  First of all, we need to pollute the prototype.
2552.86s - 2560.86s |  We add a runner with a value of empty array in the prototype to trigger handle update.
2560.86s - 2562.86s |  Good.
2562.86s - 2574.42s |  After that, we trigger this save function with org that has a runner value.
2574.42s - 2580.42s |  It means we will try to read the runner from the prototype at this step.
2580.42s - 2583.42s |  And we pollute the runner after that.
2583.42s - 2589.42s |  We can't feel any additional properties in the runner.
2589.42s - 2591.42s |  By this call and the second call.
2591.42s - 2595.42s |  And after that, we trigger backup handler.
2595.42s - 2601.42s |  It gives us the remote code execution again by this chain of the calls.
2602.42s - 2606.42s |  The web request that triggers such functions.
2606.42s - 2611.42s |  If you think that it's unlikely that we find some fixed prototype pollution case
2611.42s - 2616.42s |  and unfixed prototype pollution case in the same application,
2616.42s - 2619.42s |  I can say to you that, for example,
2619.42s - 2628.42s |  merge functions are very typical in the fixed prototype pollutions.
2628.42s - 2638.42s |  A merge function of the very popular package lodash allows us to pollute a runner with such payload.
2638.42s - 2643.42s |  And you can find lodash merge calls in many applications.
2643.42s - 2647.42s |  And that's important that these two parts can be unrelated.
2647.42s - 2655.42s |  It could be absolutely different features in the application.
2656.42s - 2660.42s |  Use it for fun and bounces.
2660.42s - 2667.42s |  In conclusion, in this talk, I wanted to show the cases that look unexploitable.
2667.42s - 2670.42s |  And say, don't give up.
2670.42s - 2676.42s |  Try to achieve remote code execution even when it looks impossible.
2676.42s - 2681.42s |  If you're interested in prototype pollution research, check out our papers.
2681.42s - 2685.42s |  SilentSpring, G-Hunter and Dusty that I mentioned in the talk.
2685.42s - 2692.42s |  Check out the collection of server-side prototype pollution gadgets that we shared.
2692.42s - 2701.42s |  This is a gadget in Node.js itself and Deno and NPM packages that I also use in my bug bounty cases.
2701.42s - 2709.42s |  If you're interested in networking attacks and this story about ARP spoofing,
2709.42s - 2712.42s |  I highly recommend to read this blog post.
2712.42s - 2717.42s |  ARP spoofing in Kubernetes is not so easy as it looks like.
2717.42s - 2726.42s |  It also has some difficulties with IP table rules that was bypassed by this talk.
2726.42s - 2729.42s |  Check out this blog post.
2729.42s - 2731.42s |  I think you'll enjoy it.
2731.42s - 2737.42s |  And follow me on Twitter if you're interested in some details of code reuse attacks.
2737.42s - 2742.42s |  I want to share some findings that I am now including in my thesis.
2742.42s - 2746.42s |  And thank you for your attention.
2746.42s - 2748.42s |  Enjoy DEF CON.
2748.42s - 2749.42s |  Bye-bye.


