# MediaChunks

chunk_id: 175_chunk_57
chunk_text:
are something that you have to understand and think about. Um 2781.70s - 2787.44s | there's new acts and new legislation out there. Like palm oil and such that we have to worry 2787.44s - 2792.54s | about. But as you probably know the more you push researchers and say you can't do 2792.58s - 2796.62s | something the more likely they're going to go unethical route and sell it on the dark net and 2796.62s - 2803.08s | make money that way. So mitigations are uh a real thing. They're hard but they're not going 2803.08s - 2806.66s | away and you just have to deal with it. And they're how you have to think about it as if 2806.66s - 2812.96s | there's always a way around it. And the prize will continue to grow. What was $10,000 is 2812.96s - 2818.90s | $500,000 now. So it is worth your time putting months into research. So references and 2818.90s - 2823.10s | thanks. I there's always more people than I can remember to thank but lots of researchers 2823.10s - 2826.34s | out there in the past. Uh Jeremy Tinder just a shout out to him for getting me those 2826.34s - 2830.38s | Microsoft documents or those updated charts which is cool. Brad Spangler helped me out 2830.38s - 2833.88s | with going over some things so I'm not going to go through everyone. Harun Mir is the 2833.88s - 2838.92s | individual I said that did a talk from 2010 that went through every single mitigation that 2838.92s - 2843.52s | ever came out. It's a beautiful document. Definitely check that one out. And a lot of 2843.52s - 2848.16s | other folks as well. Thanks to Def Con for selecting a talk. That is it. I think I'm right 2848.16s - 2851.46s | on time here. I'm happy to you know chat out in the hall because I know I got to make 2851.46s - 2854.96s | way if you have any questions. But thank you so much for coming to my talk. I really appreciate 2854.96s - 2855.00s | it.


chunk_id: 175_chunk_58
chunk_text:
me those 2826.34s - 2830.38s | Microsoft documents or those updated charts which is cool. Brad Spangler helped me out 2830.38s - 2833.88s | with going over some things so I'm not going to go through everyone. Harun Mir is the 2833.88s - 2838.92s | individual I said that did a talk from 2010 that went through every single mitigation that 2838.92s - 2843.52s | ever came out. It's a beautiful document. Definitely check that one out. And a lot of 2843.52s - 2848.16s | other folks as well. Thanks to Def Con for selecting a talk. That is it. I think I'm right 2848.16s - 2851.46s | on time here. I'm happy to you know chat out in the hall because I know I got to make 2851.46s - 2854.96s | way if you have any questions. But thank you so much for coming to my talk. I really appreciate 2854.96s - 2855.00s | it.


chunk_id: 176_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=T5K4ABfzkhI", "title": "DEF CON 32 - Behind Enemy Lines: Engaging and Disrupting Ransomware Web Panel - Vangelis Stykas", "description": "Ransomware groups have become notably proficient at wreaking havoc across various sectors , but we can turn the tables. However, a less explored avenue in the fight against these digital adversaries lies in the proactive offense against their web panels. In this presentation, I will delve into the strategies and methodologies for infiltrating and commandeering the web panels used by ransomware groups to manage their malicious operations or the APIs used during their initial exfiltration of data.\n\nI will demonstrate how to leverage these vulnerabilities to gain unauthorized access to the ransomware groups' web panels. This access not only disrupts their operations but also opens a window to gather intelligence and potentially identify the operators behind those APTs. Let\u2019s explore the frontiers of cyber offense, targeting the very command and control (C2) centers ransomware groups rely on, turning the tables in our ongoing battle against cyber threats, it\u2019s our turn to wreak havoc.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2338, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 3.09s - 12.09s | This text was transcribed using whisper model: large-v2 Hello Deftone. First of all, if anyone does not want to be photographed, I'm going to take two pictures. 12.09s - 28.42s | That's for my mom. She never believes that anyone comes and hears me talking. 28.42s - 34.75s | That says a lot about her trust issues, but yeah. 34.75s - 42.75s | So, hello everyone and welcome to my talk, Behind Enemy Lines, Engaging and Disrupting ransomware web panels. 45.61s - 50.61s | This talk is PG-17 due to two reasons. 50.61s - 60.61s | First, there are going to be some notions about drugs and bad words from people in the talk. 60.61s - 68.61s | And secondly, I love saying fuck and shit, and I'm not going to stop it. 71.34s - 74.34s | Hello all. As you can see, I'm Vangelis Stikas. 74.34s - 80.34s | I'm the CTO and co-founder of a penetration testing firm called Atropos. 80.34s - 90.34s | We specialize in API penetration testing and green PV and electronic vehicle chargers penetration testing. 90.34s - 99.34s | My research interest for the past decade is API security and for the past couple of years, malware and ransomware situation. 99.34s - 114.61s | How everything


chunk_id: 176_chunk_1
chunk_text:
all, if anyone does not want to be photographed, I'm going to take two pictures. 12.09s - 28.42s | That's for my mom. She never believes that anyone comes and hears me talking. 28.42s - 34.75s | That says a lot about her trust issues, but yeah. 34.75s - 42.75s | So, hello everyone and welcome to my talk, Behind Enemy Lines, Engaging and Disrupting ransomware web panels. 45.61s - 50.61s | This talk is PG-17 due to two reasons. 50.61s - 60.61s | First, there are going to be some notions about drugs and bad words from people in the talk. 60.61s - 68.61s | And secondly, I love saying fuck and shit, and I'm not going to stop it. 71.34s - 74.34s | Hello all. As you can see, I'm Vangelis Stikas. 74.34s - 80.34s | I'm the CTO and co-founder of a penetration testing firm called Atropos. 80.34s - 90.34s | We specialize in API penetration testing and green PV and electronic vehicle chargers penetration testing. 90.34s - 99.34s | My research interest for the past decade is API security and for the past couple of years, malware and ransomware situation. 99.34s - 114.61s | How everything started. So, I don't know who of you were here last DEF CON, but I did a pretty similar talk about malware C2s, which was really, really easy. 114.61s - 122.61s | So, I wanted a bigger challenge and the main question in here is, could it be any harder? 125.72s - 132.72s | Markus Hatzins, I think you all know who he is, said that cyber threat intelligence is such a white industry. 132.72s - 143.72s | In contrast to the actual intelligence, which is a monopoly of the governments, there is the CTI. 143.72s - 153.72s | There is just some random dude named Brad who got really baked one night and yellowed his way into a major APT's backend server. 153.72s - 159.72s | Two issues in here. I'm going to start with the one that has legal implications. 159.72s - 168.18s | Who the fuck named his son Brad? I'm not Brad, I'm Vangelis. 168.18s - 180.18s | And secondly, I don't take drugs. I do like my occasional alcohol, but I also have three really strange people in the signal chat. 181.18s - 186.18s | If you want to drop them a follow on Twitter,


chunk_id: 176_chunk_2
chunk_text:
started. So, I don't know who of you were here last DEF CON, but I did a pretty similar talk about malware C2s, which was really, really easy. 114.61s - 122.61s | So, I wanted a bigger challenge and the main question in here is, could it be any harder? 125.72s - 132.72s | Markus Hatzins, I think you all know who he is, said that cyber threat intelligence is such a white industry. 132.72s - 143.72s | In contrast to the actual intelligence, which is a monopoly of the governments, there is the CTI. 143.72s - 153.72s | There is just some random dude named Brad who got really baked one night and yellowed his way into a major APT's backend server. 153.72s - 159.72s | Two issues in here. I'm going to start with the one that has legal implications. 159.72s - 168.18s | Who the fuck named his son Brad? I'm not Brad, I'm Vangelis. 168.18s - 180.18s | And secondly, I don't take drugs. I do like my occasional alcohol, but I also have three really strange people in the signal chat. 181.18s - 186.18s | If you want to drop them a follow on Twitter, Twitter, no text, fuck Elon Musk. 186.18s - 195.18s | First is Solfer, my really good friend and pretty much partner in all my research and the main person to blame. 196.18s - 210.18s | My second person is Iskuri, who is a legendary DEF CON, multiple times DEF CON and Black Hat speaker and a person who hacks bootloaders for fun. 210.18s - 222.18s | And third one is No Thanks. He's a super ninja hacker, multiple times DEF CON speaker too, and a really good artist. 222.18s - 229.18s | So all three of them were trying to poke me around to start going after ransomware. 229.18s - 239.00s | A couple of minutes ago, I asked how much more difficult it would be. 239.00s - 252.00s | For the malwares, in the past couple of years, I have been able to pawn or gain access to pretty much 50% of all the bundles that I have seen. 252.00s - 257.00s | So it's 18 out of 36. For the ransomware, it's quite difficult. 257.00s - 266.00s | So I only was able to get access to three and a half out of 140 that I have tested.


chunk_id: 176_chunk_3
chunk_text:
Twitter, no text, fuck Elon Musk. 186.18s - 195.18s | First is Solfer, my really good friend and pretty much partner in all my research and the main person to blame. 196.18s - 210.18s | My second person is Iskuri, who is a legendary DEF CON, multiple times DEF CON and Black Hat speaker and a person who hacks bootloaders for fun. 210.18s - 222.18s | And third one is No Thanks. He's a super ninja hacker, multiple times DEF CON speaker too, and a really good artist. 222.18s - 229.18s | So all three of them were trying to poke me around to start going after ransomware. 229.18s - 239.00s | A couple of minutes ago, I asked how much more difficult it would be. 239.00s - 252.00s | For the malwares, in the past couple of years, I have been able to pawn or gain access to pretty much 50% of all the bundles that I have seen. 252.00s - 257.00s | So it's 18 out of 36. For the ransomware, it's quite difficult. 257.00s - 266.00s | So I only was able to get access to three and a half out of 140 that I have tested. 266.00s - 276.34s | Quick intro. That's the only intro. Ransomware is a type of malicious software that threatens to publish or block access until the blah, blah, blah. 276.34s - 280.34s | If you don't know what the ransomware is, go somewhere else. 281.34s - 287.23s | How ransomware hacks work, there's a step-by-step process. 287.23s - 297.23s | One is they somehow get access and distribute their malware and infect an internal user. 297.23s - 301.23s | The second step is getting access to command and control C2s. 301.23s - 305.23s | Then they do the discovery and lateral movement. 305.23s - 309.23s | The data extraction, so they're extracting all the data. 309.23s - 313.23s | Data encryption, which means you have lost all your data. 313.23s - 319.23s | Then there is extortion, so what we're going to see there are three or four ways of extortion. 319.23s - 325.23s | And then there is resolution, however you resolve that issue. 329.61s - 336.61s | That slide is going to seem like I'm pitching you on how good ransomware market is. 336.61s - 338.61s | I'm not. 338.61s - 340.61s | I fucking hate them. 340.61s


chunk_id: 176_chunk_4
chunk_text:
266.00s - 276.34s | Quick intro. That's the only intro. Ransomware is a type of malicious software that threatens to publish or block access until the blah, blah, blah. 276.34s - 280.34s | If you don't know what the ransomware is, go somewhere else. 281.34s - 287.23s | How ransomware hacks work, there's a step-by-step process. 287.23s - 297.23s | One is they somehow get access and distribute their malware and infect an internal user. 297.23s - 301.23s | The second step is getting access to command and control C2s. 301.23s - 305.23s | Then they do the discovery and lateral movement. 305.23s - 309.23s | The data extraction, so they're extracting all the data. 309.23s - 313.23s | Data encryption, which means you have lost all your data. 313.23s - 319.23s | Then there is extortion, so what we're going to see there are three or four ways of extortion. 319.23s - 325.23s | And then there is resolution, however you resolve that issue. 329.61s - 336.61s | That slide is going to seem like I'm pitching you on how good ransomware market is. 336.61s - 338.61s | I'm not. 338.61s - 340.61s | I fucking hate them. 340.61s - 342.61s | They fucking hate me. 342.61s - 345.61s | But I want to say some good stuff about them. 345.61s - 348.61s | It's the fastest growing type of cybercrime. 348.61s - 354.61s | Their payout broke the limit of 1 billion last year. 354.61s - 356.61s | They hit 1.1 billion. 356.61s - 359.61s | It's a highly professional industry. 359.61s - 363.61s | It seems that the boundaries here are falling off. 363.61s - 370.61s | So they're after hospitals, critical national infrastructure, and pretty much everything else. 370.61s - 375.61s | And WannaCry opened the kind of forms that we cannot close. 375.61s - 379.61s | Again, this slide too, I fucking hate them. 379.61s - 381.61s | The gangs are highly hierarchical. 381.61s - 385.61s | We expect that it's a criminal rig. 385.61s - 387.61s | They have a clear structure. 387.61s - 390.61s | The first part is obviously the tech part that we're going to see later on. 390.61s - 396.61s | But they also have ransomware negotiators and customer support, as pretty much any company has. 396.61s - 402.61s | Money launderers and payment processing, because as we saw, they're


chunk_id: 176_chunk_5
chunk_text:
- 342.61s | They fucking hate me. 342.61s - 345.61s | But I want to say some good stuff about them. 345.61s - 348.61s | It's the fastest growing type of cybercrime. 348.61s - 354.61s | Their payout broke the limit of 1 billion last year. 354.61s - 356.61s | They hit 1.1 billion. 356.61s - 359.61s | It's a highly professional industry. 359.61s - 363.61s | It seems that the boundaries here are falling off. 363.61s - 370.61s | So they're after hospitals, critical national infrastructure, and pretty much everything else. 370.61s - 375.61s | And WannaCry opened the kind of forms that we cannot close. 375.61s - 379.61s | Again, this slide too, I fucking hate them. 379.61s - 381.61s | The gangs are highly hierarchical. 381.61s - 385.61s | We expect that it's a criminal rig. 385.61s - 387.61s | They have a clear structure. 387.61s - 390.61s | The first part is obviously the tech part that we're going to see later on. 390.61s - 396.61s | But they also have ransomware negotiators and customer support, as pretty much any company has. 396.61s - 402.61s | Money launderers and payment processing, because as we saw, they're processing 1.1 billion per year. 402.61s - 410.86s | And collaboration and partnerships, because why not partner with a ransomware, right? 410.86s - 412.86s | The tech part. 412.86s - 416.86s | They have several specific and special users. 416.86s - 418.86s | One is the malware developers. 418.86s - 420.86s | I'm not going to explain what it is. 420.86s - 425.86s | Exploitation developers who are possibly developing either zero day or end day. 425.86s - 428.86s | They have special people for data theft and leaks. 428.86s - 430.86s | They have people for operational security. 430.86s - 434.86s | And last but not least, and usually we don't know about that, 434.86s - 437.86s | they have really good people on infrastructure and hosting. 437.86s - 442.86s | And that makes sense, because imagine owning a unicorn company, 442.86s - 447.86s | extracting half a terabyte of data and not being able to process it 447.86s - 451.86s | because your infrastructure or hosting was bad enough. 451.86s - 456.52s | Let's move to the ransomware models. 456.52s - 458.52s | First of all, there were lone wolves. 458.52s - 461.52s | At some point, right


chunk_id: 176_chunk_6
chunk_text:
processing 1.1 billion per year. 402.61s - 410.86s | And collaboration and partnerships, because why not partner with a ransomware, right? 410.86s - 412.86s | The tech part. 412.86s - 416.86s | They have several specific and special users. 416.86s - 418.86s | One is the malware developers. 418.86s - 420.86s | I'm not going to explain what it is. 420.86s - 425.86s | Exploitation developers who are possibly developing either zero day or end day. 425.86s - 428.86s | They have special people for data theft and leaks. 428.86s - 430.86s | They have people for operational security. 430.86s - 434.86s | And last but not least, and usually we don't know about that, 434.86s - 437.86s | they have really good people on infrastructure and hosting. 437.86s - 442.86s | And that makes sense, because imagine owning a unicorn company, 442.86s - 447.86s | extracting half a terabyte of data and not being able to process it 447.86s - 451.86s | because your infrastructure or hosting was bad enough. 451.86s - 456.52s | Let's move to the ransomware models. 456.52s - 458.52s | First of all, there were lone wolves. 458.52s - 461.52s | At some point, right now, they're no longer it. 461.52s - 465.52s | Those were single people who were doing everything. 465.52s - 469.52s | Initial access brokers are a special way of ransomware groups. 469.52s - 474.52s | There are people who specialize in just that, initial access, 474.52s - 477.52s | getting it and then selling it to other ransomware groups. 477.52s - 481.52s | Only one ransomware groups, which is from start to finish, 481.52s - 484.52s | everything done by them. 484.52s - 490.52s | And ransomware as a service, which you could consider it as software as a service 490.52s - 496.52s | or as I like to say, ransomware meets capitalism. 496.52s - 501.12s | How ransomware as a service are being paid? 501.12s - 505.12s | Flat monthly fee, affiliate programs with a monthly percent of the profits, 505.12s - 507.12s | one-time license. 507.12s - 512.12s | This is not as a service, just saying, but they do advertise that. 512.12s - 517.12s | Pure profit sharing, payments made to the RAS, 517.12s - 524.12s | and then they give their affiliate, not me, a part of the profits. 524.12s - 529.12s | And the most


chunk_id: 176_chunk_7
chunk_text:
now, they're no longer it. 461.52s - 465.52s | Those were single people who were doing everything. 465.52s - 469.52s | Initial access brokers are a special way of ransomware groups. 469.52s - 474.52s | There are people who specialize in just that, initial access, 474.52s - 477.52s | getting it and then selling it to other ransomware groups. 477.52s - 481.52s | Only one ransomware groups, which is from start to finish, 481.52s - 484.52s | everything done by them. 484.52s - 490.52s | And ransomware as a service, which you could consider it as software as a service 490.52s - 496.52s | or as I like to say, ransomware meets capitalism. 496.52s - 501.12s | How ransomware as a service are being paid? 501.12s - 505.12s | Flat monthly fee, affiliate programs with a monthly percent of the profits, 505.12s - 507.12s | one-time license. 507.12s - 512.12s | This is not as a service, just saying, but they do advertise that. 512.12s - 517.12s | Pure profit sharing, payments made to the RAS, 517.12s - 524.12s | and then they give their affiliate, not me, a part of the profits. 524.12s - 529.12s | And the most well-known were Lockbit, Blackcat, Clop, and some more. 529.12s - 536.12s | This is my only try of being a graphic designer. 536.12s - 538.12s | You see I'm not good. 538.12s - 541.12s | So we are going after the C2 server. 541.12s - 543.12s | As we can see, there's the user, there's the cloud, 543.12s - 549.12s | and there is the hacker slash ransomware on the top with the red. 549.12s - 553.12s | Can anyone guess why he's the hacker? 553.12s - 555.12s | No one? 555.12s - 557.12s | He's wearing a hoodie, guys. 557.12s - 559.12s | If you wear a hoodie, you're a hacker. 559.12s - 560.12s | You should know that. 560.12s - 564.40s | You're DEF CON for fuck's sake. 564.40s - 565.40s | The extortion, how they do. 565.40s - 569.40s | They establish communications with victim with multiple ways, 569.40s - 574.40s | talks, telegram, email, or some internal web panels. 574.40s - 575.40s | Keep that in mind. 575.40s - 577.40s | You're going to see one. 577.40s - 582.40s | They lay their terms and then they extort victims in multiple ways. 582.40s - 585.40s |


chunk_id: 176_chunk_8
chunk_text:
well-known were Lockbit, Blackcat, Clop, and some more. 529.12s - 536.12s | This is my only try of being a graphic designer. 536.12s - 538.12s | You see I'm not good. 538.12s - 541.12s | So we are going after the C2 server. 541.12s - 543.12s | As we can see, there's the user, there's the cloud, 543.12s - 549.12s | and there is the hacker slash ransomware on the top with the red. 549.12s - 553.12s | Can anyone guess why he's the hacker? 553.12s - 555.12s | No one? 555.12s - 557.12s | He's wearing a hoodie, guys. 557.12s - 559.12s | If you wear a hoodie, you're a hacker. 559.12s - 560.12s | You should know that. 560.12s - 564.40s | You're DEF CON for fuck's sake. 564.40s - 565.40s | The extortion, how they do. 565.40s - 569.40s | They establish communications with victim with multiple ways, 569.40s - 574.40s | talks, telegram, email, or some internal web panels. 574.40s - 575.40s | Keep that in mind. 575.40s - 577.40s | You're going to see one. 577.40s - 582.40s | They lay their terms and then they extort victims in multiple ways. 582.40s - 585.40s | There are four ways of extorting people. 585.40s - 587.40s | The first is ransomware data. 587.40s - 589.40s | So they have encrypted their data. 589.40s - 595.40s | So they're wanting the money to decrypt data. 595.40s - 599.40s | This was easily fell over 599.40s - 606.40s | because now pretty much everyone has a proper backup system, I hope. 606.40s - 609.40s | Then the second part where the second level of extortion 609.40s - 611.40s | was releasing data to the public. 611.40s - 613.40s | So extorting the people that we have your data, 613.40s - 615.40s | we're going to release it on the public. 615.40s - 619.40s | The third was DDoS with knowledge obtained from data. 619.40s - 625.40s | And fourth was communicate with people that were the victim's customers 625.40s - 627.40s | or even the LEA. 627.40s - 634.40s | We have seen in 2024 a lot of groups going to the LEIA 634.40s - 638.40s | and saying that this company was hacked and they did not report it. 640.74s - 643.74s | So let's set some goals. 643.74s - 648.74s | First, we want to identify


chunk_id: 176_chunk_9
chunk_text:
There are four ways of extorting people. 585.40s - 587.40s | The first is ransomware data. 587.40s - 589.40s | So they have encrypted their data. 589.40s - 595.40s | So they're wanting the money to decrypt data. 595.40s - 599.40s | This was easily fell over 599.40s - 606.40s | because now pretty much everyone has a proper backup system, I hope. 606.40s - 609.40s | Then the second part where the second level of extortion 609.40s - 611.40s | was releasing data to the public. 611.40s - 613.40s | So extorting the people that we have your data, 613.40s - 615.40s | we're going to release it on the public. 615.40s - 619.40s | The third was DDoS with knowledge obtained from data. 619.40s - 625.40s | And fourth was communicate with people that were the victim's customers 625.40s - 627.40s | or even the LEA. 627.40s - 634.40s | We have seen in 2024 a lot of groups going to the LEIA 634.40s - 638.40s | and saying that this company was hacked and they did not report it. 640.74s - 643.74s | So let's set some goals. 643.74s - 648.74s | First, we want to identify all the C2s and data leak sites. 648.74s - 652.74s | Try to find any vulnerabilities, and I mean any vulnerabilities. 652.74s - 654.74s | Identify any people behind them. 654.74s - 658.74s | Try to disrupt panels and threat actors. 658.74s - 661.74s | And the three last ones are really, really important. 661.74s - 666.74s | Do not disrupt with any active LEA investigation. 666.74s - 670.74s | Don't be a malakas, and don't get vanned. 670.74s - 675.74s | So those two, the last are my motto for the past couple of years. 675.74s - 676.74s | I have them as stickers. 676.74s - 678.74s | If you want them, come ask for them. 678.74s - 684.74s | So the past couple of years, I have been joking around 684.74s - 687.74s | that I will be vanned, which was mostly a joke 687.74s - 692.74s | and a tongue in the cheek thing. 692.74s - 697.74s | But right now, I'm trying to disrupt criminal rigs 697.74s - 705.74s | that handle more or less tens of millions of dollars, 705.74s - 707.74s | and they are criminal rigs. 707.74s - 716.74s | So this is


chunk_id: 176_chunk_10
chunk_text:
all the C2s and data leak sites. 648.74s - 652.74s | Try to find any vulnerabilities, and I mean any vulnerabilities. 652.74s - 654.74s | Identify any people behind them. 654.74s - 658.74s | Try to disrupt panels and threat actors. 658.74s - 661.74s | And the three last ones are really, really important. 661.74s - 666.74s | Do not disrupt with any active LEA investigation. 666.74s - 670.74s | Don't be a malakas, and don't get vanned. 670.74s - 675.74s | So those two, the last are my motto for the past couple of years. 675.74s - 676.74s | I have them as stickers. 676.74s - 678.74s | If you want them, come ask for them. 678.74s - 684.74s | So the past couple of years, I have been joking around 684.74s - 687.74s | that I will be vanned, which was mostly a joke 687.74s - 692.74s | and a tongue in the cheek thing. 692.74s - 697.74s | But right now, I'm trying to disrupt criminal rigs 697.74s - 705.74s | that handle more or less tens of millions of dollars, 705.74s - 707.74s | and they are criminal rigs. 707.74s - 716.74s | So this is no longer a joke, but an actual probable risk for me. 716.74s - 724.74s | So this last night, when someone tried to enter my room by wrong, 724.74s - 727.74s | I literally thought that I was getting vanned. 727.74s - 730.74s | This is not funny. 730.74s - 737.74s | A more probable situation, though, is me waking up again with this message. 737.74s - 743.74s | I don't know how many of you have woken up with this kind of message, 743.74s - 748.74s | whether on your Google account or your iPhone. 748.74s - 750.74s | But when you wake up and you see that government-backed attackers 750.74s - 757.12s | may be trying to steal your password, you are freaked out. 757.12s - 761.12s | So I'm going to say it here in DEF CON. 761.12s - 763.12s | I also said it on Black Hat a couple of days ago. 763.12s - 768.12s | If anyone wants to burn his one million zero day 768.12s - 772.12s | to get access to my email or my phone, 772.12s - 775.12s | I'm going to delete the photos from my kids 775.12s - 781.82s |


chunk_id: 176_chunk_11
chunk_text:
no longer a joke, but an actual probable risk for me. 716.74s - 724.74s | So this last night, when someone tried to enter my room by wrong, 724.74s - 727.74s | I literally thought that I was getting vanned. 727.74s - 730.74s | This is not funny. 730.74s - 737.74s | A more probable situation, though, is me waking up again with this message. 737.74s - 743.74s | I don't know how many of you have woken up with this kind of message, 743.74s - 748.74s | whether on your Google account or your iPhone. 748.74s - 750.74s | But when you wake up and you see that government-backed attackers 750.74s - 757.12s | may be trying to steal your password, you are freaked out. 757.12s - 761.12s | So I'm going to say it here in DEF CON. 761.12s - 763.12s | I also said it on Black Hat a couple of days ago. 763.12s - 768.12s | If anyone wants to burn his one million zero day 768.12s - 772.12s | to get access to my email or my phone, 772.12s - 775.12s | I'm going to delete the photos from my kids 775.12s - 781.82s | and give him my phone for just 100K plus VAT. 781.82s - 787.22s | There's no reason to burn your zero day for me. 787.22s - 795.22s | I want to state again that I had really low expectations into finding anything, 795.22s - 800.22s | and I didn't find as much as I would want. 800.22s - 803.22s | How did I identify pandemics? 803.22s - 809.22s | Those really nice people that are doing CTI, I'm not a CTI expert. 809.22s - 814.22s | I'm just a random guy who Googles and doing scrolls on Twitter. 814.22s - 820.22s | So I use Ransomlook.io, Ransomwave, Ransomware.live, 820.22s - 823.22s | the deep dark CTI on GitHub, 823.22s - 826.22s | and lots and I mean lots of doing scrolling 826.22s - 831.82s | and monitoring CTI companies for new posts. 832.82s - 837.82s | Research had certain limitations that I knew from the beginning. 837.82s - 840.82s | The C2s had a terribly small lifetime 840.82s - 847.82s | because they were live only during the actual phase of being of the ponies. 847.82s - 850.82s | And they're also really difficult to find 850.82s - 853.82s |


chunk_id: 176_chunk_12
chunk_text:
and give him my phone for just 100K plus VAT. 781.82s - 787.22s | There's no reason to burn your zero day for me. 787.22s - 795.22s | I want to state again that I had really low expectations into finding anything, 795.22s - 800.22s | and I didn't find as much as I would want. 800.22s - 803.22s | How did I identify pandemics? 803.22s - 809.22s | Those really nice people that are doing CTI, I'm not a CTI expert. 809.22s - 814.22s | I'm just a random guy who Googles and doing scrolls on Twitter. 814.22s - 820.22s | So I use Ransomlook.io, Ransomwave, Ransomware.live, 820.22s - 823.22s | the deep dark CTI on GitHub, 823.22s - 826.22s | and lots and I mean lots of doing scrolling 826.22s - 831.82s | and monitoring CTI companies for new posts. 832.82s - 837.82s | Research had certain limitations that I knew from the beginning. 837.82s - 840.82s | The C2s had a terribly small lifetime 840.82s - 847.82s | because they were live only during the actual phase of being of the ponies. 847.82s - 850.82s | And they're also really difficult to find 850.82s - 853.82s | because all the CTIs companies will keep them for themselves, 853.82s - 858.82s | obviously, and not going to post an active threat. 858.82s - 863.82s | The data link sites are very, very well looked after, 863.82s - 866.82s | and they're also behind Tor and Onion. 866.82s - 872.82s | So it gives an extra obstacle that I would have to bypass 872.82s - 874.82s | in order to get to them and test them. 874.82s - 880.49s | My methodology is quite straightforward. 880.49s - 884.49s | I'm going to ignore malware distribution and reversing. 884.49s - 888.49s | First, because I'm a singleton and I don't understand reversing. 888.49s - 892.49s | This is mostly because I'm, as I said, a singleton, 892.49s - 897.49s | and two, because I hate assembly due to my college years 897.49s - 902.49s | and a certain person who tried to teach me. 902.49s - 905.49s | I would just run the malware in a sandbox, 905.49s - 907.49s | extract all the URLs, 907.49s - 911.49s | and use data link URLs found via CTI or other means. 911.49s - 919.86s | And then I will introduce you


chunk_id: 176_chunk_13
chunk_text:
because all the CTIs companies will keep them for themselves, 853.82s - 858.82s | obviously, and not going to post an active threat. 858.82s - 863.82s | The data link sites are very, very well looked after, 863.82s - 866.82s | and they're also behind Tor and Onion. 866.82s - 872.82s | So it gives an extra obstacle that I would have to bypass 872.82s - 874.82s | in order to get to them and test them. 874.82s - 880.49s | My methodology is quite straightforward. 880.49s - 884.49s | I'm going to ignore malware distribution and reversing. 884.49s - 888.49s | First, because I'm a singleton and I don't understand reversing. 888.49s - 892.49s | This is mostly because I'm, as I said, a singleton, 892.49s - 897.49s | and two, because I hate assembly due to my college years 897.49s - 902.49s | and a certain person who tried to teach me. 902.49s - 905.49s | I would just run the malware in a sandbox, 905.49s - 907.49s | extract all the URLs, 907.49s - 911.49s | and use data link URLs found via CTI or other means. 911.49s - 919.86s | And then I will introduce you to a newer Toyota Corolla. 919.86s - 922.86s | The Toyota Corolla of security testing, 922.86s - 926.86s | also known as web application penetration testing, 926.86s - 929.86s | will get you from place A to place B. 929.86s - 932.86s | It's not sexy. It's not nice. 932.86s - 934.86s | But by getting you from A to B, 934.86s - 939.86s | it will probably also give you some info about ransomware groups 939.86s - 941.86s | and potentially a couple of RCs. 941.86s - 945.50s | Methodology. 945.50s - 946.50s | Boring stuff, but I have to say, 946.50s - 951.50s | because those tools literally made the whole research. 951.50s - 953.50s | Dirsearch for the win. 953.50s - 954.50s | FFUF. 954.50s - 955.50s | Burpsuit. 955.50s - 958.50s | The trifecta of Tor, which is Tor Expert Bundle, 958.50s - 960.50s | Tor Browser, and Tor Socks, 960.50s - 963.50s | which greatly helps to run any other tool. 963.50s - 964.50s | Coffee. 964.50s - 966.50s | And I mean a lot of coffee. 966.50s - 968.50s | Anyrun for running all the malwares. 968.50s - 970.50s | Several droplets on DigitalOcean,


chunk_id: 176_chunk_14
chunk_text:
to a newer Toyota Corolla. 919.86s - 922.86s | The Toyota Corolla of security testing, 922.86s - 926.86s | also known as web application penetration testing, 926.86s - 929.86s | will get you from place A to place B. 929.86s - 932.86s | It's not sexy. It's not nice. 932.86s - 934.86s | But by getting you from A to B, 934.86s - 939.86s | it will probably also give you some info about ransomware groups 939.86s - 941.86s | and potentially a couple of RCs. 941.86s - 945.50s | Methodology. 945.50s - 946.50s | Boring stuff, but I have to say, 946.50s - 951.50s | because those tools literally made the whole research. 951.50s - 953.50s | Dirsearch for the win. 953.50s - 954.50s | FFUF. 954.50s - 955.50s | Burpsuit. 955.50s - 958.50s | The trifecta of Tor, which is Tor Expert Bundle, 958.50s - 960.50s | Tor Browser, and Tor Socks, 960.50s - 963.50s | which greatly helps to run any other tool. 963.50s - 964.50s | Coffee. 964.50s - 966.50s | And I mean a lot of coffee. 966.50s - 968.50s | Anyrun for running all the malwares. 968.50s - 970.50s | Several droplets on DigitalOcean, 970.50s - 972.50s | because, as I said, they had a lot of operation security, 972.50s - 975.50s | so I was getting banned en masse. 975.50s - 977.50s | So done ION Census, 977.50s - 983.50s | so that you could potentially find websites outside of Tor. 983.50s - 985.50s | And did I mention coffee? 985.50s - 987.50s | I mean lots of coffee. 987.50s - 992.67s | How I'm going to approach the whole thing. 992.67s - 994.67s | Black box web application testing. 994.67s - 998.67s | Use any acquired information for furthering my attacks. 998.67s - 1001.67s | Interact with data leaks and chat websites. 1001.67s - 1003.67s | Intentionally infect sandbox 1003.67s - 1005.67s | so that I could get a ticket. 1005.67s - 1006.67s | And by ticket I mean, 1006.67s - 1010.67s | you're going to see later that all the chats wanted a ticket 1010.67s - 1014.67s | so that they can identify what company you were in. 1014.67s - 1019.34s | My first step was, as I did with malware, 1019.34s - 1022.34s | just blatantly run Dirsearch and FFUF 1022.34s - 1025.34s | with a custom word list through


chunk_id: 176_chunk_15
chunk_text:
970.50s - 972.50s | because, as I said, they had a lot of operation security, 972.50s - 975.50s | so I was getting banned en masse. 975.50s - 977.50s | So done ION Census, 977.50s - 983.50s | so that you could potentially find websites outside of Tor. 983.50s - 985.50s | And did I mention coffee? 985.50s - 987.50s | I mean lots of coffee. 987.50s - 992.67s | How I'm going to approach the whole thing. 992.67s - 994.67s | Black box web application testing. 994.67s - 998.67s | Use any acquired information for furthering my attacks. 998.67s - 1001.67s | Interact with data leaks and chat websites. 1001.67s - 1003.67s | Intentionally infect sandbox 1003.67s - 1005.67s | so that I could get a ticket. 1005.67s - 1006.67s | And by ticket I mean, 1006.67s - 1010.67s | you're going to see later that all the chats wanted a ticket 1010.67s - 1014.67s | so that they can identify what company you were in. 1014.67s - 1019.34s | My first step was, as I did with malware, 1019.34s - 1022.34s | just blatantly run Dirsearch and FFUF 1022.34s - 1025.34s | with a custom word list through Tor Socks. 1025.34s - 1027.34s | My results were disappointing. 1027.34s - 1031.34s | There were only 15 URLs that gave something interesting, 1031.34s - 1034.34s | which is not exactly interesting. 1034.34s - 1038.34s | Then I moved to manually check all of them. 1038.34s - 1041.34s | Five of them were WordPress. 1041.34s - 1044.34s | A couple of them were leaking IP addresses, 1044.34s - 1046.34s | and some of them were cheeky. 1046.34s - 1049.34s | And when I say cheeky, I mean really cheeky. 1049.34s - 1053.34s | So one of them told me to fuck off. 1053.34s - 1057.34s | The other one told me to use the N word. 1057.34s - 1060.34s | I'm not going to use it because I respect people. 1060.34s - 1064.34s | And the cheeky was Abish who said, 1064.34s - 1067.34s | just business, nothing personal. 1067.34s - 1070.34s | Keep that. 1070.34s - 1072.34s | So let's go. 1072.34s - 1076.34s | Much like Alice in Wonderland, 1076.34s - 1081.34s | let's take the little dumb bunny by hand 1081.34s - 1088.42s | and let's move inside ransomware land, shall we? 1088.42s - 1089.42s | First


chunk_id: 176_chunk_16
chunk_text:
Tor Socks. 1025.34s - 1027.34s | My results were disappointing. 1027.34s - 1031.34s | There were only 15 URLs that gave something interesting, 1031.34s - 1034.34s | which is not exactly interesting. 1034.34s - 1038.34s | Then I moved to manually check all of them. 1038.34s - 1041.34s | Five of them were WordPress. 1041.34s - 1044.34s | A couple of them were leaking IP addresses, 1044.34s - 1046.34s | and some of them were cheeky. 1046.34s - 1049.34s | And when I say cheeky, I mean really cheeky. 1049.34s - 1053.34s | So one of them told me to fuck off. 1053.34s - 1057.34s | The other one told me to use the N word. 1057.34s - 1060.34s | I'm not going to use it because I respect people. 1060.34s - 1064.34s | And the cheeky was Abish who said, 1064.34s - 1067.34s | just business, nothing personal. 1067.34s - 1070.34s | Keep that. 1070.34s - 1072.34s | So let's go. 1072.34s - 1076.34s | Much like Alice in Wonderland, 1076.34s - 1081.34s | let's take the little dumb bunny by hand 1081.34s - 1088.42s | and let's move inside ransomware land, shall we? 1088.42s - 1089.42s | First one is mallocs. 1089.42s - 1091.42s | I don't know who is familiar with that. 1091.42s - 1094.42s | They're also known as Target Company, Fargo, 1094.42s - 1097.42s | and Tonsomething. 1097.42s - 1098.42s | I cannot pronounce it. 1098.42s - 1101.42s | First appearance was of June 2021. 1101.42s - 1104.42s | They target mostly Windows machines 1104.42s - 1107.42s | and specifically MSSQL servers, 1107.42s - 1109.42s | the brute force SA accounts. 1109.42s - 1112.42s | Last year, they started using also some NDAs, 1112.42s - 1117.42s | and they are in the hundreds of victims. 1118.42s - 1122.42s | This is their index page of their data leaks. 1122.42s - 1125.42s | As you can see, they have a lot of victims. 1125.42s - 1130.42s | And the slash malloc slash private sign-in, 1130.42s - 1135.42s | they requested a private key so that I could chat with them. 1135.42s - 1139.42s | So I had to, as I said, infect something. 1139.42s - 1141.42s | I infected anyone. 1141.42s - 1143.42s | I got a key. 1145.76s - 1146.76s | Is it clear? 1146.76s - 1148.76s | I said, hello. 1148.76s - 1149.76s |


chunk_id: 176_chunk_17
chunk_text:
one is mallocs. 1089.42s - 1091.42s | I don't know who is familiar with that. 1091.42s - 1094.42s | They're also known as Target Company, Fargo, 1094.42s - 1097.42s | and Tonsomething. 1097.42s - 1098.42s | I cannot pronounce it. 1098.42s - 1101.42s | First appearance was of June 2021. 1101.42s - 1104.42s | They target mostly Windows machines 1104.42s - 1107.42s | and specifically MSSQL servers, 1107.42s - 1109.42s | the brute force SA accounts. 1109.42s - 1112.42s | Last year, they started using also some NDAs, 1112.42s - 1117.42s | and they are in the hundreds of victims. 1118.42s - 1122.42s | This is their index page of their data leaks. 1122.42s - 1125.42s | As you can see, they have a lot of victims. 1125.42s - 1130.42s | And the slash malloc slash private sign-in, 1130.42s - 1135.42s | they requested a private key so that I could chat with them. 1135.42s - 1139.42s | So I had to, as I said, infect something. 1139.42s - 1141.42s | I infected anyone. 1141.42s - 1143.42s | I got a key. 1145.76s - 1146.76s | Is it clear? 1146.76s - 1148.76s | I said, hello. 1148.76s - 1149.76s | Guy didn't respond. 1149.76s - 1153.76s | So I said again, hello. 1153.76s - 1154.76s | Nothing back. 1154.76s - 1156.76s | Sorry. 1156.76s - 1160.76s | I then decided to run Deer Search and FFUF. 1160.76s - 1164.76s | There was an Apache server status page exposed, 1164.76s - 1168.76s | which was leaking URLs, server IP addresses, 1168.76s - 1171.76s | and it was also leaking tokens to check other people's messages. 1171.76s - 1173.76s | But that was not fun enough. 1173.76s - 1178.84s | So can you see the whole thing? 1178.84s - 1183.84s | There is a button underneath my hello that says reply. 1183.84s - 1185.84s | This is the post message. 1185.84s - 1187.84s | It's practically a quote. 1187.84s - 1191.84s | Can anyone guess what the issue is in here? 1191.84s - 1194.44s | No? 1194.44s - 1196.75s | Okay. 1196.75s - 1200.75s | So there was an IDOR on reply ID parameter, 1200.75s - 1205.75s | which means I could quote pretty much any message in the world. 1206.75s - 1207.75s | In the server. 1207.75s - 1209.75s | The parameter was an incremental integer, 1209.75s - 1212.75s | so


chunk_id: 176_chunk_18
chunk_text:
Guy didn't respond. 1149.76s - 1153.76s | So I said again, hello. 1153.76s - 1154.76s | Nothing back. 1154.76s - 1156.76s | Sorry. 1156.76s - 1160.76s | I then decided to run Deer Search and FFUF. 1160.76s - 1164.76s | There was an Apache server status page exposed, 1164.76s - 1168.76s | which was leaking URLs, server IP addresses, 1168.76s - 1171.76s | and it was also leaking tokens to check other people's messages. 1171.76s - 1173.76s | But that was not fun enough. 1173.76s - 1178.84s | So can you see the whole thing? 1178.84s - 1183.84s | There is a button underneath my hello that says reply. 1183.84s - 1185.84s | This is the post message. 1185.84s - 1187.84s | It's practically a quote. 1187.84s - 1191.84s | Can anyone guess what the issue is in here? 1191.84s - 1194.44s | No? 1194.44s - 1196.75s | Okay. 1196.75s - 1200.75s | So there was an IDOR on reply ID parameter, 1200.75s - 1205.75s | which means I could quote pretty much any message in the world. 1206.75s - 1207.75s | In the server. 1207.75s - 1209.75s | The parameter was an incremental integer, 1209.75s - 1212.75s | so all I had to do was to take that post, 1212.75s - 1215.75s | write the Python script really badly, 1215.75s - 1221.75s | and do a for loop from one to, I don't know, 50 million, 1221.75s - 1223.75s | and export all the messages. 1223.75s - 1234.16s | That was also used for in-organization messages. 1234.16s - 1236.16s | So first there is the boss. 1236.16s - 1239.16s | Clearly a God complex. 1239.16s - 1241.16s | I work according to my own schedule, 1241.16s - 1243.16s | which does not change on anyone's request. 1243.16s - 1247.16s | As soon as I see the payment, I will send the decryptor. 1247.16s - 1250.16s | I have a well-maintained business, blah, blah. 1250.16s - 1255.16s | It will not be disturbed by any moron that could not secure their machines. 1255.16s - 1258.16s | Oh, the irony, right? 1258.16s - 1262.16s | And last one, I was on special key for a couple of days, 1262.16s - 1266.16s | so fuck off and do the work that I'm paying you to do. 1266.16s - 1268.16s | I don't know exactly what special key is, 1268.16s - 1271.16s |


chunk_id: 176_chunk_19
chunk_text:
all I had to do was to take that post, 1212.75s - 1215.75s | write the Python script really badly, 1215.75s - 1221.75s | and do a for loop from one to, I don't know, 50 million, 1221.75s - 1223.75s | and export all the messages. 1223.75s - 1234.16s | That was also used for in-organization messages. 1234.16s - 1236.16s | So first there is the boss. 1236.16s - 1239.16s | Clearly a God complex. 1239.16s - 1241.16s | I work according to my own schedule, 1241.16s - 1243.16s | which does not change on anyone's request. 1243.16s - 1247.16s | As soon as I see the payment, I will send the decryptor. 1247.16s - 1250.16s | I have a well-maintained business, blah, blah. 1250.16s - 1255.16s | It will not be disturbed by any moron that could not secure their machines. 1255.16s - 1258.16s | Oh, the irony, right? 1258.16s - 1262.16s | And last one, I was on special key for a couple of days, 1262.16s - 1266.16s | so fuck off and do the work that I'm paying you to do. 1266.16s - 1268.16s | I don't know exactly what special key is, 1268.16s - 1271.16s | but I think it's a drag. 1271.16s - 1276.47s | So employees, boss, the budget for this client is only 15K. 1276.47s - 1278.47s | Do you agree? 1278.47s - 1280.47s | They don't need much data. 1280.47s - 1282.47s | And Jessica, probably to another employee, 1282.47s - 1284.47s | boss is not on a good mood today. 1284.47s - 1285.47s | Let's be careful. 1285.47s - 1287.47s | Yeah, be careful. 1287.47s - 1290.78s | Good for you, Jessica. 1290.78s - 1292.78s | And last but really not least, 1292.78s - 1295.78s | the boss was sending the decryptors to the guys. 1295.78s - 1297.78s | Here's the decryptor for company A. 1297.78s - 1299.78s | Here's the decryptor for company B. 1299.78s - 1303.78s | I got those decryptors because I wanted them too. 1303.78s - 1308.19s | This is the actual organization. 1308.19s - 1311.19s | I said I wouldn't have another graphic, 1311.19s - 1313.19s | but I needed to do another graphic. 1313.19s - 1315.19s | You should forgive me for that. 1315.19s - 1319.19s | So boss on the top, Panda, Jessica, Malox, and Ismail on the bottom. 1319.19s - 1322.19s | And


chunk_id: 176_chunk_20
chunk_text:
but I think it's a drag. 1271.16s - 1276.47s | So employees, boss, the budget for this client is only 15K. 1276.47s - 1278.47s | Do you agree? 1278.47s - 1280.47s | They don't need much data. 1280.47s - 1282.47s | And Jessica, probably to another employee, 1282.47s - 1284.47s | boss is not on a good mood today. 1284.47s - 1285.47s | Let's be careful. 1285.47s - 1287.47s | Yeah, be careful. 1287.47s - 1290.78s | Good for you, Jessica. 1290.78s - 1292.78s | And last but really not least, 1292.78s - 1295.78s | the boss was sending the decryptors to the guys. 1295.78s - 1297.78s | Here's the decryptor for company A. 1297.78s - 1299.78s | Here's the decryptor for company B. 1299.78s - 1303.78s | I got those decryptors because I wanted them too. 1303.78s - 1308.19s | This is the actual organization. 1308.19s - 1311.19s | I said I wouldn't have another graphic, 1311.19s - 1313.19s | but I needed to do another graphic. 1313.19s - 1315.19s | You should forgive me for that. 1315.19s - 1319.19s | So boss on the top, Panda, Jessica, Malox, and Ismail on the bottom. 1319.19s - 1322.19s | And then after a day or so, 1322.19s - 1327.19s | unfortunately, my chat was disabled and my ID was fixed. 1327.19s - 1329.19s | Message was not delivered. 1329.19s - 1333.19s | Unfortunately, I couldn't quote it anymore. 1333.19s - 1334.19s | What did I get? 1334.19s - 1336.19s | I got internal knowledge of the team. 1336.19s - 1338.19s | I got pretty much all of their messages. 1338.19s - 1339.19s | I got some decryptors, 1339.19s - 1343.19s | which I communicated to the companies that were ransomed with, 1343.19s - 1345.19s | and they used it. 1345.19s - 1350.19s | Once the admin got up or sober, I don't know what, 1350.19s - 1351.19s | it was fixed. 1351.19s - 1355.19s | So all in all, result? 1355.19s - 1357.19s | Mediocre, I guess. 1357.19s - 1359.19s | Sorry about that, but I was too verbose. 1359.19s - 1361.19s | I was too blatant. 1361.19s - 1366.19s | I just did it all at once, but I wanted to do it. 1366.19s - 1370.19s | That's my second group. 1370.19s - 1374.19s | I think all of you know it, Black Hat and Alpha V. 1374.19s -


chunk_id: 176_chunk_21
chunk_text:
then after a day or so, 1322.19s - 1327.19s | unfortunately, my chat was disabled and my ID was fixed. 1327.19s - 1329.19s | Message was not delivered. 1329.19s - 1333.19s | Unfortunately, I couldn't quote it anymore. 1333.19s - 1334.19s | What did I get? 1334.19s - 1336.19s | I got internal knowledge of the team. 1336.19s - 1338.19s | I got pretty much all of their messages. 1338.19s - 1339.19s | I got some decryptors, 1339.19s - 1343.19s | which I communicated to the companies that were ransomed with, 1343.19s - 1345.19s | and they used it. 1345.19s - 1350.19s | Once the admin got up or sober, I don't know what, 1350.19s - 1351.19s | it was fixed. 1351.19s - 1355.19s | So all in all, result? 1355.19s - 1357.19s | Mediocre, I guess. 1357.19s - 1359.19s | Sorry about that, but I was too verbose. 1359.19s - 1361.19s | I was too blatant. 1361.19s - 1366.19s | I just did it all at once, but I wanted to do it. 1366.19s - 1370.19s | That's my second group. 1370.19s - 1374.19s | I think all of you know it, Black Hat and Alpha V. 1374.19s - 1376.19s | They're also known as Noberus. 1376.19s - 1378.19s | Their first appearance was in 2021. 1378.19s - 1381.19s | They operated as a ransomware as a service. 1381.19s - 1384.19s | They have a Rust-based malware and server-side C2, 1384.19s - 1387.19s | and they use the triple extortion scheme. 1387.19s - 1391.86s | The Rust loader that we're going to go after 1391.86s - 1394.86s | was researched by Lapuseanu, 1394.86s - 1398.86s | sorry if I butchered your name, Andrei, 1398.86s - 1400.86s | by Bitdefender Labs. 1400.86s - 1402.86s | It was targeting only Mac. 1402.86s - 1404.86s | It was developed in Rust. 1404.86s - 1408.86s | I think all of the Black Hat malware was developed in Rust, 1408.86s - 1413.86s | and their C2 was used on all of Black Hat malware. 1413.86s - 1418.86s | Andrei Lapuseanu, that's the actual research 1418.86s - 1420.86s | that I saw while Doomscrolling, 1420.86s - 1426.86s | and there were one, two, three, four CNC servers in there. 1426.86s - 1429.86s | I checked all the C2 URLs. 1429.86s - 1433.86s | One of them was online, but it was just returning 404. 1433.86s


chunk_id: 176_chunk_22
chunk_text:
1376.19s | They're also known as Noberus. 1376.19s - 1378.19s | Their first appearance was in 2021. 1378.19s - 1381.19s | They operated as a ransomware as a service. 1381.19s - 1384.19s | They have a Rust-based malware and server-side C2, 1384.19s - 1387.19s | and they use the triple extortion scheme. 1387.19s - 1391.86s | The Rust loader that we're going to go after 1391.86s - 1394.86s | was researched by Lapuseanu, 1394.86s - 1398.86s | sorry if I butchered your name, Andrei, 1398.86s - 1400.86s | by Bitdefender Labs. 1400.86s - 1402.86s | It was targeting only Mac. 1402.86s - 1404.86s | It was developed in Rust. 1404.86s - 1408.86s | I think all of the Black Hat malware was developed in Rust, 1408.86s - 1413.86s | and their C2 was used on all of Black Hat malware. 1413.86s - 1418.86s | Andrei Lapuseanu, that's the actual research 1418.86s - 1420.86s | that I saw while Doomscrolling, 1420.86s - 1426.86s | and there were one, two, three, four CNC servers in there. 1426.86s - 1429.86s | I checked all the C2 URLs. 1429.86s - 1433.86s | One of them was online, but it was just returning 404. 1433.86s - 1436.86s | So me being me, I have decided to put it 1436.86s - 1441.86s | in the loop of continuous scanning that I have in my rig. 1441.86s - 1446.86s | And two days later, it downloaded some documentation. 1446.86s - 1449.86s | The first documentation was for clients, 1449.86s - 1454.86s | so I could see all the malware-infected clients. 1454.86s - 1457.86s | And the second one was tasks, 1457.86s - 1461.86s | so I could see all the tasks that were ever run 1461.86s - 1464.86s | on the server, on the machines. 1464.86s - 1467.86s | Unfortunately, both of those endpoints 1467.86s - 1470.86s | were offline at that point. 1470.86s - 1475.86s | So what I had to do is read the documentation, 1475.86s - 1478.86s | try to guess, not exactly guess, 1478.86s - 1480.86s | try to understand the documentation, 1480.86s - 1483.86s | create a Python script, automate the check, 1483.86s - 1487.86s | and put that in the loop again, and wait. 1487.86s - 1492.86s | And by wait, I mean really wait. 1492.86s - 1496.86s | I think seven or eight days after, 1496.86s - 1499.86s | I


chunk_id: 176_chunk_23
chunk_text:
- 1436.86s | So me being me, I have decided to put it 1436.86s - 1441.86s | in the loop of continuous scanning that I have in my rig. 1441.86s - 1446.86s | And two days later, it downloaded some documentation. 1446.86s - 1449.86s | The first documentation was for clients, 1449.86s - 1454.86s | so I could see all the malware-infected clients. 1454.86s - 1457.86s | And the second one was tasks, 1457.86s - 1461.86s | so I could see all the tasks that were ever run 1461.86s - 1464.86s | on the server, on the machines. 1464.86s - 1467.86s | Unfortunately, both of those endpoints 1467.86s - 1470.86s | were offline at that point. 1470.86s - 1475.86s | So what I had to do is read the documentation, 1475.86s - 1478.86s | try to guess, not exactly guess, 1478.86s - 1480.86s | try to understand the documentation, 1480.86s - 1483.86s | create a Python script, automate the check, 1483.86s - 1487.86s | and put that in the loop again, and wait. 1487.86s - 1492.86s | And by wait, I mean really wait. 1492.86s - 1496.86s | I think seven or eight days after, 1496.86s - 1499.86s | I got a push notification on my phone. 1499.86s - 1501.86s | Yay, you got something. 1501.86s - 1504.86s | So I extracted 197 commands in two minutes 1504.86s - 1506.86s | on a four-hour window. 1506.86s - 1508.86s | What does that say to us? 1508.86s - 1512.86s | It means that Black Cat was putting the C2 server 1512.86s - 1515.86s | only when using it and exploiting it, 1515.86s - 1518.86s | and when they're not using it to do any movement, 1518.86s - 1520.86s | any lateral movement or anything else, 1520.86s - 1522.86s | they were putting it off. 1522.86s - 1528.86s | And you can see that in here, it uploads a file. 1528.86s - 1530.86s | And this is the scary command. 1530.86s - 1535.86s | When you see the XXX in here was a company's name, 1535.86s - 1538.86s | so when you see zipping someone's AWS 1538.86s - 1543.86s | and GCP environments on an env.zip 1543.86s - 1546.86s | and then being uploaded to another server, 1547.86s - 1549.86s | it means that someone is getting exploited 1549.86s - 1552.86s | as we speak right now. 1552.86s - 1557.86s | So


chunk_id: 176_chunk_24
chunk_text:
got a push notification on my phone. 1499.86s - 1501.86s | Yay, you got something. 1501.86s - 1504.86s | So I extracted 197 commands in two minutes 1504.86s - 1506.86s | on a four-hour window. 1506.86s - 1508.86s | What does that say to us? 1508.86s - 1512.86s | It means that Black Cat was putting the C2 server 1512.86s - 1515.86s | only when using it and exploiting it, 1515.86s - 1518.86s | and when they're not using it to do any movement, 1518.86s - 1520.86s | any lateral movement or anything else, 1520.86s - 1522.86s | they were putting it off. 1522.86s - 1528.86s | And you can see that in here, it uploads a file. 1528.86s - 1530.86s | And this is the scary command. 1530.86s - 1535.86s | When you see the XXX in here was a company's name, 1535.86s - 1538.86s | so when you see zipping someone's AWS 1538.86s - 1543.86s | and GCP environments on an env.zip 1543.86s - 1546.86s | and then being uploaded to another server, 1547.86s - 1549.86s | it means that someone is getting exploited 1549.86s - 1552.86s | as we speak right now. 1552.86s - 1557.86s | So I had to switch to incident response mode. 1557.86s - 1561.86s | I hate incident response. 1561.86s - 1563.86s | I identified four companies. 1563.86s - 1566.86s | All of them were cryptocurrency-related. 1566.86s - 1569.86s | Crypto is cryptography. 1569.86s - 1571.86s | Fuck cryptocurrency. 1571.86s - 1573.86s | Two of them were unicorns, 1573.86s - 1578.86s | which means their valuation was over a billion. 1578.86s - 1580.86s | All four of them were notified, 1580.86s - 1582.86s | and they acknowledged the issue. 1582.86s - 1585.86s | None of them were ransomed. 1585.86s - 1586.86s | What did I do? 1586.86s - 1589.86s | I got all the info and understood the lateral movement 1589.86s - 1591.86s | that Black Cat was doing at that point. 1591.86s - 1593.86s | I stopped the whole campaign. 1593.86s - 1595.86s | Four companies were not ransomed, 1595.86s - 1609.38s | and Black Cat got a really big financial hit. 1609.38s - 1612.38s | And after a month, under increasing federal scrutiny, 1612.38s - 1616.38s | Black Cat ransomware gang pulls XXX on its way out. 1616.38s - 1619.38s | I'm not going to say that this was all me,


chunk_id: 176_chunk_25
chunk_text:
I had to switch to incident response mode. 1557.86s - 1561.86s | I hate incident response. 1561.86s - 1563.86s | I identified four companies. 1563.86s - 1566.86s | All of them were cryptocurrency-related. 1566.86s - 1569.86s | Crypto is cryptography. 1569.86s - 1571.86s | Fuck cryptocurrency. 1571.86s - 1573.86s | Two of them were unicorns, 1573.86s - 1578.86s | which means their valuation was over a billion. 1578.86s - 1580.86s | All four of them were notified, 1580.86s - 1582.86s | and they acknowledged the issue. 1582.86s - 1585.86s | None of them were ransomed. 1585.86s - 1586.86s | What did I do? 1586.86s - 1589.86s | I got all the info and understood the lateral movement 1589.86s - 1591.86s | that Black Cat was doing at that point. 1591.86s - 1593.86s | I stopped the whole campaign. 1593.86s - 1595.86s | Four companies were not ransomed, 1595.86s - 1609.38s | and Black Cat got a really big financial hit. 1609.38s - 1612.38s | And after a month, under increasing federal scrutiny, 1612.38s - 1616.38s | Black Cat ransomware gang pulls XXX on its way out. 1616.38s - 1619.38s | I'm not going to say that this was all me, 1619.38s - 1622.38s | but I'm going to say that my exploitation 1622.38s - 1624.38s | and stopping that campaign 1624.38s - 1628.38s | probably helped them to do that XXX, 1628.38s - 1630.38s | the decision to do that XXX. 1630.38s - 1637.30s | So all in all, I would say not bad, right? 1637.30s - 1640.30s | Third one, Everest. 1640.30s - 1643.30s | Oh, my lovely Everest. 1643.30s - 1646.30s | Active since late 2020. 1646.30s - 1648.30s | They targeted high-profile targets 1648.30s - 1651.30s | for the first three years. 1651.30s - 1656.30s | In the last year, they moved to also lower-profile targets. 1656.30s - 1659.30s | They pivoted to initial access broker. 1659.30s - 1662.30s | They pivoted to just data leak. 1662.30s - 1665.30s | Fuck, they pivot around like they're startups. 1665.30s - 1668.30s | They grade it as highly sophisticated 1668.30s - 1670.30s | by multiple researchers, 1670.30s - 1673.30s | and they're also well-known for being paid 1673.30s - 1678.30s | and not getting and then releasing the data, 1678.30s - 1681.30s | so they're mentally unstable. 1681.30s - 1682.30s | Right? 1682.30s - 1686.30s | Why don't you


chunk_id: 176_chunk_26
chunk_text:
1619.38s - 1622.38s | but I'm going to say that my exploitation 1622.38s - 1624.38s | and stopping that campaign 1624.38s - 1628.38s | probably helped them to do that XXX, 1628.38s - 1630.38s | the decision to do that XXX. 1630.38s - 1637.30s | So all in all, I would say not bad, right? 1637.30s - 1640.30s | Third one, Everest. 1640.30s - 1643.30s | Oh, my lovely Everest. 1643.30s - 1646.30s | Active since late 2020. 1646.30s - 1648.30s | They targeted high-profile targets 1648.30s - 1651.30s | for the first three years. 1651.30s - 1656.30s | In the last year, they moved to also lower-profile targets. 1656.30s - 1659.30s | They pivoted to initial access broker. 1659.30s - 1662.30s | They pivoted to just data leak. 1662.30s - 1665.30s | Fuck, they pivot around like they're startups. 1665.30s - 1668.30s | They grade it as highly sophisticated 1668.30s - 1670.30s | by multiple researchers, 1670.30s - 1673.30s | and they're also well-known for being paid 1673.30s - 1678.30s | and not getting and then releasing the data, 1678.30s - 1681.30s | so they're mentally unstable. 1681.30s - 1682.30s | Right? 1682.30s - 1686.30s | Why don't you go after a mentally unstable millionaire? 1686.30s - 1691.19s | This is their data leak page. 1691.19s - 1694.19s | Does it look like something you know? 1694.19s - 1696.19s | No one? 1696.19s - 1704.22s | It's fucking WordPress. 1704.22s - 1709.62s | Version 5.5.3. 1709.62s - 1712.62s | This version was done in 2020. 1712.62s - 1714.62s | That's four years ago. 1714.62s - 1717.62s | There on the left, there is the login page, 1717.62s - 1719.62s | and on the right, there is also the readme.txt 1719.62s - 1723.62s | in case you didn't know how to install WordPress. 1723.62s - 1729.97s | Then I ran WPScan via Torsox 1729.97s - 1732.97s | because why not, right? 1732.97s - 1736.97s | It said it's really insecure, 42 vulnerabilities identified. 1736.97s - 1740.97s | Unfortunately, none of them was really exploitable 1740.97s - 1742.97s | by silly me. 1742.97s - 1746.97s | The only thing that I could see in here 1746.97s - 1752.97s | was that error on RSS functions. 1752.97s - 1753.97s | As you can see in here, 1753.97s - 1757.97s | we can see that the PHP error reporting was on. 1757.97s -


chunk_id: 176_chunk_27
chunk_text:
go after a mentally unstable millionaire? 1686.30s - 1691.19s | This is their data leak page. 1691.19s - 1694.19s | Does it look like something you know? 1694.19s - 1696.19s | No one? 1696.19s - 1704.22s | It's fucking WordPress. 1704.22s - 1709.62s | Version 5.5.3. 1709.62s - 1712.62s | This version was done in 2020. 1712.62s - 1714.62s | That's four years ago. 1714.62s - 1717.62s | There on the left, there is the login page, 1717.62s - 1719.62s | and on the right, there is also the readme.txt 1719.62s - 1723.62s | in case you didn't know how to install WordPress. 1723.62s - 1729.97s | Then I ran WPScan via Torsox 1729.97s - 1732.97s | because why not, right? 1732.97s - 1736.97s | It said it's really insecure, 42 vulnerabilities identified. 1736.97s - 1740.97s | Unfortunately, none of them was really exploitable 1740.97s - 1742.97s | by silly me. 1742.97s - 1746.97s | The only thing that I could see in here 1746.97s - 1752.97s | was that error on RSS functions. 1752.97s - 1753.97s | As you can see in here, 1753.97s - 1757.97s | we can see that the PHP error reporting was on. 1757.97s - 1759.97s | It was a Windows machine, 1759.97s - 1763.97s | and we were running Vertigo server hosting, 1763.97s - 1767.97s | which is end of life for the past two years. 1767.97s - 1770.97s | They also had OpenDIR, 1770.97s - 1772.97s | so you could see pretty much everything. 1772.97s - 1776.97s | They had a couple of zip files, but nothing interesting. 1776.97s - 1780.97s | They also had PHPMyAdmin. 1780.97s - 1782.97s | Why not, right? 1782.97s - 1787.97s | And I did what every super hacker does in the world. 1787.97s - 1795.97s | I googled Vertigo default MySQL password. 1795.97s - 1803.70s | Yeah, I got that, but unfortunately, it didn't work. 1803.70s - 1809.70s | And that was my talk up until 15th of July. 1809.70s - 1815.70s | Then my nine-year-old son, okay, let me stop. 1815.70s - 1816.70s | In Greece, I have two sons. 1816.70s - 1817.70s | The one is nine-year-old. 1817.70s - 1821.70s | The other just became 13, 1821.70s - 1824.70s | so can we all say happy birthday to Antonis? 1824.70s - 1830.04s | Because thanks for that. 1830.04s - 1831.04s | Happy birthday, Antonis. 1831.04s


chunk_id: 176_chunk_28
chunk_text:
1759.97s | It was a Windows machine, 1759.97s - 1763.97s | and we were running Vertigo server hosting, 1763.97s - 1767.97s | which is end of life for the past two years. 1767.97s - 1770.97s | They also had OpenDIR, 1770.97s - 1772.97s | so you could see pretty much everything. 1772.97s - 1776.97s | They had a couple of zip files, but nothing interesting. 1776.97s - 1780.97s | They also had PHPMyAdmin. 1780.97s - 1782.97s | Why not, right? 1782.97s - 1787.97s | And I did what every super hacker does in the world. 1787.97s - 1795.97s | I googled Vertigo default MySQL password. 1795.97s - 1803.70s | Yeah, I got that, but unfortunately, it didn't work. 1803.70s - 1809.70s | And that was my talk up until 15th of July. 1809.70s - 1815.70s | Then my nine-year-old son, okay, let me stop. 1815.70s - 1816.70s | In Greece, I have two sons. 1816.70s - 1817.70s | The one is nine-year-old. 1817.70s - 1821.70s | The other just became 13, 1821.70s - 1824.70s | so can we all say happy birthday to Antonis? 1824.70s - 1830.04s | Because thanks for that. 1830.04s - 1831.04s | Happy birthday, Antonis. 1831.04s - 1835.04s | I should be there in Greece, but I'm here, so you know me. 1835.04s - 1840.04s | So my nine-year-old was sitting at my computer 1840.04s - 1844.04s | reading my 2000 open tabs. 1845.04s - 1847.04s | At some point, he says, 1847.04s - 1852.04s | that's a really strange name to call your server. 1852.04s - 1855.04s | Why the fuck would you call it Vertigo? 1855.04s - 1858.04s | I'm like, no, it's not Vertigo, it's Vertigo. 1858.04s - 1860.04s | He says, no, I know how to read. 1860.04s - 1863.04s | It has two R's, it's Vertigo. 1863.04s - 1869.67s | I'm like, what, motherfucker? 1869.67s - 1871.67s | He then said that he's not the thing, I'm the thing, 1871.67s - 1873.67s | but it is what it is. 1873.67s - 1875.67s | Do you all know what that means? 1875.67s - 1879.67s | I have to reuse my favorite meme. 1879.67s - 1882.67s | I use Vertigo, and what that means is, 1882.67s - 1889.25s | I'm the fucking admin. 1889.25s - 1894.01s | WordPress administration, 1894.01s - 1898.01s | I did develop a WordPress plugin. 1898.01s - 1901.01s |


chunk_id: 176_chunk_29
chunk_text:
- 1835.04s | I should be there in Greece, but I'm here, so you know me. 1835.04s - 1840.04s | So my nine-year-old was sitting at my computer 1840.04s - 1844.04s | reading my 2000 open tabs. 1845.04s - 1847.04s | At some point, he says, 1847.04s - 1852.04s | that's a really strange name to call your server. 1852.04s - 1855.04s | Why the fuck would you call it Vertigo? 1855.04s - 1858.04s | I'm like, no, it's not Vertigo, it's Vertigo. 1858.04s - 1860.04s | He says, no, I know how to read. 1860.04s - 1863.04s | It has two R's, it's Vertigo. 1863.04s - 1869.67s | I'm like, what, motherfucker? 1869.67s - 1871.67s | He then said that he's not the thing, I'm the thing, 1871.67s - 1873.67s | but it is what it is. 1873.67s - 1875.67s | Do you all know what that means? 1875.67s - 1879.67s | I have to reuse my favorite meme. 1879.67s - 1882.67s | I use Vertigo, and what that means is, 1882.67s - 1889.25s | I'm the fucking admin. 1889.25s - 1894.01s | WordPress administration, 1894.01s - 1898.01s | I did develop a WordPress plugin. 1898.01s - 1901.01s | No, I didn't develop a WordPress plugin, sorry. 1901.01s - 1904.01s | I took a PHP cell, Pony cell, 1904.01s - 1908.01s | zipped it, named it cell.plugin, 1908.01s - 1915.62s | uploaded there, 1915.62s - 1918.62s | and I think I might have prematurely 1918.62s - 1921.62s | used the I'm the admin meme, 1921.62s - 1923.62s | because right now, 1923.62s - 1933.86s | I'm the fucking admin in the whole situation. 1933.86s - 1938.86s | Then, after doing things that 1938.86s - 1940.86s | most of the red teamers in here, 1940.86s - 1942.86s | I see a really good red teamer in here, 1942.86s - 1945.86s | would decapitate me of doing, 1945.86s - 1949.86s | but again, I'm a simpleton, sorry about that. 1949.86s - 1952.86s | I somehow run Mimikatz, 1952.86s - 1955.86s | got the whole, I don't know, token and shit, 1955.86s - 1960.13s | and all that, which means, 1960.13s - 1962.13s | they're Russians. 1962.13s - 1965.13s | Who the fuck would expect them to be Russians? 1965.13s - 1969.13s | It's a Windows 2012 server, 1969.13s - 1972.13s | and they have done a lot of crimes, 1972.13s -


chunk_id: 176_chunk_30
chunk_text:
No, I didn't develop a WordPress plugin, sorry. 1901.01s - 1904.01s | I took a PHP cell, Pony cell, 1904.01s - 1908.01s | zipped it, named it cell.plugin, 1908.01s - 1915.62s | uploaded there, 1915.62s - 1918.62s | and I think I might have prematurely 1918.62s - 1921.62s | used the I'm the admin meme, 1921.62s - 1923.62s | because right now, 1923.62s - 1933.86s | I'm the fucking admin in the whole situation. 1933.86s - 1938.86s | Then, after doing things that 1938.86s - 1940.86s | most of the red teamers in here, 1940.86s - 1942.86s | I see a really good red teamer in here, 1942.86s - 1945.86s | would decapitate me of doing, 1945.86s - 1949.86s | but again, I'm a simpleton, sorry about that. 1949.86s - 1952.86s | I somehow run Mimikatz, 1952.86s - 1955.86s | got the whole, I don't know, token and shit, 1955.86s - 1960.13s | and all that, which means, 1960.13s - 1962.13s | they're Russians. 1962.13s - 1965.13s | Who the fuck would expect them to be Russians? 1965.13s - 1969.13s | It's a Windows 2012 server, 1969.13s - 1972.13s | and they have done a lot of crimes, 1972.13s - 1978.08s | but can anyone guess what's their biggest crime? 1978.08s - 1981.08s | They haven't paid for WinRAR. 1981.08s - 1987.66s | For fuck's sake, if you make, 1987.66s - 1989.66s | I don't know, 20 million per year, 1989.66s - 1991.66s | pay the fucking WinRAR. 1991.66s - 1996.20s | So, database export, 1996.20s - 1998.20s | username extract, 1998.20s - 2000.20s | remote command execution on the server, 2000.20s - 2003.20s | got hold of their own secret keys, 2003.20s - 2006.20s | lots, and I mean lots of locks to analyze. 2006.20s - 2009.20s | I was hoping that it would be down 2009.20s - 2011.20s | by someone by now, 2011.20s - 2012.20s | but it's still there, 2012.20s - 2015.20s | so if anyone wants to play, go play. 2015.20s - 2025.01s | Result? 2025.01s - 2028.01s | Again, this was supposedly my talk 2028.01s - 2030.01s | up until this Saturday, 2030.01s - 2032.01s | but this Saturday, 2032.01s - 2035.80s | Black Angels, 2035.80s - 2037.80s | it emerged in May 2022, 2037.80s - 2039.80s | high profile targets, 2039.80s - 2040.80s | Babook based, 2040.80s - 2042.80s | that means that


chunk_id: 176_chunk_31
chunk_text:
1978.08s | but can anyone guess what's their biggest crime? 1978.08s - 1981.08s | They haven't paid for WinRAR. 1981.08s - 1987.66s | For fuck's sake, if you make, 1987.66s - 1989.66s | I don't know, 20 million per year, 1989.66s - 1991.66s | pay the fucking WinRAR. 1991.66s - 1996.20s | So, database export, 1996.20s - 1998.20s | username extract, 1998.20s - 2000.20s | remote command execution on the server, 2000.20s - 2003.20s | got hold of their own secret keys, 2003.20s - 2006.20s | lots, and I mean lots of locks to analyze. 2006.20s - 2009.20s | I was hoping that it would be down 2009.20s - 2011.20s | by someone by now, 2011.20s - 2012.20s | but it's still there, 2012.20s - 2015.20s | so if anyone wants to play, go play. 2015.20s - 2025.01s | Result? 2025.01s - 2028.01s | Again, this was supposedly my talk 2028.01s - 2030.01s | up until this Saturday, 2030.01s - 2032.01s | but this Saturday, 2032.01s - 2035.80s | Black Angels, 2035.80s - 2037.80s | it emerged in May 2022, 2037.80s - 2039.80s | high profile targets, 2039.80s - 2040.80s | Babook based, 2040.80s - 2042.80s | that means that they just 2042.80s - 2044.80s | stole the whole league of Babook, 2044.80s - 2045.80s | and they're using it, 2045.80s - 2048.80s | they're focused on Linux and ESXi, 2048.80s - 2052.80s | and they received a record 75 million ransom, 2052.80s - 2054.80s | as we all saw last week. 2054.80s - 2056.80s | And then, 2056.80s - 2058.80s | Rakesh Krishnan, 2058.80s - 2060.80s | I hope I said it correctly, 2060.80s - 2062.80s | found their clear text, 2062.80s - 2065.80s | their open web IP, 2065.80s - 2068.80s | which means I had to take a look. 2068.80s - 2069.80s | This was on Saturday morning, 2069.80s - 2072.80s | and I was flying away Saturday evening, 2072.80s - 2074.80s | so I had six hours. 2074.80s - 2079.85s | You can go there right now. 2079.85s - 2080.85s | I should make it a demo, 2080.85s - 2082.85s | but I don't like demos. 2082.85s - 2084.85s | They have a different HTTPS 2084.85s - 2086.85s | and HTTP configuration. 2086.85s - 2089.85s | The HTTPS is on the slash public 2089.85s - 2092.85s | of their symphony. 2092.85s - 2095.85s | The HTTP


chunk_id: 176_chunk_32
chunk_text:
they just 2042.80s - 2044.80s | stole the whole league of Babook, 2044.80s - 2045.80s | and they're using it, 2045.80s - 2048.80s | they're focused on Linux and ESXi, 2048.80s - 2052.80s | and they received a record 75 million ransom, 2052.80s - 2054.80s | as we all saw last week. 2054.80s - 2056.80s | And then, 2056.80s - 2058.80s | Rakesh Krishnan, 2058.80s - 2060.80s | I hope I said it correctly, 2060.80s - 2062.80s | found their clear text, 2062.80s - 2065.80s | their open web IP, 2065.80s - 2068.80s | which means I had to take a look. 2068.80s - 2069.80s | This was on Saturday morning, 2069.80s - 2072.80s | and I was flying away Saturday evening, 2072.80s - 2074.80s | so I had six hours. 2074.80s - 2079.85s | You can go there right now. 2079.85s - 2080.85s | I should make it a demo, 2080.85s - 2082.85s | but I don't like demos. 2082.85s - 2084.85s | They have a different HTTPS 2084.85s - 2086.85s | and HTTP configuration. 2086.85s - 2089.85s | The HTTPS is on the slash public 2089.85s - 2092.85s | of their symphony. 2092.85s - 2095.85s | The HTTP port 80 2095.85s - 2098.85s | is on the root of symphony, 2098.85s - 2100.85s | which means if you go to .env, 2100.85s - 2102.85s | you are going to see .env, 2102.85s - 2104.85s | and you are going to see AppSecret 2104.85s - 2108.85s | and the MySQL password. 2108.85s - 2113.85s | You do what you want with that information. 2113.85s - 2115.85s | What did I found? 2115.85s - 2116.85s | .env file exposure, 2116.85s - 2118.85s | internal URLs exposure, 2118.85s - 2120.85s | some error logs exposed. 2120.85s - 2123.85s | I'm not going to say what those error logs were. 2123.85s - 2125.85s | You can look at it. 2125.85s - 2127.85s | One message mentioning 2127.85s - 2131.85s | 5.5 million payment exposed. 2131.85s - 2133.85s | This was nowhere to be found, 2133.85s - 2135.85s | so I guess they were paid 2135.85s - 2137.85s | and killed the whole thing. 2137.85s - 2140.85s | All in all, that was fast. 2140.85s - 2142.85s | I could do some stuff with AppSecret, 2142.85s - 2144.85s | but unfortunately I had to fly here, 2144.85s - 2150.12s | so you should


chunk_id: 176_chunk_33
chunk_text:
port 80 2095.85s - 2098.85s | is on the root of symphony, 2098.85s - 2100.85s | which means if you go to .env, 2100.85s - 2102.85s | you are going to see .env, 2102.85s - 2104.85s | and you are going to see AppSecret 2104.85s - 2108.85s | and the MySQL password. 2108.85s - 2113.85s | You do what you want with that information. 2113.85s - 2115.85s | What did I found? 2115.85s - 2116.85s | .env file exposure, 2116.85s - 2118.85s | internal URLs exposure, 2118.85s - 2120.85s | some error logs exposed. 2120.85s - 2123.85s | I'm not going to say what those error logs were. 2123.85s - 2125.85s | You can look at it. 2125.85s - 2127.85s | One message mentioning 2127.85s - 2131.85s | 5.5 million payment exposed. 2131.85s - 2133.85s | This was nowhere to be found, 2133.85s - 2135.85s | so I guess they were paid 2135.85s - 2137.85s | and killed the whole thing. 2137.85s - 2140.85s | All in all, that was fast. 2140.85s - 2142.85s | I could do some stuff with AppSecret, 2142.85s - 2144.85s | but unfortunately I had to fly here, 2144.85s - 2150.12s | so you should excuse me for that. 2150.12s - 2154.12s | We are getting to the end. 2154.12s - 2159.12s | My favorite part of ethical dilemmas. 2159.12s - 2161.12s | Are we the baddies? 2161.12s - 2164.12s | What the fuck we are doing with our lives? 2164.12s - 2168.72s | I never wanted to become a vigilante. 2168.72s - 2170.72s | I'm not seeing myself as a vigilante 2170.72s - 2173.72s | or someone who wanted to do bad things. 2173.72s - 2176.72s | I always wanted to be considered, 2176.72s - 2178.72s | as we Greeks say, 2178.72s - 2180.72s | the Socratic fly or the god fly. 2180.72s - 2182.72s | I wanted to be the one that 2182.72s - 2185.72s | reinvents the status quo 2185.72s - 2189.72s | and tries to make the bad people, 2189.72s - 2190.72s | the ransomware gangs, 2190.72s - 2194.72s | give them a taste of their own medicine. 2194.72s - 2197.72s | And I also want to say to CTI companies 2197.72s - 2201.72s | that they would really need to be more 2201.72s - 2204.72s | open into sharing information. 2204.72s - 2209.72s | If I only had C2's information


chunk_id: 176_chunk_34
chunk_text:
excuse me for that. 2150.12s - 2154.12s | We are getting to the end. 2154.12s - 2159.12s | My favorite part of ethical dilemmas. 2159.12s - 2161.12s | Are we the baddies? 2161.12s - 2164.12s | What the fuck we are doing with our lives? 2164.12s - 2168.72s | I never wanted to become a vigilante. 2168.72s - 2170.72s | I'm not seeing myself as a vigilante 2170.72s - 2173.72s | or someone who wanted to do bad things. 2173.72s - 2176.72s | I always wanted to be considered, 2176.72s - 2178.72s | as we Greeks say, 2178.72s - 2180.72s | the Socratic fly or the god fly. 2180.72s - 2182.72s | I wanted to be the one that 2182.72s - 2185.72s | reinvents the status quo 2185.72s - 2189.72s | and tries to make the bad people, 2189.72s - 2190.72s | the ransomware gangs, 2190.72s - 2194.72s | give them a taste of their own medicine. 2194.72s - 2197.72s | And I also want to say to CTI companies 2197.72s - 2201.72s | that they would really need to be more 2201.72s - 2204.72s | open into sharing information. 2204.72s - 2209.72s | If I only had C2's information more quicker, 2209.72s - 2214.72s | I would have a really bigger talk right now. 2214.72s - 2217.72s | Except the two CTI companies 2217.72s - 2219.72s | that have already used my research 2219.72s - 2221.72s | without mentioning me. 2221.72s - 2228.08s | Those can go fuck off, I don't care. 2228.08s - 2230.08s | Conclusions. 2230.08s - 2234.08s | Some of us fail and fail miserably. 2234.08s - 2237.08s | Some of you really succeed 2237.08s - 2240.08s | and succeed gloriously. 2240.08s - 2243.08s | And I'm really happy with everyone that succeeds. 2243.08s - 2246.08s | I know that for the past two years 2246.08s - 2248.08s | I have been looking, 2248.08s - 2250.08s | I really love VX Underground 2250.08s - 2254.08s | and their five horsemen paradigm. 2254.08s - 2256.08s | So for the past two years, 2256.08s - 2259.08s | from London 2022 with Spower, 2259.08s - 2261.08s | Defcon last year with Stealer and Botnet, 2261.08s - 2264.08s | and this year's Defcon and Blackhat with Ransomware, 2264.08s - 2268.08s | I have been fighting all those five horsemen. 2268.08s - 2273.08s | And while I never had a clear


chunk_id: 176_chunk_35
chunk_text:
more quicker, 2209.72s - 2214.72s | I would have a really bigger talk right now. 2214.72s - 2217.72s | Except the two CTI companies 2217.72s - 2219.72s | that have already used my research 2219.72s - 2221.72s | without mentioning me. 2221.72s - 2228.08s | Those can go fuck off, I don't care. 2228.08s - 2230.08s | Conclusions. 2230.08s - 2234.08s | Some of us fail and fail miserably. 2234.08s - 2237.08s | Some of you really succeed 2237.08s - 2240.08s | and succeed gloriously. 2240.08s - 2243.08s | And I'm really happy with everyone that succeeds. 2243.08s - 2246.08s | I know that for the past two years 2246.08s - 2248.08s | I have been looking, 2248.08s - 2250.08s | I really love VX Underground 2250.08s - 2254.08s | and their five horsemen paradigm. 2254.08s - 2256.08s | So for the past two years, 2256.08s - 2259.08s | from London 2022 with Spower, 2259.08s - 2261.08s | Defcon last year with Stealer and Botnet, 2261.08s - 2264.08s | and this year's Defcon and Blackhat with Ransomware, 2264.08s - 2268.08s | I have been fighting all those five horsemen. 2268.08s - 2273.08s | And while I never had a clear win, 2273.08s - 2276.08s | I could never say that this was not the case, 2276.08s - 2278.08s | that I didn't look anyone, 2278.08s - 2281.08s | all of them in the eye and smiled. 2281.08s - 2284.08s | So, thank you. 2284.08s - 2286.08s | And if anyone has any questions, 2286.08s - 2289.08s | we have like five minutes to talk. 2289.08s - 2291.08s | There's the microphone. 2291.08s - 2299.13s | No one? 2299.13s - 2300.13s | Nice. 2300.13s - 2302.13s | Thank you, guys. 2302.13s - 2304.13s | Oh, I have one. 2304.13s - 2306.13s | Where is he? 2306.13s - 2307.13s | Oh, nice. 2307.13s - 2311.46s | Hi, thank you. 2311.46s - 2312.46s | Great talk. 2312.46s - 2314.46s | My question is, 2314.46s - 2317.46s | which would you choose to fight? 2317.46s - 2321.46s | Five duck-sized horses 2321.46s - 2323.46s | or... 2323.46s - 2325.46s | Oh, I got it wrong. 2325.46s - 2326.46s | I got no question. 2326.46s - 2327.46s | Thank you for the talk. 2327.46s - 2329.46s | Thank you. 2329.46s - 2331.46s | Anyone else? 2331.46s - 2333.46s | Thank you, guys.


chunk_id: 176_chunk_36
chunk_text:
win, 2273.08s - 2276.08s | I could never say that this was not the case, 2276.08s - 2278.08s | that I didn't look anyone, 2278.08s - 2281.08s | all of them in the eye and smiled. 2281.08s - 2284.08s | So, thank you. 2284.08s - 2286.08s | And if anyone has any questions, 2286.08s - 2289.08s | we have like five minutes to talk. 2289.08s - 2291.08s | There's the microphone. 2291.08s - 2299.13s | No one? 2299.13s - 2300.13s | Nice. 2300.13s - 2302.13s | Thank you, guys. 2302.13s - 2304.13s | Oh, I have one. 2304.13s - 2306.13s | Where is he? 2306.13s - 2307.13s | Oh, nice. 2307.13s - 2311.46s | Hi, thank you. 2311.46s - 2312.46s | Great talk. 2312.46s - 2314.46s | My question is, 2314.46s - 2317.46s | which would you choose to fight? 2317.46s - 2321.46s | Five duck-sized horses 2321.46s - 2323.46s | or... 2323.46s - 2325.46s | Oh, I got it wrong. 2325.46s - 2326.46s | I got no question. 2326.46s - 2327.46s | Thank you for the talk. 2327.46s - 2329.46s | Thank you. 2329.46s - 2331.46s | Anyone else? 2331.46s - 2333.46s | Thank you, guys.


chunk_id: 177_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=RHhyrcgm7n4", "title": "DEF CON 32 - Abusing legacy railroad signaling systems - David Mele\u0301ndez, Gabriela Gabs Garcia", "description": "In this study, we delve into the darker aspects of railway technology, revealing how easily accessible domestic hardware tools can compromise the seemingly infallible robustness of signaling systems. We demonstrate how these accessible technologies can be utilized to devise strategies that potentially threaten train circulation in Spain. Our research presents a critical analysis of the vulnerabilities present in the railway signaling systems, highlighting the ease with which these systems can be tampered with, using tools that are readily available to the general public. Through a combination of theoretical insights and practical demonstrations, we offer a comprehensive overview of the risks associated with such vulnerabilities.\n\nOur findings aim to raise awareness among stakeholders in the railway industry, prompting a reevaluation of current security measures and encouraging the adoption of more stringent protections against such threats. This paper contributes to the ongoing discussion in the cybersecurity community, offering valuable insights into the potential risks facing modern transportation infrastructures and suggesting avenues for future research and development in railway system security.\n\nWe consider this work to be innovative on a type of system that has been present for over half a century in railway infrastructures. Therefore, the references provided are primarily about the operation of the systems and relevant news concerning them.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2571, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 1.58s - 4.58s | This text was transcribed using whisper model: large-v2 Okay. Hello, everyone. 4.58s - 9.06s | Yeah, NRG. 9.06s - 13.06s | Thanks, everyone, for coming, especially to being the last day, 13.06s - 17.06s | and most of the people that we knew are going home, 17.06s - 21.06s | so we are very glad for us to have you here. 21.06s - 26.06s | Thanks, the La Villa Hacker people that are here, I'm sure, 26.06s - 29.06s | because I cried for that. Yeah. 30.06s - 40.06s | And, well, we are prepared now to talk to you about railroad hacking. 40.06s - 42.06s | We call this... 42.06s - 45.06s | It's working? Not working? Okay. 45.06s - 48.06s | We are Gabriela Garcia and David Melendez. 48.06s - 50.06s | I am a security software developer 50.06s - 53.06s | that got into hacking and hardware hacking 53.06s - 55.06s | because of the


chunk_id: 177_chunk_1
chunk_text:
been present for over half a century in railway infrastructures. Therefore, the references provided are primarily about the operation of the systems and relevant news concerning them.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2571, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 1.58s - 4.58s | This text was transcribed using whisper model: large-v2 Okay. Hello, everyone. 4.58s - 9.06s | Yeah, NRG. 9.06s - 13.06s | Thanks, everyone, for coming, especially to being the last day, 13.06s - 17.06s | and most of the people that we knew are going home, 17.06s - 21.06s | so we are very glad for us to have you here. 21.06s - 26.06s | Thanks, the La Villa Hacker people that are here, I'm sure, 26.06s - 29.06s | because I cried for that. Yeah. 30.06s - 40.06s | And, well, we are prepared now to talk to you about railroad hacking. 40.06s - 42.06s | We call this... 42.06s - 45.06s | It's working? Not working? Okay. 45.06s - 48.06s | We are Gabriela Garcia and David Melendez. 48.06s - 50.06s | I am a security software developer 50.06s - 53.06s | that got into hacking and hardware hacking 53.06s - 55.06s | because of the hardware hacker people 55.06s - 59.06s | that they like to introduce you to their weird world. 59.06s - 63.06s | And David Melendez, I am the embedded software engineer 63.06s - 70.06s | that is here to talk to you with me about railroad hacking. 70.06s - 74.06s | We call this a dark territory because in railway sector, 74.06s - 77.06s | a dark territory is a section of the railway 77.06s - 81.06s | that lacks remotely control of signals 81.06s - 85.06s | and you have no automatic blocking systems. 85.06s - 88.06s | So in this area, the communication and coordination 88.06s - 92.06s | is really exclusive on the railway operator, 92.06s - 98.06s | and the term has gained popularity in railway hackers 98.06s - 104.06s | to describe sectors that lack supervision in any other kind of way. 104.06s - 108.06s | So we are introducing you Fun with Trains. 108.06s - 115.70s | As you can see, graphic design is our passion. 115.70s - 121.06s | So let me introduce you to some concepts. 121.06s - 123.06s | For example, the railway block. 123.06s - 128.06s | Railway block is a


chunk_id: 177_chunk_2
chunk_text:
hardware hacker people 55.06s - 59.06s | that they like to introduce you to their weird world. 59.06s - 63.06s | And David Melendez, I am the embedded software engineer 63.06s - 70.06s | that is here to talk to you with me about railroad hacking. 70.06s - 74.06s | We call this a dark territory because in railway sector, 74.06s - 77.06s | a dark territory is a section of the railway 77.06s - 81.06s | that lacks remotely control of signals 81.06s - 85.06s | and you have no automatic blocking systems. 85.06s - 88.06s | So in this area, the communication and coordination 88.06s - 92.06s | is really exclusive on the railway operator, 92.06s - 98.06s | and the term has gained popularity in railway hackers 98.06s - 104.06s | to describe sectors that lack supervision in any other kind of way. 104.06s - 108.06s | So we are introducing you Fun with Trains. 108.06s - 115.70s | As you can see, graphic design is our passion. 115.70s - 121.06s | So let me introduce you to some concepts. 121.06s - 123.06s | For example, the railway block. 123.06s - 128.06s | Railway block is a section that is normally no more than one train 128.06s - 133.06s | can be present to evade collision between two trains. 133.06s - 138.06s | This block session can be between stations 138.06s - 140.06s | and can be between signals 140.06s - 146.06s | for the railroad control people to be able to control 146.06s - 152.06s | the passes of the trains between these blocks. 152.06s - 156.06s | To know where and how they have been passing the trains, 156.06s - 163.06s | we have axle counters that are systems that count the axis of every train 163.06s - 168.06s | and every train needs to be the same amount of axles 168.06s - 171.06s | in the first one and in the last one. 171.06s - 175.06s | It's nice because you don't lose people or half of your train, 175.06s - 177.06s | so it's very cool. 177.06s - 181.06s | And we can have train blockings in different ways. 181.06s - 183.06s | For example, we can give a token. 183.06s - 187.06s | It's vintage, but it's still happening in some parts of the world. 187.06s - 193.06s | You can give


chunk_id: 177_chunk_3
chunk_text:
section that is normally no more than one train 128.06s - 133.06s | can be present to evade collision between two trains. 133.06s - 138.06s | This block session can be between stations 138.06s - 140.06s | and can be between signals 140.06s - 146.06s | for the railroad control people to be able to control 146.06s - 152.06s | the passes of the trains between these blocks. 152.06s - 156.06s | To know where and how they have been passing the trains, 156.06s - 163.06s | we have axle counters that are systems that count the axis of every train 163.06s - 168.06s | and every train needs to be the same amount of axles 168.06s - 171.06s | in the first one and in the last one. 171.06s - 175.06s | It's nice because you don't lose people or half of your train, 175.06s - 177.06s | so it's very cool. 177.06s - 181.06s | And we can have train blockings in different ways. 181.06s - 183.06s | For example, we can give a token. 183.06s - 187.06s | It's vintage, but it's still happening in some parts of the world. 187.06s - 193.06s | You can give the railway operator a token and he takes it. 193.06s - 195.06s | It's vintage, okay? 195.06s - 200.06s | It takes it and then you know that this train has passed through your station. 200.06s - 205.06s | The next technological advancement has been to call people 205.06s - 208.06s | instead of giving them a token because it's weird. 208.06s - 213.06s | So the telephone block is just to tell the next block 213.06s - 216.06s | that the train is passing through your block. 216.06s - 219.06s | It's less vintage, but vintage too. 219.06s - 223.06s | And then we pass it to the train blocking, the electronic train blocking. 223.06s - 229.06s | What we have is slices of railway that are controlled by signals 229.06s - 232.06s | or controlled by a central operation center 232.06s - 240.06s | that blocks the slice of railway when the train is passing out, 240.06s - 244.06s | taking into account the data received through the axis counter. 244.06s - 248.06s | We have it in one track. 248.06s - 252.06s | We have two tracks and we have reversible two tracks. 252.06s - 260.06s |


chunk_id: 177_chunk_4
chunk_text:
the railway operator a token and he takes it. 193.06s - 195.06s | It's vintage, okay? 195.06s - 200.06s | It takes it and then you know that this train has passed through your station. 200.06s - 205.06s | The next technological advancement has been to call people 205.06s - 208.06s | instead of giving them a token because it's weird. 208.06s - 213.06s | So the telephone block is just to tell the next block 213.06s - 216.06s | that the train is passing through your block. 216.06s - 219.06s | It's less vintage, but vintage too. 219.06s - 223.06s | And then we pass it to the train blocking, the electronic train blocking. 223.06s - 229.06s | What we have is slices of railway that are controlled by signals 229.06s - 232.06s | or controlled by a central operation center 232.06s - 240.06s | that blocks the slice of railway when the train is passing out, 240.06s - 244.06s | taking into account the data received through the axis counter. 244.06s - 248.06s | We have it in one track. 248.06s - 252.06s | We have two tracks and we have reversible two tracks. 252.06s - 260.06s | So we can have control in every direction you have your train passing. 260.06s - 268.06s | The control is just set by the side where these beacons in the railway are set. 268.06s - 272.06s | So if you are in one direction, 272.06s - 279.06s | the beacon that is controlling you is in the right side of the railway. 279.06s - 282.06s | And if you are in the opposite direction, 282.06s - 285.06s | in your direction there will be another beacon 285.06s - 289.06s | controlling that you are passing through this segment. 289.06s - 291.06s | And this is the central light traffic control. 291.06s - 294.06s | This is specially in Madrid called Chamartín. 294.06s - 299.06s | And there are lots of people working here 299.06s - 303.06s | controlling that the trains don't collide, especially. 303.06s - 308.34s | We have based this investigation in one of the systems 308.34s - 312.34s | that is present in Spain that is called ASFA. 312.34s - 315.34s | In Spanish it's Anuncio de Señales y Frenado Automático. 315.34s - 319.34s | In English, Announcement of Signal and Automatic Braking. 319.34s - 323.34s |


chunk_id: 177_chunk_5
chunk_text:
So we can have control in every direction you have your train passing. 260.06s - 268.06s | The control is just set by the side where these beacons in the railway are set. 268.06s - 272.06s | So if you are in one direction, 272.06s - 279.06s | the beacon that is controlling you is in the right side of the railway. 279.06s - 282.06s | And if you are in the opposite direction, 282.06s - 285.06s | in your direction there will be another beacon 285.06s - 289.06s | controlling that you are passing through this segment. 289.06s - 291.06s | And this is the central light traffic control. 291.06s - 294.06s | This is specially in Madrid called Chamartín. 294.06s - 299.06s | And there are lots of people working here 299.06s - 303.06s | controlling that the trains don't collide, especially. 303.06s - 308.34s | We have based this investigation in one of the systems 308.34s - 312.34s | that is present in Spain that is called ASFA. 312.34s - 315.34s | In Spanish it's Anuncio de Señales y Frenado Automático. 315.34s - 319.34s | In English, Announcement of Signal and Automatic Braking. 319.34s - 323.34s | What it does is support the train circulation 323.34s - 327.34s | based on a core capacitor circuit connected to a signal. 327.34s - 331.34s | And depending the signal, the aspect they need to transmit, 331.34s - 337.34s | transmit one frequency or another in the onboard equipment. 338.34s - 340.34s | So this is the whole process. 340.34s - 344.34s | You have a railway signal that connects to a unit 344.34s - 347.34s | that gives a signal to a beacon. 347.34s - 352.34s | The beacon is received by the perturbation. 352.34s - 354.34s | Is the name? 354.34s - 357.34s | The perturbation is received by the antenna. 357.34s - 362.34s | And this antenna gives a signal to a console that is inside the train 362.34s - 367.34s | and gives different aspects related to different signs. 367.34s - 372.34s | The first of all is that you can have fixed aspects 372.34s - 376.34s | that are signals or beacons that only transmit one signal 376.34s - 382.34s | and variable aspects that have beacons that have different signals. 382.34s - 384.34s | And it depends on the frequency. 384.34s - 388.34s |


chunk_id: 177_chunk_6
chunk_text:
What it does is support the train circulation 323.34s - 327.34s | based on a core capacitor circuit connected to a signal. 327.34s - 331.34s | And depending the signal, the aspect they need to transmit, 331.34s - 337.34s | transmit one frequency or another in the onboard equipment. 338.34s - 340.34s | So this is the whole process. 340.34s - 344.34s | You have a railway signal that connects to a unit 344.34s - 347.34s | that gives a signal to a beacon. 347.34s - 352.34s | The beacon is received by the perturbation. 352.34s - 354.34s | Is the name? 354.34s - 357.34s | The perturbation is received by the antenna. 357.34s - 362.34s | And this antenna gives a signal to a console that is inside the train 362.34s - 367.34s | and gives different aspects related to different signs. 367.34s - 372.34s | The first of all is that you can have fixed aspects 372.34s - 376.34s | that are signals or beacons that only transmit one signal 376.34s - 382.34s | and variable aspects that have beacons that have different signals. 382.34s - 384.34s | And it depends on the frequency. 384.34s - 388.34s | The frequency they leave the antenna is the aspect 388.34s - 392.34s | that the railway operator is receiving inside. 392.34s - 397.34s | So the first problem is that, as you can see, 397.34s - 402.34s | a couple of different signals give different aspects. 402.34s - 407.34s | Or the same range of frequencies give different signals 407.34s - 410.34s | to the railway operator. 411.34s - 420.34s | So, for example, the L1 and the L3 are in the same range of frequencies. 420.34s - 428.34s | So we can have little problems when we are not controlling it as much as we need. 428.34s - 432.34s | And this is the panel that the operator receives here. 432.34s - 436.34s | It's completely in Spanish because this picture is taken 436.34s - 443.34s | on open source documentation that the railway company in Spain 443.34s - 447.34s | have completely publicly available on the Internet. 447.34s - 452.34s | So this is a screenshot of their documentation. 452.34s - 455.34s | And this is what the train driver sees. 455.34s - 462.34s | As you can see, this little blue dashboard has some buttons 462.34s -


chunk_id: 177_chunk_7
chunk_text:
The frequency they leave the antenna is the aspect 388.34s - 392.34s | that the railway operator is receiving inside. 392.34s - 397.34s | So the first problem is that, as you can see, 397.34s - 402.34s | a couple of different signals give different aspects. 402.34s - 407.34s | Or the same range of frequencies give different signals 407.34s - 410.34s | to the railway operator. 411.34s - 420.34s | So, for example, the L1 and the L3 are in the same range of frequencies. 420.34s - 428.34s | So we can have little problems when we are not controlling it as much as we need. 428.34s - 432.34s | And this is the panel that the operator receives here. 432.34s - 436.34s | It's completely in Spanish because this picture is taken 436.34s - 443.34s | on open source documentation that the railway company in Spain 443.34s - 447.34s | have completely publicly available on the Internet. 447.34s - 452.34s | So this is a screenshot of their documentation. 452.34s - 455.34s | And this is what the train driver sees. 455.34s - 462.34s | As you can see, this little blue dashboard has some buttons 462.34s - 466.34s | that represent the acknowledgement of the train driver 466.34s - 471.34s | that they have received this signal or the advice of this signal. 471.34s - 475.34s | So they push, I have acknowledged this signal, 475.34s - 479.34s | and I have to keep moving forward. 479.34s - 482.34s | And we get into what we call the dark territory 482.34s - 488.34s | because there have been several serious accidents in Spain 488.34s - 492.34s | related to the control of the signals. 492.34s - 495.34s | The first one is the Huarte Araquil. 495.34s - 498.34s | It was like 30 years ago. 498.34s - 504.34s | And it was related to not having any kind of beacons or signals 504.34s - 508.34s | or systems of control on the railway. 508.34s - 516.34s | And the train driver saw a signal but misconfused the signal 516.34s - 524.34s | and misinterpreted what he saw, and lots of people died. 524.34s - 531.34s | And then, like 10 years ago, when was the Galician accident? 531.34s - 534.34s | It was 10 years ago, right? 534.34s - 542.34s | They had a huge accident in


chunk_id: 177_chunk_8
chunk_text:
466.34s | that represent the acknowledgement of the train driver 466.34s - 471.34s | that they have received this signal or the advice of this signal. 471.34s - 475.34s | So they push, I have acknowledged this signal, 475.34s - 479.34s | and I have to keep moving forward. 479.34s - 482.34s | And we get into what we call the dark territory 482.34s - 488.34s | because there have been several serious accidents in Spain 488.34s - 492.34s | related to the control of the signals. 492.34s - 495.34s | The first one is the Huarte Araquil. 495.34s - 498.34s | It was like 30 years ago. 498.34s - 504.34s | And it was related to not having any kind of beacons or signals 504.34s - 508.34s | or systems of control on the railway. 508.34s - 516.34s | And the train driver saw a signal but misconfused the signal 516.34s - 524.34s | and misinterpreted what he saw, and lots of people died. 524.34s - 531.34s | And then, like 10 years ago, when was the Galician accident? 531.34s - 534.34s | It was 10 years ago, right? 534.34s - 542.34s | They had a huge accident in Spain, too, where kind of lots of people died 542.34s - 546.34s | because there was a misconfiguration between other factors. 546.34s - 549.34s | There was a misconfiguration in the ASFA system, 549.34s - 560.62s | so it could be not completely avoidable but less difficult to fix. 560.62s - 562.62s | So we have these beacons. 562.62s - 565.62s | These are the beacons that we have in the ASFA systems, 565.62s - 570.62s | and these beacons sit on the railway, 570.62s - 573.62s | and you can receive it by the capture. 573.62s - 580.37s | So I have to work here. 580.37s - 586.87s | So we have the beacon in the black box. 586.87s - 588.87s | The wood doesn't count. 588.87s - 590.87s | It's only the black box. 590.87s - 597.87s | And inside this black box is a coil and a capacitor. 597.87s - 602.87s | So we have a coil-capacitor circuit in closed loop. 602.87s - 610.87s | No batteries, no voltage here, no batteries, no IC power. 610.87s - 616.87s | So it's a passive device that is powered by the train 616.87s - 620.87s | when the train


chunk_id: 177_chunk_9
chunk_text:
Spain, too, where kind of lots of people died 542.34s - 546.34s | because there was a misconfiguration between other factors. 546.34s - 549.34s | There was a misconfiguration in the ASFA system, 549.34s - 560.62s | so it could be not completely avoidable but less difficult to fix. 560.62s - 562.62s | So we have these beacons. 562.62s - 565.62s | These are the beacons that we have in the ASFA systems, 565.62s - 570.62s | and these beacons sit on the railway, 570.62s - 573.62s | and you can receive it by the capture. 573.62s - 580.37s | So I have to work here. 580.37s - 586.87s | So we have the beacon in the black box. 586.87s - 588.87s | The wood doesn't count. 588.87s - 590.87s | It's only the black box. 590.87s - 597.87s | And inside this black box is a coil and a capacitor. 597.87s - 602.87s | So we have a coil-capacitor circuit in closed loop. 602.87s - 610.87s | No batteries, no voltage here, no batteries, no IC power. 610.87s - 616.87s | So it's a passive device that is powered by the train 616.87s - 620.87s | when the train passes along the track. 620.87s - 632.87s | So we have here a very simple circuit with a coil and capacitors in parallel. 632.87s - 643.87s | So I'm going to explain why this setup makes sense. 643.87s - 648.87s | The technology behind the ASFA system is based on induction. 648.87s - 654.87s | As you can find in your kitchen or in your phone charger, 654.87s - 660.87s | wireless, of course, and even in RFID tags and so on. 660.87s - 666.87s | But it's a very primitive kind of RFID tag. 666.87s - 670.87s | Very primitive because there is no data transmit, 670.87s - 674.87s | but it's only an aspect transmit. 674.87s - 679.43s | Where do I want to see that? 679.43s - 683.43s | It's in Spanish because it's open source. 683.43s - 690.43s | All of this is publicly available if you Google that. 690.43s - 696.43s | So a guy put this on the Internet. 696.43s - 701.43s | Oh, I have to repair an ASFA tester. 701.43s - 708.43s | An ASFA tester is a device that will be on the train path. 708.43s - 717.43s | So you


chunk_id: 177_chunk_10
chunk_text:
passes along the track. 620.87s - 632.87s | So we have here a very simple circuit with a coil and capacitors in parallel. 632.87s - 643.87s | So I'm going to explain why this setup makes sense. 643.87s - 648.87s | The technology behind the ASFA system is based on induction. 648.87s - 654.87s | As you can find in your kitchen or in your phone charger, 654.87s - 660.87s | wireless, of course, and even in RFID tags and so on. 660.87s - 666.87s | But it's a very primitive kind of RFID tag. 666.87s - 670.87s | Very primitive because there is no data transmit, 670.87s - 674.87s | but it's only an aspect transmit. 674.87s - 679.43s | Where do I want to see that? 679.43s - 683.43s | It's in Spanish because it's open source. 683.43s - 690.43s | All of this is publicly available if you Google that. 690.43s - 696.43s | So a guy put this on the Internet. 696.43s - 701.43s | Oh, I have to repair an ASFA tester. 701.43s - 708.43s | An ASFA tester is a device that will be on the train path. 708.43s - 717.43s | So you put this device above the beacon 717.43s - 722.43s | and this device reads what kind of beacon it is. 722.43s - 725.43s | So we have two coils here. 725.43s - 728.43s | The two circles are two coils. 729.43s - 735.43s | One coil is for transmit to give power to the beacon 735.43s - 738.43s | and the other one is to receive power. 738.43s - 749.99s | So what about if you use a circuit with a coil and capacitor 749.99s - 756.07s | to emulate a beacon? 756.07s - 761.07s | We could replicate a beacon and we could make a fake beacon. 761.07s - 767.07s | So we require wire and a capacitor. 767.07s - 768.07s | That's all. 768.07s - 769.07s | It's enough. 769.07s - 772.07s | It's enough for that. 772.07s - 779.07s | So I think this is the most important slide here in this talk 779.07s - 786.07s | because it represents very well how the setup is configured. 786.07s - 790.07s | So we have the beacon itself in the DAC 790.07s - 794.07s | and the beacon is, as you can see in the diagram, 794.07s -


chunk_id: 177_chunk_11
chunk_text:
put this device above the beacon 717.43s - 722.43s | and this device reads what kind of beacon it is. 722.43s - 725.43s | So we have two coils here. 725.43s - 728.43s | The two circles are two coils. 729.43s - 735.43s | One coil is for transmit to give power to the beacon 735.43s - 738.43s | and the other one is to receive power. 738.43s - 749.99s | So what about if you use a circuit with a coil and capacitor 749.99s - 756.07s | to emulate a beacon? 756.07s - 761.07s | We could replicate a beacon and we could make a fake beacon. 761.07s - 767.07s | So we require wire and a capacitor. 767.07s - 768.07s | That's all. 768.07s - 769.07s | It's enough. 769.07s - 772.07s | It's enough for that. 772.07s - 779.07s | So I think this is the most important slide here in this talk 779.07s - 786.07s | because it represents very well how the setup is configured. 786.07s - 790.07s | So we have the beacon itself in the DAC 790.07s - 794.07s | and the beacon is, as you can see in the diagram, 794.07s - 798.07s | we have a coil and a capacitor. 798.07s - 800.07s | We represented a variable capacitor 800.07s - 805.07s | because you can change the capacitance of the circuit 805.07s - 807.07s | to change the aspect. 807.07s - 811.07s | For example, if I want to transmit a red light, 811.07s - 815.07s | we change the capacitance. 815.07s - 819.07s | This beacon is by default in red signal. 819.07s - 826.07s | It's the safest symbol that is red light, obviously. 826.07s - 835.07s | So if we put a smart current temporarily to that symbol, 835.07s - 838.07s | we can change the aspect. 838.07s - 845.07s | So we only need power only to change from red to another symbol. 845.07s - 849.07s | For example, green or yellow. 849.07s - 856.07s | And the other setup here is in the train part. 856.07s - 864.07s | So we have a capture that has two items. 864.07s - 871.07s | We have a 111 kilohertz generator, IEC power. 871.07s - 875.07s | So we can generate a frequency of that kind 875.07s - 880.07s | with also a coil and a capacitor. 880.07s


chunk_id: 177_chunk_12
chunk_text:
798.07s | we have a coil and a capacitor. 798.07s - 800.07s | We represented a variable capacitor 800.07s - 805.07s | because you can change the capacitance of the circuit 805.07s - 807.07s | to change the aspect. 807.07s - 811.07s | For example, if I want to transmit a red light, 811.07s - 815.07s | we change the capacitance. 815.07s - 819.07s | This beacon is by default in red signal. 819.07s - 826.07s | It's the safest symbol that is red light, obviously. 826.07s - 835.07s | So if we put a smart current temporarily to that symbol, 835.07s - 838.07s | we can change the aspect. 838.07s - 845.07s | So we only need power only to change from red to another symbol. 845.07s - 849.07s | For example, green or yellow. 849.07s - 856.07s | And the other setup here is in the train part. 856.07s - 864.07s | So we have a capture that has two items. 864.07s - 871.07s | We have a 111 kilohertz generator, IEC power. 871.07s - 875.07s | So we can generate a frequency of that kind 875.07s - 880.07s | with also a coil and a capacitor. 880.07s - 889.07s | At the same time, the train has put together another device 889.07s - 898.07s | that receives that power by inductance coupling. 898.07s - 901.07s | Oh, I've seen 111 kilohertz. 901.07s - 905.07s | That's okay. It's working. 905.07s - 914.42s | But when the train passes... 914.42s - 918.42s | When the train passes through... 918.42s - 923.42s | When the train passes through the beacon, 923.42s - 928.42s | an inductive coupling is produced between 928.42s - 932.42s | the first coil that transmits 111 kilohertz, 932.42s - 935.42s | the second coil that receives that signal, 935.42s - 938.42s | and the third coil that is on the tracks 938.42s - 944.42s | that modifies the inductance coupling to another frequency, 945.42s - 949.42s | to the frequency that this configures that beacon. 949.42s - 955.42s | It's easy to understand. Yes? Okay? 955.42s - 959.95s | It's okay. 959.95s - 964.95s | So, that's our desk. 964.95s - 969.95s | We have the transmitter part. 969.95s - 972.95s | Firstly, to make the fake beacon, 972.95s - 977.95s | we need the framework like Java, Javascript, and so on. 977.95s - 982.95s


chunk_id: 177_chunk_13
chunk_text:
- 889.07s | At the same time, the train has put together another device 889.07s - 898.07s | that receives that power by inductance coupling. 898.07s - 901.07s | Oh, I've seen 111 kilohertz. 901.07s - 905.07s | That's okay. It's working. 905.07s - 914.42s | But when the train passes... 914.42s - 918.42s | When the train passes through... 918.42s - 923.42s | When the train passes through the beacon, 923.42s - 928.42s | an inductive coupling is produced between 928.42s - 932.42s | the first coil that transmits 111 kilohertz, 932.42s - 935.42s | the second coil that receives that signal, 935.42s - 938.42s | and the third coil that is on the tracks 938.42s - 944.42s | that modifies the inductance coupling to another frequency, 945.42s - 949.42s | to the frequency that this configures that beacon. 949.42s - 955.42s | It's easy to understand. Yes? Okay? 955.42s - 959.95s | It's okay. 959.95s - 964.95s | So, that's our desk. 964.95s - 969.95s | We have the transmitter part. 969.95s - 972.95s | Firstly, to make the fake beacon, 972.95s - 977.95s | we need the framework like Java, Javascript, and so on. 977.95s - 982.95s | So, this is our code editor. 982.95s - 987.95s | So we need a framework to test the beacon 987.95s - 992.95s | at that point that was not existing. 992.95s - 995.95s | So, firstly we need a transmitter. 995.95s - 998.95s | So, we set up a coil and a capacitor 998.95s - 1006.95s | that is suitable to transmit power at 111 kilohertz. 1006.95s - 1008.95s | Okay? 1008.95s - 1012.95s | We use an AliExpress device called NanoVNeA 1012.95s - 1018.95s | that is a vector network analyzer that you can buy. 1018.95s - 1021.95s | It's cheap. 1022.95s - 1026.95s | You can see the impedance, the inductance, the resonance, and so on. 1026.95s - 1032.52s | So, this is the receiver part. 1032.52s - 1035.52s | It's more or less the same setup, 1035.52s - 1042.52s | but instead of transmitting power, it receives power. 1042.52s - 1053.52s | So, it's fine tuned to capture frequencies from 50 kilohertz to 111. 1053.52s - 1061.52s | So, it's very wide range to capture all the aspects of any beacon. 1061.52s - 1070.52s | So, we have a signal generator, also from AliExpress. 1070.52s -


chunk_id: 177_chunk_14
chunk_text:
| So, this is our code editor. 982.95s - 987.95s | So we need a framework to test the beacon 987.95s - 992.95s | at that point that was not existing. 992.95s - 995.95s | So, firstly we need a transmitter. 995.95s - 998.95s | So, we set up a coil and a capacitor 998.95s - 1006.95s | that is suitable to transmit power at 111 kilohertz. 1006.95s - 1008.95s | Okay? 1008.95s - 1012.95s | We use an AliExpress device called NanoVNeA 1012.95s - 1018.95s | that is a vector network analyzer that you can buy. 1018.95s - 1021.95s | It's cheap. 1022.95s - 1026.95s | You can see the impedance, the inductance, the resonance, and so on. 1026.95s - 1032.52s | So, this is the receiver part. 1032.52s - 1035.52s | It's more or less the same setup, 1035.52s - 1042.52s | but instead of transmitting power, it receives power. 1042.52s - 1053.52s | So, it's fine tuned to capture frequencies from 50 kilohertz to 111. 1053.52s - 1061.52s | So, it's very wide range to capture all the aspects of any beacon. 1061.52s - 1070.52s | So, we have a signal generator, also from AliExpress. 1070.52s - 1076.52s | And we receive that signal on the receiver part. 1076.52s - 1080.52s | So, we already have the tester. 1080.52s - 1087.08s | So, we need to make the beacon itself. 1087.08s - 1094.08s | So, what if two people here or not here could replicate this beacon 1094.08s - 1098.08s | and show it to you right now? 1098.08s - 1099.08s | Shall we? 1099.08s - 1101.08s | I'll pay you for that. 1101.08s - 1104.94s | It's my turn. 1104.94s - 1106.94s | The tester. 1110.94s - 1116.94s | Well, the most important part of this tester we did is a can of morteruero de cuenca, 1116.94s - 1118.94s | which is... 1118.94s - 1122.94s | They are laughing because morteruero de cuenca means meat in a can. 1122.94s - 1123.94s | Okay? 1123.94s - 1129.94s | So, it's what helped us to have this coil or setup. 1129.94s - 1131.94s | And it works perfectly. 1131.94s - 1136.94s | So, meat in a can may be a key factor in this tester. 1136.94s - 1137.94s | Okay? 1137.94s - 1141.94s | And the second part is the beacon. 1141.94s - 1142.94s | Okay. 1142.94s -


chunk_id: 177_chunk_15
chunk_text:
1076.52s | And we receive that signal on the receiver part. 1076.52s - 1080.52s | So, we already have the tester. 1080.52s - 1087.08s | So, we need to make the beacon itself. 1087.08s - 1094.08s | So, what if two people here or not here could replicate this beacon 1094.08s - 1098.08s | and show it to you right now? 1098.08s - 1099.08s | Shall we? 1099.08s - 1101.08s | I'll pay you for that. 1101.08s - 1104.94s | It's my turn. 1104.94s - 1106.94s | The tester. 1110.94s - 1116.94s | Well, the most important part of this tester we did is a can of morteruero de cuenca, 1116.94s - 1118.94s | which is... 1118.94s - 1122.94s | They are laughing because morteruero de cuenca means meat in a can. 1122.94s - 1123.94s | Okay? 1123.94s - 1129.94s | So, it's what helped us to have this coil or setup. 1129.94s - 1131.94s | And it works perfectly. 1131.94s - 1136.94s | So, meat in a can may be a key factor in this tester. 1136.94s - 1137.94s | Okay? 1137.94s - 1141.94s | And the second part is the beacon. 1141.94s - 1142.94s | Okay. 1142.94s - 1149.94s | So, we could replicate the beacon by following the calculus that you can do with data 1149.94s - 1158.94s | that is completely, I repeat, completely available on the Internet in open source information. 1158.94s - 1164.94s | So, this one is the L5 as you saw. 1164.94s - 1165.94s | One second. 1165.94s - 1170.94s | Here, this one is the L5, the yellow sign. 1170.94s - 1178.94s | And for legal reasons, we cannot show you here on this stage the proof that this works. 1178.94s - 1184.94s | But outside of the stage, anyone that comes and asks will have the answer. 1184.94s - 1185.94s | Okay? 1189.21s - 1194.21s | We don't want to go to jail, but we like to brag about our things. 1194.21s - 1195.21s | Yeah, okay. 1206.07s - 1208.07s | Hacking. 1208.07s - 1222.91s | So, as a computer engineer, I have to make the work of the electronic engineer here. 1222.91s - 1229.91s | So, if any electronic engineer here can come to explain that, and we rest here. 1229.91s - 1237.91s | So, if there is any electronic engineer in the house, is there any electronic engineer


chunk_id: 177_chunk_16
chunk_text:
1149.94s | So, we could replicate the beacon by following the calculus that you can do with data 1149.94s - 1158.94s | that is completely, I repeat, completely available on the Internet in open source information. 1158.94s - 1164.94s | So, this one is the L5 as you saw. 1164.94s - 1165.94s | One second. 1165.94s - 1170.94s | Here, this one is the L5, the yellow sign. 1170.94s - 1178.94s | And for legal reasons, we cannot show you here on this stage the proof that this works. 1178.94s - 1184.94s | But outside of the stage, anyone that comes and asks will have the answer. 1184.94s - 1185.94s | Okay? 1189.21s - 1194.21s | We don't want to go to jail, but we like to brag about our things. 1194.21s - 1195.21s | Yeah, okay. 1206.07s - 1208.07s | Hacking. 1208.07s - 1222.91s | So, as a computer engineer, I have to make the work of the electronic engineer here. 1222.91s - 1229.91s | So, if any electronic engineer here can come to explain that, and we rest here. 1229.91s - 1237.91s | So, if there is any electronic engineer in the house, is there any electronic engineer here? 1237.91s - 1239.91s | Just raise your hand. 1239.91s - 1246.23s | Okay, we are sorry in advance. 1246.23s - 1265.23s | So, when you put current in an inductor and capacitive circuit, it's like magic, you know. 1265.23s - 1266.23s | It's magic. 1266.23s - 1269.23s | Indeed, it's black magic here. 1269.23s - 1273.23s | Because when you put a set of frequencies, 1273.23s - 1283.23s | So, the circuit behaves differently according to the frequency that you put in the circuit. 1283.23s - 1289.23s | We, the computing engineers here, we couldn't understand this. 1290.23s - 1303.23s | The circuit behaves as a capacitive, as a virtual capacitor, as a virtual resistance, or as a virtual inductor. 1303.23s - 1306.23s | It's okay, eh? That's cool. 1306.23s - 1314.23s | You don't get rid of virtual devices even if you are an electronic engineer. 1315.23s - 1326.23s | The point here is to design a circuit that resonates at a very specific and very narrow set of frequencies. 1326.23s - 1336.23s | Indeed, you need to resonate at a very narrow interval of frequencies. 1336.23s - 1345.23s | So, as you see, as Gabs explained to


chunk_id: 177_chunk_17
chunk_text:
here? 1237.91s - 1239.91s | Just raise your hand. 1239.91s - 1246.23s | Okay, we are sorry in advance. 1246.23s - 1265.23s | So, when you put current in an inductor and capacitive circuit, it's like magic, you know. 1265.23s - 1266.23s | It's magic. 1266.23s - 1269.23s | Indeed, it's black magic here. 1269.23s - 1273.23s | Because when you put a set of frequencies, 1273.23s - 1283.23s | So, the circuit behaves differently according to the frequency that you put in the circuit. 1283.23s - 1289.23s | We, the computing engineers here, we couldn't understand this. 1290.23s - 1303.23s | The circuit behaves as a capacitive, as a virtual capacitor, as a virtual resistance, or as a virtual inductor. 1303.23s - 1306.23s | It's okay, eh? That's cool. 1306.23s - 1314.23s | You don't get rid of virtual devices even if you are an electronic engineer. 1315.23s - 1326.23s | The point here is to design a circuit that resonates at a very specific and very narrow set of frequencies. 1326.23s - 1336.23s | Indeed, you need to resonate at a very narrow interval of frequencies. 1336.23s - 1345.23s | So, as you see, as Gabs explained to you, we need a circuit that resonates at a certain set of frequencies 1345.23s - 1350.23s | to make the train think that this is a symbol. 1350.23s - 1358.23s | It's a real symbol, a red light, a green light, a yellow, even a yellow and green light. 1358.23s - 1360.23s | That exists. 1360.23s - 1364.23s | It's trainiac stuff, don't worry. 1365.23s - 1370.23s | So, we need that, but how do you do that? 1370.23s - 1372.23s | We are computing engineers. 1372.23s - 1385.24s | So, we need to wire, by public photos and seeing the device in real world, 1385.24s - 1389.24s | we can get the dimensions of the beacon. 1389.24s - 1394.24s | We can guess that because there is a public documentation, 1394.24s - 1401.24s | but they don't give you the exact details to make the beacon, obviously. 1401.24s - 1405.24s | So, you have to guess that at some point. 1405.24s - 1411.24s | So, guessing the dimensions of the beacon and the shape, indeed, 1412.24s - 1421.24s | we started to wire one turn, two turns, three turns, all day long. 1421.24s - 1428.24s | So, we asked


chunk_id: 177_chunk_18
chunk_text:
you, we need a circuit that resonates at a certain set of frequencies 1345.23s - 1350.23s | to make the train think that this is a symbol. 1350.23s - 1358.23s | It's a real symbol, a red light, a green light, a yellow, even a yellow and green light. 1358.23s - 1360.23s | That exists. 1360.23s - 1364.23s | It's trainiac stuff, don't worry. 1365.23s - 1370.23s | So, we need that, but how do you do that? 1370.23s - 1372.23s | We are computing engineers. 1372.23s - 1385.24s | So, we need to wire, by public photos and seeing the device in real world, 1385.24s - 1389.24s | we can get the dimensions of the beacon. 1389.24s - 1394.24s | We can guess that because there is a public documentation, 1394.24s - 1401.24s | but they don't give you the exact details to make the beacon, obviously. 1401.24s - 1405.24s | So, you have to guess that at some point. 1405.24s - 1411.24s | So, guessing the dimensions of the beacon and the shape, indeed, 1412.24s - 1421.24s | we started to wire one turn, two turns, three turns, all day long. 1421.24s - 1428.24s | So, we asked ourselves, what am I doing with my life? 1428.24s - 1432.24s | I could be in the swimming pool. 1432.24s - 1437.24s | So, we end with a lot of turns and what happens now? 1437.24s - 1442.24s | So, we tested with the nano VNA and nothing works. 1442.24s - 1449.24s | The resonance of the circuit is very far from the target resonance. 1449.24s - 1456.24s | So, we cut the wire and we put on the nano VNA. 1456.24s - 1462.24s | So, we start to wire another round of turns. 1462.24s - 1470.24s | And we saw real time how this graph moves in real time, 1470.24s - 1477.24s | getting closer and closer and closer to the target frequency or the desired symbol. 1477.24s - 1483.24s | So, turning and turning and messing it up and what the fuck. 1483.24s - 1487.24s | So, we achieved one symbol. 1487.24s - 1498.62s | So, indeed, this is not a real coil capacitor setup, but it's a double inductor setup. 1498.62s - 1506.62s | There are two inductors put together and taking advantage of the parasitic capacitance. 1506.62s - 1514.62s | We have a virtual NC circuit


chunk_id: 177_chunk_19
chunk_text:
ourselves, what am I doing with my life? 1428.24s - 1432.24s | I could be in the swimming pool. 1432.24s - 1437.24s | So, we end with a lot of turns and what happens now? 1437.24s - 1442.24s | So, we tested with the nano VNA and nothing works. 1442.24s - 1449.24s | The resonance of the circuit is very far from the target resonance. 1449.24s - 1456.24s | So, we cut the wire and we put on the nano VNA. 1456.24s - 1462.24s | So, we start to wire another round of turns. 1462.24s - 1470.24s | And we saw real time how this graph moves in real time, 1470.24s - 1477.24s | getting closer and closer and closer to the target frequency or the desired symbol. 1477.24s - 1483.24s | So, turning and turning and messing it up and what the fuck. 1483.24s - 1487.24s | So, we achieved one symbol. 1487.24s - 1498.62s | So, indeed, this is not a real coil capacitor setup, but it's a double inductor setup. 1498.62s - 1506.62s | There are two inductors put together and taking advantage of the parasitic capacitance. 1506.62s - 1514.62s | We have a virtual NC circuit that makes the same work at the real device. 1514.62s - 1518.62s | We know that the real device is one coil and one capacitor. 1518.62s - 1528.62s | But this stuff is two coils put together and taking advantage of the parasitic capacitance. 1528.62s - 1533.62s | So, this is the center frequency. 1533.62s - 1538.62s | And less frequency, the circuit behaves as a capacitor. 1538.62s - 1543.62s | The more frequency, the circuit behaves as an inductor. 1543.62s - 1549.62s | So, at the very exact point, the circuit is a resistance. 1549.62s - 1562.15s | So, this is the graph that you have to see to make sure you are doing right. 1562.15s - 1569.15s | In order to achieve the correct resonance frequency. 1569.15s - 1580.15s | The yellow line is the resonance that has to be just in the middle of the graph. 1580.15s - 1585.15s | The green line is the impedance. 1585.15s - 1590.15s | So, it has to be as low as possible at the resonant point. 1590.15s - 1593.15s | And the other one is the standing wave radio. 1593.15s - 1603.68s | That is how well is the energy


chunk_id: 177_chunk_20
chunk_text:
that makes the same work at the real device. 1514.62s - 1518.62s | We know that the real device is one coil and one capacitor. 1518.62s - 1528.62s | But this stuff is two coils put together and taking advantage of the parasitic capacitance. 1528.62s - 1533.62s | So, this is the center frequency. 1533.62s - 1538.62s | And less frequency, the circuit behaves as a capacitor. 1538.62s - 1543.62s | The more frequency, the circuit behaves as an inductor. 1543.62s - 1549.62s | So, at the very exact point, the circuit is a resistance. 1549.62s - 1562.15s | So, this is the graph that you have to see to make sure you are doing right. 1562.15s - 1569.15s | In order to achieve the correct resonance frequency. 1569.15s - 1580.15s | The yellow line is the resonance that has to be just in the middle of the graph. 1580.15s - 1585.15s | The green line is the impedance. 1585.15s - 1590.15s | So, it has to be as low as possible at the resonant point. 1590.15s - 1593.15s | And the other one is the standing wave radio. 1593.15s - 1603.68s | That is how well is the energy transferred from the system to outside and backwards. 1603.68s - 1606.68s | So, that is the device. 1606.68s - 1611.68s | As you can see, it's very complex, very expensive. 1611.68s - 1612.68s | And beautiful. 1612.68s - 1613.68s | And beautiful. 1613.68s - 1617.68s | Because it has, I think, this Amazon cardboard. 1617.68s - 1619.68s | Thank you, Amazon. 1619.68s - 1621.68s | Thank you, Amazon. 1621.68s - 1629.68s | And you have to use isolated copper wire. 1629.68s - 1638.68s | So, once we have this item, we have to put glue on the device. 1638.68s - 1639.68s | That is very important. 1639.68s - 1646.68s | Because you make with the fingers any movement and the frequency changes. 1646.68s - 1648.68s | It's crazy. 1648.68s - 1649.68s | It's crazy. 1649.68s - 1654.68s | So, you take the device and no more works. 1654.68s - 1664.68s | So, you have to glue the wire to make sure that the center frequency remains at the target frequency. 1664.68s - 1668.68s | In the tester, the most important was the glue. 1668.68s - 1676.68s | The most important thing in the tester is the can of meat. 1676.68s


chunk_id: 177_chunk_21
chunk_text:
transferred from the system to outside and backwards. 1603.68s - 1606.68s | So, that is the device. 1606.68s - 1611.68s | As you can see, it's very complex, very expensive. 1611.68s - 1612.68s | And beautiful. 1612.68s - 1613.68s | And beautiful. 1613.68s - 1617.68s | Because it has, I think, this Amazon cardboard. 1617.68s - 1619.68s | Thank you, Amazon. 1619.68s - 1621.68s | Thank you, Amazon. 1621.68s - 1629.68s | And you have to use isolated copper wire. 1629.68s - 1638.68s | So, once we have this item, we have to put glue on the device. 1638.68s - 1639.68s | That is very important. 1639.68s - 1646.68s | Because you make with the fingers any movement and the frequency changes. 1646.68s - 1648.68s | It's crazy. 1648.68s - 1649.68s | It's crazy. 1649.68s - 1654.68s | So, you take the device and no more works. 1654.68s - 1664.68s | So, you have to glue the wire to make sure that the center frequency remains at the target frequency. 1664.68s - 1668.68s | In the tester, the most important was the glue. 1668.68s - 1676.68s | The most important thing in the tester is the can of meat. 1676.68s - 1677.68s | Here is the glue. 1677.68s - 1681.68s | The key component. 1681.68s - 1684.96s | Yeah, I'm sorry. 1684.96s - 1688.96s | I'm seeing the electronic engineering looking at us. 1688.96s - 1691.96s | Sorry, really. 1691.96s - 1694.96s | I have stickers for you to compensate this. 1694.96s - 1702.04s | So, how do you know that this works? 1702.04s - 1708.04s | Well, firstly, you have to know what to see. 1709.04s - 1713.04s | It's a key factor. 1713.04s - 1716.04s | You have to know that I have to see things. 1716.04s - 1726.04s | So, in the picture on the left, we have the default frequency being received by the receiver device. 1726.04s - 1730.04s | So, we transmit 111 kHz. 1730.04s - 1732.04s | Okay, I'm working. 1732.04s - 1735.04s | I'm receiving the same frequency as the train transmits. 1736.04s - 1741.04s | That's a permanent testing that the system works. 1741.04s - 1755.04s | So, the left one, the right one, is when you pass through a beacon. 1755.04s - 1762.04s | So, you see another spike on the spectrum analyzer. 1762.04s - 1769.04s | You have another spike


chunk_id: 177_chunk_22
chunk_text:
- 1677.68s | Here is the glue. 1677.68s - 1681.68s | The key component. 1681.68s - 1684.96s | Yeah, I'm sorry. 1684.96s - 1688.96s | I'm seeing the electronic engineering looking at us. 1688.96s - 1691.96s | Sorry, really. 1691.96s - 1694.96s | I have stickers for you to compensate this. 1694.96s - 1702.04s | So, how do you know that this works? 1702.04s - 1708.04s | Well, firstly, you have to know what to see. 1709.04s - 1713.04s | It's a key factor. 1713.04s - 1716.04s | You have to know that I have to see things. 1716.04s - 1726.04s | So, in the picture on the left, we have the default frequency being received by the receiver device. 1726.04s - 1730.04s | So, we transmit 111 kHz. 1730.04s - 1732.04s | Okay, I'm working. 1732.04s - 1735.04s | I'm receiving the same frequency as the train transmits. 1736.04s - 1741.04s | That's a permanent testing that the system works. 1741.04s - 1755.04s | So, the left one, the right one, is when you pass through a beacon. 1755.04s - 1762.04s | So, you see another spike on the spectrum analyzer. 1762.04s - 1769.04s | You have another spike that represents the resonant frequency of the device, of the beacon. 1769.04s - 1773.77s | So, that works. 1773.77s - 1785.13s | Thank you for this sincere applause. 1785.13s - 1789.13s | So, where should I place my fake beacon? 1789.13s - 1797.13s | Well, the official documentation already tells you where to put your device, your fake device. 1797.13s - 1799.13s | So, that's the dimension. 1799.13s - 1811.13s | You have to keep a distance from the rails and a certain height from the sleepers. 1811.13s - 1828.40s | So, the most important thing is that it matches the position perfectly to make all the setup take place, the induction coupling. 1828.40s - 1838.40s | This is not a radio frequency stuff, but it's more an inductive coupling. 1838.40s - 1848.40s | We firstly thought that it was a radio frequency problem, but it's more like an inductive coupling, as Gabriela says to you. 1848.40s - 1857.86s | So, what about other systems all over Europe and worldwide? 1857.86s - 1861.86s | Well, in the UK, you have the AWS system. 1861.86s - 1863.86s | Not powered by Amazon. 1863.86s - 1866.86s | Not powered by Amazon. 1866.86s


chunk_id: 177_chunk_23
chunk_text:
that represents the resonant frequency of the device, of the beacon. 1769.04s - 1773.77s | So, that works. 1773.77s - 1785.13s | Thank you for this sincere applause. 1785.13s - 1789.13s | So, where should I place my fake beacon? 1789.13s - 1797.13s | Well, the official documentation already tells you where to put your device, your fake device. 1797.13s - 1799.13s | So, that's the dimension. 1799.13s - 1811.13s | You have to keep a distance from the rails and a certain height from the sleepers. 1811.13s - 1828.40s | So, the most important thing is that it matches the position perfectly to make all the setup take place, the induction coupling. 1828.40s - 1838.40s | This is not a radio frequency stuff, but it's more an inductive coupling. 1838.40s - 1848.40s | We firstly thought that it was a radio frequency problem, but it's more like an inductive coupling, as Gabriela says to you. 1848.40s - 1857.86s | So, what about other systems all over Europe and worldwide? 1857.86s - 1861.86s | Well, in the UK, you have the AWS system. 1861.86s - 1863.86s | Not powered by Amazon. 1863.86s - 1866.86s | Not powered by Amazon. 1866.86s - 1877.86s | Indeed, the Spanish system is the most sophisticated legacy system, because they have more symbols to transmit. 1877.86s - 1880.86s | The UK system only has two symbols. 1880.86s - 1883.86s | Go and stop. That's all. 1883.86s - 1887.86s | So, you see a star in the cabin. 1887.86s - 1889.86s | It's called the sunflower. 1889.86s - 1891.86s | Sunflower. 1891.86s - 1896.43s | It's okay. Not okay. That's all. 1896.43s - 1899.43s | And this is the Indus Sea. 1899.43s - 1903.43s | In German, it's very... 1909.43s - 1913.43s | It has a name in German that we don't know how to spell. 1913.43s - 1919.43s | So, let's call it Indus Sea and let's have some fun. 1919.43s - 1924.43s | We don't want to offend German people. 1924.43s - 1931.43s | So, there is also that kind of systems that is based on the same principle. 1931.43s - 1936.43s | But they are not one-to-one compatible. 1936.43s - 1943.43s | So, you will have to make your own device adjusted to that kind of setups. 1943.43s - 1952.35s | And that is the North American system that also is based on


chunk_id: 177_chunk_24
chunk_text:
- 1877.86s | Indeed, the Spanish system is the most sophisticated legacy system, because they have more symbols to transmit. 1877.86s - 1880.86s | The UK system only has two symbols. 1880.86s - 1883.86s | Go and stop. That's all. 1883.86s - 1887.86s | So, you see a star in the cabin. 1887.86s - 1889.86s | It's called the sunflower. 1889.86s - 1891.86s | Sunflower. 1891.86s - 1896.43s | It's okay. Not okay. That's all. 1896.43s - 1899.43s | And this is the Indus Sea. 1899.43s - 1903.43s | In German, it's very... 1909.43s - 1913.43s | It has a name in German that we don't know how to spell. 1913.43s - 1919.43s | So, let's call it Indus Sea and let's have some fun. 1919.43s - 1924.43s | We don't want to offend German people. 1924.43s - 1931.43s | So, there is also that kind of systems that is based on the same principle. 1931.43s - 1936.43s | But they are not one-to-one compatible. 1936.43s - 1943.43s | So, you will have to make your own device adjusted to that kind of setups. 1943.43s - 1952.35s | And that is the North American system that also is based on the same principle. 1952.35s - 1960.35s | But they are not entirely widespread on all the tracks. 1960.35s - 1963.35s | It's an intermittent system. 1963.35s - 1970.46s | But it's based, again, on the same principle, by induction. 1970.46s - 1976.09s | What about new things? 1977.09s - 1979.09s | No. 1979.09s - 1988.09s | Well, we talk about a legacy system that was invented in the middle of the 20th century. 1988.09s - 1990.09s | So, what about new systems? 1990.09s - 1996.09s | We're talking about new because it was invented in the 90s. 1996.09s - 1998.09s | Okay? Cool. 1998.09s - 2008.72s | Well, we have the ATCS, the European Trade Control System, that is based, again, on beacons. 2008.72s - 2011.72s | But they transmit digital data. 2011.72s - 2016.72s | So, we will talk about this next year, maybe. 2017.72s - 2030.72s | So, the main thing here is that all the European regions have very different systems. 2030.72s - 2037.06s | And they thought, what about a new protocol? 2037.06s - 2046.06s | So, we have a new protocol that covers all Europe, but it is not implemented already widespread. 2046.06s - 2051.06s


chunk_id: 177_chunk_25
chunk_text:
the same principle. 1952.35s - 1960.35s | But they are not entirely widespread on all the tracks. 1960.35s - 1963.35s | It's an intermittent system. 1963.35s - 1970.46s | But it's based, again, on the same principle, by induction. 1970.46s - 1976.09s | What about new things? 1977.09s - 1979.09s | No. 1979.09s - 1988.09s | Well, we talk about a legacy system that was invented in the middle of the 20th century. 1988.09s - 1990.09s | So, what about new systems? 1990.09s - 1996.09s | We're talking about new because it was invented in the 90s. 1996.09s - 1998.09s | Okay? Cool. 1998.09s - 2008.72s | Well, we have the ATCS, the European Trade Control System, that is based, again, on beacons. 2008.72s - 2011.72s | But they transmit digital data. 2011.72s - 2016.72s | So, we will talk about this next year, maybe. 2017.72s - 2030.72s | So, the main thing here is that all the European regions have very different systems. 2030.72s - 2037.06s | And they thought, what about a new protocol? 2037.06s - 2046.06s | So, we have a new protocol that covers all Europe, but it is not implemented already widespread. 2046.06s - 2051.06s | Only in high-speed trains and very crowded lines. 2051.06s - 2054.06s | Because it takes money, you know. 2054.06s - 2060.66s | So, it combines beacons called Euroballis. 2060.66s - 2063.66s | I like more beacons. 2063.66s - 2073.66s | And they combine that system with some kind of mobile communications, changing the protocol. 2073.66s - 2076.66s | It's called JCM-Air. 2076.66s - 2084.75s | Air means railroad. 2084.75s - 2085.75s | Okay. 2085.75s - 2094.75s | So, as you have seen in the whole presentation, what we have discovered is that by inductive coupling, 2094.75s - 2101.75s | we can reach the most of the signaling system in Spain. 2101.75s - 2111.75s | Because they don't use this system, ATCS, in most of the railway segments. 2111.75s - 2121.75s | So, what we have is now security problems that was, in their time, a really robust protocol. 2121.75s - 2128.75s | Because these kinds of protocols are not being properly revised. 2128.75s - 2136.75s | So, one of the main things that we receive when we talk about this investigation is why we are talking about this. 2136.75s - 2146.75s | And the reason is that we want


chunk_id: 177_chunk_26
chunk_text:
| Only in high-speed trains and very crowded lines. 2051.06s - 2054.06s | Because it takes money, you know. 2054.06s - 2060.66s | So, it combines beacons called Euroballis. 2060.66s - 2063.66s | I like more beacons. 2063.66s - 2073.66s | And they combine that system with some kind of mobile communications, changing the protocol. 2073.66s - 2076.66s | It's called JCM-Air. 2076.66s - 2084.75s | Air means railroad. 2084.75s - 2085.75s | Okay. 2085.75s - 2094.75s | So, as you have seen in the whole presentation, what we have discovered is that by inductive coupling, 2094.75s - 2101.75s | we can reach the most of the signaling system in Spain. 2101.75s - 2111.75s | Because they don't use this system, ATCS, in most of the railway segments. 2111.75s - 2121.75s | So, what we have is now security problems that was, in their time, a really robust protocol. 2121.75s - 2128.75s | Because these kinds of protocols are not being properly revised. 2128.75s - 2136.75s | So, one of the main things that we receive when we talk about this investigation is why we are talking about this. 2136.75s - 2146.75s | And the reason is that we want companies to revise these kinds of systems. 2146.75s - 2154.75s | For example, we can adopt this new ATCS system. 2154.75s - 2162.75s | This system started being quite less robust, but now it's like in level 3, developing level 3. 2162.75s - 2168.75s | And having very good results in terms of security. 2168.75s - 2170.75s | But it costs money. 2170.75s - 2180.75s | And money is a key factor in the decision making of the petitions and authorities related to this. 2180.75s - 2191.75s | So, one of the other measures that we can offer, and we are completely willing to work with authorities in that, 2191.75s - 2197.75s | is the usage, for example, of trained drones that are being developed. 2197.75s - 2200.75s | This one is AI generated, okay? 2200.75s - 2203.75s | Because I didn't find the picture. 2203.75s - 2210.75s | Italy has now quite bigger, but yet tiny, trained drones. 2210.75s - 2221.75s | And these trained drones can be deployed through the whole railway segments to investigate or inspect the beacons. 2221.75s - 2231.75s | Just to know if there is anything, any weird objects, for example, in the railway,


chunk_id: 177_chunk_27
chunk_text:
companies to revise these kinds of systems. 2146.75s - 2154.75s | For example, we can adopt this new ATCS system. 2154.75s - 2162.75s | This system started being quite less robust, but now it's like in level 3, developing level 3. 2162.75s - 2168.75s | And having very good results in terms of security. 2168.75s - 2170.75s | But it costs money. 2170.75s - 2180.75s | And money is a key factor in the decision making of the petitions and authorities related to this. 2180.75s - 2191.75s | So, one of the other measures that we can offer, and we are completely willing to work with authorities in that, 2191.75s - 2197.75s | is the usage, for example, of trained drones that are being developed. 2197.75s - 2200.75s | This one is AI generated, okay? 2200.75s - 2203.75s | Because I didn't find the picture. 2203.75s - 2210.75s | Italy has now quite bigger, but yet tiny, trained drones. 2210.75s - 2221.75s | And these trained drones can be deployed through the whole railway segments to investigate or inspect the beacons. 2221.75s - 2231.75s | Just to know if there is anything, any weird objects, for example, in the railway, or anyone has covered these beacons. 2231.75s - 2248.75s | Because these kind of beacons, ASFA beacons, can be just shot down by putting above them a plaque, a slice of lead. 2248.75s - 2260.75s | So, we are trying to make quite a concern and talk with our authorities to make them inspect them. 2260.75s - 2271.75s | Another object they can use are normal drones, just surveillance and looking at these railway segments just to, again, 2271.75s - 2278.75s | know if there is any strange objects in the railway segments. 2278.75s - 2287.75s | And, of course, we can use testers and pass testers more frequently just to know everything is okay with the beacons. 2287.75s - 2299.75s | Actually, we don't have to create this chaos or fear, just want to have more intensity in the inspection rounds 2299.75s - 2307.75s | or to change these devices into more newer devices around the world. 2307.75s - 2314.75s | Because this investigation is based on the most robust legacy system, that is the ASFA. 2315.75s - 2319.75s | But here Amtrak is using it, UK is using it. 2319.75s - 2322.75s | Not the same, but less


chunk_id: 177_chunk_28
chunk_text:
or anyone has covered these beacons. 2231.75s - 2248.75s | Because these kind of beacons, ASFA beacons, can be just shot down by putting above them a plaque, a slice of lead. 2248.75s - 2260.75s | So, we are trying to make quite a concern and talk with our authorities to make them inspect them. 2260.75s - 2271.75s | Another object they can use are normal drones, just surveillance and looking at these railway segments just to, again, 2271.75s - 2278.75s | know if there is any strange objects in the railway segments. 2278.75s - 2287.75s | And, of course, we can use testers and pass testers more frequently just to know everything is okay with the beacons. 2287.75s - 2299.75s | Actually, we don't have to create this chaos or fear, just want to have more intensity in the inspection rounds 2299.75s - 2307.75s | or to change these devices into more newer devices around the world. 2307.75s - 2314.75s | Because this investigation is based on the most robust legacy system, that is the ASFA. 2315.75s - 2319.75s | But here Amtrak is using it, UK is using it. 2319.75s - 2322.75s | Not the same, but less robust systems. 2322.75s - 2325.75s | And, of course, Germany, Austria, Hungary. 2325.75s - 2334.75s | So, we can work to change this or at least to revise this to keep everyone safe around the world. 2334.75s - 2340.75s | So, thanks everyone that helped us to get here. 2340.75s - 2353.37s | And, of course, we are here for the questions. 2353.37s - 2356.38s | Yes? 2362.70s - 2364.70s | Right, thanks for the talk. 2364.70s - 2367.70s | Very educational, funny and scary, honestly. 2367.70s - 2376.70s | When you have a signal that can display multiple aspects, how does that relate to the meat cans that are set on the track? 2376.70s - 2381.70s | Does it change its own resonance to reflect the current aspect on the signal? 2381.70s - 2382.70s | Yeah, actually they do. 2382.70s - 2392.70s | Because what differentiates one signal through the other is the state they leave the capacitor circuit in the train. 2392.70s - 2400.70s | So, the difference between these frequencies is the aspect the operator receives inside the train. 2401.70s - 2403.94s | Okay. 2403.94s - 2404.94s | Okay. 2404.94s - 2412.94s | What are the related


chunk_id: 177_chunk_29
chunk_text:
robust systems. 2322.75s - 2325.75s | And, of course, Germany, Austria, Hungary. 2325.75s - 2334.75s | So, we can work to change this or at least to revise this to keep everyone safe around the world. 2334.75s - 2340.75s | So, thanks everyone that helped us to get here. 2340.75s - 2353.37s | And, of course, we are here for the questions. 2353.37s - 2356.38s | Yes? 2362.70s - 2364.70s | Right, thanks for the talk. 2364.70s - 2367.70s | Very educational, funny and scary, honestly. 2367.70s - 2376.70s | When you have a signal that can display multiple aspects, how does that relate to the meat cans that are set on the track? 2376.70s - 2381.70s | Does it change its own resonance to reflect the current aspect on the signal? 2381.70s - 2382.70s | Yeah, actually they do. 2382.70s - 2392.70s | Because what differentiates one signal through the other is the state they leave the capacitor circuit in the train. 2392.70s - 2400.70s | So, the difference between these frequencies is the aspect the operator receives inside the train. 2401.70s - 2403.94s | Okay. 2403.94s - 2404.94s | Okay. 2404.94s - 2412.94s | What are the related risks or threats related with this finding that you get? 2412.94s - 2422.94s | Mostly, beyond that, to prevent accidentality in the trains, what are the risks? 2422.94s - 2424.94s | The risks? 2425.94s - 2432.94s | Well, actually we started this investigation because in Spain we are in terrorist alert 4 from 5. 2432.94s - 2442.94s | So, it's quite important because most of the biggest accidents that have happened in Spain have happened with trains. 2442.94s - 2451.94s | Actually, we have a real difficult incident that happened on the 11th of March, 2451.94s - 2461.94s | that marked before and after on the way that people seized the railway and the metro in Spain. 2461.94s - 2469.94s | So, any people with the right amount of motivation and knowledge could exploit this. 2469.94s - 2475.94s | So, we want to make a wake-up call before something like this happens 2475.94s - 2484.94s | and make people invest more time and money to keep the safety around Spain and of course around the world, 2484.94s - 2487.94s | because this again happens mostly everywhere. 2487.94s - 2491.19s | So, thanks. This is really fascinating. 2491.19s - 2499.19s |


chunk_id: 177_chunk_30
chunk_text:
risks or threats related with this finding that you get? 2412.94s - 2422.94s | Mostly, beyond that, to prevent accidentality in the trains, what are the risks? 2422.94s - 2424.94s | The risks? 2425.94s - 2432.94s | Well, actually we started this investigation because in Spain we are in terrorist alert 4 from 5. 2432.94s - 2442.94s | So, it's quite important because most of the biggest accidents that have happened in Spain have happened with trains. 2442.94s - 2451.94s | Actually, we have a real difficult incident that happened on the 11th of March, 2451.94s - 2461.94s | that marked before and after on the way that people seized the railway and the metro in Spain. 2461.94s - 2469.94s | So, any people with the right amount of motivation and knowledge could exploit this. 2469.94s - 2475.94s | So, we want to make a wake-up call before something like this happens 2475.94s - 2484.94s | and make people invest more time and money to keep the safety around Spain and of course around the world, 2484.94s - 2487.94s | because this again happens mostly everywhere. 2487.94s - 2491.19s | So, thanks. This is really fascinating. 2491.19s - 2499.19s | I'm curious to know if there are any other systems that the drivers rely on to make their decisions 2499.19s - 2505.19s | about what speed to control the trains. Is it primarily these beacons that they're using for that? 2505.19s - 2510.19s | Or is there any other input they're also using to make the judgment? 2510.19s - 2513.19s | Sorry, I didn't hear you. 2513.19s - 2523.41s | Is there another system? 2524.41s - 2533.41s | The train driver has the real signals and the system is an acknowledged system 2533.41s - 2538.41s | to make sure that the train driver has seen the right signal. 2538.41s - 2543.41s | So, by default there is no other resource. 2543.41s - 2552.41s | And the point here is that you could make a red signal device in the middle of the track with no lights. 2552.41s - 2554.41s | For example. 2554.41s - 2556.41s | Thank you. 2556.41s - 2562.22s | More questions? 2562.22s - 2566.87s | Thank you. 2566.87s - 2570.15s | Thank you very much.


chunk_id: 177_chunk_31
chunk_text:
I'm curious to know if there are any other systems that the drivers rely on to make their decisions 2499.19s - 2505.19s | about what speed to control the trains. Is it primarily these beacons that they're using for that? 2505.19s - 2510.19s | Or is there any other input they're also using to make the judgment? 2510.19s - 2513.19s | Sorry, I didn't hear you. 2513.19s - 2523.41s | Is there another system? 2524.41s - 2533.41s | The train driver has the real signals and the system is an acknowledged system 2533.41s - 2538.41s | to make sure that the train driver has seen the right signal. 2538.41s - 2543.41s | So, by default there is no other resource. 2543.41s - 2552.41s | And the point here is that you could make a red signal device in the middle of the track with no lights. 2552.41s - 2554.41s | For example. 2554.41s - 2556.41s | Thank you. 2556.41s - 2562.22s | More questions? 2562.22s - 2566.87s | Thank you. 2566.87s - 2570.15s | Thank you very much.


chunk_id: 178_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=IJT6_OcY_dc", "title": "DEF CON 32 - A Shadow Librarian: Fighting back against encroaching capitalism - Daniel Messe", "description": "The public library is under attack. Calls for book banning are at an all time high. Some states have passed laws that hold librarians legally accountable for offering \"unacceptable\" materials to minors. But before this fire started, another one was already burning. In an era of digital content, from eBooks to streaming movies, public libraries have been forced to accept draconian terms of service at the expense of their patrons and to the benefit of corporations. Grossly inflated eBook prices and licensing, unobtainable materials that went out of print due to artificial scarcity, exorbitant fees for access to academic research; these are just a few of the myriad of ways that libraries have been forced to bow before capitalism, all because of a desire to serve the public. But we can fight back...\n\nAnd no one says we need to fight fairly.\n\nI\u2019d like to tell you some real life stories of a public librarian with a quasi-legal, dark grey skillset. And I\u2019d love to share some ideas about what you can do to help others. If I can do this, you can. And anyone can be a shadow librarian.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2582, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.88s - 7.20s | This text was transcribed using whisper model: large-v2 uh, welcome. Thank you all for coming to the track. Uh, the next speaker up is Daniel Messer. 7.20s - 12.00s | And the talk is A Shadow Librarian in Broad Daylight. Uh, please give Daniel a warm welcome. 12.00s - 23.42s | How y'all doing? Okay, so good afternoon. Thank you for coming. There's a whole lot of you 23.42s - 29.76s | here to see a librarian talk at DEF CON. So, um, it's nice to have you. So, uh, to start off 29.76s - 35.62s | with, quick disclaimer, you know, big disclaimer. Uh, hi, I'm not a hacker. I am not a 35.62s - 40.54s | cybersecurity expert. I will not be talking about how I cracked some passwords that I found 40.54s - 46.00s | on the dark web and used that to infiltrate some system. I won't be talking about that 46.00s - 53.14s | cause that's nothing I have ever done. Um, but I think that you and I and all of


chunk_id: 178_chunk_1
chunk_text:
can. And anyone can be a shadow librarian.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2582, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.88s - 7.20s | This text was transcribed using whisper model: large-v2 uh, welcome. Thank you all for coming to the track. Uh, the next speaker up is Daniel Messer. 7.20s - 12.00s | And the talk is A Shadow Librarian in Broad Daylight. Uh, please give Daniel a warm welcome. 12.00s - 23.42s | How y'all doing? Okay, so good afternoon. Thank you for coming. There's a whole lot of you 23.42s - 29.76s | here to see a librarian talk at DEF CON. So, um, it's nice to have you. So, uh, to start off 29.76s - 35.62s | with, quick disclaimer, you know, big disclaimer. Uh, hi, I'm not a hacker. I am not a 35.62s - 40.54s | cybersecurity expert. I will not be talking about how I cracked some passwords that I found 40.54s - 46.00s | on the dark web and used that to infiltrate some system. I won't be talking about that 46.00s - 53.14s | cause that's nothing I have ever done. Um, but I think that you and I and all of you and 53.14s - 58.14s | maybe I, uh, we share kind of a kindred relationship. Um, because though I am not a, I'm 60.94s - 65.94s | not a hacker, I think we can both, uh, we can come together on a relationship based in fear. 68.48s - 73.48s | Because people fear hackers. You know this. Some of you revel in this. And people are 76.12s - 81.12s | starting to fear others like me too. In red states, from city councils to state capitals, uh, 84.10s - 90.94s | I am a threat. And so are people like me. More legislation has been passed in the last few 90.94s - 95.94s | months to, uh, curtail my activities than have been passed to curtail yours. Because I am 98.48s - 111.13s | fucking dangerous. I am a public librarian. In the third century before the common era, there 113.27s - 118.57s | was a great library in the city of Alexandria, Egypt. Many tales have been told about this 118.59s - 125.23s | library and some of them are even true. One thing that isn't talked about as often as I think 125.23s - 131.31s | it


chunk_id: 178_chunk_2
chunk_text:
you and 53.14s - 58.14s | maybe I, uh, we share kind of a kindred relationship. Um, because though I am not a, I'm 60.94s - 65.94s | not a hacker, I think we can both, uh, we can come together on a relationship based in fear. 68.48s - 73.48s | Because people fear hackers. You know this. Some of you revel in this. And people are 76.12s - 81.12s | starting to fear others like me too. In red states, from city councils to state capitals, uh, 84.10s - 90.94s | I am a threat. And so are people like me. More legislation has been passed in the last few 90.94s - 95.94s | months to, uh, curtail my activities than have been passed to curtail yours. Because I am 98.48s - 111.13s | fucking dangerous. I am a public librarian. In the third century before the common era, there 113.27s - 118.57s | was a great library in the city of Alexandria, Egypt. Many tales have been told about this 118.59s - 125.23s | library and some of them are even true. One thing that isn't talked about as often as I think 125.23s - 131.31s | it should be, is the Alexandrian acquisitions department. Yeah, I know, I know, thrilling 131.31s - 136.85s | stuff messin' me, but hang on, we're gonna go someplace beyond an ancient library, okay? 136.85s - 143.59s | See, there was a decree by Ptolemy II Philadelphus that among other things, ordered agents of 143.61s - 148.61s | the library to, to search the ships and take any books that they found, borrow them. Now we're 152.59s - 156.63s | talking about the city of Alexandria. This was one of the biggest centers of trade in human 156.63s - 162.69s | history. We're talking about a lot of ships. These agents would snag any books and then bring 162.69s - 169.11s | them back to the library where they would be copied and added to the collection. And it was 169.13s - 174.19s | often the case that the ships would sail away with the copies while the library kept the 174.19s - 179.21s | originals. Um, this was the first large scale version of a modern adage in that information 181.81s - 186.81s | should be free and it should belong to me. In the year of our goddess, 2024, can


chunk_id: 178_chunk_3
chunk_text:
should be, is the Alexandrian acquisitions department. Yeah, I know, I know, thrilling 131.31s - 136.85s | stuff messin' me, but hang on, we're gonna go someplace beyond an ancient library, okay? 136.85s - 143.59s | See, there was a decree by Ptolemy II Philadelphus that among other things, ordered agents of 143.61s - 148.61s | the library to, to search the ships and take any books that they found, borrow them. Now we're 152.59s - 156.63s | talking about the city of Alexandria. This was one of the biggest centers of trade in human 156.63s - 162.69s | history. We're talking about a lot of ships. These agents would snag any books and then bring 162.69s - 169.11s | them back to the library where they would be copied and added to the collection. And it was 169.13s - 174.19s | often the case that the ships would sail away with the copies while the library kept the 174.19s - 179.21s | originals. Um, this was the first large scale version of a modern adage in that information 181.81s - 186.81s | should be free and it should belong to me. In the year of our goddess, 2024, can you imagine a 190.49s - 195.49s | library doing anything like that today? That library would have more lawyers at their front 195.91s - 200.91s | door than they have children attending the herpetologist event at a summer reading program. 204.79s - 210.43s | So, okay, yeah, maybe, uh, maybe some introductions before I really get into this. Hi, I'm Dan. 210.43s - 215.99s | Uh, I've been working libraries for almost 30 years now. Uh, from the front desk to systems 215.99s - 222.27s | administration and a few stops in between, you know. As a systems librarian, I specialize in 222.29s - 228.39s | integrated library systems, which is the day to day operating system of a modern library, 228.39s - 233.39s | checking the things out, checking the things in, managing the catalog, all that stuff. Um, so, 235.87s - 241.57s | what I'm called is a systems librarian by most people. If you, um, I'm also into things like, 241.57s - 247.31s | uh, SQL hacking. I say that I'm a SQL hacker because, uh, the way I typically get SQL to work 247.33s - 252.83s | is that I write a query, I swear because


chunk_id: 178_chunk_4
chunk_text:
you imagine a 190.49s - 195.49s | library doing anything like that today? That library would have more lawyers at their front 195.91s - 200.91s | door than they have children attending the herpetologist event at a summer reading program. 204.79s - 210.43s | So, okay, yeah, maybe, uh, maybe some introductions before I really get into this. Hi, I'm Dan. 210.43s - 215.99s | Uh, I've been working libraries for almost 30 years now. Uh, from the front desk to systems 215.99s - 222.27s | administration and a few stops in between, you know. As a systems librarian, I specialize in 222.29s - 228.39s | integrated library systems, which is the day to day operating system of a modern library, 228.39s - 233.39s | checking the things out, checking the things in, managing the catalog, all that stuff. Um, so, 235.87s - 241.57s | what I'm called is a systems librarian by most people. If you, um, I'm also into things like, 241.57s - 247.31s | uh, SQL hacking. I say that I'm a SQL hacker because, uh, the way I typically get SQL to work 247.33s - 252.83s | is that I write a query, I swear because it doesn't work, then I rewrite the query and I'm 252.83s - 258.13s | closer but they're still swearing and finally the query works. So, I, yeah, that's how I hack 258.13s - 264.43s | SQL. I'm also into data analysis and storytelling. Libraries love data, the sort of running 264.43s - 270.71s | joke is that librarians are into stats and cats. Um, so, yeah, I'm into, I'm one of the data 270.71s - 275.65s | guys where I work. No surprise I'm into library technology, self-checkout machines, 275.65s - 281.29s | self-check-in machines, everything from the barcode on the front desk to the RFID tags 281.29s - 286.17s | within the items. And this probably doesn't matter to anyone, I'm a circulation 286.17s - 291.17s | methodologist. In other words, I can help libraries better circulate their materials. But, 294.71s - 298.87s | one, one thing, um, one thing that you might also know me for is if you listen to library 298.87s - 303.71s | related podcasts, I am known as your little free cyberpunk librarian. And with a name like 303.71s - 308.15s | that, it shouldn't be, uh, it shouldn't be a real big surprise


chunk_id: 178_chunk_5
chunk_text:
it doesn't work, then I rewrite the query and I'm 252.83s - 258.13s | closer but they're still swearing and finally the query works. So, I, yeah, that's how I hack 258.13s - 264.43s | SQL. I'm also into data analysis and storytelling. Libraries love data, the sort of running 264.43s - 270.71s | joke is that librarians are into stats and cats. Um, so, yeah, I'm into, I'm one of the data 270.71s - 275.65s | guys where I work. No surprise I'm into library technology, self-checkout machines, 275.65s - 281.29s | self-check-in machines, everything from the barcode on the front desk to the RFID tags 281.29s - 286.17s | within the items. And this probably doesn't matter to anyone, I'm a circulation 286.17s - 291.17s | methodologist. In other words, I can help libraries better circulate their materials. But, 294.71s - 298.87s | one, one thing, um, one thing that you might also know me for is if you listen to library 298.87s - 303.71s | related podcasts, I am known as your little free cyberpunk librarian. And with a name like 303.71s - 308.15s | that, it shouldn't be, uh, it shouldn't be a real big surprise that I am into shadow 308.15s - 314.35s | libraries. Um, I have been researching shadow libraries for about 10 years. I can't be, uh, I 314.35s - 318.85s | can't be, uh, specific on that because I don't remember exactly when I started approaching it 318.85s - 323.89s | as a topic of research rather than as a topic of usage. Um, so, yeah, I've done this for 323.89s - 329.73s | about 10 years. I've worked in shadow libraries as a, uh, cataloger. In other words, if I am 329.75s - 335.07s | presented with an e-book of questionable sources, um, and that e-book is lacking metadata, I 335.07s - 340.97s | can help provide that metadata. I've also worked in interlibrary loan, which, uh, in this 340.97s - 345.97s | case usually involves someone on the internet needs a PDF. And I can provide that PDF. But I've 348.17s - 352.85s | also done work in acquisitions, aka book scanning, digitization, things like that. And I've 352.85s - 357.85s | also done some system, uh, systems administration and development. So, okay, here's the deal. 360.33s - 367.33s | As a public librarian and a shadow librarian, I


chunk_id: 178_chunk_6
chunk_text:
that I am into shadow 308.15s - 314.35s | libraries. Um, I have been researching shadow libraries for about 10 years. I can't be, uh, I 314.35s - 318.85s | can't be, uh, specific on that because I don't remember exactly when I started approaching it 318.85s - 323.89s | as a topic of research rather than as a topic of usage. Um, so, yeah, I've done this for 323.89s - 329.73s | about 10 years. I've worked in shadow libraries as a, uh, cataloger. In other words, if I am 329.75s - 335.07s | presented with an e-book of questionable sources, um, and that e-book is lacking metadata, I 335.07s - 340.97s | can help provide that metadata. I've also worked in interlibrary loan, which, uh, in this 340.97s - 345.97s | case usually involves someone on the internet needs a PDF. And I can provide that PDF. But I've 348.17s - 352.85s | also done work in acquisitions, aka book scanning, digitization, things like that. And I've 352.85s - 357.85s | also done some system, uh, systems administration and development. So, okay, here's the deal. 360.33s - 367.33s | As a public librarian and a shadow librarian, I work in two sides of the library world. The 367.33s - 372.33s | public library, which I'm sure many of you are familiar with, and shadow libraries, which 374.81s - 381.51s | I'm sure many of you are familiar with. Um, so, that might come as a surprise to you because 381.51s - 386.35s | why would, why would a legit librarian go to the dark side? You know, why, why would I do 386.37s - 392.41s | that? Well, you can encompass a lot of that under a heading of you do what you gotta do. I'm 392.41s - 397.41s | here to serve the public in matters of information and media. And to a librarian, everything 400.85s - 405.85s | is media. This podium, this podium I'm speaking from, librarians can totally catalog and 408.59s - 413.59s | circulate this thing. Uh, we, we actually have a word for it. It's called realia. This is a 413.67s - 420.47s | realistic thing, it's not a book, it's not a, you know, a piece of like a Blu-ray or anything 420.47s - 426.61s | like that. This is realia. We can circulate this stuff. See, if you haven't been


chunk_id: 178_chunk_7
chunk_text:
work in two sides of the library world. The 367.33s - 372.33s | public library, which I'm sure many of you are familiar with, and shadow libraries, which 374.81s - 381.51s | I'm sure many of you are familiar with. Um, so, that might come as a surprise to you because 381.51s - 386.35s | why would, why would a legit librarian go to the dark side? You know, why, why would I do 386.37s - 392.41s | that? Well, you can encompass a lot of that under a heading of you do what you gotta do. I'm 392.41s - 397.41s | here to serve the public in matters of information and media. And to a librarian, everything 400.85s - 405.85s | is media. This podium, this podium I'm speaking from, librarians can totally catalog and 408.59s - 413.59s | circulate this thing. Uh, we, we actually have a word for it. It's called realia. This is a 413.67s - 420.47s | realistic thing, it's not a book, it's not a, you know, a piece of like a Blu-ray or anything 420.47s - 426.61s | like that. This is realia. We can circulate this stuff. See, if you haven't been to your local 426.61s - 432.11s | public library recently, I strongly encourage you to go. The reasons for that are stuff that 432.11s - 435.53s | you probably already know, but I'll drop the two biggest ones just in case you need a 435.53s - 442.07s | reminder. Number one, we lend you stuff for free. And, uh, with that, that could include 442.07s - 447.09s | stuff that, uh, you didn't, you may not associate with public libraries, which is the 447.09s - 452.09s | number two reason you should go to the library and see what they have. If you think we're just a 452.09s - 457.09s | stronghold of books and Blu-rays, you might give it another look just in case. So, um, for 459.43s - 463.27s | instance, I work with libraries all across the country and some of them have tool 463.27s - 468.53s | collections, and I'm not talking about the band. Um, if you're, uh, if you're putting 468.53s - 474.71s | something together and maybe you need a hammer or a cordless drill or something like that, but 474.71s - 478.61s | you're not a handy person, you're not Norm Abram,


chunk_id: 178_chunk_8
chunk_text:
to your local 426.61s - 432.11s | public library recently, I strongly encourage you to go. The reasons for that are stuff that 432.11s - 435.53s | you probably already know, but I'll drop the two biggest ones just in case you need a 435.53s - 442.07s | reminder. Number one, we lend you stuff for free. And, uh, with that, that could include 442.07s - 447.09s | stuff that, uh, you didn't, you may not associate with public libraries, which is the 447.09s - 452.09s | number two reason you should go to the library and see what they have. If you think we're just a 452.09s - 457.09s | stronghold of books and Blu-rays, you might give it another look just in case. So, um, for 459.43s - 463.27s | instance, I work with libraries all across the country and some of them have tool 463.27s - 468.53s | collections, and I'm not talking about the band. Um, if you're, uh, if you're putting 468.53s - 474.71s | something together and maybe you need a hammer or a cordless drill or something like that, but 474.71s - 478.61s | you're not a handy person, you're not Norm Abram, so you don't want to just buy this, you're 478.61s - 483.79s | just assembling something that you bought at Ikea, check, check with your local library. They, 483.79s - 487.99s | uh, they might have a tool collection for you. Um, do you want to learn how to play the 487.99s - 494.13s | guitar? Some libraries have musical instrument collections. So, this is great because you 494.13s - 499.13s | can go lend, you can borrow that guitar and you don't have to buy one because later on if you 501.57s - 505.35s | find out, well, playing the guitar isn't for me or I'm just not good at that. Well, if you 505.35s - 509.81s | bought a guitar, now you have a symbol of your failure laying around your house. With the, with 509.81s - 514.83s | the borrowed guitar, you just take it back to the library. So, I work with a library that has a 518.45s - 523.53s | massive collection of cake pans. Literally, lots of cake pans. And you might think, cake 523.53s - 528.87s | pans, well, how often do you need to make a Hello Kitty birthday cake? Maybe once


chunk_id: 178_chunk_9
chunk_text:
so you don't want to just buy this, you're 478.61s - 483.79s | just assembling something that you bought at Ikea, check, check with your local library. They, 483.79s - 487.99s | uh, they might have a tool collection for you. Um, do you want to learn how to play the 487.99s - 494.13s | guitar? Some libraries have musical instrument collections. So, this is great because you 494.13s - 499.13s | can go lend, you can borrow that guitar and you don't have to buy one because later on if you 501.57s - 505.35s | find out, well, playing the guitar isn't for me or I'm just not good at that. Well, if you 505.35s - 509.81s | bought a guitar, now you have a symbol of your failure laying around your house. With the, with 509.81s - 514.83s | the borrowed guitar, you just take it back to the library. So, I work with a library that has a 518.45s - 523.53s | massive collection of cake pans. Literally, lots of cake pans. And you might think, cake 523.53s - 528.87s | pans, well, how often do you need to make a Hello Kitty birthday cake? Maybe once a year? So, 528.87s - 534.97s | why should you buy a Hello Kitty cake shaped cake pan for the other 364 days? Just go borrow 534.97s - 539.97s | the thing. So, podiums, right? I'm just saying, sometimes people need to talk in front of a 542.15s - 549.15s | crowd and, uh, you know what they might not have? Podium. It's not something you got laying 549.17s - 554.81s | around your house most of the time. A library could buy, catalog and circulate one of these 554.81s - 559.35s | things. I would not be surprised if that's something that's already happening in a library 559.35s - 565.79s | somewhere. So, as I said, I am here to serve the public about information and media and 565.79s - 570.83s | sometimes that stuff doesn't come easy. At one point in your lives, you may have gone to a 570.83s - 575.83s | library for a story time. Um, so, you have your very own librarian right here, so let's, let's 579.23s - 584.21s | have a story time. Sit back and relax. I'm going to tell you a couple of stories because it's 584.21s - 589.41s |


chunk_id: 178_chunk_10
chunk_text:
a year? So, 528.87s - 534.97s | why should you buy a Hello Kitty cake shaped cake pan for the other 364 days? Just go borrow 534.97s - 539.97s | the thing. So, podiums, right? I'm just saying, sometimes people need to talk in front of a 542.15s - 549.15s | crowd and, uh, you know what they might not have? Podium. It's not something you got laying 549.17s - 554.81s | around your house most of the time. A library could buy, catalog and circulate one of these 554.81s - 559.35s | things. I would not be surprised if that's something that's already happening in a library 559.35s - 565.79s | somewhere. So, as I said, I am here to serve the public about information and media and 565.79s - 570.83s | sometimes that stuff doesn't come easy. At one point in your lives, you may have gone to a 570.83s - 575.83s | library for a story time. Um, so, you have your very own librarian right here, so let's, let's 579.23s - 584.21s | have a story time. Sit back and relax. I'm going to tell you a couple of stories because it's 584.21s - 589.41s | the war stories track, right? Um, I was going to bring puppets, but when I explained to the 589.41s - 593.71s | DEF CON organizers what I wanted to do with them, they shot that idea down for ethical 593.71s - 600.33s | reasons, so. Once upon a time, there was a law. It's a pretty good law, as laws go. And its name 600.39s - 605.39s | was Title 17 United States Code Subsection 109A. Thank you. Big fans! Anyway. Uh, this little 614.83s - 619.83s | bit of legislation does us the small service of providing only the entire foundation of how 622.91s - 627.91s | libraries operate in the United States. But please, Title 17 United States Code Subsection 109A 630.95s - 636.55s | that's a very long name, very complicated. So, it's got a nickname. It's called the First Sale 636.55s - 641.55s | Doctrine. Simply stated, this law allows libraries to buy physical items and lend them. We can 644.59s - 649.59s | lend books, blu-rays, and banjos. Uh, because when we buy them, we own them. And because we 652.17s - 657.17s | own them, we can decide to lend them to others. So,


chunk_id: 178_chunk_11
chunk_text:
the war stories track, right? Um, I was going to bring puppets, but when I explained to the 589.41s - 593.71s | DEF CON organizers what I wanted to do with them, they shot that idea down for ethical 593.71s - 600.33s | reasons, so. Once upon a time, there was a law. It's a pretty good law, as laws go. And its name 600.39s - 605.39s | was Title 17 United States Code Subsection 109A. Thank you. Big fans! Anyway. Uh, this little 614.83s - 619.83s | bit of legislation does us the small service of providing only the entire foundation of how 622.91s - 627.91s | libraries operate in the United States. But please, Title 17 United States Code Subsection 109A 630.95s - 636.55s | that's a very long name, very complicated. So, it's got a nickname. It's called the First Sale 636.55s - 641.55s | Doctrine. Simply stated, this law allows libraries to buy physical items and lend them. We can 644.59s - 649.59s | lend books, blu-rays, and banjos. Uh, because when we buy them, we own them. And because we 652.17s - 657.17s | own them, we can decide to lend them to others. So, more than one person has said that if a 657.35s - 662.35s | library didn't exist today, it would probably be illegal to create one. And that's because 665.25s - 671.79s | media publishers would never let a law like this pass if this was something that came forward 671.79s - 676.79s | today. So, this law is great though when it comes to physical items. What about the digital 679.49s - 684.41s | stuff? So, hey, you might not have known this either if you haven't been to the library for a 684.41s - 689.25s | little while. Uh, did you know you can check out stuff at the library and never leave your 689.25s - 694.25s | home? You can get things from e-books and digital comics. You can stream music and movies. Uh, 696.13s - 701.37s | you can download magazines and read the news. You don't even have to put on pants. Just get 701.37s - 706.37s | your tablet, get your phone, log into your library account and get stuff for free. Legally, 707.17s - 712.17s | for a change. And that, dear hearts, that's the problem. Digital items are not sold. They're 719.75s -


chunk_id: 178_chunk_12
chunk_text:
more than one person has said that if a 657.35s - 662.35s | library didn't exist today, it would probably be illegal to create one. And that's because 665.25s - 671.79s | media publishers would never let a law like this pass if this was something that came forward 671.79s - 676.79s | today. So, this law is great though when it comes to physical items. What about the digital 679.49s - 684.41s | stuff? So, hey, you might not have known this either if you haven't been to the library for a 684.41s - 689.25s | little while. Uh, did you know you can check out stuff at the library and never leave your 689.25s - 694.25s | home? You can get things from e-books and digital comics. You can stream music and movies. Uh, 696.13s - 701.37s | you can download magazines and read the news. You don't even have to put on pants. Just get 701.37s - 706.37s | your tablet, get your phone, log into your library account and get stuff for free. Legally, 707.17s - 712.17s | for a change. And that, dear hearts, that's the problem. Digital items are not sold. They're 719.75s - 726.69s | licensed. And licensing does not equal ownership. And libraries all across the country are 726.69s - 731.69s | seeing a steep rise in their public's desire for digital items. Okay, well, so what? Well, how 732.69s - 737.69s | much do you pay for an e-book on Amazon? Maybe about 15 bucks or so, give or take, you know, if 740.99s - 747.33s | it's new or it's big or whatever. Say about 15 bucks. And keep in mind, you are licensing it 747.33s - 754.57s | too. You don't own that. Um, but you are just a single licensee reading the book on your 754.57s - 761.41s | devices. Fine. Libraries, on the other hand, we want to lend e-books to multiple people so 761.43s - 768.11s | they can read it on multiple devices. And publishers, they don't like that. They 768.11s - 774.81s | absolutely see that as lost sales. Do you know how much a library will pay for the same e-book 774.81s - 779.81s | that you bought on Amazon for 15 bucks? 60. They will pay about 4 times the cost so that you 784.79s - 790.89s | can have access to


chunk_id: 178_chunk_13
chunk_text:
726.69s | licensed. And licensing does not equal ownership. And libraries all across the country are 726.69s - 731.69s | seeing a steep rise in their public's desire for digital items. Okay, well, so what? Well, how 732.69s - 737.69s | much do you pay for an e-book on Amazon? Maybe about 15 bucks or so, give or take, you know, if 740.99s - 747.33s | it's new or it's big or whatever. Say about 15 bucks. And keep in mind, you are licensing it 747.33s - 754.57s | too. You don't own that. Um, but you are just a single licensee reading the book on your 754.57s - 761.41s | devices. Fine. Libraries, on the other hand, we want to lend e-books to multiple people so 761.43s - 768.11s | they can read it on multiple devices. And publishers, they don't like that. They 768.11s - 774.81s | absolutely see that as lost sales. Do you know how much a library will pay for the same e-book 774.81s - 779.81s | that you bought on Amazon for 15 bucks? 60. They will pay about 4 times the cost so that you 784.79s - 790.89s | can have access to an e-book. And that's for a single user license. Well, what the hell is a 790.91s - 795.85s | single user license? A single user license basically says that one person can check out that 795.85s - 800.85s | e-book at a time. Just like a physical book. It's an e-book. It's not like we have a problem 804.29s - 809.29s | making copies of it, but the licensing is that one person can have that book at a time. So, more 811.97s - 818.57s | than that, publishers will also literally withhold sales to, to libraries. Um, because they 818.59s - 823.25s | want to hit that buyer's market first. The new, you know, James Patterson pulls a lever and 823.25s - 828.27s | publishes a novel and the, the publisher might not offer that as a e-book to libraries because 831.83s - 837.73s | they want to hit that buyer's market first. Those free-loading librarians can just wait to 837.73s - 843.87s | pay 4 times the amount for that e-book because, you know, the publishing industry got to get 843.87s - 850.45s | paid, son. Oh, and by the way, that license is good for anywhere from


chunk_id: 178_chunk_14
chunk_text:
an e-book. And that's for a single user license. Well, what the hell is a 790.91s - 795.85s | single user license? A single user license basically says that one person can check out that 795.85s - 800.85s | e-book at a time. Just like a physical book. It's an e-book. It's not like we have a problem 804.29s - 809.29s | making copies of it, but the licensing is that one person can have that book at a time. So, more 811.97s - 818.57s | than that, publishers will also literally withhold sales to, to libraries. Um, because they 818.59s - 823.25s | want to hit that buyer's market first. The new, you know, James Patterson pulls a lever and 823.25s - 828.27s | publishes a novel and the, the publisher might not offer that as a e-book to libraries because 831.83s - 837.73s | they want to hit that buyer's market first. Those free-loading librarians can just wait to 837.73s - 843.87s | pay 4 times the amount for that e-book because, you know, the publishing industry got to get 843.87s - 850.45s | paid, son. Oh, and by the way, that license is good for anywhere from a few months to maybe a 850.45s - 855.45s | couple years. And then the library has to license the book again. Why? Did it wear out? 861.23s - 866.23s | Actually, that's the story. The publishers, uh, and the sellers will tell you that a physical book 866.67s - 871.67s | will wear out over time, so you're going to need to replace it. So, that's all we're doing, we're 874.11s - 879.61s | just emulating what's happening in the physical book. That's okay, right? Beloved, there are 879.61s - 884.61s | books in libraries that are over 200 years old. Travel to Europe, there are books in libraries 887.99s - 893.55s | that are centuries old. Um, yeah, you might not be able to check them out and take them home, 893.55s - 898.55s | granted, but I bet they're still somehow available for use. There's not an e-book around right 901.19s - 907.95s | now that is even half as old as some of the oldest books in a, in a library. In other words, this 907.95s - 913.03s | is just good old fashioned bog standard capitalism at work. You, you've heard of forced 913.03s -


chunk_id: 178_chunk_15
chunk_text:
a few months to maybe a 850.45s - 855.45s | couple years. And then the library has to license the book again. Why? Did it wear out? 861.23s - 866.23s | Actually, that's the story. The publishers, uh, and the sellers will tell you that a physical book 866.67s - 871.67s | will wear out over time, so you're going to need to replace it. So, that's all we're doing, we're 874.11s - 879.61s | just emulating what's happening in the physical book. That's okay, right? Beloved, there are 879.61s - 884.61s | books in libraries that are over 200 years old. Travel to Europe, there are books in libraries 887.99s - 893.55s | that are centuries old. Um, yeah, you might not be able to check them out and take them home, 893.55s - 898.55s | granted, but I bet they're still somehow available for use. There's not an e-book around right 901.19s - 907.95s | now that is even half as old as some of the oldest books in a, in a library. In other words, this 907.95s - 913.03s | is just good old fashioned bog standard capitalism at work. You, you've heard of forced 913.03s - 918.03s | scarcity, I'm sure. This is enforced scarcity. We live in a time where nothing, nothing ever 918.55s - 923.55s | needs to go out of print. And even things that have gone out of print, they could be digitized, 927.37s - 934.19s | resurrected and brought forward. And, you know, Google did that. And they got away with it 934.19s - 938.37s | because they're Google. And then the Internet Archive did that, got sued and had to remove 938.37s - 943.37s | 500,000 books from their collection. Um, because of course, of course, that represents a loss of 948.17s - 954.31s | sales. As a counterpoint, according to Publishers Weekly and the Association of American 954.31s - 959.31s | Publishers, the United States publishing industry made over 12.5 billion dollars last year. We 961.85s - 966.85s | should all have some of those lost sales. How do they survive? And with the growing demand for 969.33s - 974.59s | e-books, library budgets are feeling that pinch more than ever because e-book licenses are 974.59s - 980.83s | more or less twice the price of a physical book. A new dead tree book might cost 20, 25 980.83s


chunk_id: 178_chunk_16
chunk_text:
918.03s | scarcity, I'm sure. This is enforced scarcity. We live in a time where nothing, nothing ever 918.55s - 923.55s | needs to go out of print. And even things that have gone out of print, they could be digitized, 927.37s - 934.19s | resurrected and brought forward. And, you know, Google did that. And they got away with it 934.19s - 938.37s | because they're Google. And then the Internet Archive did that, got sued and had to remove 938.37s - 943.37s | 500,000 books from their collection. Um, because of course, of course, that represents a loss of 948.17s - 954.31s | sales. As a counterpoint, according to Publishers Weekly and the Association of American 954.31s - 959.31s | Publishers, the United States publishing industry made over 12.5 billion dollars last year. We 961.85s - 966.85s | should all have some of those lost sales. How do they survive? And with the growing demand for 969.33s - 974.59s | e-books, library budgets are feeling that pinch more than ever because e-book licenses are 974.59s - 980.83s | more or less twice the price of a physical book. A new dead tree book might cost 20, 25 980.83s - 987.37s | bucks. A library could buy two books for 50 bucks, or they can buy one single e-book license 987.37s - 992.37s | for 10 dollars more. I mean, fiscally, those physical items make more sense, but that's not 995.41s - 1001.89s | what people are after. And beyond that though, what do you do when you're faced with a 1001.89s - 1008.59s | patron who needs an item, but that item is almost unobtainable? Because Amikoi, my God, we 1008.59s - 1012.79s | haven't even talked about things like the price of journals, like academic journals. Any 1012.79s - 1018.37s | students here today, anyone working on a bachelor's, a master's, maybe even a doctorate. I 1018.37s - 1024.65s | got, I got a few hands, awesome. Okay, so do you know how much money your college library 1024.65s - 1030.81s | spends per year for access to academic articles and publications? I want you to think of a 1030.83s - 1035.43s | number. A price that sounds reasonable, let's not get cos, cos, you know, cosmically 1035.43s - 1040.87s | stratospheric here, but a price that sounds reasonable. What do you think your university is 1040.87s


chunk_id: 178_chunk_17
chunk_text:
- 987.37s | bucks. A library could buy two books for 50 bucks, or they can buy one single e-book license 987.37s - 992.37s | for 10 dollars more. I mean, fiscally, those physical items make more sense, but that's not 995.41s - 1001.89s | what people are after. And beyond that though, what do you do when you're faced with a 1001.89s - 1008.59s | patron who needs an item, but that item is almost unobtainable? Because Amikoi, my God, we 1008.59s - 1012.79s | haven't even talked about things like the price of journals, like academic journals. Any 1012.79s - 1018.37s | students here today, anyone working on a bachelor's, a master's, maybe even a doctorate. I 1018.37s - 1024.65s | got, I got a few hands, awesome. Okay, so do you know how much money your college library 1024.65s - 1030.81s | spends per year for access to academic articles and publications? I want you to think of a 1030.83s - 1035.43s | number. A price that sounds reasonable, let's not get cos, cos, you know, cosmically 1035.43s - 1040.87s | stratospheric here, but a price that sounds reasonable. What do you think your university is 1040.87s - 1045.89s | paying for access to those academic journals? Got that number? No, you're wrong, it's higher. 1045.89s - 1050.89s | The, the cost of academic journals and access to those publications is insane and it's 1053.65s - 1059.09s | obscene, and never mind that many of the articles that these students are after were written 1059.11s - 1065.71s | by researchers and scientists working with public funds. So, if you're a student browsing a 1065.71s - 1072.41s | database of publications at your uni's library and you find what you need, I, holy crap, here 1072.41s - 1077.05s | it is, this, this is what I'm looking for. I know this author. They're working in my arena. 1077.05s - 1083.09s | This will go a long way to helping me finish my master's thesis or my doctoral dissertation. 1083.13s - 1088.13s | Fantastic. And they don't have it. This is the heartbreak of the abstract, where all they 1092.77s - 1097.91s | have is the abstract. Your library, for some reason, just does not have access to that 1097.91s - 1105.12s | article. So, imagine yourself now as a librarian. You've got that patron looking for a book


chunk_id: 178_chunk_18
chunk_text:
- 1045.89s | paying for access to those academic journals? Got that number? No, you're wrong, it's higher. 1045.89s - 1050.89s | The, the cost of academic journals and access to those publications is insane and it's 1053.65s - 1059.09s | obscene, and never mind that many of the articles that these students are after were written 1059.11s - 1065.71s | by researchers and scientists working with public funds. So, if you're a student browsing a 1065.71s - 1072.41s | database of publications at your uni's library and you find what you need, I, holy crap, here 1072.41s - 1077.05s | it is, this, this is what I'm looking for. I know this author. They're working in my arena. 1077.05s - 1083.09s | This will go a long way to helping me finish my master's thesis or my doctoral dissertation. 1083.13s - 1088.13s | Fantastic. And they don't have it. This is the heartbreak of the abstract, where all they 1092.77s - 1097.91s | have is the abstract. Your library, for some reason, just does not have access to that 1097.91s - 1105.12s | article. So, imagine yourself now as a librarian. You've got that patron looking for a book 1107.26s - 1112.74s | that's had one print run and hasn't been published again since the 1970s. You've got a patron 1112.74s - 1118.52s | who needs an indie film that was made in 1990 and can't be found anywhere. Or you've got 1118.52s - 1124.86s | this student who needs the article, but you don't have it. When I was in high school, never 1124.86s - 1129.86s | mind how many years ago, a friend of mine taught me something that literally stuck with me 1129.86s - 1134.40s | ever since. I could put this on a business card and it would make some sense for me. And that 1134.40s - 1139.40s | thing is, is when what you need don't meet your eyes, you must learn to improvise. So, time 1139.60s - 1144.60s | to improvise. Due to patron confidentiality, I will not divulge the title of this book, 1147.64s - 1153.18s | except to say it was a work of fiction written in the 1970s by some author I had never heard 1153.18s - 1159.72s | of. The patron read this book back in their younger days. And like a fever dream, it popped 1159.72s - 1164.60s


chunk_id: 178_chunk_19
chunk_text:
1107.26s - 1112.74s | that's had one print run and hasn't been published again since the 1970s. You've got a patron 1112.74s - 1118.52s | who needs an indie film that was made in 1990 and can't be found anywhere. Or you've got 1118.52s - 1124.86s | this student who needs the article, but you don't have it. When I was in high school, never 1124.86s - 1129.86s | mind how many years ago, a friend of mine taught me something that literally stuck with me 1129.86s - 1134.40s | ever since. I could put this on a business card and it would make some sense for me. And that 1134.40s - 1139.40s | thing is, is when what you need don't meet your eyes, you must learn to improvise. So, time 1139.60s - 1144.60s | to improvise. Due to patron confidentiality, I will not divulge the title of this book, 1147.64s - 1153.18s | except to say it was a work of fiction written in the 1970s by some author I had never heard 1153.18s - 1159.72s | of. The patron read this book back in their younger days. And like a fever dream, it popped 1159.72s - 1164.60s | into their head again and they just, they needed to read it again. And hey, I get it. I don't 1164.60s - 1168.96s | know about you, but as a librarian, there's certain books that I always go back to. I cannot 1168.96s - 1176.90s | tell you how many times I've read Neuromancer and the Hitchhiker's Guide to the Galaxy. It's 1176.90s - 1181.90s | like comfort food. Now, libraries have various networks that they can go through to do 1184.28s - 1189.28s | something magical. And that magical thing is interlibrary loan. And if you're not familiar 1191.82s - 1198.42s | with it, no shame. Today, you are one of today's lucky 10,000. So, let me tell you about 1198.46s - 1204.62s | interlibrary loan. See, if you go to a library and they don't have the thing you need, you can 1204.62s - 1209.76s | talk to someone there and they can try to get it from another library. Maybe even at a 1209.76s - 1214.34s | completely different state, sometimes in a completely different country. You may have to 1214.34s - 1221.40s | pay for shipping, but they can help you get that weird and


chunk_id: 178_chunk_20
chunk_text:
| into their head again and they just, they needed to read it again. And hey, I get it. I don't 1164.60s - 1168.96s | know about you, but as a librarian, there's certain books that I always go back to. I cannot 1168.96s - 1176.90s | tell you how many times I've read Neuromancer and the Hitchhiker's Guide to the Galaxy. It's 1176.90s - 1181.90s | like comfort food. Now, libraries have various networks that they can go through to do 1184.28s - 1189.28s | something magical. And that magical thing is interlibrary loan. And if you're not familiar 1191.82s - 1198.42s | with it, no shame. Today, you are one of today's lucky 10,000. So, let me tell you about 1198.46s - 1204.62s | interlibrary loan. See, if you go to a library and they don't have the thing you need, you can 1204.62s - 1209.76s | talk to someone there and they can try to get it from another library. Maybe even at a 1209.76s - 1214.34s | completely different state, sometimes in a completely different country. You may have to 1214.34s - 1221.40s | pay for shipping, but they can help you get that weird and wonderful thing that cannot be 1221.40s - 1226.22s | found anywhere else. And that's exactly what I did. I, you know, worked with this patron, I 1226.22s - 1230.98s | looked it up in the computer, we placed a request through an interlibrary loan network and 1230.98s - 1236.00s | we waited for the item to arrive. Which it did. Just the next week. In pieces. It's a paperback 1242.00s - 1248.80s | from the 1970s. Do you know what they used to make binding glue out of in the 1970s? 1248.80s - 1256.19s | Lysergic acid diethylamide and the dreams of small children. I called this patron and I 1256.19s - 1262.85s | said, hey, um, I got your thing, but there's this problem. And they were heartbroken. That's 1262.85s - 1267.13s | one of my favorite patrons. They were afraid to check it out because they didn't want to 1267.13s - 1270.73s | further damage that. I don't know how they would have done that other than sticking it in a 1270.73s - 1277.27s | blender with some protein powder. Um, but dammit, I hated to disappoint this person. And the 1277.27s - 1281.57s | lending library that


chunk_id: 178_chunk_21
chunk_text:
wonderful thing that cannot be 1221.40s - 1226.22s | found anywhere else. And that's exactly what I did. I, you know, worked with this patron, I 1226.22s - 1230.98s | looked it up in the computer, we placed a request through an interlibrary loan network and 1230.98s - 1236.00s | we waited for the item to arrive. Which it did. Just the next week. In pieces. It's a paperback 1242.00s - 1248.80s | from the 1970s. Do you know what they used to make binding glue out of in the 1970s? 1248.80s - 1256.19s | Lysergic acid diethylamide and the dreams of small children. I called this patron and I 1256.19s - 1262.85s | said, hey, um, I got your thing, but there's this problem. And they were heartbroken. That's 1262.85s - 1267.13s | one of my favorite patrons. They were afraid to check it out because they didn't want to 1267.13s - 1270.73s | further damage that. I don't know how they would have done that other than sticking it in a 1270.73s - 1277.27s | blender with some protein powder. Um, but dammit, I hated to disappoint this person. And the 1277.27s - 1281.57s | lending library that responded was the only lending library that responded. It was either this 1281.59s - 1286.59s | copy or nothing. Time for the lie. This patron, I'll call him Joe. I'm talking to him on the 1289.27s - 1294.27s | phone. I said, hey Joe, do you have an e-reader? You do. That's awesome. Hey, what kind of e-reader 1294.27s - 1299.77s | you got? Uh huh. That new Kindle? Yeah, right. How do you like it? Nice. Okay, so here's what 1299.77s - 1304.65s | we're gonna do. I'm gonna, I'm gonna check in a different ILL system real quick. This one deals 1304.65s - 1309.05s | in digital copies. And no, no Joe, I know you already look, but I'm a librarian. Let me do my 1309.07s - 1315.31s | job. And oh my God, Joe, check it out. I found it. It's right here. No, this one library, they've 1315.31s - 1320.51s | got it. Um, I need to contact them to see uh, see what I need to do to borrow it. But I'll give 1320.51s - 1325.39s | you a call back in a couple days. Okay, talk to you later Joe. Bye. Beloved, did you


chunk_id: 178_chunk_22
chunk_text:
responded was the only lending library that responded. It was either this 1281.59s - 1286.59s | copy or nothing. Time for the lie. This patron, I'll call him Joe. I'm talking to him on the 1289.27s - 1294.27s | phone. I said, hey Joe, do you have an e-reader? You do. That's awesome. Hey, what kind of e-reader 1294.27s - 1299.77s | you got? Uh huh. That new Kindle? Yeah, right. How do you like it? Nice. Okay, so here's what 1299.77s - 1304.65s | we're gonna do. I'm gonna, I'm gonna check in a different ILL system real quick. This one deals 1304.65s - 1309.05s | in digital copies. And no, no Joe, I know you already look, but I'm a librarian. Let me do my 1309.07s - 1315.31s | job. And oh my God, Joe, check it out. I found it. It's right here. No, this one library, they've 1315.31s - 1320.51s | got it. Um, I need to contact them to see uh, see what I need to do to borrow it. But I'll give 1320.51s - 1325.39s | you a call back in a couple days. Okay, talk to you later Joe. Bye. Beloved, did you know you 1325.39s - 1332.15s | can scan a paperback in about 30 minutes? Uh, I took the book home and this was before I got a 1332.37s - 1337.37s | proper book scanner. I have tools now. But I just had at the time, you know, regular run of the 1341.61s - 1347.31s | mill, pretty decent flatbed scanner. And it was great cause you could easily fit the pages on 1347.31s - 1351.89s | the glass uh, you know, the glass part of the scanner and push what was left of the binding up 1351.89s - 1356.75s | against the uh, you know, up against the thing. Got some good pages. And you know, I threw in a 1356.75s - 1361.83s | podcast and about half an hour later I had a bunch of images of pages which I could feed to 1361.87s - 1368.41s | ScanTailor. A bit of software that I think the Internet Archive still uses for um, ingesting, 1368.41s - 1373.41s | OCRing and converting images of pages into actual e-books. Um, it's not pretty but it works. 1376.65s - 1381.49s | Uh, well and then after I'm done, well this patron has a


chunk_id: 178_chunk_23
chunk_text:
know you 1325.39s - 1332.15s | can scan a paperback in about 30 minutes? Uh, I took the book home and this was before I got a 1332.37s - 1337.37s | proper book scanner. I have tools now. But I just had at the time, you know, regular run of the 1341.61s - 1347.31s | mill, pretty decent flatbed scanner. And it was great cause you could easily fit the pages on 1347.31s - 1351.89s | the glass uh, you know, the glass part of the scanner and push what was left of the binding up 1351.89s - 1356.75s | against the uh, you know, up against the thing. Got some good pages. And you know, I threw in a 1356.75s - 1361.83s | podcast and about half an hour later I had a bunch of images of pages which I could feed to 1361.87s - 1368.41s | ScanTailor. A bit of software that I think the Internet Archive still uses for um, ingesting, 1368.41s - 1373.41s | OCRing and converting images of pages into actual e-books. Um, it's not pretty but it works. 1376.65s - 1381.49s | Uh, well and then after I'm done, well this patron has a Kindle so obviously I needed to use 1381.49s - 1386.57s | Calibre to convert it to Mobi format. And 2 days later I gave him a copy of a favorite book 1386.57s - 1391.57s | that he had not read in 30 years. Okay. Thank you. Thank you. You're far too kind. Alright, 1396.45s - 1401.23s | this is one of my favorite stories of all time. I'll be telling this until I die. Uh, and 1401.23s - 1406.23s | this worked because of people like what I'm looking at at here at DEF CON. In the 1990s a 1408.69s - 1415.07s | bunch of punks made a movie. And I mean that literally. I want to tell you a story about 1415.07s - 1421.11s | Terminal City Ricochet. This is the one, this is one of the most independent of indie films. 1421.11s - 1428.15s | It's a punk rock counterculture cyberpunk cult masterpiece starring, well, featuring Jella 1428.15s - 1433.15s | Biafra of the Dead Kennedys and Joe Keithley of DOA. So uh, there was this uh, there was this 1437.49s - 1442.49s | person, I mean well let me back up. So why is this, why is


chunk_id: 178_chunk_24
chunk_text:
Kindle so obviously I needed to use 1381.49s - 1386.57s | Calibre to convert it to Mobi format. And 2 days later I gave him a copy of a favorite book 1386.57s - 1391.57s | that he had not read in 30 years. Okay. Thank you. Thank you. You're far too kind. Alright, 1396.45s - 1401.23s | this is one of my favorite stories of all time. I'll be telling this until I die. Uh, and 1401.23s - 1406.23s | this worked because of people like what I'm looking at at here at DEF CON. In the 1990s a 1408.69s - 1415.07s | bunch of punks made a movie. And I mean that literally. I want to tell you a story about 1415.07s - 1421.11s | Terminal City Ricochet. This is the one, this is one of the most independent of indie films. 1421.11s - 1428.15s | It's a punk rock counterculture cyberpunk cult masterpiece starring, well, featuring Jella 1428.15s - 1433.15s | Biafra of the Dead Kennedys and Joe Keithley of DOA. So uh, there was this uh, there was this 1437.49s - 1442.49s | person, I mean well let me back up. So why is this, why is this thing hard to find? Um, 1445.07s - 1450.07s | so this, this uh, this movie was made in sunny British Columbia, which is not Hollywood. Um, it 1453.27s - 1458.27s | has a soundtrack with some raging Canadian punk bands. And as I said in 2023, late 2023, it was 1460.61s - 1466.59s | almost entirely unobtainable. I mean they probably printed, you know, just a few DVDs and VHS 1466.59s - 1472.19s | cassettes and probably sold them through their friends and independent shops and stuff like 1472.21s - 1477.45s | that. So they're just strewn to the four winds. You could not even find it on eBay. And you 1477.45s - 1482.53s | can't pirate it because if you want to pirate something, you need to kind of have a copy of it. 1482.53s - 1489.27s | So, one day on Mastodon, someone started asking around about this movie and they wanted to get a 1489.27s - 1495.41s | copy of it. And that was proven to be difficult if not impossible. So, by the way, I don't know 1495.41s - 1499.65s | if he's here, but big shout out to the Gibson for hosting, running and


chunk_id: 178_chunk_25
chunk_text:
this thing hard to find? Um, 1445.07s - 1450.07s | so this, this uh, this movie was made in sunny British Columbia, which is not Hollywood. Um, it 1453.27s - 1458.27s | has a soundtrack with some raging Canadian punk bands. And as I said in 2023, late 2023, it was 1460.61s - 1466.59s | almost entirely unobtainable. I mean they probably printed, you know, just a few DVDs and VHS 1466.59s - 1472.19s | cassettes and probably sold them through their friends and independent shops and stuff like 1472.21s - 1477.45s | that. So they're just strewn to the four winds. You could not even find it on eBay. And you 1477.45s - 1482.53s | can't pirate it because if you want to pirate something, you need to kind of have a copy of it. 1482.53s - 1489.27s | So, one day on Mastodon, someone started asking around about this movie and they wanted to get a 1489.27s - 1495.41s | copy of it. And that was proven to be difficult if not impossible. So, by the way, I don't know 1495.41s - 1499.65s | if he's here, but big shout out to the Gibson for hosting, running and putting up with all the 1499.67s - 1505.91s | insanity that is the hackers dot town Mastodon server. Um, you know, awesome, awesome work 1505.91s - 1511.85s | there. And that's what facilitated this whole thing. This user had checked out some libraries 1511.85s - 1516.59s | and they couldn't find it. And someone just popped up, I didn't even know who this person was, 1516.59s - 1522.29s | popped up and said, hey, if you ask Cyberpunk Librarian, he might know a way to get it. So, 1522.29s - 1528.87s | they checked a bunch of libraries. They had not, however, checked WorldCat. Now if you don't 1528.89s - 1535.13s | know, WorldCat is a massive catalog of library materials and libraries all over the globe. And 1535.13s - 1540.41s | it's run by a company called OCLC. Now, I'm not going to get into the problems inherent with 1540.41s - 1545.37s | OCLC and modern libraries because we don't have the time and they only allowed me a shot and 1545.37s - 1552.69s | not the entire bottle. I, but I will tell you that if you want to see if you can find something in 1552.71s -


chunk_id: 178_chunk_26
chunk_text:
putting up with all the 1499.67s - 1505.91s | insanity that is the hackers dot town Mastodon server. Um, you know, awesome, awesome work 1505.91s - 1511.85s | there. And that's what facilitated this whole thing. This user had checked out some libraries 1511.85s - 1516.59s | and they couldn't find it. And someone just popped up, I didn't even know who this person was, 1516.59s - 1522.29s | popped up and said, hey, if you ask Cyberpunk Librarian, he might know a way to get it. So, 1522.29s - 1528.87s | they checked a bunch of libraries. They had not, however, checked WorldCat. Now if you don't 1528.89s - 1535.13s | know, WorldCat is a massive catalog of library materials and libraries all over the globe. And 1535.13s - 1540.41s | it's run by a company called OCLC. Now, I'm not going to get into the problems inherent with 1540.41s - 1545.37s | OCLC and modern libraries because we don't have the time and they only allowed me a shot and 1545.37s - 1552.69s | not the entire bottle. I, but I will tell you that if you want to see if you can find something in 1552.71s - 1557.71s | a library somewhere, your first stop is WorldCat dot org. So start there. And using WorldCat, I 1560.51s - 1565.51s | found a copy. One single copy. And do you know where it was? No surprises. Greater Victoria 1568.53s - 1573.53s | Public Library in beautiful British Columbia. So, uh, yeah. We're able to uh, you know, on 1574.21s - 1579.21s | Mastodon, we're able to work with each other. And uh, you know, a little back and forth, we 1585.35s - 1591.09s | found a Victorian local who literally lived down the street from this library. Now, this is a 1591.09s - 1598.09s | rare piece of media, but you could check it out. And they did. And they ripped us a beautiful 1598.13s - 1603.13s | digital copy, including the soundtrack. Um, so, you know, and they provide it for this 1607.23s - 1613.81s | person who is doing everything they could to obtain it legally. So, there was this guy, I'm 1613.81s - 1617.31s | sure you've not heard of him because there's librarians that might never heard of him. His 1617.31s - 1622.81s | name was Ranganathan. I'm probably pronouncing that wrong. He wrote


chunk_id: 178_chunk_27
chunk_text:
1557.71s | a library somewhere, your first stop is WorldCat dot org. So start there. And using WorldCat, I 1560.51s - 1565.51s | found a copy. One single copy. And do you know where it was? No surprises. Greater Victoria 1568.53s - 1573.53s | Public Library in beautiful British Columbia. So, uh, yeah. We're able to uh, you know, on 1574.21s - 1579.21s | Mastodon, we're able to work with each other. And uh, you know, a little back and forth, we 1585.35s - 1591.09s | found a Victorian local who literally lived down the street from this library. Now, this is a 1591.09s - 1598.09s | rare piece of media, but you could check it out. And they did. And they ripped us a beautiful 1598.13s - 1603.13s | digital copy, including the soundtrack. Um, so, you know, and they provide it for this 1607.23s - 1613.81s | person who is doing everything they could to obtain it legally. So, there was this guy, I'm 1613.81s - 1617.31s | sure you've not heard of him because there's librarians that might never heard of him. His 1617.31s - 1622.81s | name was Ranganathan. I'm probably pronouncing that wrong. He wrote down the five laws of 1622.81s - 1628.55s | library science. These are still pretty good today. And as you can see, the third law is every 1628.55s - 1633.55s | book its reader. Or in this case, every DVD its viewer. So, within a few days, a long lost 1637.15s - 1641.49s | movie had been re-obtained. And nowadays, strangely enough, you can view it on the 1641.49s - 1646.49s | internet archive. Funny how that happened. Okay, circling back, let's go back to that student 1646.91s - 1654.21s | who needed the article that their library didn't have access to. Now, there's something that you 1654.21s - 1660.99s | need to understand about libraries and librarians in that it's kind of an insular world. We 1660.99s - 1665.99s | know lots of other librarians. And you know what librarians love to do? They love to talk to 1668.67s - 1673.67s | other librarians. Um, so, okay, fine. But what does that mean for the student? Well, we've got a 1674.05s - 1679.05s | stat request for this article. They need this, the paper's due next week and oh my God. Okay, well 1681.69s - 1687.99s | even back


chunk_id: 178_chunk_28
chunk_text:
down the five laws of 1622.81s - 1628.55s | library science. These are still pretty good today. And as you can see, the third law is every 1628.55s - 1633.55s | book its reader. Or in this case, every DVD its viewer. So, within a few days, a long lost 1637.15s - 1641.49s | movie had been re-obtained. And nowadays, strangely enough, you can view it on the 1641.49s - 1646.49s | internet archive. Funny how that happened. Okay, circling back, let's go back to that student 1646.91s - 1654.21s | who needed the article that their library didn't have access to. Now, there's something that you 1654.21s - 1660.99s | need to understand about libraries and librarians in that it's kind of an insular world. We 1660.99s - 1665.99s | know lots of other librarians. And you know what librarians love to do? They love to talk to 1668.67s - 1673.67s | other librarians. Um, so, okay, fine. But what does that mean for the student? Well, we've got a 1674.05s - 1679.05s | stat request for this article. They need this, the paper's due next week and oh my God. Okay, well 1681.69s - 1687.99s | even back in the day, before, you know, all the cool internet stuff and things, a good 1687.99s - 1693.43s | interline- a good interlibrary loan librarian, which is hard to say, could turn this request 1693.43s - 1700.07s | around in hours if not minutes. Cause yes, there is a formal process that you have to go 1700.07s - 1705.21s | through to request an interlibrary loan, which you can totally do after you've made a phone 1705.21s - 1710.81s | call to your friend at the other library way over there and said, hey, I got a student that 1710.81s - 1714.95s | needs this thing, can you give a copy of it and send it? Yeah, I'll check my email later, I'll 1714.95s - 1720.79s | send you over the request later this afternoon. Thanks, bye! Now, while I'm not an interlibrary 1720.79s - 1725.97s | loan coordinator anymore, um, I have worked as an interlibrary loan coordinator over the 1725.97s - 1731.51s | course of my career. I've been in, I've actually done it for three separate times. I've been 1731.51s - 1736.51s | on both sides of that conversation. So, these days, like I said, I work


chunk_id: 178_chunk_29
chunk_text:
in the day, before, you know, all the cool internet stuff and things, a good 1687.99s - 1693.43s | interline- a good interlibrary loan librarian, which is hard to say, could turn this request 1693.43s - 1700.07s | around in hours if not minutes. Cause yes, there is a formal process that you have to go 1700.07s - 1705.21s | through to request an interlibrary loan, which you can totally do after you've made a phone 1705.21s - 1710.81s | call to your friend at the other library way over there and said, hey, I got a student that 1710.81s - 1714.95s | needs this thing, can you give a copy of it and send it? Yeah, I'll check my email later, I'll 1714.95s - 1720.79s | send you over the request later this afternoon. Thanks, bye! Now, while I'm not an interlibrary 1720.79s - 1725.97s | loan coordinator anymore, um, I have worked as an interlibrary loan coordinator over the 1725.97s - 1731.51s | course of my career. I've been in, I've actually done it for three separate times. I've been 1731.51s - 1736.51s | on both sides of that conversation. So, these days, like I said, I work in interlibrary loan as 1739.09s - 1745.15s | a shadow librarian. What that means is literally I'll, I'll watch Reddit, I'll watch Discord or, 1745.15s - 1750.83s | you know, chat room, whatever, and someone needs a PDF. They don't have access to that PDF. And 1750.83s - 1755.83s | maybe I do, and suddenly they have access to that PDF. It's very simple. Um, but, to, uh, kind 1760.03s - 1766.11s | of, kind of move beyond even that, if you listen to podcasts or, uh, watch YouTube videos, which I 1766.11s - 1772.25s | bet some of you do, um, you will hear someone occasionally say something along the lines of, I'm 1772.25s - 1777.25s | a lawyer, but I'm not your lawyer. Or I'm a therapist, but I'm not your therapist. Librarians 1777.91s - 1782.91s | are different. In a capitalistic society, the public library remains one of the few places where 1785.61s - 1790.61s | you can go and be there, and exist in a location, and no one expects you to pay for it. I am, I 1794.25s - 1799.97s | take pride in being part of a rare organization that can literally say, hi,


chunk_id: 178_chunk_30
chunk_text:
in interlibrary loan as 1739.09s - 1745.15s | a shadow librarian. What that means is literally I'll, I'll watch Reddit, I'll watch Discord or, 1745.15s - 1750.83s | you know, chat room, whatever, and someone needs a PDF. They don't have access to that PDF. And 1750.83s - 1755.83s | maybe I do, and suddenly they have access to that PDF. It's very simple. Um, but, to, uh, kind 1760.03s - 1766.11s | of, kind of move beyond even that, if you listen to podcasts or, uh, watch YouTube videos, which I 1766.11s - 1772.25s | bet some of you do, um, you will hear someone occasionally say something along the lines of, I'm 1772.25s - 1777.25s | a lawyer, but I'm not your lawyer. Or I'm a therapist, but I'm not your therapist. Librarians 1777.91s - 1782.91s | are different. In a capitalistic society, the public library remains one of the few places where 1785.61s - 1790.61s | you can go and be there, and exist in a location, and no one expects you to pay for it. I am, I 1794.25s - 1799.97s | take pride in being part of a rare organization that can literally say, hi, I'm from the 1799.97s - 1808.86s | government and I'm here to help and people don't laugh at me. I said people don't laugh at me. 1808.88s - 1814.64s | But, uh, the funny thing about librarians, we'll teach you how to do our job. We'll show you how to 1814.64s - 1821.18s | do what we do. And in essence, we kind of cut ourselves out of the, uh, out of the process. And 1821.18s - 1826.82s | it's not that we don't want to lose you as a patron, uh, but, because we believe in education, 1826.82s - 1832.40s | okay? Um, and even then, we'll, we'll always be there to back you up. We don't expect you to be 1832.40s - 1837.90s | experts. Um, so if you're having trouble using the library, you can't find something, well, hey, 1837.90s - 1842.84s | we are still there. And it doesn't matter if you're standing in a brick and mortar library, it 1842.84s - 1847.74s | doesn't matter if you're chatting to a librarian online or trying to find something on Mastodon, 1847.74s - 1852.76s | Discord, Reddit, whatever. So, let present me help future you. Like Liam


chunk_id: 178_chunk_31
chunk_text:
I'm from the 1799.97s - 1808.86s | government and I'm here to help and people don't laugh at me. I said people don't laugh at me. 1808.88s - 1814.64s | But, uh, the funny thing about librarians, we'll teach you how to do our job. We'll show you how to 1814.64s - 1821.18s | do what we do. And in essence, we kind of cut ourselves out of the, uh, out of the process. And 1821.18s - 1826.82s | it's not that we don't want to lose you as a patron, uh, but, because we believe in education, 1826.82s - 1832.40s | okay? Um, and even then, we'll, we'll always be there to back you up. We don't expect you to be 1832.40s - 1837.90s | experts. Um, so if you're having trouble using the library, you can't find something, well, hey, 1837.90s - 1842.84s | we are still there. And it doesn't matter if you're standing in a brick and mortar library, it 1842.84s - 1847.74s | doesn't matter if you're chatting to a librarian online or trying to find something on Mastodon, 1847.74s - 1852.76s | Discord, Reddit, whatever. So, let present me help future you. Like Liam Neeson, I have a 1858.36s - 1864.00s | particular set of skills. Because I can offer guidance and assistance from a public 1864.00s - 1870.80s | librarian's point of view and from a shadow librarian's standpoint as well. So, just a few 1870.80s - 1877.28s | things to consider. If you ever need to go researching something and you need in-depth 1877.28s - 1883.38s | information beyond what a search engine can provide. First, don't discount your public 1883.38s - 1888.32s | library. And I'm not saying that because I want you to support your library. Folks, your tax is 1888.34s - 1894.02s | paid for the library. You're supporting the library. You may as well go use it. It's one of the 1894.02s - 1898.82s | few places where you can go use the things you paid for. You paid for the cop cars, go drive 1898.82s - 1909.48s | one, see how it works. But there is one thing that shadow libraries suck at. They're just not 1909.48s - 1914.48s | good at it at all and I love shadow libraries. Um, and that thing is browsing. Serendipity is a 1914.80s - 1919.80s | hell of a discovery


chunk_id: 178_chunk_32
chunk_text:
Neeson, I have a 1858.36s - 1864.00s | particular set of skills. Because I can offer guidance and assistance from a public 1864.00s - 1870.80s | librarian's point of view and from a shadow librarian's standpoint as well. So, just a few 1870.80s - 1877.28s | things to consider. If you ever need to go researching something and you need in-depth 1877.28s - 1883.38s | information beyond what a search engine can provide. First, don't discount your public 1883.38s - 1888.32s | library. And I'm not saying that because I want you to support your library. Folks, your tax is 1888.34s - 1894.02s | paid for the library. You're supporting the library. You may as well go use it. It's one of the 1894.02s - 1898.82s | few places where you can go use the things you paid for. You paid for the cop cars, go drive 1898.82s - 1909.48s | one, see how it works. But there is one thing that shadow libraries suck at. They're just not 1909.48s - 1914.48s | good at it at all and I love shadow libraries. Um, and that thing is browsing. Serendipity is a 1914.80s - 1919.80s | hell of a discovery tool. Uh, for example, I write ghost stories. I have a podcast called AM800 1924.40s - 1930.92s | WRTH and it's like a night gallery thing in that this fictional AM radio station provides a 1930.92s - 1936.72s | delivery mechanism for the ghost story. Um, so, yeah, just the same way that the gallery did for 1936.72s - 1942.32s | the spooky TV story. So, I popped into the, uh, Warren County Public Library in Bowling Green, 1942.36s - 1947.54s | Kentucky. Because I wanted to find some ghost stories that I could, you know, have as maybe 1947.54s - 1952.84s | some ticklers. Something, you know, I'm not plagiarizing, I just need ideas, dammit. And my 1952.84s - 1956.68s | father's side of the family is from Appalachia, which now that you've heard me talk for a 1956.68s - 1962.88s | little while, might not surprise you. And that is a culture with a wonderful richness of ghost 1962.88s - 1969.28s | stories. And I figured, hey, I could find something along those lines. And I sure did. That 1969.28s - 1976.32s | was easy. I mean, 133. That's the Dewey Decimal number for specific topics in the


chunk_id: 178_chunk_33
chunk_text:
tool. Uh, for example, I write ghost stories. I have a podcast called AM800 1924.40s - 1930.92s | WRTH and it's like a night gallery thing in that this fictional AM radio station provides a 1930.92s - 1936.72s | delivery mechanism for the ghost story. Um, so, yeah, just the same way that the gallery did for 1936.72s - 1942.32s | the spooky TV story. So, I popped into the, uh, Warren County Public Library in Bowling Green, 1942.36s - 1947.54s | Kentucky. Because I wanted to find some ghost stories that I could, you know, have as maybe 1947.54s - 1952.84s | some ticklers. Something, you know, I'm not plagiarizing, I just need ideas, dammit. And my 1952.84s - 1956.68s | father's side of the family is from Appalachia, which now that you've heard me talk for a 1956.68s - 1962.88s | little while, might not surprise you. And that is a culture with a wonderful richness of ghost 1962.88s - 1969.28s | stories. And I figured, hey, I could find something along those lines. And I sure did. That 1969.28s - 1976.32s | was easy. I mean, 133. That's the Dewey Decimal number for specific topics in the paranormal, 1976.32s - 1981.86s | parapsychological and occultism. Uh, I didn't even use the library's catalog because I'm a 1981.86s - 1988.54s | professional, dammit. So, I go straight to the shelf and I'm standing there with a couple of, 1988.54s - 1993.10s | you know, a couple of shelves of, you know, ghost stories. And that's when I noticed 1993.10s - 2002.08s | something. Wow, this one guy. Uh, William Linwood Montel. Okay. Um, he's got a hell of a 2002.08s - 2008.28s | lot of books here. Um, right here in this section. Uh, and most all of them are about 2008.28s - 2013.86s | paranormal stories and incidents in the state of Kentucky. What's that about? Well, you know 2013.86s - 2018.50s | what else is in Bowling Green, Kentucky? Western Kentucky University. And if you know 2018.50s - 2023.24s | anything about the paranormal, you might know that John Carpenter went to Western Kentucky 2023.24s - 2029.64s | University. His father was a professor at Western Kentucky University and so was Dr. William 2029.64s - 2036.62s | Linwood Montel. Um, this was a man that was involved in editing, writing, publishing about 2036.62s - 2043.62s |


chunk_id: 178_chunk_34
chunk_text:
paranormal, 1976.32s - 1981.86s | parapsychological and occultism. Uh, I didn't even use the library's catalog because I'm a 1981.86s - 1988.54s | professional, dammit. So, I go straight to the shelf and I'm standing there with a couple of, 1988.54s - 1993.10s | you know, a couple of shelves of, you know, ghost stories. And that's when I noticed 1993.10s - 2002.08s | something. Wow, this one guy. Uh, William Linwood Montel. Okay. Um, he's got a hell of a 2002.08s - 2008.28s | lot of books here. Um, right here in this section. Uh, and most all of them are about 2008.28s - 2013.86s | paranormal stories and incidents in the state of Kentucky. What's that about? Well, you know 2013.86s - 2018.50s | what else is in Bowling Green, Kentucky? Western Kentucky University. And if you know 2018.50s - 2023.24s | anything about the paranormal, you might know that John Carpenter went to Western Kentucky 2023.24s - 2029.64s | University. His father was a professor at Western Kentucky University and so was Dr. William 2029.64s - 2036.62s | Linwood Montel. Um, this was a man that was involved in editing, writing, publishing about 2036.62s - 2043.62s | 28 books. He was a folklorist. He studied what he called the history of the common people. Um, 2043.62s - 2048.30s | I had never heard of this guy until I'm standing in a library looking at a couple shelves of 2048.30s - 2055.30s | books and then suddenly, I'm a big fan. Browsing a well-ordered collection of information and 2055.30s - 2061.38s | media might not help you find exactly what you want, but you could find what you need. Um, 2061.38s - 2066.12s | libraries are great for that and yeah, so are bookstores, but in a library you can borrow the 2066.12s - 2071.86s | thing and pay nothing. Gather your sources. Yeah, yeah, sometimes the shortest distance 2071.86s - 2075.60s | between two points is a search on Anna's Archive and suddenly you have an e-book that you 2075.62s - 2080.86s | didn't have before. But you remember WorldCat? You can uh, you can set up an account on 2080.86s - 2085.54s | WorldCat, totally free, and you can give it your zip code. And now if you want to see if you can 2085.54s - 2091.24s | find that weird and wonderful thing that you


chunk_id: 178_chunk_35
chunk_text:
28 books. He was a folklorist. He studied what he called the history of the common people. Um, 2043.62s - 2048.30s | I had never heard of this guy until I'm standing in a library looking at a couple shelves of 2048.30s - 2055.30s | books and then suddenly, I'm a big fan. Browsing a well-ordered collection of information and 2055.30s - 2061.38s | media might not help you find exactly what you want, but you could find what you need. Um, 2061.38s - 2066.12s | libraries are great for that and yeah, so are bookstores, but in a library you can borrow the 2066.12s - 2071.86s | thing and pay nothing. Gather your sources. Yeah, yeah, sometimes the shortest distance 2071.86s - 2075.60s | between two points is a search on Anna's Archive and suddenly you have an e-book that you 2075.62s - 2080.86s | didn't have before. But you remember WorldCat? You can uh, you can set up an account on 2080.86s - 2085.54s | WorldCat, totally free, and you can give it your zip code. And now if you want to see if you can 2085.54s - 2091.24s | find that weird and wonderful thing that you need to read right now, you can check WorldCat and 2091.24s - 2095.38s | it will tell you if it's any libraries that are close to you, sometimes within driving 2095.38s - 2100.38s | distance. Um, so, not only do you want to, you know, worry about that, but you can also uh, 2100.60s - 2105.60s | check out your library's uh, collection of databases. Um, yeah, libraries have got great 2109.34s - 2113.78s | collections, but depending on your library, they're gonna have things like magazine and 2113.78s - 2119.62s | newspaper databases. They're gonna have business databases, medical databases, legal 2119.62s - 2125.26s | databases. You need forms? They probably got your forms. Hell, lots of libraries have an 2125.26s - 2130.36s | online language learning system where you can learn a foreign language and you won't have to 2130.38s - 2137.22s | put up with a guilt trip from a little green owl. So, you may not need any of this stuff today, 2137.22s - 2142.22s | you might not need it tomorrow, but next week, next month, who knows? Check out other 2144.40s - 2150.36s | libraries, online or in person. This is not meant to


chunk_id: 178_chunk_36
chunk_text:
need to read right now, you can check WorldCat and 2091.24s - 2095.38s | it will tell you if it's any libraries that are close to you, sometimes within driving 2095.38s - 2100.38s | distance. Um, so, not only do you want to, you know, worry about that, but you can also uh, 2100.60s - 2105.60s | check out your library's uh, collection of databases. Um, yeah, libraries have got great 2109.34s - 2113.78s | collections, but depending on your library, they're gonna have things like magazine and 2113.78s - 2119.62s | newspaper databases. They're gonna have business databases, medical databases, legal 2119.62s - 2125.26s | databases. You need forms? They probably got your forms. Hell, lots of libraries have an 2125.26s - 2130.36s | online language learning system where you can learn a foreign language and you won't have to 2130.38s - 2137.22s | put up with a guilt trip from a little green owl. So, you may not need any of this stuff today, 2137.22s - 2142.22s | you might not need it tomorrow, but next week, next month, who knows? Check out other 2144.40s - 2150.36s | libraries, online or in person. This is not meant to be an exclusive relationship. We are not 2150.36s - 2155.10s | monogamous here, at least not when it comes to the libraries. What you do on your own time is 2155.12s - 2160.12s | up to you. Um, but is there something your library is lacking? Okay. Check another. Back in 2164.66s - 2170.70s | the COVID days, a library set up a thing where you could uh, sign up online for a digital 2170.70s - 2175.64s | library card that allowed you access to the e-book, you know, e-content collections and the 2175.64s - 2180.64s | databases and stuff. There was no charge for it. And in most cases, there still isn't. And that 2181.56s - 2186.56s | card might only be good for maybe 6 months or so, but hey, 6 months might be all you need. If 2189.30s - 2194.80s | you wanna get something that's, you know, more permanent, almost any library will offer you a 2194.80s - 2201.64s | library card with full borrowing privileges for some kind of fee. Back in the shadows for a 2201.64s - 2206.98s | moment, remember that there is a thriving e-book community in other places besides Zed 2207.02s


chunk_id: 178_chunk_37
chunk_text:
be an exclusive relationship. We are not 2150.36s - 2155.10s | monogamous here, at least not when it comes to the libraries. What you do on your own time is 2155.12s - 2160.12s | up to you. Um, but is there something your library is lacking? Okay. Check another. Back in 2164.66s - 2170.70s | the COVID days, a library set up a thing where you could uh, sign up online for a digital 2170.70s - 2175.64s | library card that allowed you access to the e-book, you know, e-content collections and the 2175.64s - 2180.64s | databases and stuff. There was no charge for it. And in most cases, there still isn't. And that 2181.56s - 2186.56s | card might only be good for maybe 6 months or so, but hey, 6 months might be all you need. If 2189.30s - 2194.80s | you wanna get something that's, you know, more permanent, almost any library will offer you a 2194.80s - 2201.64s | library card with full borrowing privileges for some kind of fee. Back in the shadows for a 2201.64s - 2206.98s | moment, remember that there is a thriving e-book community in other places besides Zed 2207.02s - 2213.30s | Library and Anna's Archive and stuff. Check out IRC. Remember IRC? Good times those were. 2213.30s - 2218.30s | There's a couple channels there on Undernet called e-books and books. That's a books with a 2218.30s - 2223.24s | Zed on the end of it. Um, you know, check that out. Easy to use, especially if you know how to 2223.24s - 2230.18s | use IRC. But, outside of all of that, today I would like to offer you a fantastic 2230.22s - 2235.22s | opportunity. I have a timeshare, no. Um, I would like to offer you a fantastic opportunity to 2239.26s - 2245.80s | be someone else's librarian. Listen, all of you, you're, you're here at DEF CON, right? I 2245.80s - 2250.80s | think so. I haven't hallucinated this bad in ages. Um, that means, whoops, I think I just got 2252.84s - 2257.84s | out of that. There we go. That means that you too have a particular set of skills. You have 2260.18s - 2265.18s | you know things and you know how to find things and you know how to do things with what you 2267.32s - 2273.86s | have learned.


chunk_id: 178_chunk_38
chunk_text:
- 2213.30s | Library and Anna's Archive and stuff. Check out IRC. Remember IRC? Good times those were. 2213.30s - 2218.30s | There's a couple channels there on Undernet called e-books and books. That's a books with a 2218.30s - 2223.24s | Zed on the end of it. Um, you know, check that out. Easy to use, especially if you know how to 2223.24s - 2230.18s | use IRC. But, outside of all of that, today I would like to offer you a fantastic 2230.22s - 2235.22s | opportunity. I have a timeshare, no. Um, I would like to offer you a fantastic opportunity to 2239.26s - 2245.80s | be someone else's librarian. Listen, all of you, you're, you're here at DEF CON, right? I 2245.80s - 2250.80s | think so. I haven't hallucinated this bad in ages. Um, that means, whoops, I think I just got 2252.84s - 2257.84s | out of that. There we go. That means that you too have a particular set of skills. You have 2260.18s - 2265.18s | you know things and you know how to find things and you know how to do things with what you 2267.32s - 2273.86s | have learned. You know about torrents, you know about Anna's Archive, you know how to break 2273.86s - 2279.80s | DRM. I could have totally put in a talk topic where I stood up here, talked about how DRM 2279.80s - 2284.14s | works on digital library materials, how you could strip that shit off and then make those 2284.14s - 2288.64s | files available for someone else to get a hold of, you know, that may not have access to it. I 2288.64s - 2295.38s | didn't do that because I think it'd be boring because I bet, I bet many of you already know how 2295.38s - 2300.38s | to do that shit already. And if you don't, you can learn it in an afternoon, believe me. But 2302.52s - 2307.32s | across the United States right now, right wing legislators and fascists, sorry, but I repeat 2307.32s - 2314.06s | myself there, are effectively banning books and materials in libraries and schools. Is it 2314.06s - 2319.06s | related to sex? Ban it. Anything to do with the GOBTQ community? That's gotta go. Uh, does it 2322.26s - 2327.26s | involve a non-Christian deity? That, can't have that. Um,


chunk_id: 178_chunk_39
chunk_text:
You know about torrents, you know about Anna's Archive, you know how to break 2273.86s - 2279.80s | DRM. I could have totally put in a talk topic where I stood up here, talked about how DRM 2279.80s - 2284.14s | works on digital library materials, how you could strip that shit off and then make those 2284.14s - 2288.64s | files available for someone else to get a hold of, you know, that may not have access to it. I 2288.64s - 2295.38s | didn't do that because I think it'd be boring because I bet, I bet many of you already know how 2295.38s - 2300.38s | to do that shit already. And if you don't, you can learn it in an afternoon, believe me. But 2302.52s - 2307.32s | across the United States right now, right wing legislators and fascists, sorry, but I repeat 2307.32s - 2314.06s | myself there, are effectively banning books and materials in libraries and schools. Is it 2314.06s - 2319.06s | related to sex? Ban it. Anything to do with the GOBTQ community? That's gotta go. Uh, does it 2322.26s - 2327.26s | involve a non-Christian deity? That, can't have that. Um, but it goes beyond that. Some states, 2331.74s - 2336.38s | namely, let's see if I can do this, Arkansas, Idaho, Indiana, Missouri, Montana, North 2336.38s - 2341.38s | Carolina, Oklahoma and Tennessee have tried to pass laws that make multiple aspects of public 2341.84s - 2346.84s | librarianship a criminal offense. And in some states, they succeeded. In uh, in Oklahoma, 2352.08s - 2358.28s | school and public librarians are looking at up to $20,000 in fines or 10 years in prison for 2358.28s - 2363.30s | exposing children to obscene materials, whatever the hell that is. In uh, in uh, Montana, school 2364.02s - 2369.02s | library and museum uh, employees face prosecution for dealing in obscene materials. Have you 2376.60s - 2382.64s | got a renaissance exhibit coming through town? Does it have pictures of naked people? You 2382.64s - 2387.64s | might go to jail if a kid comes to the museum. Sounds great, doesn't it? So, what can you do 2388.26s - 2393.26s | to help? It's very easy. Share your skills, share the media. Now, you can take that however you 2402.66s - 2408.04s | like. You might be thinking, oh, I, I see


chunk_id: 178_chunk_40
chunk_text:
but it goes beyond that. Some states, 2331.74s - 2336.38s | namely, let's see if I can do this, Arkansas, Idaho, Indiana, Missouri, Montana, North 2336.38s - 2341.38s | Carolina, Oklahoma and Tennessee have tried to pass laws that make multiple aspects of public 2341.84s - 2346.84s | librarianship a criminal offense. And in some states, they succeeded. In uh, in Oklahoma, 2352.08s - 2358.28s | school and public librarians are looking at up to $20,000 in fines or 10 years in prison for 2358.28s - 2363.30s | exposing children to obscene materials, whatever the hell that is. In uh, in uh, Montana, school 2364.02s - 2369.02s | library and museum uh, employees face prosecution for dealing in obscene materials. Have you 2376.60s - 2382.64s | got a renaissance exhibit coming through town? Does it have pictures of naked people? You 2382.64s - 2387.64s | might go to jail if a kid comes to the museum. Sounds great, doesn't it? So, what can you do 2388.26s - 2393.26s | to help? It's very easy. Share your skills, share the media. Now, you can take that however you 2402.66s - 2408.04s | like. You might be thinking, oh, I, I see what he's saying. He's encouraging me to liberate 2408.04s - 2412.64s | DRM encumbered materials and make sure that others can access those materials uh, 2412.64s - 2416.96s | regardless of the capitalist bullshit, unconstitutional laws and oppressive 2416.96s - 2423.21s | governments. And you'd be right. You, or you might think, hey, he's suggesting, I know what he's 2430.45s - 2435.65s | saying, he's suggesting that I should scan and copy and digitize materials that aren't even 2435.65s - 2440.67s | available online and then put them online. And you'd be correct. Um, or you might be 2445.43s - 2450.43s | thinking, hey, I uh, I know a kid and they really need to read genderqueer. Cause they're 2456.81s - 2462.29s | going through some shit right now, man. And uh, maybe I should get them a copy of their own 2462.29s - 2467.29s | because their state banned that book in public and school libraries. That's good too. I'm 2468.29s - 2473.29s | gonna close this out with a uh, with a dirty little secret about me. That's not really a dirty 2477.53s - 2489.25s | little secret if uh, if you know anything about me. I never


chunk_id: 178_chunk_41
chunk_text:
what he's saying. He's encouraging me to liberate 2408.04s - 2412.64s | DRM encumbered materials and make sure that others can access those materials uh, 2412.64s - 2416.96s | regardless of the capitalist bullshit, unconstitutional laws and oppressive 2416.96s - 2423.21s | governments. And you'd be right. You, or you might think, hey, he's suggesting, I know what he's 2430.45s - 2435.65s | saying, he's suggesting that I should scan and copy and digitize materials that aren't even 2435.65s - 2440.67s | available online and then put them online. And you'd be correct. Um, or you might be 2445.43s - 2450.43s | thinking, hey, I uh, I know a kid and they really need to read genderqueer. Cause they're 2456.81s - 2462.29s | going through some shit right now, man. And uh, maybe I should get them a copy of their own 2462.29s - 2467.29s | because their state banned that book in public and school libraries. That's good too. I'm 2468.29s - 2473.29s | gonna close this out with a uh, with a dirty little secret about me. That's not really a dirty 2477.53s - 2489.25s | little secret if uh, if you know anything about me. I never finished my library degree. I 2489.25s - 2494.29s | started working in libraries uh, 30 years ago. I've never been able to finish my library 2494.29s - 2498.47s | degree cause I'm too busy doing library work. I've shelved books, worked the front desk, 2498.47s - 2501.83s | reference desk, children's desk, built curriculum, taught classes, installed tech, fixed 2502.29s - 2506.45s | problems, started problems, migrated systems, abandoned systems, created workflows, created 2506.45s - 2513.33s | databases, wrote SQL, wrote PHP, wrote documentation and wrote an entire goddamn book on how to 2513.33s - 2518.33s | use a very specific database in a very specific library system. I did all that shit without a 2520.91s - 2529.50s | degree. I started working in libraries 30 years ago. You can start today. You can be someone 2529.82s - 2534.82s | else's librarian. Even if they're, even if they're your only patron. All you need to do is 2538.36s - 2543.36s | help and share. Anything you don't know, you're allowed to look it up. Thank you for 2545.84s - 2551.48s | listening. Thank you to Derek Brown for browbeating me into being here. Rise above my 2551.48s - 2565.34s |


chunk_id: 178_chunk_42
chunk_text:
finished my library degree. I 2489.25s - 2494.29s | started working in libraries uh, 30 years ago. I've never been able to finish my library 2494.29s - 2498.47s | degree cause I'm too busy doing library work. I've shelved books, worked the front desk, 2498.47s - 2501.83s | reference desk, children's desk, built curriculum, taught classes, installed tech, fixed 2502.29s - 2506.45s | problems, started problems, migrated systems, abandoned systems, created workflows, created 2506.45s - 2513.33s | databases, wrote SQL, wrote PHP, wrote documentation and wrote an entire goddamn book on how to 2513.33s - 2518.33s | use a very specific database in a very specific library system. I did all that shit without a 2520.91s - 2529.50s | degree. I started working in libraries 30 years ago. You can start today. You can be someone 2529.82s - 2534.82s | else's librarian. Even if they're, even if they're your only patron. All you need to do is 2538.36s - 2543.36s | help and share. Anything you don't know, you're allowed to look it up. Thank you for 2545.84s - 2551.48s | listening. Thank you to Derek Brown for browbeating me into being here. Rise above my 2551.48s - 2565.34s | friends, enjoy the rest of DEF CON. They got a thing coming up I'm sure in a few minutes. I'm 2565.36s - 2569.36s | going to head out into the hallway if you want to ask me questions. Well, hi, I'm a 2569.36s - 2574.94s | librarian. Um and uh yeah, I'll meet you all out there. Thank you all for coming. There's a 2574.94s - 2578.94s | hell of a lot more of you than I thought there would be and thank you for having me.


chunk_id: 178_chunk_43
chunk_text:
friends, enjoy the rest of DEF CON. They got a thing coming up I'm sure in a few minutes. I'm 2565.36s - 2569.36s | going to head out into the hallway if you want to ask me questions. Well, hi, I'm a 2569.36s - 2574.94s | librarian. Um and uh yeah, I'll meet you all out there. Thank you all for coming. There's a 2574.94s - 2578.94s | hell of a lot more of you than I thought there would be and thank you for having me.


chunk_id: 179_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=QgeEHdAmJDg", "title": "DEF CON 32 - Secret Life of Rogue Device: Lost IT Assets on the Public Marketplace - Matthew Bryant", "description": "An ex-employee's work laptop, a secret hardware prototype, the company backup server, and classified government computers. What do these things have in common? They should never end up on the public market. Ask any IT department and they'll tell you that \"it happens\", but how serious is the problem and what's really at stake? This talk explores the interesting journey of a research project to learn the surprising answers to these questions.\n\nAlong the way we'll scrape over 150 million images from online listings in Western and Eastern second hand markets, hack together an OCR cluster out of old iPhones, reverse engineer well-obfuscated Chinese apps, and converse with secretive underground groups of collectors.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1815, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 4.04s | This text was transcribed using whisper model: large-v2 Good deal. Thank you all for coming. This is a secret life of a rogue device 5.24s - 9.36s | My wife told me not to tell anybody who helped me with these slides and make them look beautiful 9.36s - 15.12s | So I'm just gonna say a beautiful anonymous woman helped me make these look nice and the earlier format was much uglier 15.12s - 16.36s | I assure you 16.36s - 22.04s | So a quick background. I'm Matthew. My friends call me mandatory 22.04s - 29.50s | I've worked on a variety of security projects things like XSS center cursed Chrome and I write security research at the hacker blog calm 29.94s - 32.58s | In my professional life, I also lead the red team at snap 33.18s - 37.69s | So this talks sort of about quote-unquote rogue hardware 38.43s - 43.03s | Ending up on the secondhand online electronics markets. So what do I mean by rogue? 43.03s - 45.39s | I mean things that shouldn't end up there 45.39s - 49.43s | So this is kind of a few key categories, right things like employee laptops 49.43s - 54.17s | Which you're probably familiar with right that shouldn't be resold maybe has sensitive data on it stuff like that 54.95s - 56.63s | It means things like prototypes 56.63s - 59.15s | So early development version of your favorite products 59.15s - 63.87s |


chunk_id: 179_chunk_1
chunk_text:
15.12s | So I'm just gonna say a beautiful anonymous woman helped me make these look nice and the earlier format was much uglier 15.12s - 16.36s | I assure you 16.36s - 22.04s | So a quick background. I'm Matthew. My friends call me mandatory 22.04s - 29.50s | I've worked on a variety of security projects things like XSS center cursed Chrome and I write security research at the hacker blog calm 29.94s - 32.58s | In my professional life, I also lead the red team at snap 33.18s - 37.69s | So this talks sort of about quote-unquote rogue hardware 38.43s - 43.03s | Ending up on the secondhand online electronics markets. So what do I mean by rogue? 43.03s - 45.39s | I mean things that shouldn't end up there 45.39s - 49.43s | So this is kind of a few key categories, right things like employee laptops 49.43s - 54.17s | Which you're probably familiar with right that shouldn't be resold maybe has sensitive data on it stuff like that 54.95s - 56.63s | It means things like prototypes 56.63s - 59.15s | So early development version of your favorite products 59.15s - 63.87s | maybe like the iPhones that you enjoy right earlier stages when they were first being built right and 64.07s - 70.11s | Then sort of like more specialized things like factory line equipments and you know backup hard drives stuff like that 70.11s - 72.11s | So that's sort of what we'll be covering 72.35s - 77.64s | The main questions we're gonna be answering here is some of them are pretty obvious, right? 77.64s - 80.76s | It's like how often does this actually happen right? Is this a problem, right? 80.76s - 85.32s | And then for the stuff that does end up here, you know on these secondary markets. What's the impact? 85.32s - 90.00s | Is there anything security related that we have to worry about and then, you know, ultimately what is it? 90.00s - 92.00s | That actually ends up getting resold like this 93.32s - 99.12s | Along the way we'll sort of figure out like, you know, what are the challenges of doing research in this space once we figure those 99.12s - 103.48s | Out well to scale it up to sort of do all of the listings across Western and


chunk_id: 179_chunk_2
chunk_text:
maybe like the iPhones that you enjoy right earlier stages when they were first being built right and 64.07s - 70.11s | Then sort of like more specialized things like factory line equipments and you know backup hard drives stuff like that 70.11s - 72.11s | So that's sort of what we'll be covering 72.35s - 77.64s | The main questions we're gonna be answering here is some of them are pretty obvious, right? 77.64s - 80.76s | It's like how often does this actually happen right? Is this a problem, right? 80.76s - 85.32s | And then for the stuff that does end up here, you know on these secondary markets. What's the impact? 85.32s - 90.00s | Is there anything security related that we have to worry about and then, you know, ultimately what is it? 90.00s - 92.00s | That actually ends up getting resold like this 93.32s - 99.12s | Along the way we'll sort of figure out like, you know, what are the challenges of doing research in this space once we figure those 99.12s - 103.48s | Out well to scale it up to sort of do all of the listings across Western and Eastern markets 103.48s - 108.96s | And then we'll finish up with everybody's favorite part, which is like war stories and loot and all that cool stuff 111.60s - 114.84s | Great. So what are the challenges to finding rogue hardware? 115.84s - 120.28s | First one is probably pretty obvious. You probably already guessed it. We've got to get it from somewhere 120.28s - 122.84s | So what are the places that stuff gets resold on right? 122.84s - 127.64s | So if you're you know from the US you probably familiar with eBay right for the Western side of things 127.76s - 132.60s | There's also other things like Craigslist and Facebook Marketplace, but those are generally a little bit more local, right? 132.60s - 136.44s | You they might expect you to show up and you know, that's kind of hard to scale out 136.44s - 139.72s | So we want stuff where you can sort of ship it. So we'll kind of focus on eBay on this side 140.72s - 146.24s | On the eastern side, you know sort of where all the electronics are assembled actually put together right within some manufactured 146.60s - 151.72s


chunk_id: 179_chunk_3
chunk_text:
Eastern markets 103.48s - 108.96s | And then we'll finish up with everybody's favorite part, which is like war stories and loot and all that cool stuff 111.60s - 114.84s | Great. So what are the challenges to finding rogue hardware? 115.84s - 120.28s | First one is probably pretty obvious. You probably already guessed it. We've got to get it from somewhere 120.28s - 122.84s | So what are the places that stuff gets resold on right? 122.84s - 127.64s | So if you're you know from the US you probably familiar with eBay right for the Western side of things 127.76s - 132.60s | There's also other things like Craigslist and Facebook Marketplace, but those are generally a little bit more local, right? 132.60s - 136.44s | You they might expect you to show up and you know, that's kind of hard to scale out 136.44s - 139.72s | So we want stuff where you can sort of ship it. So we'll kind of focus on eBay on this side 140.72s - 146.24s | On the eastern side, you know sort of where all the electronics are assembled actually put together right within some manufactured 146.60s - 151.72s | There's another market which you may not be as familiar with. I apologize to the native Chinese speakers here 151.72s - 152.64s | I'm gonna butcher this word 152.64s - 154.64s | But Shen you is the app that they have there 154.76s - 160.48s | Which is much larger than I thought it was going to be but this is basically the second-hand market in China 160.48s - 162.40s | So if you want to resell something there 162.40s - 168.53s | So we know the where but the second challenge is like sellers don't usually make listings like this 168.53s - 173.17s | They're not like hey, this is a secret, you know prototype for this crazy product thing, right? 173.45s - 177.37s | Usually the sellers don't even know what it is that they're selling right in many of these cases 177.57s - 182.21s | And they're not just gonna put that in a listing where we could easily find it. So how do we deal with that? 183.25s - 187.61s | I'll give you a little spoiler a lot of the information that we actually want is more in the images, right? 187.61s - 188.77s


chunk_id: 179_chunk_4
chunk_text:
| There's another market which you may not be as familiar with. I apologize to the native Chinese speakers here 151.72s - 152.64s | I'm gonna butcher this word 152.64s - 154.64s | But Shen you is the app that they have there 154.76s - 160.48s | Which is much larger than I thought it was going to be but this is basically the second-hand market in China 160.48s - 162.40s | So if you want to resell something there 162.40s - 168.53s | So we know the where but the second challenge is like sellers don't usually make listings like this 168.53s - 173.17s | They're not like hey, this is a secret, you know prototype for this crazy product thing, right? 173.45s - 177.37s | Usually the sellers don't even know what it is that they're selling right in many of these cases 177.57s - 182.21s | And they're not just gonna put that in a listing where we could easily find it. So how do we deal with that? 183.25s - 187.61s | I'll give you a little spoiler a lot of the information that we actually want is more in the images, right? 187.61s - 188.77s | So it's not in any text 188.77s - 194.13s | What's actually in the text embedded in the images themselves if you have again a company laptop probably sticker on the bottom 194.13s - 197.05s | It says property of whatever or asset tag, you know, whatever 197.81s - 202.01s | So we have to dig a little bit deeper to find the answer to this stuff right to figure out the real truth of where 202.01s - 202.85s | These are 202.85s - 209.34s | So assuming that we get all the stuff from where we've talked about and then we sort of analyze those images and do all this 209.34s - 212.62s | Stuff right? We still have to know kind of like what we're looking for, right? 212.66s - 218.06s | So in the case of prototypes, like I mentioned there's like secret code words secret labeling conventions they use 218.62s - 223.14s | For I mentioned before for employee laptops, there's special barcode formats and whatever else, right? 223.14s - 226.46s | So we have to sort of figure out what these are in order to identify when these things show up 226.98s - 232.84s


chunk_id: 179_chunk_5
chunk_text:
| So it's not in any text 188.77s - 194.13s | What's actually in the text embedded in the images themselves if you have again a company laptop probably sticker on the bottom 194.13s - 197.05s | It says property of whatever or asset tag, you know, whatever 197.81s - 202.01s | So we have to dig a little bit deeper to find the answer to this stuff right to figure out the real truth of where 202.01s - 202.85s | These are 202.85s - 209.34s | So assuming that we get all the stuff from where we've talked about and then we sort of analyze those images and do all this 209.34s - 212.62s | Stuff right? We still have to know kind of like what we're looking for, right? 212.66s - 218.06s | So in the case of prototypes, like I mentioned there's like secret code words secret labeling conventions they use 218.62s - 223.14s | For I mentioned before for employee laptops, there's special barcode formats and whatever else, right? 223.14s - 226.46s | So we have to sort of figure out what these are in order to identify when these things show up 226.98s - 232.84s | And let's talk about sort of building a pipeline for detecting this rogue hardware at scale 234.40s - 238.24s | Probably unsurprisingly the first challenge is we've got to scrape the hell out of a bunch of sites, right? 238.24s - 242.36s | So I mentioned before we'll focus on two main sites here eBay and sinew 242.80s - 246.24s | Let's start off with eBay because it's dramatically easier to scrape. You'll see why 247.12s - 249.00s | So on the eBay side, this is pretty simple 249.00s - 253.92s | You just do searches for the kind of products you're looking for right something like laptop or phone or whatever it is 254.28s - 258.36s | You scrape the resulting listings and you extract the images out of them so we can do analysis on them 259.44s - 263.60s | But we have a hurdle and this is pretty much the case for any major site, right? 263.60s - 267.16s | They'll have some form of rate limiting right to prevent either bots or whatever it is 267.60s - 271.96s | In the case of eBay if you do too many requests, they give you this fake


chunk_id: 179_chunk_6
chunk_text:
| And let's talk about sort of building a pipeline for detecting this rogue hardware at scale 234.40s - 238.24s | Probably unsurprisingly the first challenge is we've got to scrape the hell out of a bunch of sites, right? 238.24s - 242.36s | So I mentioned before we'll focus on two main sites here eBay and sinew 242.80s - 246.24s | Let's start off with eBay because it's dramatically easier to scrape. You'll see why 247.12s - 249.00s | So on the eBay side, this is pretty simple 249.00s - 253.92s | You just do searches for the kind of products you're looking for right something like laptop or phone or whatever it is 254.28s - 258.36s | You scrape the resulting listings and you extract the images out of them so we can do analysis on them 259.44s - 263.60s | But we have a hurdle and this is pretty much the case for any major site, right? 263.60s - 267.16s | They'll have some form of rate limiting right to prevent either bots or whatever it is 267.60s - 271.96s | In the case of eBay if you do too many requests, they give you this fake 404 page saying hey 272.56s - 276.36s | You know, you're doing that too much and to try to fool you into thinking this page doesn't exist 277.72s - 281.08s | Luckily in the modern Internet is not quite as simple as it used to be, right? 281.08s - 286.76s | We have like CDN services in the middle of a lot of things to sort of speed up page loads and optimize content being served 286.76s - 290.56s | At the edge right and we can use this to our advantage to circumvent this rate limiting 290.76s - 295.16s | So in the case of eBay, you know, they essentially have an allow list from all of cloudflare 295.16s - 298.60s | Which is a popular CDNs like IP ranges that said hey if it's coming from here 299.00s - 301.84s | Don't bother with the rate limiting just allow unlimited requests, right? 302.32s - 305.72s | So cloudflare allows you to make workers which come from like their space, right? 305.72s - 310.52s | So I just simply upload a cloudflare worker which proxy to eBay and so by using this as a proxy 310.52s - 316.56s |


chunk_id: 179_chunk_7
chunk_text:
404 page saying hey 272.56s - 276.36s | You know, you're doing that too much and to try to fool you into thinking this page doesn't exist 277.72s - 281.08s | Luckily in the modern Internet is not quite as simple as it used to be, right? 281.08s - 286.76s | We have like CDN services in the middle of a lot of things to sort of speed up page loads and optimize content being served 286.76s - 290.56s | At the edge right and we can use this to our advantage to circumvent this rate limiting 290.76s - 295.16s | So in the case of eBay, you know, they essentially have an allow list from all of cloudflare 295.16s - 298.60s | Which is a popular CDNs like IP ranges that said hey if it's coming from here 299.00s - 301.84s | Don't bother with the rate limiting just allow unlimited requests, right? 302.32s - 305.72s | So cloudflare allows you to make workers which come from like their space, right? 305.72s - 310.52s | So I just simply upload a cloudflare worker which proxy to eBay and so by using this as a proxy 310.52s - 316.56s | I can get around all the rate limiting and do unlimited requests. So super easy. We've got that problem solved 317.76s - 319.52s | moving right along 319.52s - 325.16s | All right. So in the China side right Shen you it's not quite as easy 325.16s - 327.92s | In fact, you go to their website and you don't see like anything at all 327.92s - 331.00s | It just says like hey download our app to continue. They're like, all right 331.44s - 336.20s | So you go to their your local app store you download their web their their little app 336.20s - 338.20s | You start browsing for listings on this, right? 338.40s - 341.92s | Of course if we want to do this at scale and do any scrapings is not going to cut it 341.92s - 345.92s | So we got to crack open the app. We remove cert pinning and under the hood 345.92s - 350.84s | We find that it has a total custom signing API for all of their requests 351.04s - 354.04s | So they basically generate some cryptographic material. They sign all the requests 354.04s - 356.52s | They


chunk_id: 179_chunk_8
chunk_text:
I can get around all the rate limiting and do unlimited requests. So super easy. We've got that problem solved 317.76s - 319.52s | moving right along 319.52s - 325.16s | All right. So in the China side right Shen you it's not quite as easy 325.16s - 327.92s | In fact, you go to their website and you don't see like anything at all 327.92s - 331.00s | It just says like hey download our app to continue. They're like, all right 331.44s - 336.20s | So you go to their your local app store you download their web their their little app 336.20s - 338.20s | You start browsing for listings on this, right? 338.40s - 341.92s | Of course if we want to do this at scale and do any scrapings is not going to cut it 341.92s - 345.92s | So we got to crack open the app. We remove cert pinning and under the hood 345.92s - 350.84s | We find that it has a total custom signing API for all of their requests 351.04s - 354.04s | So they basically generate some cryptographic material. They sign all the requests 354.04s - 356.52s | They have to be byte perfect and be signed properly 356.52s - 359.76s | Otherwise the servers will just reject your requests on top of this 359.76s - 364.78s | Even if you do those requests you get responses where the fields are actually encrypted in their proprietary format 365.00s - 367.40s | So you have to be able to figure out how to get rid of that as well 367.88s - 370.28s | And of course they implement their own capture system 370.28s - 375.04s | So if you're doing a lot of these requests, right, you're not logged in they're gonna spawn this and you have to solve this 375.04s - 376.24s | and 376.24s - 380.24s | You're like it's too easy. There's still more all of that stuff 380.52s - 387.00s | It's not done like in the Java where it might be easier to reverse right? It's done deep inside the obfuscated JNA binary, right? 387.00s - 389.36s | So you're gonna have to pull out some assembly and start cooking, right? 390.04s - 394.20s | Really great job actually like by the team. They did a good job of doing the any bot stuff here


chunk_id: 179_chunk_9
chunk_text:
have to be byte perfect and be signed properly 356.52s - 359.76s | Otherwise the servers will just reject your requests on top of this 359.76s - 364.78s | Even if you do those requests you get responses where the fields are actually encrypted in their proprietary format 365.00s - 367.40s | So you have to be able to figure out how to get rid of that as well 367.88s - 370.28s | And of course they implement their own capture system 370.28s - 375.04s | So if you're doing a lot of these requests, right, you're not logged in they're gonna spawn this and you have to solve this 375.04s - 376.24s | and 376.24s - 380.24s | You're like it's too easy. There's still more all of that stuff 380.52s - 387.00s | It's not done like in the Java where it might be easier to reverse right? It's done deep inside the obfuscated JNA binary, right? 387.00s - 389.36s | So you're gonna have to pull out some assembly and start cooking, right? 390.04s - 394.20s | Really great job actually like by the team. They did a good job of doing the any bot stuff here 395.12s - 400.12s | But for us, this is just like a skill issue. So we're gonna have to get around all this shit, right? 401.04s - 405.24s | If any of you have ever done Android reverse engineering before you have personally been on this scale 405.36s - 409.00s | You start off and you're like reading a blog post. You're like dude Frieda is sick 409.00s - 412.92s | I can just hook all these functions and like I don't have to do a reverse engineering look like 413.12s - 418.88s | Easy and then eventually you start like becoming like I'm the real deal. I learned assembly. I can reverse engineer stuff 418.88s - 424.12s | I can actually just figure out their custom thing and like re-implemented my own language and it's super leaf 424.12s - 427.28s | And then they do an update and it breaks all your shit and you're like, wait a minute 427.92s - 430.44s | Every update I'm gonna have to do like three hours of reversing 430.44s - 434.76s | No fucking thank you. And so you go back to Frieda, right? So in this case, we just skip to


chunk_id: 179_chunk_10
chunk_text:
395.12s - 400.12s | But for us, this is just like a skill issue. So we're gonna have to get around all this shit, right? 401.04s - 405.24s | If any of you have ever done Android reverse engineering before you have personally been on this scale 405.36s - 409.00s | You start off and you're like reading a blog post. You're like dude Frieda is sick 409.00s - 412.92s | I can just hook all these functions and like I don't have to do a reverse engineering look like 413.12s - 418.88s | Easy and then eventually you start like becoming like I'm the real deal. I learned assembly. I can reverse engineer stuff 418.88s - 424.12s | I can actually just figure out their custom thing and like re-implemented my own language and it's super leaf 424.12s - 427.28s | And then they do an update and it breaks all your shit and you're like, wait a minute 427.92s - 430.44s | Every update I'm gonna have to do like three hours of reversing 430.44s - 434.76s | No fucking thank you. And so you go back to Frieda, right? So in this case, we just skip to the end 435.76s - 438.40s | so I wrote a custom thing to basically 438.92s - 445.48s | basically open the app click through all the prompts do initial requests and do the fun like thumb capsule sliding thing automatically and 445.76s - 449.00s | Then once it's into the state where I can start actually doing these requests 449.00s - 453.96s | It does a Frieda server and doesn't injection so we can basically hand it an HTTP request that 454.12s - 458.68s | We want to sign for us and it will return us to sign the request that we can then send to their API server 461.43s - 462.99s | So this is essentially what it looks like 462.99s - 466.95s | You got like a rooted phone with a server and essentially it does the signing proxying for us, right? 466.95s - 470.19s | and then we send that off over residential proxy to make the request and 470.83s - 475.55s | Result looks something like this again cable management was not me. It was much uglier when I did it 476.23s - 480.00s | So this gives us a good way to sort of find


chunk_id: 179_chunk_11
chunk_text:
the end 435.76s - 438.40s | so I wrote a custom thing to basically 438.92s - 445.48s | basically open the app click through all the prompts do initial requests and do the fun like thumb capsule sliding thing automatically and 445.76s - 449.00s | Then once it's into the state where I can start actually doing these requests 449.00s - 453.96s | It does a Frieda server and doesn't injection so we can basically hand it an HTTP request that 454.12s - 458.68s | We want to sign for us and it will return us to sign the request that we can then send to their API server 461.43s - 462.99s | So this is essentially what it looks like 462.99s - 466.95s | You got like a rooted phone with a server and essentially it does the signing proxying for us, right? 466.95s - 470.19s | and then we send that off over residential proxy to make the request and 470.83s - 475.55s | Result looks something like this again cable management was not me. It was much uglier when I did it 476.23s - 480.00s | So this gives us a good way to sort of find new sellers, right? 480.00s - 484.64s | We do searches we get their seller IDs and now we've got a good base to actually scrape the items that we want here 485.56s - 488.96s | So when I said that there's like no websites that was kind of a lie 489.08s - 493.28s | They do have a special like preview thing for ostensibly growth reasons, right? 493.28s - 497.24s | So you can like share a link in the app with somebody else and they don't have to have the app to see it 497.24s - 499.64s | And it's like a little it'll show you the listing information 499.64s - 501.76s | But then when you try to buy it, right, it's like down on our app 502.00s - 506.92s | So that sounds like a great way to get around this but there's kind of a caveat, right? 506.96s - 510.20s | The rate limiting here is severe. I don't mean like you're like wow 510.20s - 513.88s | This is like three previews you view it and it's like no, no, no, no more 513.88s - 519.26s | No more previews you got to log in


chunk_id: 179_chunk_12
chunk_text:
new sellers, right? 480.00s - 484.64s | We do searches we get their seller IDs and now we've got a good base to actually scrape the items that we want here 485.56s - 488.96s | So when I said that there's like no websites that was kind of a lie 489.08s - 493.28s | They do have a special like preview thing for ostensibly growth reasons, right? 493.28s - 497.24s | So you can like share a link in the app with somebody else and they don't have to have the app to see it 497.24s - 499.64s | And it's like a little it'll show you the listing information 499.64s - 501.76s | But then when you try to buy it, right, it's like down on our app 502.00s - 506.92s | So that sounds like a great way to get around this but there's kind of a caveat, right? 506.96s - 510.20s | The rate limiting here is severe. I don't mean like you're like wow 510.20s - 513.88s | This is like three previews you view it and it's like no, no, no, no more 513.88s - 519.26s | No more previews you got to log in and so this means that we're gonna need like a lot of IP addresses 520.04s - 523.36s | So even for like the crappy budget networks, this is gonna be a lot of IP addresses 523.64s - 530.52s | So I had to do a little bit of digging pun intended and I was like, oh it's available over IPv6 530.96s - 534.76s | Last time I checked I think there's a lot more IPv6 IPs out there than IPv4 535.08s - 537.08s | So I think there might be a solution here 537.08s - 538.76s | Okay 538.76s - 544.00s | So I went straight to the source for you know for me this is like the North American number registry 544.00s - 545.12s | Which is Aaron, right? 545.12s - 551.84s | you can apparently get a fat 36 range IPv6 right allocation and it only costs like 250 bucks a year and 552.04s - 555.76s | So with this you actually the number of IPs is a bigger number that I can even pronounce 555.80s - 558.88s | But you essentially have a limited IP space that you can now utilize. 559.92s - 564.12s | I combined


chunk_id: 179_chunk_13
chunk_text:
and so this means that we're gonna need like a lot of IP addresses 520.04s - 523.36s | So even for like the crappy budget networks, this is gonna be a lot of IP addresses 523.64s - 530.52s | So I had to do a little bit of digging pun intended and I was like, oh it's available over IPv6 530.96s - 534.76s | Last time I checked I think there's a lot more IPv6 IPs out there than IPv4 535.08s - 537.08s | So I think there might be a solution here 537.08s - 538.76s | Okay 538.76s - 544.00s | So I went straight to the source for you know for me this is like the North American number registry 544.00s - 545.12s | Which is Aaron, right? 545.12s - 551.84s | you can apparently get a fat 36 range IPv6 right allocation and it only costs like 250 bucks a year and 552.04s - 555.76s | So with this you actually the number of IPs is a bigger number that I can even pronounce 555.80s - 558.88s | But you essentially have a limited IP space that you can now utilize. 559.92s - 564.12s | I combined this with a piece of software that my friend wrote which essentially takes like if you have a box where you write 564.12s - 569.60s | All the IP addresses to you this turns it into like a Sox by a Sox proxy server where every request you make to it 569.60s - 572.28s | It will randomize it through the outbound range that you have set up, right? 572.36s - 577.76s | So now we can just start blasting from a limit this huge range right with unlimited IPs and rate limiting is 578.00s - 581.84s | We'll call it more or less solved, right? We may never come from the same IP twice 583.98s - 585.14s | Great 585.14s - 587.90s | Scraping is solved. Let's talk about that second challenge, right? 588.14s - 593.94s | Again, that challenge is that the secrets that we want are probably not outright in the listing description, right? They're hidden, right? 593.94s - 596.06s | Maybe the seller doesn't even know what it is that they're selling 596.78s - 602.06s | So, how do we address this right? The key way that we do this is via OCR, right? So 602.74s


chunk_id: 179_chunk_14
chunk_text:
this with a piece of software that my friend wrote which essentially takes like if you have a box where you write 564.12s - 569.60s | All the IP addresses to you this turns it into like a Sox by a Sox proxy server where every request you make to it 569.60s - 572.28s | It will randomize it through the outbound range that you have set up, right? 572.36s - 577.76s | So now we can just start blasting from a limit this huge range right with unlimited IPs and rate limiting is 578.00s - 581.84s | We'll call it more or less solved, right? We may never come from the same IP twice 583.98s - 585.14s | Great 585.14s - 587.90s | Scraping is solved. Let's talk about that second challenge, right? 588.14s - 593.94s | Again, that challenge is that the secrets that we want are probably not outright in the listing description, right? They're hidden, right? 593.94s - 596.06s | Maybe the seller doesn't even know what it is that they're selling 596.78s - 602.06s | So, how do we address this right? The key way that we do this is via OCR, right? So 602.74s - 604.62s | There's some problems with this in practice 604.62s - 606.50s | You probably heard of open source solutions 606.50s - 611.50s | but they have things like this where Apple does their very chic gray on silver design and 611.70s - 615.30s | Even some humans have issues reading this text right and computers are no different 615.46s - 621.14s | When I plug this into the open source Tesseract model, right? It basically said there's no text on this 621.14s - 622.70s | I have no idea what you're talking about 622.70s - 628.18s | So that was like not gonna fly. I looked at some like proprietary APIs, right? 628.18s - 630.58s | There's Google Vision Google Vision actually did a great job 630.58s - 634.54s | I was like, wow, look at all the text that I could you know, want me to get out of this, right? 635.06s - 637.06s | but then I sort of looked at the pricing and 637.98s - 643.66s | I was like, oh one penny for seven images. That's pretty good. But then I was like wait so for a million images 643.66s - 647.38s | That's


chunk_id: 179_chunk_15
chunk_text:
- 604.62s | There's some problems with this in practice 604.62s - 606.50s | You probably heard of open source solutions 606.50s - 611.50s | but they have things like this where Apple does their very chic gray on silver design and 611.70s - 615.30s | Even some humans have issues reading this text right and computers are no different 615.46s - 621.14s | When I plug this into the open source Tesseract model, right? It basically said there's no text on this 621.14s - 622.70s | I have no idea what you're talking about 622.70s - 628.18s | So that was like not gonna fly. I looked at some like proprietary APIs, right? 628.18s - 630.58s | There's Google Vision Google Vision actually did a great job 630.58s - 634.54s | I was like, wow, look at all the text that I could you know, want me to get out of this, right? 635.06s - 637.06s | but then I sort of looked at the pricing and 637.98s - 643.66s | I was like, oh one penny for seven images. That's pretty good. But then I was like wait so for a million images 643.66s - 647.38s | That's 1500 bucks and we're doing hundreds of millions of images. So 648.10s - 650.10s | Yeah, that's not really tenable 650.98s - 653.90s | But I had sort of a eureka moment when I was actually using my iPhone 653.90s - 658.02s | I had one of those old-school captures, you know before the current more annoying like grid ones 658.50s - 660.50s | where essentially I held my thumb down and I 660.78s - 666.50s | Realized that I could actually select the warped texts and I could copy it and I was like wait 666.50s - 671.54s | I was as an OCR model. This is sick, and I could paste it and it got it exactly, right? 671.54s - 675.14s | so I was like there there might be something here and 676.66s - 679.98s | Not only is it available you can actually like if you just write an app you can integrate 679.98s - 684.78s | with this API and automate it so I wrote some of the ugliest Swift code any of you have probably ever seen and 685.18s - 692.54s | made a little HTTP server where I could send it an image


chunk_id: 179_chunk_16
chunk_text:
1500 bucks and we're doing hundreds of millions of images. So 648.10s - 650.10s | Yeah, that's not really tenable 650.98s - 653.90s | But I had sort of a eureka moment when I was actually using my iPhone 653.90s - 658.02s | I had one of those old-school captures, you know before the current more annoying like grid ones 658.50s - 660.50s | where essentially I held my thumb down and I 660.78s - 666.50s | Realized that I could actually select the warped texts and I could copy it and I was like wait 666.50s - 671.54s | I was as an OCR model. This is sick, and I could paste it and it got it exactly, right? 671.54s - 675.14s | so I was like there there might be something here and 676.66s - 679.98s | Not only is it available you can actually like if you just write an app you can integrate 679.98s - 684.78s | with this API and automate it so I wrote some of the ugliest Swift code any of you have probably ever seen and 685.18s - 692.54s | made a little HTTP server where I could send it an image and it would do OCR in English and Chinese and do barcode detection and 693.06s - 699.34s | This basically solved it, but you're probably like, okay, you can use an iPhone, but that's got to be expensive, right? 699.34s - 701.18s | Like iPhones are super expensive 701.18s - 707.82s | but in fact the GPU acceleration chip actually goes back as far as the iPhone second generation SE and 708.58s - 714.62s | And if you get those on like, you know cricket wireless or some unpopular carrier, right they're sold for as little as 40 bucks 715.02s - 719.74s | So you can get these for super cheap and you can build yourself a high-capacity OCR array 720.70s - 722.70s | So I wired a bunch of these together 722.90s - 727.30s | And I had a high-capacity array that could do around 50 HD images 727.54s - 731.90s | second in English and Chinese even with a lot of text and barcode detection as well and 732.38s - 739.22s | To make it even better it basically uses no power because the mobile like compute was actually super efficient. So it worked out really well 740.86s


chunk_id: 179_chunk_17
chunk_text:
and it would do OCR in English and Chinese and do barcode detection and 693.06s - 699.34s | This basically solved it, but you're probably like, okay, you can use an iPhone, but that's got to be expensive, right? 699.34s - 701.18s | Like iPhones are super expensive 701.18s - 707.82s | but in fact the GPU acceleration chip actually goes back as far as the iPhone second generation SE and 708.58s - 714.62s | And if you get those on like, you know cricket wireless or some unpopular carrier, right they're sold for as little as 40 bucks 715.02s - 719.74s | So you can get these for super cheap and you can build yourself a high-capacity OCR array 720.70s - 722.70s | So I wired a bunch of these together 722.90s - 727.30s | And I had a high-capacity array that could do around 50 HD images 727.54s - 731.90s | second in English and Chinese even with a lot of text and barcode detection as well and 732.38s - 739.22s | To make it even better it basically uses no power because the mobile like compute was actually super efficient. So it worked out really well 740.86s - 744.78s | Great so we scraped all this shit. We got all these images we can do OCR on all these images 744.78s - 747.94s | We index all of it, but now we need to know what we're looking for, right? 748.14s - 750.06s | So I started off by just looking like 750.06s - 756.02s | general examples of like prototypes and company laptops and sort of built a very early set of keywords to alert on and 756.10s - 760.82s | When I found matches to those alerts for products that were listed anything else on the laptops that they had 760.82s - 766.02s | I then added those marks to my list of things to alert for right so maybe I had some text that was like property 766.02s - 770.34s | Of then I get a barcode and I'd see what their barcode format was and then I would add that to my rules 770.34s - 773.10s | And it's iterative, right? So every time I get more results 773.10s - 774.82s | I'm improving my rule sets and pretty soon 774.82s - 779.30s | I've got a huge alert list of keywords that


chunk_id: 179_chunk_18
chunk_text:
- 744.78s | Great so we scraped all this shit. We got all these images we can do OCR on all these images 744.78s - 747.94s | We index all of it, but now we need to know what we're looking for, right? 748.14s - 750.06s | So I started off by just looking like 750.06s - 756.02s | general examples of like prototypes and company laptops and sort of built a very early set of keywords to alert on and 756.10s - 760.82s | When I found matches to those alerts for products that were listed anything else on the laptops that they had 760.82s - 766.02s | I then added those marks to my list of things to alert for right so maybe I had some text that was like property 766.02s - 770.34s | Of then I get a barcode and I'd see what their barcode format was and then I would add that to my rules 770.34s - 773.10s | And it's iterative, right? So every time I get more results 773.10s - 774.82s | I'm improving my rule sets and pretty soon 774.82s - 779.30s | I've got a huge alert list of keywords that when something comes up I can immediately get a notified of it. I 780.26s - 784.02s | Made this a little easier by building like a nice little data lake UI so I can just type in 784.10s - 789.38s | Fancy type any keyword and it will immediately start showing me matching listings so I can very quickly cook these things up 791.71s - 795.19s | Talked about a lot of pieces overall, but this is kind of a 10,000 foot view 795.35s - 802.35s | you've got the most convoluted set of like free to server bullshit combined with like exit proxying combined with like elastic search and 802.43s - 807.07s | iPhone OCRs, but TLDR took a lot to do this with the level of data that we're doing 808.83s - 810.75s | Overall we're talking about 810.75s - 817.41s | Much more now, but probably like 50 million listings scraped, right? We're talking over 250 million images OCR in total, right? 817.63s - 819.87s | None of the iPhones are exploded yet. Very great work 822.04s - 825.04s | Said there was only three challenges. There's actually kind of 3.5 825.20s - 830.72s | So imagine


chunk_id: 179_chunk_19
chunk_text:
when something comes up I can immediately get a notified of it. I 780.26s - 784.02s | Made this a little easier by building like a nice little data lake UI so I can just type in 784.10s - 789.38s | Fancy type any keyword and it will immediately start showing me matching listings so I can very quickly cook these things up 791.71s - 795.19s | Talked about a lot of pieces overall, but this is kind of a 10,000 foot view 795.35s - 802.35s | you've got the most convoluted set of like free to server bullshit combined with like exit proxying combined with like elastic search and 802.43s - 807.07s | iPhone OCRs, but TLDR took a lot to do this with the level of data that we're doing 808.83s - 810.75s | Overall we're talking about 810.75s - 817.41s | Much more now, but probably like 50 million listings scraped, right? We're talking over 250 million images OCR in total, right? 817.63s - 819.87s | None of the iPhones are exploded yet. Very great work 822.04s - 825.04s | Said there was only three challenges. There's actually kind of 3.5 825.20s - 830.72s | So imagine you're selling something on eBay and some random person like some remote province of China says 830.72s - 833.84s | Hey, could you just like ship this to me and you'd be like, dude 833.84s - 835.24s | I don't know how to do paperwork for Canada 835.24s - 837.68s | Let alone like you know this place in China, right? 837.68s - 841.40s | And it's so different if you ask somebody and do domestic Chinese markets to say hey 841.40s - 844.12s | Could you ship this to me in like, you know, Alabama or whatever it is, right? 844.36s - 850.12s | So we kind of have to figure out like how can we work in these markets and buy from local sellers when we ourselves like 850.16s - 853.80s | Don't maybe don't speak the language to understand the culture and when I get it like exported to us 854.84s - 856.84s | So where can this secret knowledge be found? 858.00s - 863.50s | Luckily, there's a community who's very familiar with a domestic Chinese market built around like really high-end fake 864.24s - 868.64s | Fashion replicas. So yeah, your Gucci handbag that's like


chunk_id: 179_chunk_20
chunk_text:
you're selling something on eBay and some random person like some remote province of China says 830.72s - 833.84s | Hey, could you just like ship this to me and you'd be like, dude 833.84s - 835.24s | I don't know how to do paperwork for Canada 835.24s - 837.68s | Let alone like you know this place in China, right? 837.68s - 841.40s | And it's so different if you ask somebody and do domestic Chinese markets to say hey 841.40s - 844.12s | Could you ship this to me in like, you know, Alabama or whatever it is, right? 844.36s - 850.12s | So we kind of have to figure out like how can we work in these markets and buy from local sellers when we ourselves like 850.16s - 853.80s | Don't maybe don't speak the language to understand the culture and when I get it like exported to us 854.84s - 856.84s | So where can this secret knowledge be found? 858.00s - 863.50s | Luckily, there's a community who's very familiar with a domestic Chinese market built around like really high-end fake 864.24s - 868.64s | Fashion replicas. So yeah, your Gucci handbag that's like indistinguishable or whatever from the real one 869.08s - 874.80s | There's a community that kind of focuses on basically getting these from inside of the domestic Chinese market and they use these agents 874.80s - 877.08s | Which will actually do the work of communicating with the seller 877.08s - 881.00s | They'll buy it and they'll actually like rewrap it for you and do all the export forms to get it to you 881.32s - 886.36s | So we basically use the exact same stuff that they use to get these designer clothes and we kind of have this solved 886.88s - 891.05s | So this is what you've all been waiting for. I'm sure let's go to the loot 891.05s - 896.89s | So now what we found here before we again, we'll start off with employee devices here before we sort of get into these 897.09s - 899.35s | We'll dispel some very quick like well 899.61s - 904.89s | Actually things that I'm sure you're gonna want to say and one of the common rebuttals I hear is like sure you can find this 904.89s - 910.05s | Hardware leaking out, but it's it's probably


chunk_id: 179_chunk_21
chunk_text:
indistinguishable or whatever from the real one 869.08s - 874.80s | There's a community that kind of focuses on basically getting these from inside of the domestic Chinese market and they use these agents 874.80s - 877.08s | Which will actually do the work of communicating with the seller 877.08s - 881.00s | They'll buy it and they'll actually like rewrap it for you and do all the export forms to get it to you 881.32s - 886.36s | So we basically use the exact same stuff that they use to get these designer clothes and we kind of have this solved 886.88s - 891.05s | So this is what you've all been waiting for. I'm sure let's go to the loot 891.05s - 896.89s | So now what we found here before we again, we'll start off with employee devices here before we sort of get into these 897.09s - 899.35s | We'll dispel some very quick like well 899.61s - 904.89s | Actually things that I'm sure you're gonna want to say and one of the common rebuttals I hear is like sure you can find this 904.89s - 910.05s | Hardware leaking out, but it's it's probably all locked and requires a passcode to access them or whatever 910.05s - 912.25s | So there's no way that you can like actually do this, right? 912.93s - 918.71s | My rebuttal in this case is merely a slide. Obviously, there's a lot more examples, but there's only so much space 920.69s - 928.03s | Plenty of notable examples here, right and you're like, okay, okay. Okay. They're unlocked 928.03s - 931.63s | I get it. I get it, but that doesn't mean that there's actually anything sensitive on the devices, right? 931.87s - 934.09s | And again, I only have a slide as a rebuttal 934.75s - 937.03s | again, many more examples, right and 939.28s - 943.36s | If you're like my company is not affected if you work for a fortune 500 company 943.52s - 947.26s | Guarantee you I've seen your equipment end up on eBay or some other market, right? 947.64s - 952.18s | Super wide breadth of you do any volume of employee equipment or whatever. It's gonna be here 953.62s - 957.80s | So let's talk about the war stories. I want to actually do a quick little preface here 957.80s -


chunk_id: 179_chunk_22
chunk_text:
all locked and requires a passcode to access them or whatever 910.05s - 912.25s | So there's no way that you can like actually do this, right? 912.93s - 918.71s | My rebuttal in this case is merely a slide. Obviously, there's a lot more examples, but there's only so much space 920.69s - 928.03s | Plenty of notable examples here, right and you're like, okay, okay. Okay. They're unlocked 928.03s - 931.63s | I get it. I get it, but that doesn't mean that there's actually anything sensitive on the devices, right? 931.87s - 934.09s | And again, I only have a slide as a rebuttal 934.75s - 937.03s | again, many more examples, right and 939.28s - 943.36s | If you're like my company is not affected if you work for a fortune 500 company 943.52s - 947.26s | Guarantee you I've seen your equipment end up on eBay or some other market, right? 947.64s - 952.18s | Super wide breadth of you do any volume of employee equipment or whatever. It's gonna be here 953.62s - 957.80s | So let's talk about the war stories. I want to actually do a quick little preface here 957.80s - 960.68s | All of my examples are for a pretty popular company called Apple 961.24s - 965.56s | This is not because Apple like fucked up especially actually it's pretty much the opposite 965.56s - 971.20s | They were like a mature hardware company and my point of the research targeting like their stuff was more because like if it affects them 971.72s - 974.76s | We can be pretty sure that any other company is affected as well, right? 974.76s - 980.12s | They have they have resources right to make this right. So I will start with the story of the time capsule 980.96s - 987.00s | So I built up a good little database of alerts and keywords for those things and eventually I got alerted to a time capsule 987.00s - 988.68s | That was listed in the United Kingdom 988.68s - 993.44s | and the reason why I got an alert is I had this cool sticker on the background which said property of Apple Computers Inc 993.60s - 997.76s | Expensed equipment and I was like, hmm. This might be interesting and 998.52s - 1003.04s | I looked at the description and it said


chunk_id: 179_chunk_23
chunk_text:
960.68s | All of my examples are for a pretty popular company called Apple 961.24s - 965.56s | This is not because Apple like fucked up especially actually it's pretty much the opposite 965.56s - 971.20s | They were like a mature hardware company and my point of the research targeting like their stuff was more because like if it affects them 971.72s - 974.76s | We can be pretty sure that any other company is affected as well, right? 974.76s - 980.12s | They have they have resources right to make this right. So I will start with the story of the time capsule 980.96s - 987.00s | So I built up a good little database of alerts and keywords for those things and eventually I got alerted to a time capsule 987.00s - 988.68s | That was listed in the United Kingdom 988.68s - 993.44s | and the reason why I got an alert is I had this cool sticker on the background which said property of Apple Computers Inc 993.60s - 997.76s | Expensed equipment and I was like, hmm. This might be interesting and 998.52s - 1003.04s | I looked at the description and it said this said hey, it was part of an office clearance good sign 1003.44s - 1007.44s | It's been powered up and lights up as expected, but it has not been tested beyond this point 1007.76s - 1012.64s | This is the perfect description for if you think something's gonna be good because it means the device works 1012.84s - 1016.96s | We couldn't wipe it ourselves because we couldn't really get it like turned on like all set up, right? 1016.96s - 1020.92s | But we can be pretty sure that like it's at least in the original state that maybe they got it in, right? 1022.00s - 1026.64s | So I also did some googling and there was actually an office clearance for Apple that like they moved offices 1026.64s - 1028.64s | So it seemed like it lined up 1028.80s - 1030.80s | So I placed a bid. I 1031.04s - 1035.76s | Didn't realize how big the shipping was it was actually like almost like it's like more than the actual device itself 1035.76s - 1041.32s | so I kind of learned that lesson the hard way, but we'll take a risk got into United States after


chunk_id: 179_chunk_24
chunk_text:
this said hey, it was part of an office clearance good sign 1003.44s - 1007.44s | It's been powered up and lights up as expected, but it has not been tested beyond this point 1007.76s - 1012.64s | This is the perfect description for if you think something's gonna be good because it means the device works 1012.84s - 1016.96s | We couldn't wipe it ourselves because we couldn't really get it like turned on like all set up, right? 1016.96s - 1020.92s | But we can be pretty sure that like it's at least in the original state that maybe they got it in, right? 1022.00s - 1026.64s | So I also did some googling and there was actually an office clearance for Apple that like they moved offices 1026.64s - 1028.64s | So it seemed like it lined up 1028.80s - 1030.80s | So I placed a bid. I 1031.04s - 1035.76s | Didn't realize how big the shipping was it was actually like almost like it's like more than the actual device itself 1035.76s - 1041.32s | so I kind of learned that lesson the hard way, but we'll take a risk got into United States after 1041.84s - 1044.84s | Sweating with a heat gun and getting the back off and pulling the hard drive out 1044.84s - 1048.12s | I was able to connect it up to my laptop to start doing like 1048.84s - 1050.84s | to look at the drive rights and 1051.64s - 1055.72s | Initially, I looked at it. I was like, oh, you know shoot. Oh, there's no files. Looks like they deleted them 1056.48s - 1058.12s | I was like unless 1058.12s - 1062.32s | Unless they deleted it and they didn't actually do a secure wipe of it. So maybe they're still hanging around 1062.32s - 1065.72s | Let's just just in case let's do a forensic scan this thing, right? 1066.12s - 1069.32s | So I let this thing run that cooked for around 28 hours 1069.88s - 1071.88s | For two terabytes, which is quite a while and 1072.40s - 1080.32s | Turns out it's not entirely true. There was data on the device things like internal credentials things like internal support tickets 1080.84s - 1084.96s | sales reports and figures internal documentation apps repair guides 1085.84s - 1088.04s | internal emails bank account information 1088.80s


chunk_id: 179_chunk_25
chunk_text:
1041.84s - 1044.84s | Sweating with a heat gun and getting the back off and pulling the hard drive out 1044.84s - 1048.12s | I was able to connect it up to my laptop to start doing like 1048.84s - 1050.84s | to look at the drive rights and 1051.64s - 1055.72s | Initially, I looked at it. I was like, oh, you know shoot. Oh, there's no files. Looks like they deleted them 1056.48s - 1058.12s | I was like unless 1058.12s - 1062.32s | Unless they deleted it and they didn't actually do a secure wipe of it. So maybe they're still hanging around 1062.32s - 1065.72s | Let's just just in case let's do a forensic scan this thing, right? 1066.12s - 1069.32s | So I let this thing run that cooked for around 28 hours 1069.88s - 1071.88s | For two terabytes, which is quite a while and 1072.40s - 1080.32s | Turns out it's not entirely true. There was data on the device things like internal credentials things like internal support tickets 1080.84s - 1084.96s | sales reports and figures internal documentation apps repair guides 1085.84s - 1088.04s | internal emails bank account information 1088.80s - 1095.60s | Passport and ID scans and I swear this last one is true dank internal memes from these Apple stores in Europe 1096.60s - 1103.48s | There was literally an entire video done in like the Backstreet Boys style of how to count the inventory in your Apple store 1103.48s - 1107.52s | I kid you not it hurt me so much to like hand this back over. So 1110.09s - 1114.73s | Anyways, I got this and I was like, all right, this is scary. I'm gonna tell Apple about this, right? 1114.73s - 1118.73s | I used the only only channel they had for reporting which was like their regular 1119.13s - 1125.09s | Like sort of bug bounty reporting cue thing and said hey, I've got this time capsule looks like it's from like the 2010s 1125.09s - 1128.21s | It's got like a bunch of euro of stored data and you probably want this 1129.93s - 1135.49s | You know, I got this I originally submit this actually to them and I got I think some regular like product security person 1135.49s - 1139.93s | Who's like I do bugs like I don't know


chunk_id: 179_chunk_26
chunk_text:
- 1095.60s | Passport and ID scans and I swear this last one is true dank internal memes from these Apple stores in Europe 1096.60s - 1103.48s | There was literally an entire video done in like the Backstreet Boys style of how to count the inventory in your Apple store 1103.48s - 1107.52s | I kid you not it hurt me so much to like hand this back over. So 1110.09s - 1114.73s | Anyways, I got this and I was like, all right, this is scary. I'm gonna tell Apple about this, right? 1114.73s - 1118.73s | I used the only only channel they had for reporting which was like their regular 1119.13s - 1125.09s | Like sort of bug bounty reporting cue thing and said hey, I've got this time capsule looks like it's from like the 2010s 1125.09s - 1128.21s | It's got like a bunch of euro of stored data and you probably want this 1129.93s - 1135.49s | You know, I got this I originally submit this actually to them and I got I think some regular like product security person 1135.49s - 1139.93s | Who's like I do bugs like I don't know what the what this is or what I'm supposed to do with it 1139.93s - 1144.93s | And he's just like I sent an email to our internal to keep like people but there's nothing I can do with this 1144.93s - 1147.65s | So I originally was like, oh, this is easiest disclosure ever 1147.65s - 1152.01s | It's like already over but then I got email later from their G stock in London 1152.01s - 1157.05s | Which is like hey, we actually do we would very much like that drive and you're in the Bay Area, right? 1157.05s - 1159.17s | Could you just like drive ten minutes and drop that off for us? 1159.17s - 1166.84s | And I was like sure, you know lunch break head over there drop it off to them and I was like good deal 1166.84s - 1171.68s | You know, I sent an email saying we're all good. The disclosure is all finished. I was like cool done deal 1173.32s - 1176.36s | Later on I received an update like later that night where they were like, hey 1176.96s - 1182.16s | Any other POC's off that drive that you


chunk_id: 179_chunk_27
chunk_text:
what the what this is or what I'm supposed to do with it 1139.93s - 1144.93s | And he's just like I sent an email to our internal to keep like people but there's nothing I can do with this 1144.93s - 1147.65s | So I originally was like, oh, this is easiest disclosure ever 1147.65s - 1152.01s | It's like already over but then I got email later from their G stock in London 1152.01s - 1157.05s | Which is like hey, we actually do we would very much like that drive and you're in the Bay Area, right? 1157.05s - 1159.17s | Could you just like drive ten minutes and drop that off for us? 1159.17s - 1166.84s | And I was like sure, you know lunch break head over there drop it off to them and I was like good deal 1166.84s - 1171.68s | You know, I sent an email saying we're all good. The disclosure is all finished. I was like cool done deal 1173.32s - 1176.36s | Later on I received an update like later that night where they were like, hey 1176.96s - 1182.16s | Any other POC's off that drive that you can send us just to assess the impact of the report and I was kind of like 1182.64s - 1186.16s | But I already gave you the drive so like how would I how would I do that? 1186.16s - 1188.56s | Cuz like obviously I don't have the data. I gave it back to you, right? 1188.56s - 1191.88s | So I was kind of like I think it was just a medication between the team 1191.88s - 1194.52s | But I was kind of like a little bit like what's the deal here? 1198.94s - 1202.82s | Cool. So let's talk about prototypes right another one of those like main columns. I mentioned 1203.66s - 1207.34s | They usually look something like this right lots of scary hardware labels in the back 1207.90s - 1209.90s | Usually a phone number to report it being missing 1210.62s - 1217.06s | And Apple actually has some pretty interesting prototypes, they're a little bit more valuable than your regular prototype that you might find 1218.10s - 1220.66s | Here's a bunch of stuff that I was able to get over doing this research 1221.10s - 1223.66s | This is actually a


chunk_id: 179_chunk_28
chunk_text:
can send us just to assess the impact of the report and I was kind of like 1182.64s - 1186.16s | But I already gave you the drive so like how would I how would I do that? 1186.16s - 1188.56s | Cuz like obviously I don't have the data. I gave it back to you, right? 1188.56s - 1191.88s | So I was kind of like I think it was just a medication between the team 1191.88s - 1194.52s | But I was kind of like a little bit like what's the deal here? 1198.94s - 1202.82s | Cool. So let's talk about prototypes right another one of those like main columns. I mentioned 1203.66s - 1207.34s | They usually look something like this right lots of scary hardware labels in the back 1207.90s - 1209.90s | Usually a phone number to report it being missing 1210.62s - 1217.06s | And Apple actually has some pretty interesting prototypes, they're a little bit more valuable than your regular prototype that you might find 1218.10s - 1220.66s | Here's a bunch of stuff that I was able to get over doing this research 1221.10s - 1223.66s | This is actually a small part of a lot of the prototypes. Those are the defiance 1225.38s - 1231.10s | So the reason why Apple prototypes are a little bit more interesting is because they have something called dev fusing and a lot of 1231.10s - 1237.54s | Their prototype versions of the iPhone right and you're like, what the hell is depth using essentially in a production iPhone that you buy from 1237.90s - 1244.46s | Right, they actually burn these fuses which prevent you from being able to do debugging of the application processor and the secure enclave processor 1244.46s - 1249.58s | Right, and so when you do exploit development, you've kind of heard these like million-dollar or whatever iPhone exploits 1249.74s - 1254.38s | Having one of these phones is key because it allows you to really easily debug your exploit to make you know 1254.38s - 1255.66s | Get it pull it off essentially 1255.66s - 1260.02s | So there's like a big gray market spawned off of this Apple actually has researcher devices that they'll give you 1260.22s - 1263.18s | If you follow a bunch of legal procedures to get yourself 1263.66s - 1267.30s | But you


chunk_id: 179_chunk_29
chunk_text:
small part of a lot of the prototypes. Those are the defiance 1225.38s - 1231.10s | So the reason why Apple prototypes are a little bit more interesting is because they have something called dev fusing and a lot of 1231.10s - 1237.54s | Their prototype versions of the iPhone right and you're like, what the hell is depth using essentially in a production iPhone that you buy from 1237.90s - 1244.46s | Right, they actually burn these fuses which prevent you from being able to do debugging of the application processor and the secure enclave processor 1244.46s - 1249.58s | Right, and so when you do exploit development, you've kind of heard these like million-dollar or whatever iPhone exploits 1249.74s - 1254.38s | Having one of these phones is key because it allows you to really easily debug your exploit to make you know 1254.38s - 1255.66s | Get it pull it off essentially 1255.66s - 1260.02s | So there's like a big gray market spawned off of this Apple actually has researcher devices that they'll give you 1260.22s - 1263.18s | If you follow a bunch of legal procedures to get yourself 1263.66s - 1267.30s | But you know, there's still people that don't want to deal with that. So there's still this big gray market, right? 1267.54s - 1271.74s | But there's these TLDR. There's these super rare iPhones which are useful for security research, right? 1272.54s - 1273.86s | This is sort of what that looks like 1273.86s - 1275.10s | They have different fusing states 1275.10s - 1279.52s | If you have the debugging cable, you can basically plug the iPhone in and say yes, this is a deaf used iPhone 1279.98s - 1284.86s | So again on around November 23rd 2023 1284.86s - 1289.02s | I had my pipeline alerted to a bunch of listings being created at once in China 1289.02s - 1293.22s | And they were all iPhone 14s and initially, you know when I get a bunch of alerts at once 1293.22s - 1296.26s | I'm like, oh somebody's reposted their listing like eight times or whatever 1296.30s - 1298.46s | But then I started to look at the photos and I was like 1298.98s - 1303.54s | Wait a minute. These are all distinct iPhones. This is not like one iPhone that's been repeatedly posted 1304.14s - 1306.58s | So


chunk_id: 179_chunk_30
chunk_text:
know, there's still people that don't want to deal with that. So there's still this big gray market, right? 1267.54s - 1271.74s | But there's these TLDR. There's these super rare iPhones which are useful for security research, right? 1272.54s - 1273.86s | This is sort of what that looks like 1273.86s - 1275.10s | They have different fusing states 1275.10s - 1279.52s | If you have the debugging cable, you can basically plug the iPhone in and say yes, this is a deaf used iPhone 1279.98s - 1284.86s | So again on around November 23rd 2023 1284.86s - 1289.02s | I had my pipeline alerted to a bunch of listings being created at once in China 1289.02s - 1293.22s | And they were all iPhone 14s and initially, you know when I get a bunch of alerts at once 1293.22s - 1296.26s | I'm like, oh somebody's reposted their listing like eight times or whatever 1296.30s - 1298.46s | But then I started to look at the photos and I was like 1298.98s - 1303.54s | Wait a minute. These are all distinct iPhones. This is not like one iPhone that's been repeatedly posted 1304.14s - 1306.58s | So it turned out this is actually a huge cache of these 1307.14s - 1313.66s | Prototype iPhone 14s, which at the time was the latest model of iPhone, right? So this is like a video of the seller 1314.94s - 1318.58s | Furthermore when I actually bought one of these iPhones and imported it here 1318.58s - 1322.90s | I realized that the seller when he was sort of taking pictures to validate the camera worked 1323.02s - 1325.74s | He didn't turn off the GPS tagging feature in the photos 1325.90s - 1329.74s | so I actually had the exact location in China where the seller actually was and 1330.50s - 1333.64s | Worse than that. He also took selfies to validate the camera 1334.50s - 1338.62s | So in terms of like finding the source of these leaks, this is a pretty compelling way to do that, right? 1340.06s - 1341.66s | But I don't want to give you the wrong impression 1341.66s - 1346.18s | It's not just that these prototype iPhones will only come from like, you know, wherever in China that they're made 1346.18s - 1348.26s | He actually ironically so I live in the


chunk_id: 179_chunk_31
chunk_text:
it turned out this is actually a huge cache of these 1307.14s - 1313.66s | Prototype iPhone 14s, which at the time was the latest model of iPhone, right? So this is like a video of the seller 1314.94s - 1318.58s | Furthermore when I actually bought one of these iPhones and imported it here 1318.58s - 1322.90s | I realized that the seller when he was sort of taking pictures to validate the camera worked 1323.02s - 1325.74s | He didn't turn off the GPS tagging feature in the photos 1325.90s - 1329.74s | so I actually had the exact location in China where the seller actually was and 1330.50s - 1333.64s | Worse than that. He also took selfies to validate the camera 1334.50s - 1338.62s | So in terms of like finding the source of these leaks, this is a pretty compelling way to do that, right? 1340.06s - 1341.66s | But I don't want to give you the wrong impression 1341.66s - 1346.18s | It's not just that these prototype iPhones will only come from like, you know, wherever in China that they're made 1346.18s - 1348.26s | He actually ironically so I live in the Bay Area 1348.26s - 1353.02s | It's either in these remote provinces of China or it's a 10-minute drive from my house with very little in between 1353.54s - 1357.30s | So in this case like this was one that was leaked in San Francisco, right? 1357.30s - 1361.42s | It's a DVT model iPhone 14 and it did indeed have depth fusing, right? 1361.50s - 1365.18s | The most hilarious part about this actually is that the sellers oftentimes when they have these 1365.22s - 1371.38s | They try to do like a regular restore of the device only to realize like this is a weird iPhone. I can't restore this 1371.38s - 1374.38s | I have no idea what's going on here. They're just like I got I'll sell it for parts 1374.38s - 1380.74s | Whatever and so the listings are sold usually for parts when it's actually like a very, you know expensive prototype iPhone, right? 1382.50s - 1388.18s | Cool so it kind of covered a couple examples here. We talked about time capsule. We talked about these rare prototype devices, right? 1388.18s - 1390.98s | Let's go to the thing the place where these


chunk_id: 179_chunk_32
chunk_text:
Bay Area 1348.26s - 1353.02s | It's either in these remote provinces of China or it's a 10-minute drive from my house with very little in between 1353.54s - 1357.30s | So in this case like this was one that was leaked in San Francisco, right? 1357.30s - 1361.42s | It's a DVT model iPhone 14 and it did indeed have depth fusing, right? 1361.50s - 1365.18s | The most hilarious part about this actually is that the sellers oftentimes when they have these 1365.22s - 1371.38s | They try to do like a regular restore of the device only to realize like this is a weird iPhone. I can't restore this 1371.38s - 1374.38s | I have no idea what's going on here. They're just like I got I'll sell it for parts 1374.38s - 1380.74s | Whatever and so the listings are sold usually for parts when it's actually like a very, you know expensive prototype iPhone, right? 1382.50s - 1388.18s | Cool so it kind of covered a couple examples here. We talked about time capsule. We talked about these rare prototype devices, right? 1388.18s - 1390.98s | Let's go to the thing the place where these things are made, right? 1390.98s - 1394.92s | So in this case the assembly line is for Foxconn for Apple for the most part, right? 1396.18s - 1398.18s | So I looked at a lot of these Chinese listings 1398.42s - 1400.02s | Things that had like, you know 1400.02s - 1402.90s | A bunch of labels that appeared to be related to Foxconn, right? 1402.90s - 1406.90s | And I started to realize that there was a pattern that was starting to emerge when I looked at these things, right? 1406.98s - 1410.06s | So if it's used inside of Foxconn, I started to realize that hey 1410.06s - 1411.70s | It usually has this like, you know 1411.70s - 1416.14s | Three-letter four-letter a six-digit combo thing that they used to label like internal equipment 1416.14s - 1420.54s | And so I created a quick rule that anytime something like this shows up in China 1420.58s - 1422.70s | Why don't you let me know and I'll take a look at it, right? 1422.90s - 1425.46s | I'm sure all of you can sort of see where this might be going 1426.18s - 1428.86s | Sometime later. I


chunk_id: 179_chunk_33
chunk_text:
things are made, right? 1390.98s - 1394.92s | So in this case the assembly line is for Foxconn for Apple for the most part, right? 1396.18s - 1398.18s | So I looked at a lot of these Chinese listings 1398.42s - 1400.02s | Things that had like, you know 1400.02s - 1402.90s | A bunch of labels that appeared to be related to Foxconn, right? 1402.90s - 1406.90s | And I started to realize that there was a pattern that was starting to emerge when I looked at these things, right? 1406.98s - 1410.06s | So if it's used inside of Foxconn, I started to realize that hey 1410.06s - 1411.70s | It usually has this like, you know 1411.70s - 1416.14s | Three-letter four-letter a six-digit combo thing that they used to label like internal equipment 1416.14s - 1420.54s | And so I created a quick rule that anytime something like this shows up in China 1420.58s - 1422.70s | Why don't you let me know and I'll take a look at it, right? 1422.90s - 1425.46s | I'm sure all of you can sort of see where this might be going 1426.18s - 1428.86s | Sometime later. I got an alert for a listing like this 1429.42s - 1431.74s | For only 181. This is like 1432.54s - 1434.54s | $28 I think in USD and 1434.98s - 1436.54s | When I took a closer look at it 1436.54s - 1438.46s | It had all the markings that I wanted 1438.46s - 1442.86s | And I looked at the bottom of it and there was an interesting of hole drilled in the bottom 1442.86s - 1444.30s | I was like, oh, okay 1444.30s - 1448.86s | So like they basically took a drill press to this thing to like securely destroy it and you know 1448.86s - 1450.86s | What can get rid of the hard drive? 1450.94s - 1453.62s | But then I thought about it a little bit more and I was like, wait a minute 1453.62s - 1457.86s | Let me look up a schematic of what this looks like inside. I was like, okay, so if like the hard drive is here 1457.86s - 1459.18s | and 1459.18s - 1461.50s | that means the magnetic platter is here and 1462.70s - 1464.70s | They drilled the hole like here 1465.50s - 1477.16s | There


chunk_id: 179_chunk_34
chunk_text:
got an alert for a listing like this 1429.42s - 1431.74s | For only 181. This is like 1432.54s - 1434.54s | $28 I think in USD and 1434.98s - 1436.54s | When I took a closer look at it 1436.54s - 1438.46s | It had all the markings that I wanted 1438.46s - 1442.86s | And I looked at the bottom of it and there was an interesting of hole drilled in the bottom 1442.86s - 1444.30s | I was like, oh, okay 1444.30s - 1448.86s | So like they basically took a drill press to this thing to like securely destroy it and you know 1448.86s - 1450.86s | What can get rid of the hard drive? 1450.94s - 1453.62s | But then I thought about it a little bit more and I was like, wait a minute 1453.62s - 1457.86s | Let me look up a schematic of what this looks like inside. I was like, okay, so if like the hard drive is here 1457.86s - 1459.18s | and 1459.18s - 1461.50s | that means the magnetic platter is here and 1462.70s - 1464.70s | They drilled the hole like here 1465.50s - 1477.16s | There might be a chance and this is one of those things where I'm like, there's no way but it would be too cool 1477.16s - 1480.44s | If it works, so I bought it right into the United States again 1480.96s - 1482.28s | Didn't you know? 1482.28s - 1483.68s | Disassembled it pulled the hard drive out 1483.68s - 1489.24s | I looked inside and I saw that beautiful orange PCB color and I was like, I think they might have missed it 1489.24s - 1491.36s | But let's let's send it to the experts 1492.08s - 1497.76s | So I shopped around a little bit found a cheap lab down in LA to that said hey they gave me the honest answer 1497.76s - 1500.76s | Which is exactly what I was looking for where they were basically like, all right 1500.76s - 1502.76s | Listen, you drilled a hole in the damn thing 1502.76s - 1507.72s | Like if you did that and you didn't turn it on and there's not a bunch of dust and all these other things then yeah 1507.72s - 1511.20s | I think we can recover it, but don't get your hopes


chunk_id: 179_chunk_35
chunk_text:
might be a chance and this is one of those things where I'm like, there's no way but it would be too cool 1477.16s - 1480.44s | If it works, so I bought it right into the United States again 1480.96s - 1482.28s | Didn't you know? 1482.28s - 1483.68s | Disassembled it pulled the hard drive out 1483.68s - 1489.24s | I looked inside and I saw that beautiful orange PCB color and I was like, I think they might have missed it 1489.24s - 1491.36s | But let's let's send it to the experts 1492.08s - 1497.76s | So I shopped around a little bit found a cheap lab down in LA to that said hey they gave me the honest answer 1497.76s - 1500.76s | Which is exactly what I was looking for where they were basically like, all right 1500.76s - 1502.76s | Listen, you drilled a hole in the damn thing 1502.76s - 1507.72s | Like if you did that and you didn't turn it on and there's not a bunch of dust and all these other things then yeah 1507.72s - 1511.20s | I think we can recover it, but don't get your hopes up like be aware, right? 1511.72s - 1516.24s | So I said down to them they basically after some time came back to me and they said hey, you know 1516.24s - 1517.12s | We pop this thing open 1517.12s - 1520.48s | It looks like it just hit the PCB and in order to recover it 1520.48s - 1524.56s | We basically get to buy a working drive go into a clean room and swap the magnetic platter from one to the other 1525.52s - 1531.64s | Obviously after getting this email I was like so just to be clear you're saying they did miss the magnetic platter and they were like 1531.64s - 1533.64s | Yep, it pretty much missed everything 1533.80s - 1537.12s | So it looks like there might be a chance here. There's not a lot of dust even on the platter 1537.12s - 1539.12s | So I think we might be good 1539.96s - 1543.36s | Sometime later. I got the email that I was looking for where they said hey 1543.36s - 1549.28s | I got 99.99 whatever percent of the data and I was like, oh, yeah, it's all coming together 1551.16s


chunk_id: 179_chunk_36
chunk_text:
up like be aware, right? 1511.72s - 1516.24s | So I said down to them they basically after some time came back to me and they said hey, you know 1516.24s - 1517.12s | We pop this thing open 1517.12s - 1520.48s | It looks like it just hit the PCB and in order to recover it 1520.48s - 1524.56s | We basically get to buy a working drive go into a clean room and swap the magnetic platter from one to the other 1525.52s - 1531.64s | Obviously after getting this email I was like so just to be clear you're saying they did miss the magnetic platter and they were like 1531.64s - 1533.64s | Yep, it pretty much missed everything 1533.80s - 1537.12s | So it looks like there might be a chance here. There's not a lot of dust even on the platter 1537.12s - 1539.12s | So I think we might be good 1539.96s - 1543.36s | Sometime later. I got the email that I was looking for where they said hey 1543.36s - 1549.28s | I got 99.99 whatever percent of the data and I was like, oh, yeah, it's all coming together 1551.16s - 1556.00s | But I was still like if you do a lot of this research you always try to like hold off on being too excited because 1556.00s - 1558.68s | Your dreams have been crushed too many times by it not working out 1558.68s - 1562.68s | So I was like, you know, maybe maybe somebody actually bought it reused it and then they drilled the hole in it 1562.68s - 1565.96s | So like, you know, maybe it's not actually the real thing, but it was 1566.96s - 1569.68s | These are the wallpapers from it being used in the factory line 1569.68s - 1574.28s | It was used to do Q&A ostensibly for actually a couple things that look like but for iPad QA it looked like 1575.04s - 1581.60s | Came along with a bunch of really tasty internal Apple software for sort of interfacing with their prototype devices and doing QA on the line 1581.92s - 1586.60s | all of that good stuff right came with internal credentials for the Foxconn factory and 1587.04s - 1591.60s | a bunch of other cool stuff a lot of cool Apple tooling to with a bunch of


chunk_id: 179_chunk_37
chunk_text:
- 1556.00s | But I was still like if you do a lot of this research you always try to like hold off on being too excited because 1556.00s - 1558.68s | Your dreams have been crushed too many times by it not working out 1558.68s - 1562.68s | So I was like, you know, maybe maybe somebody actually bought it reused it and then they drilled the hole in it 1562.68s - 1565.96s | So like, you know, maybe it's not actually the real thing, but it was 1566.96s - 1569.68s | These are the wallpapers from it being used in the factory line 1569.68s - 1574.28s | It was used to do Q&A ostensibly for actually a couple things that look like but for iPad QA it looked like 1575.04s - 1581.60s | Came along with a bunch of really tasty internal Apple software for sort of interfacing with their prototype devices and doing QA on the line 1581.92s - 1586.60s | all of that good stuff right came with internal credentials for the Foxconn factory and 1587.04s - 1591.60s | a bunch of other cool stuff a lot of cool Apple tooling to with a bunch of like you could tell engineers came up with 1591.60s - 1594.32s | The name of these tools right like footing whatever so 1596.04s - 1599.36s | Another funny story about this one is when I gave this one to Apple like the first time 1599.36s - 1603.24s | There's a lot of miss a lot of communication when it came to the time capsule like back and forth to coordinate it 1603.24s - 1607.76s | The second time I was like, hey, I've got this random drive from the Foxconn line. I got did this forensics 1607.76s - 1609.20s | I got all this data. I want to give it back to you 1609.20s - 1613.80s | They were just like here's a prepaid FedEx envelope. You just drop that shit in the mail get it right to us 1613.80s - 1615.80s | I was like sweet 1618.57s - 1622.33s | Great, so we've got some cool PLCs. We kind of show off the problem, right? 1622.37s - 1626.37s | Let's go into like maybe what are the high level like takeaways of this whole stuff, right? 1628.96s - 1632.88s | So one thing that's kind of interesting is like


chunk_id: 179_chunk_38
chunk_text:
like you could tell engineers came up with 1591.60s - 1594.32s | The name of these tools right like footing whatever so 1596.04s - 1599.36s | Another funny story about this one is when I gave this one to Apple like the first time 1599.36s - 1603.24s | There's a lot of miss a lot of communication when it came to the time capsule like back and forth to coordinate it 1603.24s - 1607.76s | The second time I was like, hey, I've got this random drive from the Foxconn line. I got did this forensics 1607.76s - 1609.20s | I got all this data. I want to give it back to you 1609.20s - 1613.80s | They were just like here's a prepaid FedEx envelope. You just drop that shit in the mail get it right to us 1613.80s - 1615.80s | I was like sweet 1618.57s - 1622.33s | Great, so we've got some cool PLCs. We kind of show off the problem, right? 1622.37s - 1626.37s | Let's go into like maybe what are the high level like takeaways of this whole stuff, right? 1628.96s - 1632.88s | So one thing that's kind of interesting is like this is not like, you know 1632.92s - 1637.12s | You think like the conventional hacking stories and sort of like, you know cracking code or whatever 1637.12s - 1643.28s | But this research raises kind of interesting question, which is like have I done anything sort of unethical or wrong here, right? 1643.28s - 1647.08s | If you talk about the source of a lot of these other prototypes, we're talking about pretty illicit stuff, right? 1647.08s - 1651.64s | They're paying somebody I assume to take it off the factory line or whatever it is, but we're not we're not doing that 1651.64s - 1653.64s | We're just literally looking for public listings 1653.76s - 1658.76s | We come to the table with a little bit more information about what is in those like listings and what it actually means, right? 1658.76s - 1661.16s | And ostensibly they would have been sold anyways 1661.20s - 1666.08s | But we just instead buy it in the first place, right? So have we like really done anything wrong, you know 1666.08s - 1668.12s | I mean, so it's just a very interesting question there 1669.52s - 1672.96s | I think


chunk_id: 179_chunk_39
chunk_text:
this is not like, you know 1632.92s - 1637.12s | You think like the conventional hacking stories and sort of like, you know cracking code or whatever 1637.12s - 1643.28s | But this research raises kind of interesting question, which is like have I done anything sort of unethical or wrong here, right? 1643.28s - 1647.08s | If you talk about the source of a lot of these other prototypes, we're talking about pretty illicit stuff, right? 1647.08s - 1651.64s | They're paying somebody I assume to take it off the factory line or whatever it is, but we're not we're not doing that 1651.64s - 1653.64s | We're just literally looking for public listings 1653.76s - 1658.76s | We come to the table with a little bit more information about what is in those like listings and what it actually means, right? 1658.76s - 1661.16s | And ostensibly they would have been sold anyways 1661.20s - 1666.08s | But we just instead buy it in the first place, right? So have we like really done anything wrong, you know 1666.08s - 1668.12s | I mean, so it's just a very interesting question there 1669.52s - 1672.96s | I think another potentially interesting takeaway here is you know 1672.96s - 1679.36s | You're probably more familiar when we have like very standardized full disk encryption and mobile device management for like the standard set of things 1679.52s - 1682.80s | So you get your work laptop things are pretty well understood there 1682.80s - 1686.56s | You have your like work phone and DM solutions that these solutions are pretty straightforward 1686.56s - 1691.08s | But then when you get to the more custom hardware side, you don't necessarily have that level of maturity 1691.08s - 1692.44s | It's like the time capsule, right? 1692.44s - 1696.76s | It's like is there a clear suite that can that can actually do ensure that these things work the way that you expect? 1696.76s - 1702.32s | And so I would assume that this probably extends to any other type of custom hardware where you don't have this very standardized 1702.40s - 1704.40s | format of software to protect this 1705.68s - 1710.04s | This one is probably obvious for anybody's done anything related to hardware or who lives through COVID 1710.76s - 1716.88s | Supply chains are incredibly difficult, right? You've


chunk_id: 179_chunk_40
chunk_text:
another potentially interesting takeaway here is you know 1672.96s - 1679.36s | You're probably more familiar when we have like very standardized full disk encryption and mobile device management for like the standard set of things 1679.52s - 1682.80s | So you get your work laptop things are pretty well understood there 1682.80s - 1686.56s | You have your like work phone and DM solutions that these solutions are pretty straightforward 1686.56s - 1691.08s | But then when you get to the more custom hardware side, you don't necessarily have that level of maturity 1691.08s - 1692.44s | It's like the time capsule, right? 1692.44s - 1696.76s | It's like is there a clear suite that can that can actually do ensure that these things work the way that you expect? 1696.76s - 1702.32s | And so I would assume that this probably extends to any other type of custom hardware where you don't have this very standardized 1702.40s - 1704.40s | format of software to protect this 1705.68s - 1710.04s | This one is probably obvious for anybody's done anything related to hardware or who lives through COVID 1710.76s - 1716.88s | Supply chains are incredibly difficult, right? You've got multiple sides of the globe on different time zones doing iterations on hardware 1716.88s - 1719.80s | It's not like software where you're halfway through and you're like, ah 1719.80s - 1721.44s | Let's just can all this and rewrite it 1721.44s - 1724.32s | You're kind of your parameters are slowly narrowing and you've got to like 1724.68s - 1729.32s | Throughout all this time make sure none of them leak out and everything's securely destroyed and all this stuff, right? 1729.32s - 1731.04s | You got to keep everybody super tight-lipped 1731.04s - 1735.72s | So it's very challenging to do this right across many countries and to deliver this final product 1737.32s - 1742.44s | Another interesting point as you noted with one of these examples is leaks very much point to sources 1742.84s - 1746.52s | So you mentioned like we found listings where these things sort of bubbled up, right? 1746.52s - 1750.52s | And we can then take those to go to the sellers to figure out like what's the real story here? 1750.52s - 1755.36s | Where did this shit actually come from and we can start to understand a full picture


chunk_id: 179_chunk_41
chunk_text:
got multiple sides of the globe on different time zones doing iterations on hardware 1716.88s - 1719.80s | It's not like software where you're halfway through and you're like, ah 1719.80s - 1721.44s | Let's just can all this and rewrite it 1721.44s - 1724.32s | You're kind of your parameters are slowly narrowing and you've got to like 1724.68s - 1729.32s | Throughout all this time make sure none of them leak out and everything's securely destroyed and all this stuff, right? 1729.32s - 1731.04s | You got to keep everybody super tight-lipped 1731.04s - 1735.72s | So it's very challenging to do this right across many countries and to deliver this final product 1737.32s - 1742.44s | Another interesting point as you noted with one of these examples is leaks very much point to sources 1742.84s - 1746.52s | So you mentioned like we found listings where these things sort of bubbled up, right? 1746.52s - 1750.52s | And we can then take those to go to the sellers to figure out like what's the real story here? 1750.52s - 1755.36s | Where did this shit actually come from and we can start to understand a full picture of like where is my stuff breaking apart? 1755.36s - 1756.88s | How is this stuff leaking out, right? 1756.88s - 1761.60s | So it becomes a very good opportunity to sort of identify these sources and ultimately close them if you're the company 1761.60s - 1769.08s | I think another really interesting piece of this too is I would say that like e-waste is a particularly interesting point, right? 1769.08s - 1773.28s | So if you have your stuff going to e-waste a lot of people sort of assume like oh, it's gonna be destroyed 1773.44s - 1778.56s | But then you get people who are at the e-waste side who are like, why are they throwing away 50 good iPhones? 1778.56s - 1781.92s | Like this could be resold right now. Like it's very strange, right? 1781.92s - 1785.92s | And so a lot of these I think leaked out from sort of e-waste recycling centers, right? 1785.92s - 1787.52s | And this is what causes these problems 1787.52s - 1791.20s | So you got to make sure that like your stuff is actually being destroyed and not being you know 1791.20s - 1798.44s | Essentially diverted and


chunk_id: 179_chunk_42
chunk_text:
of like where is my stuff breaking apart? 1755.36s - 1756.88s | How is this stuff leaking out, right? 1756.88s - 1761.60s | So it becomes a very good opportunity to sort of identify these sources and ultimately close them if you're the company 1761.60s - 1769.08s | I think another really interesting piece of this too is I would say that like e-waste is a particularly interesting point, right? 1769.08s - 1773.28s | So if you have your stuff going to e-waste a lot of people sort of assume like oh, it's gonna be destroyed 1773.44s - 1778.56s | But then you get people who are at the e-waste side who are like, why are they throwing away 50 good iPhones? 1778.56s - 1781.92s | Like this could be resold right now. Like it's very strange, right? 1781.92s - 1785.92s | And so a lot of these I think leaked out from sort of e-waste recycling centers, right? 1785.92s - 1787.52s | And this is what causes these problems 1787.52s - 1791.20s | So you got to make sure that like your stuff is actually being destroyed and not being you know 1791.20s - 1798.44s | Essentially diverted and potentially resold. I just want to give a quick quick special. Thanks to Apple demo 1798.44s - 1804.12s | He does a bunch of iPhone prototype stuff check out his YouTube for helping me serve the initial research and understanding of this space 1804.56s - 1807.04s | And I'd like to thank all of you for coming to this


chunk_id: 179_chunk_43
chunk_text:
potentially resold. I just want to give a quick quick special. Thanks to Apple demo 1798.44s - 1804.12s | He does a bunch of iPhone prototype stuff check out his YouTube for helping me serve the initial research and understanding of this space 1804.56s - 1807.04s | And I'd like to thank all of you for coming to this


chunk_id: 180_chunk_0
chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=QCoRhK7u9qw", "title": "Title: DEF CON 32 - DEF CON Unplugged: Cocktails & Cyber with Jeff & Jen - Jen Easterly, Jeff Moss", "description": "REAL WORLD DEFCON: Where hackers stop being polite and start getting real. The Dark Tangent and Jen Easterly sit down for an Ask Me Anything.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2893, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.62s - 8.55s | This text was transcribed using whisper model: large-v2 I'm transitioning from my central nervous system stimulant. 8.55s - 15.75s | Jen's going to flex her skills in mixology and create some central nervous system depressants 15.75s - 19.47s | that we're then going to consume and have a great conversation. 19.47s - 25.51s | And then we are definitely going to open it up to ask Jen anything or ask me anything. 25.51s - 28.95s | We'll go to an AMA style format after we talk for a little bit. 28.95s - 34.43s | So we've got a microphone here. 34.43s - 37.79s | Please ask a question. 37.79s - 40.09s | This is not a statement in the form of a question. 40.09s - 41.79s | It's a question. 41.79s - 44.43s | And then we'll discuss the question. 44.43s - 47.89s | So just please use this microphone if you can. 47.89s - 50.39s | It's harder to see if there's another one. 50.39s - 51.51s | Great. 51.51s - 52.55s | So that's what we're going to do. 52.55s - 53.55s | That's the plan. 53.55s - 55.55s | Thanks for coming. 55.55s - 61.95s | Jen's a multiple time DEF CON veteran. 61.95s - 62.95s | And it's fascinating. 62.95s - 71.07s | I always love, so disclaimer, I'm, Jen's my director. 71.07s - 74.11s | I'm on the advisory council she set up at CISA. 74.11s - 78.27s | So normally when I interact with Jen, it's much more formal. 78.27s - 82.95s | We're delivering reports, technical advisory recommendations to her. 82.95s - 88.95s | Her staff, CISA, determines whether to accept our recommendations, reject them, modify them. 88.95s - 96.67s | And so outside of that dynamic, it's fantastic for her to make a drink for me. 96.67s - 97.67s | So thank you. 97.67s - 98.67s | Do you want me to? 98.67s - 101.24s | Yeah. 101.24s - 104.64s | Why don't you tell us what


chunk_id: 180_chunk_1
chunk_text:
then we'll discuss the question. 44.43s - 47.89s | So just please use this microphone if you can. 47.89s - 50.39s | It's harder to see if there's another one. 50.39s - 51.51s | Great. 51.51s - 52.55s | So that's what we're going to do. 52.55s - 53.55s | That's the plan. 53.55s - 55.55s | Thanks for coming. 55.55s - 61.95s | Jen's a multiple time DEF CON veteran. 61.95s - 62.95s | And it's fascinating. 62.95s - 71.07s | I always love, so disclaimer, I'm, Jen's my director. 71.07s - 74.11s | I'm on the advisory council she set up at CISA. 74.11s - 78.27s | So normally when I interact with Jen, it's much more formal. 78.27s - 82.95s | We're delivering reports, technical advisory recommendations to her. 82.95s - 88.95s | Her staff, CISA, determines whether to accept our recommendations, reject them, modify them. 88.95s - 96.67s | And so outside of that dynamic, it's fantastic for her to make a drink for me. 96.67s - 97.67s | So thank you. 97.67s - 98.67s | Do you want me to? 98.67s - 101.24s | Yeah. 101.24s - 104.64s | Why don't you tell us what you're doing? 104.64s - 107.34s | Oh. 107.34s - 108.34s | Yeah. 108.34s - 109.34s | What's going on here? 109.34s - 110.34s | So, hey, everybody. 110.34s - 111.34s | My name's Jen. 112.06s - 117.66s | So this is the, it should have been the fourth time, but that 2021 was a COVID year. 117.66s - 121.74s | This is my third time at DEF CON. 121.74s - 125.22s | And this is my favorite con of the year. 125.22s - 126.22s | My favorite thing to do. 126.22s - 129.82s | I look forward to it every single year. 129.82s - 135.94s | And last year, I was not, it was my second time, but I was with two newbies. 135.94s - 138.06s | And so they had to do shots. 138.06s - 139.62s | So I, you know, in solidarity. 139.62s - 142.82s | But I said, this year, like, Jeff, what do you want to do? 142.82s - 143.82s | And he's like, well, I don't know. 143.82s - 144.82s | What do you want to do? 144.82s - 150.74s | And I said, well, let's just, let's just have some cocktails and cyber talk


chunk_id: 180_chunk_2
chunk_text:
you're doing? 104.64s - 107.34s | Oh. 107.34s - 108.34s | Yeah. 108.34s - 109.34s | What's going on here? 109.34s - 110.34s | So, hey, everybody. 110.34s - 111.34s | My name's Jen. 112.06s - 117.66s | So this is the, it should have been the fourth time, but that 2021 was a COVID year. 117.66s - 121.74s | This is my third time at DEF CON. 121.74s - 125.22s | And this is my favorite con of the year. 125.22s - 126.22s | My favorite thing to do. 126.22s - 129.82s | I look forward to it every single year. 129.82s - 135.94s | And last year, I was not, it was my second time, but I was with two newbies. 135.94s - 138.06s | And so they had to do shots. 138.06s - 139.62s | So I, you know, in solidarity. 139.62s - 142.82s | But I said, this year, like, Jeff, what do you want to do? 142.82s - 143.82s | And he's like, well, I don't know. 143.82s - 144.82s | What do you want to do? 144.82s - 150.74s | And I said, well, let's just, let's just have some cocktails and cyber talk and hear from 150.74s - 151.74s | my friends. 151.74s - 152.74s | Yeah. 152.74s - 153.74s | See where it goes. 153.74s - 154.74s | Yeah. 154.74s - 163.42s | So before I took this job, I chatted with Jeff and I said, hey, Jeff, what's your best 163.42s - 168.06s | advice to be successful as the director of CISA? 168.14s - 169.94s | And it was great advice. 169.94s - 180.10s | It wasn't like shockingly, you know, surprising advice, but it has really stayed with me since 180.10s - 181.10s | I took this job. 181.10s - 187.10s | And it was like, be a part of the community, you know, really like be a part of the community 187.10s - 188.90s | because it's an amazing community. 188.90s - 192.66s | And you know, CISA is not an intel agency. 192.66s - 194.30s | We're not a law enforcement agency. 194.30s - 196.26s | We're not a regulator. 196.26s - 202.06s | Everything we do is by, with and through partners and our success is predicated on our ability 202.06s - 207.82s | to catalyze trusted partnerships, whether it's with industry, with the research community,


chunk_id: 180_chunk_3
chunk_text:
and hear from 150.74s - 151.74s | my friends. 151.74s - 152.74s | Yeah. 152.74s - 153.74s | See where it goes. 153.74s - 154.74s | Yeah. 154.74s - 163.42s | So before I took this job, I chatted with Jeff and I said, hey, Jeff, what's your best 163.42s - 168.06s | advice to be successful as the director of CISA? 168.14s - 169.94s | And it was great advice. 169.94s - 180.10s | It wasn't like shockingly, you know, surprising advice, but it has really stayed with me since 180.10s - 181.10s | I took this job. 181.10s - 187.10s | And it was like, be a part of the community, you know, really like be a part of the community 187.10s - 188.90s | because it's an amazing community. 188.90s - 192.66s | And you know, CISA is not an intel agency. 192.66s - 194.30s | We're not a law enforcement agency. 194.30s - 196.26s | We're not a regulator. 196.26s - 202.06s | Everything we do is by, with and through partners and our success is predicated on our ability 202.06s - 207.82s | to catalyze trusted partnerships, whether it's with industry, with the research community, 207.82s - 211.42s | with the hacker community, across the federal government, with the state and local community, 211.42s - 213.06s | with election officials. 213.06s - 219.58s | It's all about how do you build trusted partnerships and people don't trust institutions. 219.58s - 221.34s | They trust people. 221.34s - 228.46s | And so I like to get out and spend time with all of our partners so that they understand 228.46s - 234.14s | who I am, who my team is, what we do, the value that we bring, and how we can help support 234.14s - 238.26s | others and serve others and ultimately help the American people. 238.26s - 239.26s | So I'm excited. 239.26s - 245.66s | We're going to chat a little bit, but we really did just want to open this up as an ask us 245.66s - 248.42s | anything, AUA, I guess. 248.42s - 254.54s | You can ask all the hard questions to Jeff and I'll take all the easy ones, but I do 254.54s - 260.78s | want to thank my friend Jeff, who has been a fabulous partner throughout my three plus 260.78s - 266.54s | years


chunk_id: 180_chunk_4
chunk_text:
207.82s - 211.42s | with the hacker community, across the federal government, with the state and local community, 211.42s - 213.06s | with election officials. 213.06s - 219.58s | It's all about how do you build trusted partnerships and people don't trust institutions. 219.58s - 221.34s | They trust people. 221.34s - 228.46s | And so I like to get out and spend time with all of our partners so that they understand 228.46s - 234.14s | who I am, who my team is, what we do, the value that we bring, and how we can help support 234.14s - 238.26s | others and serve others and ultimately help the American people. 238.26s - 239.26s | So I'm excited. 239.26s - 245.66s | We're going to chat a little bit, but we really did just want to open this up as an ask us 245.66s - 248.42s | anything, AUA, I guess. 248.42s - 254.54s | You can ask all the hard questions to Jeff and I'll take all the easy ones, but I do 254.54s - 260.78s | want to thank my friend Jeff, who has been a fabulous partner throughout my three plus 260.78s - 266.54s | years in this job and for your service as well as the head of our technical advisory 266.54s - 271.22s | council and really important work throughout the last three years. 271.22s - 273.06s | So super grateful for that. 273.50s - 281.06s | You're one of the first people that actually listened to my advice and really actually 281.06s - 286.10s | visibly did some of the hard work to actually engage. 286.10s - 290.06s | Building community is not easy and it sometimes fails. 290.06s - 295.74s | And so I appreciate you calling that out because CISA's got some interesting things. 295.74s - 298.82s | You can convene people. 298.82s - 301.06s | You can try to regulate people. 301.06s - 302.06s | You can- 302.06s - 303.06s | Nope. 303.06s - 309.30s | Well, in some critical infrastructure areas, you could, you know, not chemical. 309.30s - 313.14s | Well, no, we lost those authorities, unfortunately. 313.14s - 314.98s | They lost the authorities. 314.98s - 315.98s | Yeah. 315.98s - 320.70s | We're going to have to drink to that. 320.70s - 327.78s | And so there's essentially the areas where you can be a convener


chunk_id: 180_chunk_5
chunk_text:
in this job and for your service as well as the head of our technical advisory 266.54s - 271.22s | council and really important work throughout the last three years. 271.22s - 273.06s | So super grateful for that. 273.50s - 281.06s | You're one of the first people that actually listened to my advice and really actually 281.06s - 286.10s | visibly did some of the hard work to actually engage. 286.10s - 290.06s | Building community is not easy and it sometimes fails. 290.06s - 295.74s | And so I appreciate you calling that out because CISA's got some interesting things. 295.74s - 298.82s | You can convene people. 298.82s - 301.06s | You can try to regulate people. 301.06s - 302.06s | You can- 302.06s - 303.06s | Nope. 303.06s - 309.30s | Well, in some critical infrastructure areas, you could, you know, not chemical. 309.30s - 313.14s | Well, no, we lost those authorities, unfortunately. 313.14s - 314.98s | They lost the authorities. 314.98s - 315.98s | Yeah. 315.98s - 320.70s | We're going to have to drink to that. 320.70s - 327.78s | And so there's essentially the areas where you can be a convener or you can be a coordinator, 327.78s - 328.78s | right? 328.78s - 330.82s | A lot of sector coordination. 330.82s - 335.58s | And so knowing what hat you're wearing and when and which is appropriate. 335.58s - 339.66s | And I really love that you used that phrase, people trust individuals, not institutions. 339.66s - 345.58s | That was one of the first lessons I learned at ICANN when I was back there was that nobody 345.58s - 348.42s | is going to- everything's built on individual trust. 348.42s - 351.74s | They're not going to reveal the secret to the random organization. 351.74s - 355.30s | They're going to reveal it to their friend that they trust in the organization, which 355.30s - 358.94s | then means you have to have people that are willing to put in the time to travel and not 358.94s - 360.72s | turn over every year. 360.72s - 365.40s | And so one of my pieces of advice was, Jen, is like, find some non-political appointees. 365.40s - 369.60s | People will be there for a long time, some full-time employees, and they will be your 369.60s - 374.28s | like


chunk_id: 180_chunk_6
chunk_text:
or you can be a coordinator, 327.78s - 328.78s | right? 328.78s - 330.82s | A lot of sector coordination. 330.82s - 335.58s | And so knowing what hat you're wearing and when and which is appropriate. 335.58s - 339.66s | And I really love that you used that phrase, people trust individuals, not institutions. 339.66s - 345.58s | That was one of the first lessons I learned at ICANN when I was back there was that nobody 345.58s - 348.42s | is going to- everything's built on individual trust. 348.42s - 351.74s | They're not going to reveal the secret to the random organization. 351.74s - 355.30s | They're going to reveal it to their friend that they trust in the organization, which 355.30s - 358.94s | then means you have to have people that are willing to put in the time to travel and not 358.94s - 360.72s | turn over every year. 360.72s - 365.40s | And so one of my pieces of advice was, Jen, is like, find some non-political appointees. 365.40s - 369.60s | People will be there for a long time, some full-time employees, and they will be your 369.60s - 374.28s | like avatars out in the community that people can build trust with and make sure you're 374.28s - 378.76s | committing enough budget that they can show up in enough places over time that those relationships 378.76s - 381.44s | build and you have a way of mentoring the next. 381.44s - 383.68s | And she did it, which is awesome. 383.68s - 386.00s | Okay, we're not doing an orange. 386.00s - 387.00s | What the orange one? 387.00s - 388.00s | Not the orange one. 388.00s - 389.00s | Oh, okay. 389.00s - 390.00s | Let's start out. 390.28s - 392.28s | Okay, so tell us what you've done here. 392.28s - 394.28s | Okay, we had a little bitters. 394.28s - 397.40s | We had a little sugar cube that's partially melted. 397.40s - 400.12s | We have a little maker's mark. 400.12s - 403.96s | Didn't have a lot of success with the orange, but I do have some maraschino cherries. 403.96s - 405.84s | Yeah, yeah. 405.84s - 406.84s | It's my favorite. 406.84s - 409.36s | So I don't see the cherry in here. 409.36s - 410.36s | I didn't- okay. 410.36s - 411.36s |


chunk_id: 180_chunk_7
chunk_text:
avatars out in the community that people can build trust with and make sure you're 374.28s - 378.76s | committing enough budget that they can show up in enough places over time that those relationships 378.76s - 381.44s | build and you have a way of mentoring the next. 381.44s - 383.68s | And she did it, which is awesome. 383.68s - 386.00s | Okay, we're not doing an orange. 386.00s - 387.00s | What the orange one? 387.00s - 388.00s | Not the orange one. 388.00s - 389.00s | Oh, okay. 389.00s - 390.00s | Let's start out. 390.28s - 392.28s | Okay, so tell us what you've done here. 392.28s - 394.28s | Okay, we had a little bitters. 394.28s - 397.40s | We had a little sugar cube that's partially melted. 397.40s - 400.12s | We have a little maker's mark. 400.12s - 403.96s | Didn't have a lot of success with the orange, but I do have some maraschino cherries. 403.96s - 405.84s | Yeah, yeah. 405.84s - 406.84s | It's my favorite. 406.84s - 409.36s | So I don't see the cherry in here. 409.36s - 410.36s | I didn't- okay. 410.36s - 411.36s | All right. 411.36s - 412.36s | All right. 412.36s - 413.36s | I want the full meal deal. 413.36s - 414.36s | All right, all right. 414.36s - 415.36s | If it's on the table. 415.36s - 416.36s | Okay. 416.36s - 417.36s | All right. 417.36s - 418.36s | All right. 418.36s - 419.36s | As long as you're having one, right? 419.72s - 420.72s | Yeah. 420.72s - 421.72s | Good. 421.72s - 423.72s | We have to have a parity, you know, a public-private partnership here. 423.72s - 424.72s | Yeah, exactly. 424.72s - 425.72s | Exactly. 425.72s - 426.72s | All right. 426.72s - 427.72s | There you go, brother. 427.72s - 428.72s | Excellent. 428.72s - 431.19s | Thank you. 431.19s - 434.19s | I don't want to know how many government regulations we're violating. 434.19s - 435.19s | None. 435.19s - 436.19s | Right now. 436.19s - 437.19s | I've had all of this approved. 437.19s - 441.19s | You've had it all approved by the OGE lawyer. 441.19s - 442.19s | Yes. 442.19s - 443.19s | Okay. 443.19s - 452.08s | So while you're mixing, maybe you can be thinking about like over


chunk_id: 180_chunk_8
chunk_text:
All right. 411.36s - 412.36s | All right. 412.36s - 413.36s | I want the full meal deal. 413.36s - 414.36s | All right, all right. 414.36s - 415.36s | If it's on the table. 415.36s - 416.36s | Okay. 416.36s - 417.36s | All right. 417.36s - 418.36s | All right. 418.36s - 419.36s | As long as you're having one, right? 419.72s - 420.72s | Yeah. 420.72s - 421.72s | Good. 421.72s - 423.72s | We have to have a parity, you know, a public-private partnership here. 423.72s - 424.72s | Yeah, exactly. 424.72s - 425.72s | Exactly. 425.72s - 426.72s | All right. 426.72s - 427.72s | There you go, brother. 427.72s - 428.72s | Excellent. 428.72s - 431.19s | Thank you. 431.19s - 434.19s | I don't want to know how many government regulations we're violating. 434.19s - 435.19s | None. 435.19s - 436.19s | Right now. 436.19s - 437.19s | I've had all of this approved. 437.19s - 441.19s | You've had it all approved by the OGE lawyer. 441.19s - 442.19s | Yes. 442.19s - 443.19s | Okay. 443.19s - 452.08s | So while you're mixing, maybe you can be thinking about like over the last three years now that 452.64s - 457.64s | you've been building this community, maybe tell us what you think of when you see a community 457.64s - 463.64s | like DEF CON and we want to get engaged, people want to help, they don't know how to help, 463.64s - 467.76s | they're not very many good on-ramps to helping, and they don't even know if they have the 467.76s - 469.68s | right skills that are needed. 469.68s - 472.68s | And then on the other hand, you've got government doing the same thing. 472.68s - 477.04s | They see this pool of talented people, but they don't necessarily know how to approach 477.04s - 478.04s | them. 478.04s - 479.76s | They don't know what to ask of them. 480.48s - 487.16s | How have you puzzled through that, or is it like an ongoing mix and match, or I'll use 487.16s - 492.28s | your term, Rubik's cube solve, trying to get everything on the right color on the right 492.28s - 493.28s | side? 493.28s - 494.28s | Yeah. 494.28s - 501.88s | So we have tried really, really hard to be an agency


chunk_id: 180_chunk_9
chunk_text:
the last three years now that 452.64s - 457.64s | you've been building this community, maybe tell us what you think of when you see a community 457.64s - 463.64s | like DEF CON and we want to get engaged, people want to help, they don't know how to help, 463.64s - 467.76s | they're not very many good on-ramps to helping, and they don't even know if they have the 467.76s - 469.68s | right skills that are needed. 469.68s - 472.68s | And then on the other hand, you've got government doing the same thing. 472.68s - 477.04s | They see this pool of talented people, but they don't necessarily know how to approach 477.04s - 478.04s | them. 478.04s - 479.76s | They don't know what to ask of them. 480.48s - 487.16s | How have you puzzled through that, or is it like an ongoing mix and match, or I'll use 487.16s - 492.28s | your term, Rubik's cube solve, trying to get everything on the right color on the right 492.28s - 493.28s | side? 493.28s - 494.28s | Yeah. 494.28s - 501.88s | So we have tried really, really hard to be an agency that is not a lumbering government 501.88s - 502.88s | bureaucracy. 502.88s - 503.88s | Right? 503.88s - 511.20s | And yeah, I mean, again, like I was in the government for 27 years. 511.20s - 513.08s | I was in the army for most of that time. 513.08s - 518.24s | I was the National Security Agency, I was in the White House a couple times doing policy. 518.24s - 521.44s | And then I left to go to the private sector. 521.44s - 524.80s | I was at Morgan Stanley for four and a half years. 524.80s - 529.84s | And it was like a very liberating feel, frankly, to leave the federal government and go to 529.84s - 531.88s | the private sector. 531.88s - 539.96s | And when I looked back from the private sector to the federal government, I'm like, oh, oh, 539.96s - 540.96s | that's really hard to understand. 540.96s - 542.20s | Like a reverse culture shock? 542.20s - 543.20s | Yeah, it was. 543.20s - 544.28s | It really was. 544.28s - 550.88s | And when I came back, I was very determined to ensure that this agency, which was then


chunk_id: 180_chunk_10
chunk_text:
that is not a lumbering government 501.88s - 502.88s | bureaucracy. 502.88s - 503.88s | Right? 503.88s - 511.20s | And yeah, I mean, again, like I was in the government for 27 years. 511.20s - 513.08s | I was in the army for most of that time. 513.08s - 518.24s | I was the National Security Agency, I was in the White House a couple times doing policy. 518.24s - 521.44s | And then I left to go to the private sector. 521.44s - 524.80s | I was at Morgan Stanley for four and a half years. 524.80s - 529.84s | And it was like a very liberating feel, frankly, to leave the federal government and go to 529.84s - 531.88s | the private sector. 531.88s - 539.96s | And when I looked back from the private sector to the federal government, I'm like, oh, oh, 539.96s - 540.96s | that's really hard to understand. 540.96s - 542.20s | Like a reverse culture shock? 542.20s - 543.20s | Yeah, it was. 543.20s - 544.28s | It really was. 544.28s - 550.88s | And when I came back, I was very determined to ensure that this agency, which was then 550.88s - 559.36s | the newest agency in the federal government, that we were going to add value, not friction. 559.36s - 564.96s | That we were going to be accessible, that we were going to be transparent, that we were 564.96s - 567.40s | going to be responsive. 567.40s - 572.76s | And it sounds like obvious, but it's not that, you know, it's not an easy thing. 572.76s - 577.20s | And so we really just wanted to build a very different culture from your typical government 577.20s - 578.52s | agency. 578.52s - 582.20s | And a lot of that is being accessible to the community. 582.20s - 586.92s | So that's sort of the first thing, because, you know, if you only show up once a year, 586.92s - 591.28s | if you only, you know, I mean, people know you're not authentic about it. 591.28s - 594.28s | And so you have to be part of the community. 594.28s - 596.56s | And when you're part of the community, you're going to take some lumps. 596.56s - 597.56s | Yeah. 597.56s - 599.84s | Well, dude, I've taken a lot of lumps in my life.


chunk_id: 180_chunk_11
chunk_text:
550.88s - 559.36s | the newest agency in the federal government, that we were going to add value, not friction. 559.36s - 564.96s | That we were going to be accessible, that we were going to be transparent, that we were 564.96s - 567.40s | going to be responsive. 567.40s - 572.76s | And it sounds like obvious, but it's not that, you know, it's not an easy thing. 572.76s - 577.20s | And so we really just wanted to build a very different culture from your typical government 577.20s - 578.52s | agency. 578.52s - 582.20s | And a lot of that is being accessible to the community. 582.20s - 586.92s | So that's sort of the first thing, because, you know, if you only show up once a year, 586.92s - 591.28s | if you only, you know, I mean, people know you're not authentic about it. 591.28s - 594.28s | And so you have to be part of the community. 594.28s - 596.56s | And when you're part of the community, you're going to take some lumps. 596.56s - 597.56s | Yeah. 597.56s - 599.84s | Well, dude, I've taken a lot of lumps in my life. 599.84s - 603.28s | So that's not it's not a problem for me. 603.28s - 606.00s | But you know, I do treat feedback as a gift. 606.00s - 607.00s | I really do. 607.00s - 611.80s | Like, I don't really I don't really appreciate people who are assholes. 611.80s - 612.80s | I get it. 612.80s - 618.60s | You know, but if but I really appreciate Frank, you know, positive, critical feedback. 618.60s - 622.92s | That's like given a constructive, constructive feedback given in good faith. 622.92s - 623.92s | Yeah. 623.92s - 624.92s | Good faith. 624.92s - 625.92s | Feedback is always. 625.92s - 626.92s | Yeah. 626.92s - 628.48s | I mean, you know, if you want to be a dick, that's fine. 628.48s - 630.36s | But like, I don't really have time for you. 630.36s - 631.36s | Right. 631.36s - 632.36s | Right. 632.36s - 637.60s | And so if as long as it's coming from a good place, half the questions, they just don't 637.60s - 639.56s | know it's already been answered. 639.56s - 642.04s | So it's just a lot of trying to orient people. 642.48s -


chunk_id: 180_chunk_12
chunk_text:
599.84s - 603.28s | So that's not it's not a problem for me. 603.28s - 606.00s | But you know, I do treat feedback as a gift. 606.00s - 607.00s | I really do. 607.00s - 611.80s | Like, I don't really I don't really appreciate people who are assholes. 611.80s - 612.80s | I get it. 612.80s - 618.60s | You know, but if but I really appreciate Frank, you know, positive, critical feedback. 618.60s - 622.92s | That's like given a constructive, constructive feedback given in good faith. 622.92s - 623.92s | Yeah. 623.92s - 624.92s | Good faith. 624.92s - 625.92s | Feedback is always. 625.92s - 626.92s | Yeah. 626.92s - 628.48s | I mean, you know, if you want to be a dick, that's fine. 628.48s - 630.36s | But like, I don't really have time for you. 630.36s - 631.36s | Right. 631.36s - 632.36s | Right. 632.36s - 637.60s | And so if as long as it's coming from a good place, half the questions, they just don't 637.60s - 639.56s | know it's already been answered. 639.56s - 642.04s | So it's just a lot of trying to orient people. 642.48s - 643.48s | Totally. 643.48s - 644.76s | So then. 644.76s - 648.76s | So maybe in the last since you first started showing up at DEF CON, have there been good 648.76s - 653.80s | examples or any exchanges of things that worked out the way you thought or didn't work out 653.80s - 655.72s | like that's enough time to. 655.72s - 656.72s | Yeah. 656.72s - 659.32s | I mean, I will tell you, it's funny. 659.32s - 664.56s | The first experience I had with DEF CON, I wasn't actually here. 664.56s - 669.12s | It was it was when I was working at the National Security Agency in 2013. 669.12s - 670.12s | Oh, do tell. 670.12s - 671.12s | Remember? 671.88s - 677.52s | And it was I was working counterterrorism and it was the year of Snowden. 677.52s - 682.48s | And my boss at the time, Keith Alexander, wanted to come to Vegas. 682.48s - 686.64s | I think you probably chatted with him about that. 686.64s - 691.92s | And I didn't come with them then, but I was one of the staffers who sort of helped help 691.92s - 694.40s |


chunk_id: 180_chunk_13
chunk_text:
643.48s | Totally. 643.48s - 644.76s | So then. 644.76s - 648.76s | So maybe in the last since you first started showing up at DEF CON, have there been good 648.76s - 653.80s | examples or any exchanges of things that worked out the way you thought or didn't work out 653.80s - 655.72s | like that's enough time to. 655.72s - 656.72s | Yeah. 656.72s - 659.32s | I mean, I will tell you, it's funny. 659.32s - 664.56s | The first experience I had with DEF CON, I wasn't actually here. 664.56s - 669.12s | It was it was when I was working at the National Security Agency in 2013. 669.12s - 670.12s | Oh, do tell. 670.12s - 671.12s | Remember? 671.88s - 677.52s | And it was I was working counterterrorism and it was the year of Snowden. 677.52s - 682.48s | And my boss at the time, Keith Alexander, wanted to come to Vegas. 682.48s - 686.64s | I think you probably chatted with him about that. 686.64s - 691.92s | And I didn't come with them then, but I was one of the staffers who sort of helped help 691.92s - 694.40s | prepare remarks for that. 694.40s - 699.60s | And I think the you know, I think the vibe is very, very different from those days. 699.60s - 700.60s | Right. 701.08s - 702.76s | I hate I hate the term Fed. 702.76s - 704.12s | I just have to say that. 704.12s - 707.28s | But it's like the federal is. 707.28s - 710.16s | But I I think it's come a long way. 710.16s - 713.56s | And I mean, people have been so gracious, so kind. 713.56s - 714.80s | So it's been fantastic. 714.80s - 720.84s | That's why I love this community, because everybody here, I think, shares the desire 720.84s - 727.04s | to actually do good, to fix things, to help. 727.04s - 730.72s | And that's what we need, because frankly, our job is to protect and defend the critical 730.72s - 734.56s | infrastructure that Americans rely on every hour of every day. 734.56s - 739.96s | And the vast majority of that infrastructure is owned and operated by other people. 739.96s - 747.32s | And so if we do not catalyze a community approach to driving down risk to our technology


chunk_id: 180_chunk_14
chunk_text:
prepare remarks for that. 694.40s - 699.60s | And I think the you know, I think the vibe is very, very different from those days. 699.60s - 700.60s | Right. 701.08s - 702.76s | I hate I hate the term Fed. 702.76s - 704.12s | I just have to say that. 704.12s - 707.28s | But it's like the federal is. 707.28s - 710.16s | But I I think it's come a long way. 710.16s - 713.56s | And I mean, people have been so gracious, so kind. 713.56s - 714.80s | So it's been fantastic. 714.80s - 720.84s | That's why I love this community, because everybody here, I think, shares the desire 720.84s - 727.04s | to actually do good, to fix things, to help. 727.04s - 730.72s | And that's what we need, because frankly, our job is to protect and defend the critical 730.72s - 734.56s | infrastructure that Americans rely on every hour of every day. 734.56s - 739.96s | And the vast majority of that infrastructure is owned and operated by other people. 739.96s - 747.32s | And so if we do not catalyze a community approach to driving down risk to our technology ecosystem, 747.32s - 748.80s | we won't be successful. 748.80s - 749.80s | Right. 749.80s - 750.80s | Yeah. 750.80s - 755.72s | Do you think that's maybe an advantage in the in the U.S. model? 755.72s - 760.68s | I mean, not every country has so much critical infrastructure owned and operated by a private 760.68s - 762.60s | entity. 762.60s - 768.76s | And so maybe it's a secret benefit I hadn't even really considered. 768.76s - 773.36s | Because as long as you can orient the owner operators to do the right thing, they're not 773.36s - 777.16s | just waiting in a passive mode for top down command and control, telling them to patch 777.16s - 778.68s | this or do that. 778.68s - 779.68s | Right. 779.68s - 782.12s | There's enough independent autonomy or maybe diversity. 782.12s - 785.64s | Well, there's definitely diversity. 786.56s - 788.32s | I mean, you could say diversity equals resilience. 788.32s - 793.56s | But I gave a talk yesterday at Black Hat, and, you know, since I've been in this job 793.56s - 797.68s | now three plus years, we're trying to figure out, you know, when


chunk_id: 180_chunk_15
chunk_text:
ecosystem, 747.32s - 748.80s | we won't be successful. 748.80s - 749.80s | Right. 749.80s - 750.80s | Yeah. 750.80s - 755.72s | Do you think that's maybe an advantage in the in the U.S. model? 755.72s - 760.68s | I mean, not every country has so much critical infrastructure owned and operated by a private 760.68s - 762.60s | entity. 762.60s - 768.76s | And so maybe it's a secret benefit I hadn't even really considered. 768.76s - 773.36s | Because as long as you can orient the owner operators to do the right thing, they're not 773.36s - 777.16s | just waiting in a passive mode for top down command and control, telling them to patch 777.16s - 778.68s | this or do that. 778.68s - 779.68s | Right. 779.68s - 782.12s | There's enough independent autonomy or maybe diversity. 782.12s - 785.64s | Well, there's definitely diversity. 786.56s - 788.32s | I mean, you could say diversity equals resilience. 788.32s - 793.56s | But I gave a talk yesterday at Black Hat, and, you know, since I've been in this job 793.56s - 797.68s | now three plus years, we're trying to figure out, you know, when I came in, ransomware 797.68s - 798.92s | is a problem. 798.92s - 802.72s | Three plus years later, ransomware is still a big problem. 802.72s - 808.80s | You know, I think the really important progress that we have made with the community, I think 808.80s - 814.88s | we have been able to catalyze real collaboration between the federal government, state and 814.88s - 821.80s | local industry, hacker community, academia, I mean, all kinds of partners. 821.80s - 824.60s | We've been able to build good collaboration. 824.60s - 833.64s | Second, I think CEOs and boards and business leaders are increasingly seeing cyber risk 833.64s - 834.92s | as a core business risk. 834.92s - 836.32s | I think that's really good. 836.32s - 841.56s | I think there is greater awareness of the importance of basic cyber hygiene. 841.56s - 843.96s | You know, we have the Secure Our World campaign. 844.04s - 845.24s | Those are the four things to do. 845.24s - 848.28s | And so, you know, we've been working on that. 848.28s - 854.80s | I love efforts like Craig Newmark's Cyber Civil Defense, really bringing together the 854.80s - 859.84s


chunk_id: 180_chunk_16
chunk_text:
I came in, ransomware 797.68s - 798.92s | is a problem. 798.92s - 802.72s | Three plus years later, ransomware is still a big problem. 802.72s - 808.80s | You know, I think the really important progress that we have made with the community, I think 808.80s - 814.88s | we have been able to catalyze real collaboration between the federal government, state and 814.88s - 821.80s | local industry, hacker community, academia, I mean, all kinds of partners. 821.80s - 824.60s | We've been able to build good collaboration. 824.60s - 833.64s | Second, I think CEOs and boards and business leaders are increasingly seeing cyber risk 833.64s - 834.92s | as a core business risk. 834.92s - 836.32s | I think that's really good. 836.32s - 841.56s | I think there is greater awareness of the importance of basic cyber hygiene. 841.56s - 843.96s | You know, we have the Secure Our World campaign. 844.04s - 845.24s | Those are the four things to do. 845.24s - 848.28s | And so, you know, we've been working on that. 848.28s - 854.80s | I love efforts like Craig Newmark's Cyber Civil Defense, really bringing together the 854.80s - 859.84s | community and we help with some of the cyber clinics, and that's really great. 859.84s - 866.80s | But I think at the end of the day, unless we stop talking about the villains, right, 866.80s - 871.56s | and the victims and start demanding more of the vendors, I don't think we're going to 871.56s - 877.64s | get into a place where we're going to be able to drive down risk as much as we really 877.64s - 878.64s | want to. 878.64s - 881.80s | I mean, at the end of the day, we have, you know, Jeff and I were talking earlier, like 881.80s - 887.36s | we should stop calling things vulnerabilities because it really diffuses responsibility. 887.36s - 895.96s | We should start calling them product defects because that names it much more clearly, right? 895.96s - 897.44s | And that's what they are. 897.44s - 902.12s | And at the end of the day, it also highlights how important it is for tech manufacturers 902.12s - 910.24s | to design and develop and test and deploy software specifically focused on driving down 910.24s - 913.84s | dramatically the number of exploitable defects.


chunk_id: 180_chunk_17
chunk_text:
| community and we help with some of the cyber clinics, and that's really great. 859.84s - 866.80s | But I think at the end of the day, unless we stop talking about the villains, right, 866.80s - 871.56s | and the victims and start demanding more of the vendors, I don't think we're going to 871.56s - 877.64s | get into a place where we're going to be able to drive down risk as much as we really 877.64s - 878.64s | want to. 878.64s - 881.80s | I mean, at the end of the day, we have, you know, Jeff and I were talking earlier, like 881.80s - 887.36s | we should stop calling things vulnerabilities because it really diffuses responsibility. 887.36s - 895.96s | We should start calling them product defects because that names it much more clearly, right? 895.96s - 897.44s | And that's what they are. 897.44s - 902.12s | And at the end of the day, it also highlights how important it is for tech manufacturers 902.12s - 910.24s | to design and develop and test and deploy software specifically focused on driving down 910.24s - 913.84s | dramatically the number of exploitable defects. 913.84s - 917.72s | And when you use the common language that's used in other industries, everybody else kind 917.72s - 918.72s | of gets it. 918.72s - 919.72s | Oh, a defect. 919.72s - 920.72s | Oh, we track defects. 920.72s - 921.72s | We study defects. 921.72s - 922.72s | We do these things. 923.00s - 927.92s | It goes away from being mysterious so we can't protect ourselves. 927.92s - 928.92s | It's a vulnerability. 928.92s - 929.92s | Yeah. 929.92s - 931.32s | I mean, a hundred percent. 931.32s - 936.24s | We should be learning from what other industries possess that like inexplicably. 936.24s - 937.24s | Oh, wait. 937.24s - 939.64s | Did you sip out of your glass without clinking? 939.64s - 940.64s | I did. 940.64s - 941.64s | I was testing it. 941.64s - 942.64s | Oh, okay. 942.64s - 943.64s | I was testing it. 943.64s - 944.64s | Okay. 944.64s - 945.64s | That was an alpha test. 945.64s - 946.64s | It's drinkable. 946.64s - 947.64s | We're going to go to deployment. 947.64s - 948.64s | Okay. 948.64s - 949.64s | We're deploying. 949.64s - 950.64s |


chunk_id: 180_chunk_18
chunk_text:
913.84s - 917.72s | And when you use the common language that's used in other industries, everybody else kind 917.72s - 918.72s | of gets it. 918.72s - 919.72s | Oh, a defect. 919.72s - 920.72s | Oh, we track defects. 920.72s - 921.72s | We study defects. 921.72s - 922.72s | We do these things. 923.00s - 927.92s | It goes away from being mysterious so we can't protect ourselves. 927.92s - 928.92s | It's a vulnerability. 928.92s - 929.92s | Yeah. 929.92s - 931.32s | I mean, a hundred percent. 931.32s - 936.24s | We should be learning from what other industries possess that like inexplicably. 936.24s - 937.24s | Oh, wait. 937.24s - 939.64s | Did you sip out of your glass without clinking? 939.64s - 940.64s | I did. 940.64s - 941.64s | I was testing it. 941.64s - 942.64s | Oh, okay. 942.64s - 943.64s | I was testing it. 943.64s - 944.64s | Okay. 944.64s - 945.64s | That was an alpha test. 945.64s - 946.64s | It's drinkable. 946.64s - 947.64s | We're going to go to deployment. 947.64s - 948.64s | Okay. 948.64s - 949.64s | We're deploying. 949.64s - 950.64s | Push to production. 950.64s - 955.26s | Okay. 955.26s - 956.26s | Here we go. 957.18s - 958.18s | Sweet. 958.18s - 959.18s | Yeah. 959.18s - 960.18s | I'm sorry. 960.18s - 963.18s | I interrupted your flow there. 963.18s - 965.18s | I totally forgot what I was saying. 965.18s - 966.18s | So. 966.18s - 967.18s | Oh, you know what I was saying? 967.18s - 971.86s | I think we can learn a lot from what other industries possess that the world of software 971.86s - 972.86s | doesn't. 972.86s - 973.86s | Right? 973.86s - 978.06s | I mean, the vast majority of other industries, they do track defects and incidents that cause 978.06s - 982.14s | harm so that you can specifically focus on reducing risk. 982.14s - 984.78s | The risk to driving on the highway, the risk to getting on an airplane. 985.30s - 990.38s | I mean, other industries are frankly obsessed with continuous improvement. 990.38s - 995.10s | The thing that I find so mind boggling about this, as an outsider, not an engineer, is 995.10s - 1001.62s | that think about all the safety engineering done around airplanes, space,


chunk_id: 180_chunk_19
chunk_text:
Push to production. 950.64s - 955.26s | Okay. 955.26s - 956.26s | Here we go. 957.18s - 958.18s | Sweet. 958.18s - 959.18s | Yeah. 959.18s - 960.18s | I'm sorry. 960.18s - 963.18s | I interrupted your flow there. 963.18s - 965.18s | I totally forgot what I was saying. 965.18s - 966.18s | So. 966.18s - 967.18s | Oh, you know what I was saying? 967.18s - 971.86s | I think we can learn a lot from what other industries possess that the world of software 971.86s - 972.86s | doesn't. 972.86s - 973.86s | Right? 973.86s - 978.06s | I mean, the vast majority of other industries, they do track defects and incidents that cause 978.06s - 982.14s | harm so that you can specifically focus on reducing risk. 982.14s - 984.78s | The risk to driving on the highway, the risk to getting on an airplane. 985.30s - 990.38s | I mean, other industries are frankly obsessed with continuous improvement. 990.38s - 995.10s | The thing that I find so mind boggling about this, as an outsider, not an engineer, is 995.10s - 1001.62s | that think about all the safety engineering done around airplanes, space, water, any kind 1001.62s - 1004.14s | of large civil engineering infrastructure. 1004.14s - 1006.14s | They're held to these ridiculous standards. 1006.14s - 1008.34s | Everybody is certified, whatever. 1008.34s - 1012.62s | And then you take that and you're like, okay, that's what we do when it's like engineering 1012.66s - 1014.86s | versus nature. 1014.86s - 1015.86s | We have all these. 1015.86s - 1019.98s | Now it's engineering versus nature plus adversaries. 1019.98s - 1025.10s | So what we'll do is we're going to do less than we would have done if it was engineering 1025.10s - 1026.18s | versus nature. 1026.18s - 1027.46s | It doesn't make any sense. 1027.46s - 1028.46s | No. 1028.46s - 1029.46s | I'm with you, brother. 1029.46s - 1030.46s | Is anyone here from MITRE? 1030.46s - 1031.46s | We've got MITRE people. 1031.46s - 1034.10s | I was talking about this yesterday. 1034.10s - 1041.30s | So MITRE in 2007 published this white paper called Unforgivable Vulnerabilities. 1041.30s - 1046.70s | And it laid out criteria for classes of defect that would be considered unforgivable for 1046.70s - 1049.54s | being both easily found and easily exploited. 1049.54s


chunk_id: 180_chunk_20
chunk_text:
water, any kind 1001.62s - 1004.14s | of large civil engineering infrastructure. 1004.14s - 1006.14s | They're held to these ridiculous standards. 1006.14s - 1008.34s | Everybody is certified, whatever. 1008.34s - 1012.62s | And then you take that and you're like, okay, that's what we do when it's like engineering 1012.66s - 1014.86s | versus nature. 1014.86s - 1015.86s | We have all these. 1015.86s - 1019.98s | Now it's engineering versus nature plus adversaries. 1019.98s - 1025.10s | So what we'll do is we're going to do less than we would have done if it was engineering 1025.10s - 1026.18s | versus nature. 1026.18s - 1027.46s | It doesn't make any sense. 1027.46s - 1028.46s | No. 1028.46s - 1029.46s | I'm with you, brother. 1029.46s - 1030.46s | Is anyone here from MITRE? 1030.46s - 1031.46s | We've got MITRE people. 1031.46s - 1034.10s | I was talking about this yesterday. 1034.10s - 1041.30s | So MITRE in 2007 published this white paper called Unforgivable Vulnerabilities. 1041.30s - 1046.70s | And it laid out criteria for classes of defect that would be considered unforgivable for 1046.70s - 1049.54s | being both easily found and easily exploited. 1049.54s - 1055.26s | So products that didn't keep security, have security in mind at all. 1055.26s - 1059.76s | And folks in here can probably guess what was on the list, but it was memory safety 1059.76s - 1065.66s | violations and coding weaknesses leading to cross-site scripting, SQL injection, and directory 1065.66s - 1067.26s | traversal. 1067.26s - 1075.14s | So then 2023, 16 years later, MITRE publishes another paper called Stubborn Weaknesses. 1075.14s - 1077.38s | And what do you think was at the top of the list? 1077.38s - 1078.38s | Yeah. 1078.38s - 1084.02s | Memory safety violations and coding weaknesses leading to cross-site scripting, SQL injection, 1084.02s - 1085.02s | and directory traversal. 1085.02s - 1087.50s | They just named it version two of their original document. 1087.50s - 1088.50s | Yeah. 1088.50s - 1092.82s | I mean, they weren't as egregious as the ones in 2007, but many of them were. 1092.82s - 1095.70s | And so again, like this has to be a community thing. 1095.70s - 1100.62s | We all have to play a role, both from the supply side, but as well as the demand side. 1100.62s - 1105.98s | I


chunk_id: 180_chunk_21
chunk_text:
- 1055.26s | So products that didn't keep security, have security in mind at all. 1055.26s - 1059.76s | And folks in here can probably guess what was on the list, but it was memory safety 1059.76s - 1065.66s | violations and coding weaknesses leading to cross-site scripting, SQL injection, and directory 1065.66s - 1067.26s | traversal. 1067.26s - 1075.14s | So then 2023, 16 years later, MITRE publishes another paper called Stubborn Weaknesses. 1075.14s - 1077.38s | And what do you think was at the top of the list? 1077.38s - 1078.38s | Yeah. 1078.38s - 1084.02s | Memory safety violations and coding weaknesses leading to cross-site scripting, SQL injection, 1084.02s - 1085.02s | and directory traversal. 1085.02s - 1087.50s | They just named it version two of their original document. 1087.50s - 1088.50s | Yeah. 1088.50s - 1092.82s | I mean, they weren't as egregious as the ones in 2007, but many of them were. 1092.82s - 1095.70s | And so again, like this has to be a community thing. 1095.70s - 1100.62s | We all have to play a role, both from the supply side, but as well as the demand side. 1100.62s - 1105.98s | I mean, all of us need to be demanding safer and more secure products and realizing that 1105.98s - 1107.22s | we have purchasing power. 1107.22s - 1108.22s | Right. 1108.22s - 1109.22s | So, right. 1109.22s - 1111.34s | So I think there's... 1111.34s - 1112.34s | If you just... 1112.34s - 1113.34s | You're not going to drink your drink. 1113.34s - 1114.34s | You don't like your drink. 1114.34s - 1115.34s | I'm drinking the drink. 1115.34s - 1116.34s | I'm drinking the drink. 1116.34s - 1117.34s | No, I'm not forcing you. 1117.34s - 1118.34s | Look how much I've got. 1118.34s - 1119.34s | Let's compare our drinks. 1119.34s - 1122.95s | I drank enough. 1122.95s - 1129.63s | So I think part of it is you have to recognize who's most responsible in any given situation. 1129.63s - 1134.23s | If it's a coding error, the people closest to the project probably bear the greatest 1134.23s - 1135.87s | responsibility in fixing it. 1135.87s - 1136.87s | Right. 1136.87s - 1140.55s | They're near the lever, the steering wheel, whatever, where they can make the change. 1140.55s - 1144.83s | Every step away from that,


chunk_id: 180_chunk_22
chunk_text:
mean, all of us need to be demanding safer and more secure products and realizing that 1105.98s - 1107.22s | we have purchasing power. 1107.22s - 1108.22s | Right. 1108.22s - 1109.22s | So, right. 1109.22s - 1111.34s | So I think there's... 1111.34s - 1112.34s | If you just... 1112.34s - 1113.34s | You're not going to drink your drink. 1113.34s - 1114.34s | You don't like your drink. 1114.34s - 1115.34s | I'm drinking the drink. 1115.34s - 1116.34s | I'm drinking the drink. 1116.34s - 1117.34s | No, I'm not forcing you. 1117.34s - 1118.34s | Look how much I've got. 1118.34s - 1119.34s | Let's compare our drinks. 1119.34s - 1122.95s | I drank enough. 1122.95s - 1129.63s | So I think part of it is you have to recognize who's most responsible in any given situation. 1129.63s - 1134.23s | If it's a coding error, the people closest to the project probably bear the greatest 1134.23s - 1135.87s | responsibility in fixing it. 1135.87s - 1136.87s | Right. 1136.87s - 1140.55s | They're near the lever, the steering wheel, whatever, where they can make the change. 1140.55s - 1144.83s | Every step away from that, there's fewer and fewer things you can do. 1144.83s - 1147.99s | Like, oh no, now I've got to wrap a firewall around it. 1147.99s - 1150.83s | Now I have to wrap a monitoring system around it. 1150.91s - 1154.27s | But the closer you get to fixing the core problem, you maybe don't have to deploy all 1154.27s - 1157.51s | those other mitigations. 1157.51s - 1161.27s | So my whole thing is the manufacturer or the person closest to the problem has the most 1161.27s - 1168.59s | responsibility, comma, we should ask for better products, comma, the government should regulate 1168.59s - 1174.87s | better labeling, better disclosures, better help inform the public debate, comma, we should 1174.87s - 1178.07s | demand better of our partner nations. 1178.07s - 1183.35s | There's a thing at each step, and no one trumps the other, but, you know. 1183.35s - 1185.47s | Yeah, I mean, it's a community thing. 1185.47s - 1191.15s | One of the things that we are having discussions around, or it's a software liability regime. 1191.15s - 1196.31s | And so one that has an articulable standard of care, but also safe harbor provisions


chunk_id: 180_chunk_23
chunk_text:
there's fewer and fewer things you can do. 1144.83s - 1147.99s | Like, oh no, now I've got to wrap a firewall around it. 1147.99s - 1150.83s | Now I have to wrap a monitoring system around it. 1150.91s - 1154.27s | But the closer you get to fixing the core problem, you maybe don't have to deploy all 1154.27s - 1157.51s | those other mitigations. 1157.51s - 1161.27s | So my whole thing is the manufacturer or the person closest to the problem has the most 1161.27s - 1168.59s | responsibility, comma, we should ask for better products, comma, the government should regulate 1168.59s - 1174.87s | better labeling, better disclosures, better help inform the public debate, comma, we should 1174.87s - 1178.07s | demand better of our partner nations. 1178.07s - 1183.35s | There's a thing at each step, and no one trumps the other, but, you know. 1183.35s - 1185.47s | Yeah, I mean, it's a community thing. 1185.47s - 1191.15s | One of the things that we are having discussions around, or it's a software liability regime. 1191.15s - 1196.31s | And so one that has an articulable standard of care, but also safe harbor provisions for 1196.31s - 1201.35s | vendors that do innovate responsibly using secure development processes. 1201.35s - 1206.79s | So the liability stuff, right, we've been complaining about that forever. 1206.79s - 1210.59s | But there's so many, right, there's so many ways you could do liability. 1210.59s - 1214.75s | You could say, you're an open source software project, your source is free. 1214.75s - 1218.39s | No liability for you, because you can self protect. 1218.39s - 1223.03s | Oh, you're a closed commercial product, and you've end of lifed your product. 1223.03s - 1225.79s | And it's, you don't ever plan to do anything with it. 1225.79s - 1226.79s | You still have liability. 1226.79s - 1230.83s | But if you open source it, no liability, you know, there's so many nuances and ways to 1230.83s - 1231.83s | approach it. 1231.83s - 1236.47s | And I feel like the liability discussion is always like, all or nothing. 1237.15s - 1239.79s | I'm saying that's like one of the levers to pull, right? 1239.79s - 1245.99s | I mean, if you, if you just think about, if two thirds of software vulnerabilities are 1245.99s - 1248.47s | memory


chunk_id: 180_chunk_24
chunk_text:
for 1196.31s - 1201.35s | vendors that do innovate responsibly using secure development processes. 1201.35s - 1206.79s | So the liability stuff, right, we've been complaining about that forever. 1206.79s - 1210.59s | But there's so many, right, there's so many ways you could do liability. 1210.59s - 1214.75s | You could say, you're an open source software project, your source is free. 1214.75s - 1218.39s | No liability for you, because you can self protect. 1218.39s - 1223.03s | Oh, you're a closed commercial product, and you've end of lifed your product. 1223.03s - 1225.79s | And it's, you don't ever plan to do anything with it. 1225.79s - 1226.79s | You still have liability. 1226.79s - 1230.83s | But if you open source it, no liability, you know, there's so many nuances and ways to 1230.83s - 1231.83s | approach it. 1231.83s - 1236.47s | And I feel like the liability discussion is always like, all or nothing. 1237.15s - 1239.79s | I'm saying that's like one of the levers to pull, right? 1239.79s - 1245.99s | I mean, if you, if you just think about, if two thirds of software vulnerabilities are 1245.99s - 1248.47s | memory safety, right? 1248.47s - 1254.83s | Memory safety, then there is a lot that can be done across the ecosystem, quite frankly. 1254.83s - 1259.91s | But you know, the yes, the technology vendor plays a significant role, but also, you know, 1259.91s - 1261.31s | higher education. 1261.31s - 1264.03s | That's why we're having discussions with that, right? 1264.03s - 1265.03s | Right. 1265.07s - 1268.59s | Yeah, I think there's, and it's interesting, because when I put on my government thinking 1268.59s - 1273.75s | hat, you look at a problem, and you're like, okay, is this a problem that's uniquely a 1273.75s - 1278.67s | governmental question, a tragedy, the commons issue, there's no market force, the incentive 1278.67s - 1281.79s | models don't work to fix it. 1281.79s - 1286.75s | So in that case, traditionally, that's why we form governments to help us in these areas 1286.75s - 1289.71s | where normal forces don't work. 1289.71s - 1292.71s | And then in other areas, you're like, oh, yeah, it totally responds to market forces, 1292.71s - 1294.91s | it responds to pricing or whatever. 1294.91s - 1298.63s | Yeah, market forces aren't working in


chunk_id: 180_chunk_25
chunk_text:
safety, right? 1248.47s - 1254.83s | Memory safety, then there is a lot that can be done across the ecosystem, quite frankly. 1254.83s - 1259.91s | But you know, the yes, the technology vendor plays a significant role, but also, you know, 1259.91s - 1261.31s | higher education. 1261.31s - 1264.03s | That's why we're having discussions with that, right? 1264.03s - 1265.03s | Right. 1265.07s - 1268.59s | Yeah, I think there's, and it's interesting, because when I put on my government thinking 1268.59s - 1273.75s | hat, you look at a problem, and you're like, okay, is this a problem that's uniquely a 1273.75s - 1278.67s | governmental question, a tragedy, the commons issue, there's no market force, the incentive 1278.67s - 1281.79s | models don't work to fix it. 1281.79s - 1286.75s | So in that case, traditionally, that's why we form governments to help us in these areas 1286.75s - 1289.71s | where normal forces don't work. 1289.71s - 1292.71s | And then in other areas, you're like, oh, yeah, it totally responds to market forces, 1292.71s - 1294.91s | it responds to pricing or whatever. 1294.91s - 1298.63s | Yeah, market forces aren't working in this market force aren't working. 1298.63s - 1305.87s | And so it's funny, because like, when I started in professionally in this field in like 98, 1305.87s - 1309.79s | we were like, okay, we're gonna run software vulnerability scanning tools, and we're going 1309.79s - 1314.03s | to release scores against products. 1314.03s - 1319.07s | This will be like an 8.2 on the 1999 score system or whatever. 1319.07s - 1321.95s | And consumers will make informed decisions. 1321.95s - 1325.39s | You will all make informed decisions because you'll want to buy the thing with a higher 1325.39s - 1326.39s | score. 1326.39s - 1332.47s | Oh, well, the software shrink wrap license prevents that. 1332.47s - 1336.27s | Like, oh, why would you prevent people testing your software? 1336.27s - 1339.27s | That was my first inkling like something is very wrong here. 1339.27s - 1343.71s | But have you looked at the standard contract language for software? 1343.71s - 1346.75s | You bear the entire risk of this product. 1346.75s - 1348.35s | And it's like part of the issue. 1348.35s - 1354.43s | It's religion and software where there's no liability. 1354.43s - 1357.15s


chunk_id: 180_chunk_26
chunk_text:
this market force aren't working. 1298.63s - 1305.87s | And so it's funny, because like, when I started in professionally in this field in like 98, 1305.87s - 1309.79s | we were like, okay, we're gonna run software vulnerability scanning tools, and we're going 1309.79s - 1314.03s | to release scores against products. 1314.03s - 1319.07s | This will be like an 8.2 on the 1999 score system or whatever. 1319.07s - 1321.95s | And consumers will make informed decisions. 1321.95s - 1325.39s | You will all make informed decisions because you'll want to buy the thing with a higher 1325.39s - 1326.39s | score. 1326.39s - 1332.47s | Oh, well, the software shrink wrap license prevents that. 1332.47s - 1336.27s | Like, oh, why would you prevent people testing your software? 1336.27s - 1339.27s | That was my first inkling like something is very wrong here. 1339.27s - 1343.71s | But have you looked at the standard contract language for software? 1343.71s - 1346.75s | You bear the entire risk of this product. 1346.75s - 1348.35s | And it's like part of the issue. 1348.35s - 1354.43s | It's religion and software where there's no liability. 1354.43s - 1357.15s | Every other industry in the world has liability. 1357.15s - 1358.15s | Death and taxes. 1358.15s - 1359.15s | Yeah, it's crazy. 1359.15s - 1363.47s | Okay, so okay, so we're not going to get it with this. 1363.47s - 1365.23s | The insurance industry. 1365.23s - 1370.27s | So now we're into the early 2000s, the insurance industry will come along, and they will mandate 1370.27s - 1375.91s | rates and better inform and then companies want to save money. 1375.91s - 1378.07s | Then that didn't happen. 1378.07s - 1379.99s | And now here we are. 1379.99s - 1380.99s | Governments looking at their tool belt. 1380.99s - 1381.99s | They're like, what do we got? 1381.99s - 1382.99s | What do we got? 1382.99s - 1383.99s | Okay. 1383.99s - 1384.99s | Industry didn't work. 1384.99s - 1386.55s | Self-regulation didn't work. 1386.55s - 1387.55s | Insurance didn't work. 1387.55s - 1388.55s | Oh, no. 1388.55s - 1390.39s | I only have regulation left. 1390.39s - 1392.59s | Like we're running out of tools. 1392.59s - 1397.51s | And it's frustrating, but I know exactly how we got here. 1397.51s - 1401.75s | You know, this


chunk_id: 180_chunk_27
chunk_text:
| Every other industry in the world has liability. 1357.15s - 1358.15s | Death and taxes. 1358.15s - 1359.15s | Yeah, it's crazy. 1359.15s - 1363.47s | Okay, so okay, so we're not going to get it with this. 1363.47s - 1365.23s | The insurance industry. 1365.23s - 1370.27s | So now we're into the early 2000s, the insurance industry will come along, and they will mandate 1370.27s - 1375.91s | rates and better inform and then companies want to save money. 1375.91s - 1378.07s | Then that didn't happen. 1378.07s - 1379.99s | And now here we are. 1379.99s - 1380.99s | Governments looking at their tool belt. 1380.99s - 1381.99s | They're like, what do we got? 1381.99s - 1382.99s | What do we got? 1382.99s - 1383.99s | Okay. 1383.99s - 1384.99s | Industry didn't work. 1384.99s - 1386.55s | Self-regulation didn't work. 1386.55s - 1387.55s | Insurance didn't work. 1387.55s - 1388.55s | Oh, no. 1388.55s - 1390.39s | I only have regulation left. 1390.39s - 1392.59s | Like we're running out of tools. 1392.59s - 1397.51s | And it's frustrating, but I know exactly how we got here. 1397.51s - 1401.75s | You know, this is not a surprise that we're now at the point of talking about liability. 1401.75s - 1403.43s | We saw this coming for decades. 1403.43s - 1408.95s | I love to quote Dan Kaminsky on this, who said like, you know, security was never a 1408.95s - 1412.83s | consideration when the internet was invented. 1412.83s - 1416.07s | The internet was invented to move pictures of cats. 1416.07s - 1418.19s | It's very good at that. 1418.19s - 1422.31s | But I do think, so at the end of the day, we are a voluntary agency, but, you know, 1422.31s - 1428.09s | we started out at RSA, we have this secure by design pledge, where companies are signing 1428.09s - 1433.97s | up to it, committing to make material progress in seven key areas, you know, increasing 1433.97s - 1439.89s | use of MFA, decreasing use of default password, eliminating whole classes of vulnerabilities. 1439.89s - 1446.09s | And we had 68 vendors that signed at RSA, three months later, we're nearly at 200. 1446.09s - 1450.45s | And I think there's virtue in being able to track progress and transparently report on 1450.45s - 1451.45s | it.


