# MediaChunks

chunk_text:
we talked about trusted types? 1346.62s - 1351.42s | And it blocks a lot of these inherently unsafe DOM APIs 1351.42s - 1354.26s | in the web platform, or at least makes it harder to use. 1354.26s - 1357.14s | What if we take that to the conclusion of the idea 1357.14s - 1359.46s | and actually ban all of those usages 1359.46s - 1362.06s | at runtime of these legacy DOM APIs 1362.06s - 1366.62s | that are a little bit inherently unsafe as they've 1366.62s - 1367.54s | been designed? 1367.54s - 1371.42s | Can you build apps where we don't use any of those APIs? 1371.42s - 1373.82s | And that's our future vision of where we go from here. 1373.82s - 1376.74s | If we have new platform-level APIs for operations 1376.74s - 1379.26s | that we currently use DOM APIs for, 1379.26s - 1381.86s | such as maybe a browser-included sanitizer 1381.86s - 1385.10s | implementation for HTML, maybe a templating solution, 1385.10s - 1386.86s | then we've really come full circle 1386.86s - 1388.74s | and have our runtime enforcements 1388.74s - 1391.66s | influence a new suite of secure-by-default web platform 1391.74s - 1394.38s | APIs to bring decisions that nudge developers 1394.38s - 1397.42s | towards safer choices, maybe at the framework level, 1397.42s - 1399.62s | from the very beginning when the first line of code 1399.62s - 1401.94s | is written in a new code base, all the way 1401.94s - 1407.38s | to the moment when it is executed on the client's 1407.38s - 1408.70s | browser. 1408.70s - 1410.54s | And this is a future we hope to get to, 1410.54s - 1412.94s | one where we can safely lock down all the accesses 1412.94s - 1416.14s | to many DOM APIs, along with a new suite of platform APIs 1416.14s - 1419.14s | to replace those operations in a safe-by-default manner. 1419.14s - 1420.50s | And we call this approach, we've 1420.50s - 1421.90s | nicknamed it Perfect Types. 1421.90s - 1424.74s | It is the logical evolution of Trusted Types. 1424.74s - 1426.50s | And we see this as the next evolution 1426.50s - 1428.62s | of Trusted Types and a post-cross-site scripting 1428.62s - 1429.26s | world. 1429.26s - 1431.74s | This, combined with the strict CSP configurations 1431.74s - 1434.50s | we talked about


chunk_text:
1394.38s | APIs to bring decisions that nudge developers 1394.38s - 1397.42s | towards safer choices, maybe at the framework level, 1397.42s - 1399.62s | from the very beginning when the first line of code 1399.62s - 1401.94s | is written in a new code base, all the way 1401.94s - 1407.38s | to the moment when it is executed on the client's 1407.38s - 1408.70s | browser. 1408.70s - 1410.54s | And this is a future we hope to get to, 1410.54s - 1412.94s | one where we can safely lock down all the accesses 1412.94s - 1416.14s | to many DOM APIs, along with a new suite of platform APIs 1416.14s - 1419.14s | to replace those operations in a safe-by-default manner. 1419.14s - 1420.50s | And we call this approach, we've 1420.50s - 1421.90s | nicknamed it Perfect Types. 1421.90s - 1424.74s | It is the logical evolution of Trusted Types. 1424.74s - 1426.50s | And we see this as the next evolution 1426.50s - 1428.62s | of Trusted Types and a post-cross-site scripting 1428.62s - 1429.26s | world. 1429.26s - 1431.74s | This, combined with the strict CSP configurations 1431.74s - 1434.50s | we talked about and our framework-based approaches, 1434.50s - 1436.18s | secure-by-design, safe-by-design, 1436.18s - 1438.18s | should guide us to a new post-cross-site scripting 1438.18s - 1438.70s | world. 1438.70s - 1441.70s | And taking a step back for a second for an even bigger 1441.70s - 1445.82s | picture, and as a final plug, this safe coding philosophy 1445.82s - 1447.98s | and safe-by-design, trying to steer developers 1447.98s - 1449.48s | in the right direction, is something 1449.48s - 1451.66s | that extends beyond just JavaScript, cross-site 1451.66s - 1455.10s | scripting, and is a core priority for all Google-scale 1455.10s - 1456.18s | security efforts. 1456.18s - 1458.46s | You can read more about our organization's work 1458.46s - 1459.14s | at these links. 1459.14s - 1462.20s | And Google is a signer of CISA's Secure-by-Design Pledge, 1462.20s - 1465.02s | along with other industry and government leaders in the space. 1465.02s - 1466.82s | And we've committed to sharing our knowledge 1466.82s - 1470.26s | on how to build a safer future together. 1470.26s - 1472.74s | All right, well, that is the end of our talk. 1472.74s - 1474.38s | So thank you, everyone, for listening. 1474.38s


chunk_text:
and our framework-based approaches, 1434.50s - 1436.18s | secure-by-design, safe-by-design, 1436.18s - 1438.18s | should guide us to a new post-cross-site scripting 1438.18s - 1438.70s | world. 1438.70s - 1441.70s | And taking a step back for a second for an even bigger 1441.70s - 1445.82s | picture, and as a final plug, this safe coding philosophy 1445.82s - 1447.98s | and safe-by-design, trying to steer developers 1447.98s - 1449.48s | in the right direction, is something 1449.48s - 1451.66s | that extends beyond just JavaScript, cross-site 1451.66s - 1455.10s | scripting, and is a core priority for all Google-scale 1455.10s - 1456.18s | security efforts. 1456.18s - 1458.46s | You can read more about our organization's work 1458.46s - 1459.14s | at these links. 1459.14s - 1462.20s | And Google is a signer of CISA's Secure-by-Design Pledge, 1462.20s - 1465.02s | along with other industry and government leaders in the space. 1465.02s - 1466.82s | And we've committed to sharing our knowledge 1466.82s - 1470.26s | on how to build a safer future together. 1470.26s - 1472.74s | All right, well, that is the end of our talk. 1472.74s - 1474.38s | So thank you, everyone, for listening. 1474.38s - 1476.02s | Hopefully, this was a good guide on how 1476.02s - 1477.46s | to think about solving XSS. 1477.46s - 1479.62s | I'll leave you to it.


chunk_text:
- 1476.02s | Hopefully, this was a good guide on how 1476.02s - 1477.46s | to think about solving XSS. 1477.46s - 1479.62s | I'll leave you to it.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=WsRSzJsrWAw", "title": "DEF CON 32 - Defeating Secure Code Review GPT Hallucinations - Wang Zhilong, Xinzhi Luo", "description": "In this talk, we will discuss the strengths and limitations of LLMs for code analysis tasks like code search and code clone detection. We will show when the LLMs make mistakes and what kinds of mistakes they make. For example, we observe that the performance of popular LLMs heavily relies on the well-defined variable and function names, therefore, they will make mistakes when some misleading variable name is given. Anyone interested in exploring the intersection of AI and code security analysis can attend this talk.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1077, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 8.00s | This text was transcribed using whisper model: large-v2 Alright everyone, thank you very much for joining us. Our next talk is SDLC Nightmares Defeating 8.00s - 26.70s | Secure Code Review H- er GPT Hallucination with Julo and April. Hello my name is Julo and uh I 26.70s - 33.70s | just graduated from the Pennsylvania State University last year and now I'm working at the 33.70s - 40.70s | security engineering industry and uh my research interest is focused on applied deep learning in 40.70s - 49.14s | cyber security. And I'm April, Carnegie Mellon University graduate and currently a security 49.14s - 56.14s | engineer as well. A fun fact about me is I learn and apply my infosec knowledge during writing 56.14s - 65.14s | science fiction. Okay let's get started. As most of us might have noticed, nowadays large language 65.14s - 72.14s | models have been playing an increasingly important role in our daily work and lives. Today we'll 72.14s - 79.14s | discuss how LLMs can be applied to security code analysis and evaluate their reliability in 80.14s - 89.65s | understanding program logic. Uh overview of our talk today, first we'll introduce LLMs and their 89.65s - 96.65s | strengths in SDLC, then we'll uncover their limitations through an experiment. Based on our findings 96.65s - 103.65s | we'll further discuss the root causes and their other related issues. Finally we'll summarize key 103.65s - 114.11s | takeaways on how to better utilize LLMs in our work. So first of all what is large language model? 114.11s - 123.11s | Basically LLM is advanced machine learning models that understand and generate human like


chunk_text:
on applied deep learning in 40.70s - 49.14s | cyber security. And I'm April, Carnegie Mellon University graduate and currently a security 49.14s - 56.14s | engineer as well. A fun fact about me is I learn and apply my infosec knowledge during writing 56.14s - 65.14s | science fiction. Okay let's get started. As most of us might have noticed, nowadays large language 65.14s - 72.14s | models have been playing an increasingly important role in our daily work and lives. Today we'll 72.14s - 79.14s | discuss how LLMs can be applied to security code analysis and evaluate their reliability in 80.14s - 89.65s | understanding program logic. Uh overview of our talk today, first we'll introduce LLMs and their 89.65s - 96.65s | strengths in SDLC, then we'll uncover their limitations through an experiment. Based on our findings 96.65s - 103.65s | we'll further discuss the root causes and their other related issues. Finally we'll summarize key 103.65s - 114.11s | takeaways on how to better utilize LLMs in our work. So first of all what is large language model? 114.11s - 123.11s | Basically LLM is advanced machine learning models that understand and generate human like text uh by 123.11s - 132.11s | learning from fast data sets. They use deep learning especially uh transformer architectures to predict 132.11s - 140.11s | the most probable word in a sentence. For example in this figure it estimates uh 91% probability that 140.11s - 149.11s | the word blue follows the phrase the color of the sky is. LLMs generate coherent and contextually 149.11s - 156.11s | appropriate text enabling tasks like answering questions, uh translation and our topic today 156.11s - 166.11s | code analysis. Now let's talk about SDLC. A typical software development life cycle involves various 166.11s - 176.11s | stages where LLM can significantly assist. By understanding semantics and recognizing patterns, LLMs 176.11s - 185.11s | can comprehend natural language and analyze code. Performing tasks like code generation, test case 185.11s - 194.11s | creation and also documentation. From a security perspective they also help with threat modeling and 194.11s - 203.11s | identifying vulnerabilities. Ultimately boosting the efficiency and uh quality throughout the SDLC. 203.11s - 211.11s | However LLMs can make mistakes. Here are two famous examples. When Google introduced their chatbot 211.11s - 220.11s | bot it made a factual error


chunk_text:
text uh by 123.11s - 132.11s | learning from fast data sets. They use deep learning especially uh transformer architectures to predict 132.11s - 140.11s | the most probable word in a sentence. For example in this figure it estimates uh 91% probability that 140.11s - 149.11s | the word blue follows the phrase the color of the sky is. LLMs generate coherent and contextually 149.11s - 156.11s | appropriate text enabling tasks like answering questions, uh translation and our topic today 156.11s - 166.11s | code analysis. Now let's talk about SDLC. A typical software development life cycle involves various 166.11s - 176.11s | stages where LLM can significantly assist. By understanding semantics and recognizing patterns, LLMs 176.11s - 185.11s | can comprehend natural language and analyze code. Performing tasks like code generation, test case 185.11s - 194.11s | creation and also documentation. From a security perspective they also help with threat modeling and 194.11s - 203.11s | identifying vulnerabilities. Ultimately boosting the efficiency and uh quality throughout the SDLC. 203.11s - 211.11s | However LLMs can make mistakes. Here are two famous examples. When Google introduced their chatbot 211.11s - 220.11s | bot it made a factual error during its very first demo. Another instance involved chat GPT which 220.11s - 229.11s | confidently asserted that 9.11 is greater than 9.9. A mistake even an elementary student will recognize. 230.11s - 239.11s | These errors stem from their tendency to state incorrect information as facts. LLMs often hallucinate like 239.11s - 245.11s | what I do every time before sleeping or conceiving a science fiction story. They tend to make up 245.11s - 254.11s | information because they're essentially autocomplete system based on probability rather than facts. Now 254.11s - 263.11s | let's see their performance in code analysis. Before diving into the experiment let's first take a closer 263.11s - 271.11s | look at the code itself. Technically source code is a sequence of tokens consisting of three types. 271.11s - 280.11s | Keywords, operators and user defined names. Keywords and operators are defined by the specification of 280.11s - 288.11s | each programming language and they control the actual logic flow of the program execution. So we categorize 288.11s - 297.11s | them as logical features. Meanwhile user defined names, annotations and comments which don't influence the 297.11s - 307.11s | program flow once it's compiled


chunk_text:
during its very first demo. Another instance involved chat GPT which 220.11s - 229.11s | confidently asserted that 9.11 is greater than 9.9. A mistake even an elementary student will recognize. 230.11s - 239.11s | These errors stem from their tendency to state incorrect information as facts. LLMs often hallucinate like 239.11s - 245.11s | what I do every time before sleeping or conceiving a science fiction story. They tend to make up 245.11s - 254.11s | information because they're essentially autocomplete system based on probability rather than facts. Now 254.11s - 263.11s | let's see their performance in code analysis. Before diving into the experiment let's first take a closer 263.11s - 271.11s | look at the code itself. Technically source code is a sequence of tokens consisting of three types. 271.11s - 280.11s | Keywords, operators and user defined names. Keywords and operators are defined by the specification of 280.11s - 288.11s | each programming language and they control the actual logic flow of the program execution. So we categorize 288.11s - 297.11s | them as logical features. Meanwhile user defined names, annotations and comments which don't influence the 297.11s - 307.11s | program flow once it's compiled are categorized as literal features. So our goal for the experiment is to 307.11s - 315.11s | determine what types of features in the code LLMs can actually learn and process. We'll mask the literal features 315.11s - 323.11s | by replacing the changeable names that don't affect the program flow and then use the LLM to perform code 323.11s - 332.11s | analysis tasks on this modified code. By evaluating the performance we'll assess whether LLM can effectively 332.11s - 341.42s | process the logical features when literal features are absent or even misleading. To conceal the literal features 341.42s - 350.42s | we'll adopt three kinds of anonymization. So here is an example of the bubble sort function in Java and the first 350.42s - 358.42s | anonymization is for function name. So here we can replace the bubble sort string with our customized string. 359.42s - 367.42s | And the second one is for variable names. Two examples here is the begin and end which we can replace with our 367.42s - 376.42s | strings. And the last one is the method invocation name. Here we have a function pret as one of the arguments for 376.42s


chunk_text:
are categorized as literal features. So our goal for the experiment is to 307.11s - 315.11s | determine what types of features in the code LLMs can actually learn and process. We'll mask the literal features 315.11s - 323.11s | by replacing the changeable names that don't affect the program flow and then use the LLM to perform code 323.11s - 332.11s | analysis tasks on this modified code. By evaluating the performance we'll assess whether LLM can effectively 332.11s - 341.42s | process the logical features when literal features are absent or even misleading. To conceal the literal features 341.42s - 350.42s | we'll adopt three kinds of anonymization. So here is an example of the bubble sort function in Java and the first 350.42s - 358.42s | anonymization is for function name. So here we can replace the bubble sort string with our customized string. 359.42s - 367.42s | And the second one is for variable names. Two examples here is the begin and end which we can replace with our 367.42s - 376.42s | strings. And the last one is the method invocation name. Here we have a function pret as one of the arguments for 376.42s - 385.77s | the bubble sort function so we can replace the invocation name with our customized string. Meanwhile to understand 386.77s - 394.77s | how literal features affect LLM comprehension we also use two name replacement strategies. The first one is just 394.77s - 403.77s | replacing it with some randomly generated string while the second one is shuffling the names with other meaningful 403.77s - 414.77s | names from the code making it more misleading for users. For readers, sorry. So after literal features are concealed 414.77s - 424.77s | the LLM performs two main tasks related to code analysis. The first one is code clone detection which identifies and 424.77s - 433.77s | measures the similarity between different code fragments to see if they generate the same result when given the same 433.77s - 443.77s | input. The second one is code search where it tries to retrieve the code fragment from a larger code corpus that 443.77s - 455.11s | closely match a developer's intent which is expressed in natural language as the input. So here are the results we got. 455.11s - 463.11s | It shows that anonymizing names significantly decreases model performance especially when


chunk_text:
- 385.77s | the bubble sort function so we can replace the invocation name with our customized string. Meanwhile to understand 386.77s - 394.77s | how literal features affect LLM comprehension we also use two name replacement strategies. The first one is just 394.77s - 403.77s | replacing it with some randomly generated string while the second one is shuffling the names with other meaningful 403.77s - 414.77s | names from the code making it more misleading for users. For readers, sorry. So after literal features are concealed 414.77s - 424.77s | the LLM performs two main tasks related to code analysis. The first one is code clone detection which identifies and 424.77s - 433.77s | measures the similarity between different code fragments to see if they generate the same result when given the same 433.77s - 443.77s | input. The second one is code search where it tries to retrieve the code fragment from a larger code corpus that 443.77s - 455.11s | closely match a developer's intent which is expressed in natural language as the input. So here are the results we got. 455.11s - 463.11s | It shows that anonymizing names significantly decreases model performance especially when we replace all three kinds of 463.11s - 472.11s | names. In the code search task we also notice that anonymizing master definition name causes more degradation than 473.11s - 481.11s | anonymizing master invocation name indicating a stronger correlation between the master definition name and their 481.11s - 491.11s | purpose. As for different languages, anonymizing a single attribute affects Python more but changing all naming 491.11s - 501.11s | attributes impact Java the most probably because the verbosity and the structure in Java code that can mitigate partial 501.11s - 512.10s | anonymization are fully disrupted. Compared to the code clone detection task, the performance degradation is more 512.10s - 520.10s | pronounced in code search task since will define variable and method names are crucial for relating the code snippet to its 520.10s - 531.10s | descriptive purpose. So overall the results clearly show that while logical features are what matters for program to 531.10s - 541.10s | execute, what LLMs processed are mostly the literal features from the code. Now I'll hand it over to Dr. Zhilong to discuss the 541.10s - 544.10s | reasons and possible solutions. 544.10s - 557.52s | Okay. So let's discuss


chunk_text:
we replace all three kinds of 463.11s - 472.11s | names. In the code search task we also notice that anonymizing master definition name causes more degradation than 473.11s - 481.11s | anonymizing master invocation name indicating a stronger correlation between the master definition name and their 481.11s - 491.11s | purpose. As for different languages, anonymizing a single attribute affects Python more but changing all naming 491.11s - 501.11s | attributes impact Java the most probably because the verbosity and the structure in Java code that can mitigate partial 501.11s - 512.10s | anonymization are fully disrupted. Compared to the code clone detection task, the performance degradation is more 512.10s - 520.10s | pronounced in code search task since will define variable and method names are crucial for relating the code snippet to its 520.10s - 531.10s | descriptive purpose. So overall the results clearly show that while logical features are what matters for program to 531.10s - 541.10s | execute, what LLMs processed are mostly the literal features from the code. Now I'll hand it over to Dr. Zhilong to discuss the 541.10s - 544.10s | reasons and possible solutions. 544.10s - 557.52s | Okay. So let's discuss some root cause for the misleading names and comments in the code. Basically we just observed three 558.52s - 566.52s | types of the root cause for these misleading names and comments and they are malicious code committers and outdated comments 566.52s - 580.36s | and bad coding practice. Malicious code contributor can contribute some malicious code to the open source projects and to avoid 580.36s - 590.36s | being detected by the code reviewers and they usually can change the naming to some misleading names to avoid being detected by 590.36s - 607.10s | the code reviewer. Secondly, in software development programs often change frequently update their code to fix some bugs or add 607.10s - 619.10s | some new features. Well the comments corresponding to the code may not be updated in time. In this example, partial code was 619.10s - 632.06s | removed during a new commit and however the corresponding comment was not removed accordingly. Comments that are not updated can 632.06s - 642.06s | cause inconsistency with the code and we call them outdated comments. And outdated comments can mislead the light learning model 642.06s - 656.87s | during code analysis. Also in bad coding


chunk_text:
some root cause for the misleading names and comments in the code. Basically we just observed three 558.52s - 566.52s | types of the root cause for these misleading names and comments and they are malicious code committers and outdated comments 566.52s - 580.36s | and bad coding practice. Malicious code contributor can contribute some malicious code to the open source projects and to avoid 580.36s - 590.36s | being detected by the code reviewers and they usually can change the naming to some misleading names to avoid being detected by 590.36s - 607.10s | the code reviewer. Secondly, in software development programs often change frequently update their code to fix some bugs or add 607.10s - 619.10s | some new features. Well the comments corresponding to the code may not be updated in time. In this example, partial code was 619.10s - 632.06s | removed during a new commit and however the corresponding comment was not removed accordingly. Comments that are not updated can 632.06s - 642.06s | cause inconsistency with the code and we call them outdated comments. And outdated comments can mislead the light learning model 642.06s - 656.87s | during code analysis. Also in bad coding practice, confusing variable names and misleading variable names could be given by even a benign 656.87s - 673.26s | programmer and developer which can mislead the code reviewer too. So next we are going to cover some other issues when using the light 673.26s - 690.51s | learning model to do the code analysis. Besides aforementioned limitations we also observe two limitations. The first one is lack of context 690.51s - 708.20s | and the second one is diverse performance on different program language. We will show the detail. Most light learning models can only 708.20s - 725.20s | handle a sequence of limited length. For example, GPT-3 can handle a sequence with 2,048 tokens at most. And the GPT-4 can handle 32,000 tokens 725.20s - 739.20s | at most. However, the code for even small projects can have thousands lines of code and each line of code contains usually more than 10 tokens. 739.20s - 752.45s | Therefore, the light learning model cannot consume all the code at once which will lead to lack of context issue. Let's show through this figure. 752.45s - 767.45s | We have a big project here showing this figure and let's consider context


chunk_text:
practice, confusing variable names and misleading variable names could be given by even a benign 656.87s - 673.26s | programmer and developer which can mislead the code reviewer too. So next we are going to cover some other issues when using the light 673.26s - 690.51s | learning model to do the code analysis. Besides aforementioned limitations we also observe two limitations. The first one is lack of context 690.51s - 708.20s | and the second one is diverse performance on different program language. We will show the detail. Most light learning models can only 708.20s - 725.20s | handle a sequence of limited length. For example, GPT-3 can handle a sequence with 2,048 tokens at most. And the GPT-4 can handle 32,000 tokens 725.20s - 739.20s | at most. However, the code for even small projects can have thousands lines of code and each line of code contains usually more than 10 tokens. 739.20s - 752.45s | Therefore, the light learning model cannot consume all the code at once which will lead to lack of context issue. Let's show through this figure. 752.45s - 767.45s | We have a big project here showing this figure and let's consider context of the light learning model through this blue box. 767.45s - 792.35s | When we use the light learning model to analyze this whole project, we need to analyze part of them individually. In most cases, the light learning model is used to 792.35s - 807.35s | analyze each function individually and cannot have a big picture of the whole project. So, we actually have written an ARXIV preprint to dive into this problem. 807.35s - 830.20s | We also propose some solution to solve this problem and for people who are interested in the details can read this ARXIV preprint. Also, we observe that light learning model has a diverse performance 830.20s - 850.20s | across different program languages and different light learning models also have different strengths across different program languages. We did a quick experiment to evaluate the light learning model's ability to infer the program logic on two program languages. 850.20s - 878.26s | The result is shown in the table here. We can observe that the GPT 3.5 has shown the best results on PHP and Go. However, Gemini can show the best results on PHP and Python. 878.26s - 904.89s | Next, we will


chunk_text:
of the light learning model through this blue box. 767.45s - 792.35s | When we use the light learning model to analyze this whole project, we need to analyze part of them individually. In most cases, the light learning model is used to 792.35s - 807.35s | analyze each function individually and cannot have a big picture of the whole project. So, we actually have written an ARXIV preprint to dive into this problem. 807.35s - 830.20s | We also propose some solution to solve this problem and for people who are interested in the details can read this ARXIV preprint. Also, we observe that light learning model has a diverse performance 830.20s - 850.20s | across different program languages and different light learning models also have different strengths across different program languages. We did a quick experiment to evaluate the light learning model's ability to infer the program logic on two program languages. 850.20s - 878.26s | The result is shown in the table here. We can observe that the GPT 3.5 has shown the best results on PHP and Go. However, Gemini can show the best results on PHP and Python. 878.26s - 904.89s | Next, we will discuss how to avoid this issue in using light learning model for code analysis. We start from some ad hoc solutions. If the code is committed by a trusted developer, we should expect them to improve the quality of the name convention. 904.89s - 921.89s | If the code is committed by some untrusted developer, we should pay special attention in case the light learning model is fooled by the malicious code committer, which can easily be achieved based on our experiments. 921.89s - 952.76s | For example, we could deploy some naming logical inconsistency detection and use it to detect the inconsistency before we perform the code review. However, to really solve this problem, we believe that we need to change the model a little bit specifically for the code analysis. 952.76s - 966.76s | A current popular pre-training task for the light learning model, as far as we know, is mask token prediction. In the mask token prediction task, it masks off some tokens in the sequence. 967.76s - 985.76s | Take this as an example. It masks off some tokens from its sequence and uses neural network to predict this token. This is how current light learning


chunk_text:
discuss how to avoid this issue in using light learning model for code analysis. We start from some ad hoc solutions. If the code is committed by a trusted developer, we should expect them to improve the quality of the name convention. 904.89s - 921.89s | If the code is committed by some untrusted developer, we should pay special attention in case the light learning model is fooled by the malicious code committer, which can easily be achieved based on our experiments. 921.89s - 952.76s | For example, we could deploy some naming logical inconsistency detection and use it to detect the inconsistency before we perform the code review. However, to really solve this problem, we believe that we need to change the model a little bit specifically for the code analysis. 952.76s - 966.76s | A current popular pre-training task for the light learning model, as far as we know, is mask token prediction. In the mask token prediction task, it masks off some tokens in the sequence. 967.76s - 985.76s | Take this as an example. It masks off some tokens from its sequence and uses neural network to predict this token. This is how current light learning model is trained, as far as we know. 985.76s - 1006.76s | The mask token prediction task mainly focuses on the literal feature when applied to the source code analysis. But if we apply this model to the neural language NLP, it's okay because it does not have too much of the logic features. 1006.76s - 1025.76s | But for the source code, we have a lot of the logic features. So, to really solve this problem, we think that we need to add some more pre-training tasks to train a new large program language model. 1025.76s - 1048.76s | We should add some logic feature prediction tasks so that it can better capture the logic feature, not the literal feature. Because, as we show, relying too much on the literal feature will result in some issues, as we have demonstrated in the experiments. 1048.76s - 1072.24s | So, for the audience who are interested in the details of this talk, you can refer to this ARX that we pre-printed for more details. Here is our contact information. And that's all of our talk.


chunk_text:
model is trained, as far as we know. 985.76s - 1006.76s | The mask token prediction task mainly focuses on the literal feature when applied to the source code analysis. But if we apply this model to the neural language NLP, it's okay because it does not have too much of the logic features. 1006.76s - 1025.76s | But for the source code, we have a lot of the logic features. So, to really solve this problem, we think that we need to add some more pre-training tasks to train a new large program language model. 1025.76s - 1048.76s | We should add some logic feature prediction tasks so that it can better capture the logic feature, not the literal feature. Because, as we show, relying too much on the literal feature will result in some issues, as we have demonstrated in the experiments. 1048.76s - 1072.24s | So, for the audience who are interested in the details of this talk, you can refer to this ARX that we pre-printed for more details. Here is our contact information. And that's all of our talk.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=1upEyCKVpkI", "title": "DEF CON 32 - The Immortal Retrofuturism of Mainframes and How to Keep Them Safe- Michelle Eggers", "description": "When you used your debit card today, do you know where that transaction was sent? Though it may conjure archival images of a 1950\u2019s IT room stocked with enormous, low-tech machines, Mainframe technology is both modernized and heavily relied upon today.\n\nMainframe architecture is some of the most reliable tech available, able to manage incredibly large input/output volumes with low risk of downtime and there are few signs of it being sunset in the decades to come. As protectors of the cyber landscape, understanding how mainframes are incorporated into a businesses topology and ways to secure mainframe architecture will remain important for any entity that utilizes this technology.\n\nIn this talk we'll explore the pervasiveness of mainframe technology, why it will remain relevant to the future landscape of mission critical-applications, and several trusted solutions for helping to secure these incredible computers.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1547, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 2.54s - 4.04s | This text was transcribed using whisper model: large-v2 All right 4.04s - 11.44s | Thanks everyone for being here. We know it's Sunday and 10 a.m. So my heart goes out. I appreciate you so much today 11.44s - 16.48s | We're gonna talk about the immortal retrofuturism of mainframe computers and how to keep them safe 16.48s - 22.24s | I will give you a small disclaimer. I am coming from of course the red team side offensive security side 22.24s - 28.16s | So this how to keep safe tips will not be as expansive as perhaps someone who is on the defensive side 28.16s - 30.28s | But we will touch on it a little bit. So to begin 30.64s - 32.64s | Let me see 32.68s - 33.88s | Yes 33.88s - 35.88s | It worked. Okay. This is me 35.88s - 40.72s | It looks a little weird. It's all blown out. But I am Michelle Eggers. I'm a security consultant with Netspy 40.72s - 46.80s | I've been with them for a couple of years. I specialize in mainframe web application and network penetration testing 46.80s - 48.56s | I have a background in accounting and finance 48.56s - 53.88s | Which is a little bit linked to mainframe because you know, the financial industry is essentially held


chunk_text:
10 a.m. So my heart goes out. I appreciate you so much today 11.44s - 16.48s | We're gonna talk about the immortal retrofuturism of mainframe computers and how to keep them safe 16.48s - 22.24s | I will give you a small disclaimer. I am coming from of course the red team side offensive security side 22.24s - 28.16s | So this how to keep safe tips will not be as expansive as perhaps someone who is on the defensive side 28.16s - 30.28s | But we will touch on it a little bit. So to begin 30.64s - 32.64s | Let me see 32.68s - 33.88s | Yes 33.88s - 35.88s | It worked. Okay. This is me 35.88s - 40.72s | It looks a little weird. It's all blown out. But I am Michelle Eggers. I'm a security consultant with Netspy 40.72s - 46.80s | I've been with them for a couple of years. I specialize in mainframe web application and network penetration testing 46.80s - 48.56s | I have a background in accounting and finance 48.56s - 53.88s | Which is a little bit linked to mainframe because you know, the financial industry is essentially held up by mainframe 53.88s - 59.32s | We'll touch on that in a minute more here, and I'm passionate about legacy tech. I like old things 59.32s - 65.60s | I think they're interesting and cool and we are still using them. So it's important that we make sure we're still securing them 65.60s - 69.72s | We can't forget to pay attention to the entire topology. All right, so 70.92s - 73.48s | This is our outline. We're gonna do a history debrief 73.64s - 77.48s | We're gonna look at how it kind of started and some things that have changed over the years 77.64s - 83.44s | We're gonna look at mainframes today why people still elect to use them. What's special about them? What even are they? 83.84s - 86.44s | We're gonna look at a few modern threats some notable 87.24s - 92.80s | Breaches that have happened in the last decade or so and then some things that we see in our pen tests currently 93.68s - 97.08s | Yeah, and I have a demo which is really cool. That shows a real thing that happened 97.08s - 100.48s | It's a little scary,


chunk_text:
up by mainframe 53.88s - 59.32s | We'll touch on that in a minute more here, and I'm passionate about legacy tech. I like old things 59.32s - 65.60s | I think they're interesting and cool and we are still using them. So it's important that we make sure we're still securing them 65.60s - 69.72s | We can't forget to pay attention to the entire topology. All right, so 70.92s - 73.48s | This is our outline. We're gonna do a history debrief 73.64s - 77.48s | We're gonna look at how it kind of started and some things that have changed over the years 77.64s - 83.44s | We're gonna look at mainframes today why people still elect to use them. What's special about them? What even are they? 83.84s - 86.44s | We're gonna look at a few modern threats some notable 87.24s - 92.80s | Breaches that have happened in the last decade or so and then some things that we see in our pen tests currently 93.68s - 97.08s | Yeah, and I have a demo which is really cool. That shows a real thing that happened 97.08s - 100.48s | It's a little scary, but it'll be interesting and then of course the tips to secure 101.28s - 107.00s | Okay, so before we get into the history and all of that. I want to know whoever doesn't currently work with mainframe 108.04s - 113.72s | Anybody want to volunteer what you think mainframe is give a description on it? 113.72s - 117.88s | Just a sentence or or two any takers 118.96s - 139.88s | Yes, right. So we have she said a cluster of computers with sort of different 140.76s - 142.76s | applications use cases 143.00s - 145.00s | Yes 145.52s - 148.12s | Close you're on your way 149.72s - 155.57s | What's that everything's bigger yeah, well depending yes 155.57s - 157.57s | Hmm 157.65s - 162.25s | Yes, wait, yeah, they're they're big systems obviously she's yes, of course 166.45s - 174.55s | Yes, I love it. Okay, great. Everybody's super smart. You'll get big gold stars 176.15s - 182.07s | So mainframes are actually just computers, right they're specialized computers that have insane 182.43s - 188.59s | Processing power storage power their input output stuff it billions of turns that transactions a day literally billions 188.83s -


chunk_text:
but it'll be interesting and then of course the tips to secure 101.28s - 107.00s | Okay, so before we get into the history and all of that. I want to know whoever doesn't currently work with mainframe 108.04s - 113.72s | Anybody want to volunteer what you think mainframe is give a description on it? 113.72s - 117.88s | Just a sentence or or two any takers 118.96s - 139.88s | Yes, right. So we have she said a cluster of computers with sort of different 140.76s - 142.76s | applications use cases 143.00s - 145.00s | Yes 145.52s - 148.12s | Close you're on your way 149.72s - 155.57s | What's that everything's bigger yeah, well depending yes 155.57s - 157.57s | Hmm 157.65s - 162.25s | Yes, wait, yeah, they're they're big systems obviously she's yes, of course 166.45s - 174.55s | Yes, I love it. Okay, great. Everybody's super smart. You'll get big gold stars 176.15s - 182.07s | So mainframes are actually just computers, right they're specialized computers that have insane 182.43s - 188.59s | Processing power storage power their input output stuff it billions of turns that transactions a day literally billions 188.83s - 193.09s | So it's not something like a quantum computer where you're having a highly 193.91s - 195.55s | complex 195.55s - 198.63s | Transaction that's occurring. They're more simplistic, but they have to be 199.15s - 204.35s | Incredibly precise and very very fast and happening in tandem at the same time happened 204.35s - 211.43s | They did parallel sysplex makes this possible and they have unique operating systems like, you know, IBM Z right and Linux 211.79s - 217.11s | So very cool. You're not gonna find Windows on a mainframe. Just I hope not. Please don't 219.59s - 221.31s | I don't do it 221.31s - 223.31s | So let's look at a few myth versus facts 223.79s - 228.43s | Something that has been fun for me this week is this first myth is something I've had to fight with people 228.91s - 236.27s | Basically every day on like Oh mainframe. Oh, that's like 1960s as 4000 and I'm like no no 238.71s - 243.87s | They've continuously evolved right there are some of the first systems to introduce virtualization 244.55s - 250.31s | Built-in encryption their continue. I mean, there's more things coming


chunk_text:
193.09s | So it's not something like a quantum computer where you're having a highly 193.91s - 195.55s | complex 195.55s - 198.63s | Transaction that's occurring. They're more simplistic, but they have to be 199.15s - 204.35s | Incredibly precise and very very fast and happening in tandem at the same time happened 204.35s - 211.43s | They did parallel sysplex makes this possible and they have unique operating systems like, you know, IBM Z right and Linux 211.79s - 217.11s | So very cool. You're not gonna find Windows on a mainframe. Just I hope not. Please don't 219.59s - 221.31s | I don't do it 221.31s - 223.31s | So let's look at a few myth versus facts 223.79s - 228.43s | Something that has been fun for me this week is this first myth is something I've had to fight with people 228.91s - 236.27s | Basically every day on like Oh mainframe. Oh, that's like 1960s as 4000 and I'm like no no 238.71s - 243.87s | They've continuously evolved right there are some of the first systems to introduce virtualization 244.55s - 250.31s | Built-in encryption their continue. I mean, there's more things coming out all the time. There's real-time a inferencing 250.31s - 254.73s | There are new things coming out next year from IBM. I'll tell you a little bit more about that, too 255.39s - 257.51s | But they're not locked in the past 257.51s - 264.71s | It's not like this green screen terminal from a 1980s movie or this image of this woman in this room with base 264.71s - 268.95s | That's basically one computer in the entire room. We're way beyond that 269.23s - 272.07s | Okay, another myth is that cloud replaces mainframe? 272.63s - 276.91s | Due to regulatory compliance reasons, this is impossible in many scenarios 277.59s - 280.59s | Also, it's kind of expensive to move off of the mainframe 280.63s - 285.99s | So that's another reason why if you know if you have a use case for it and you've implemented it 285.99s - 291.03s | It's kind of a who's you to keep it running because once you have it, it's actually pretty inexpensive 291.15s - 297.39s | It's less expensive than cloud in that regard. You can also use them to host your own virtual private cloud, which is


chunk_text:
out all the time. There's real-time a inferencing 250.31s - 254.73s | There are new things coming out next year from IBM. I'll tell you a little bit more about that, too 255.39s - 257.51s | But they're not locked in the past 257.51s - 264.71s | It's not like this green screen terminal from a 1980s movie or this image of this woman in this room with base 264.71s - 268.95s | That's basically one computer in the entire room. We're way beyond that 269.23s - 272.07s | Okay, another myth is that cloud replaces mainframe? 272.63s - 276.91s | Due to regulatory compliance reasons, this is impossible in many scenarios 277.59s - 280.59s | Also, it's kind of expensive to move off of the mainframe 280.63s - 285.99s | So that's another reason why if you know if you have a use case for it and you've implemented it 285.99s - 291.03s | It's kind of a who's you to keep it running because once you have it, it's actually pretty inexpensive 291.15s - 297.39s | It's less expensive than cloud in that regard. You can also use them to host your own virtual private cloud, which is nice 297.91s - 303.35s | And then hybridization, okay, so if you're gonna look at cloud and mainframe, it's not gonna knock mainframe away 303.35s - 304.47s | You're not gonna replace it 304.47s - 310.51s | But we are seeing more and more cases of hybridization where certain applications and functions are in the cloud 310.59s - 314.43s | Right, and there's you know, just API calls or whatever making these things possible 315.15s - 319.19s | Oh, yeah, and then I like this the CLT that is extract load and transform 319.19s - 326.87s | So that's a way of getting your data off of the mainframe into a different environment so that you can do more analysis, right? 327.87s - 331.83s | Love it. Okay, and then another myth is it's just too specialized. No one knows what it is 331.83s - 337.43s | Nobody knows how to do it. There really are literally maybe like five to ten mainframe hackers in the world 337.87s - 340.87s | So that's real. That's true, but there are 341.51s - 343.35s | moves underway 343.35s - 349.77s | To rebuild that workforce. It sort of took a hit in


chunk_text:
nice 297.91s - 303.35s | And then hybridization, okay, so if you're gonna look at cloud and mainframe, it's not gonna knock mainframe away 303.35s - 304.47s | You're not gonna replace it 304.47s - 310.51s | But we are seeing more and more cases of hybridization where certain applications and functions are in the cloud 310.59s - 314.43s | Right, and there's you know, just API calls or whatever making these things possible 315.15s - 319.19s | Oh, yeah, and then I like this the CLT that is extract load and transform 319.19s - 326.87s | So that's a way of getting your data off of the mainframe into a different environment so that you can do more analysis, right? 327.87s - 331.83s | Love it. Okay, and then another myth is it's just too specialized. No one knows what it is 331.83s - 337.43s | Nobody knows how to do it. There really are literally maybe like five to ten mainframe hackers in the world 337.87s - 340.87s | So that's real. That's true, but there are 341.51s - 343.35s | moves underway 343.35s - 349.77s | To rebuild that workforce. It sort of took a hit in the mid 90s to the early 2010s in staffing 349.91s - 354.63s | The funding went down as far as you know building people bringing them into the workforce 354.75s - 355.95s | But 355.95s - 360.43s | I was actually I was at share which is like one of the biggest mainframe conferences that happens in a year 360.43s - 366.39s | They do it twice and I met a lot of people that were early career professionals that are you know in college and they're learning 366.39s - 372.79s | Cobol and we're like really? Oh, that's great. They're becoming these sort of system programmers in the mainframe environment 372.79s - 378.43s | There's there's money going into it now because they're still being used and there's still innovation happening and people kind of woke up and said 378.43s - 383.75s | Oh, they're not dead. We have to keep going. So oh and then this Watson X code assist 383.91s - 390.07s | That's that's a cool feature that's coming out and it's basically just means you can take your cobalt and use these tools 390.11s - 393.27s | To help translate it into a language like


chunk_text:
the mid 90s to the early 2010s in staffing 349.91s - 354.63s | The funding went down as far as you know building people bringing them into the workforce 354.75s - 355.95s | But 355.95s - 360.43s | I was actually I was at share which is like one of the biggest mainframe conferences that happens in a year 360.43s - 366.39s | They do it twice and I met a lot of people that were early career professionals that are you know in college and they're learning 366.39s - 372.79s | Cobol and we're like really? Oh, that's great. They're becoming these sort of system programmers in the mainframe environment 372.79s - 378.43s | There's there's money going into it now because they're still being used and there's still innovation happening and people kind of woke up and said 378.43s - 383.75s | Oh, they're not dead. We have to keep going. So oh and then this Watson X code assist 383.91s - 390.07s | That's that's a cool feature that's coming out and it's basically just means you can take your cobalt and use these tools 390.11s - 393.27s | To help translate it into a language like Java or Python 393.27s - 396.59s | It's a lot easier to find developers who are specialized in those languages 396.59s - 401.07s | It's much more common than someone who specializes in cobalt, even though we are rebuilding cobalt people. So 401.79s - 404.91s | All right. I love old pictures. I hope you do too brief history 405.91s - 408.19s | We need these lights down. It's all washed out 409.19s - 416.23s | 1937 okay. We've got u.s. U.s. Navy Bureau ships pre mainframe technology. These were not digital systems, right? 416.39s - 421.07s | We're just talking about analog computers mechanical calculators. These are fairly gunnery 421.67s - 423.15s | calculations 423.15s - 429.83s | Navigation this is very military. This is pre-world war two stuff, but it's sort of like the the bones where it began 429.83s - 432.75s | This is where we started seeing innovation in this area 433.51s - 435.51s | 1951 the Eckert Mockley Computer Corporation 436.03s - 442.07s | They made it possible for businesses to now get this technology for their own use 442.07s - 448.23s | It was no longer simply relegated to government. However, it was the


chunk_text:
Java or Python 393.27s - 396.59s | It's a lot easier to find developers who are specialized in those languages 396.59s - 401.07s | It's much more common than someone who specializes in cobalt, even though we are rebuilding cobalt people. So 401.79s - 404.91s | All right. I love old pictures. I hope you do too brief history 405.91s - 408.19s | We need these lights down. It's all washed out 409.19s - 416.23s | 1937 okay. We've got u.s. U.s. Navy Bureau ships pre mainframe technology. These were not digital systems, right? 416.39s - 421.07s | We're just talking about analog computers mechanical calculators. These are fairly gunnery 421.67s - 423.15s | calculations 423.15s - 429.83s | Navigation this is very military. This is pre-world war two stuff, but it's sort of like the the bones where it began 429.83s - 432.75s | This is where we started seeing innovation in this area 433.51s - 435.51s | 1951 the Eckert Mockley Computer Corporation 436.03s - 442.07s | They made it possible for businesses to now get this technology for their own use 442.07s - 448.23s | It was no longer simply relegated to government. However, it was the UNIVAC system. That was for the census 448.23s - 455.35s | I there's 1950 census and then they rolled out the UNIVAC in 1951 to help process that data that they pulled in that year 455.35s - 457.11s | So really cool 457.11s - 458.87s | Time marches on 458.87s - 465.55s | When is this next one? Yes, I oh, I love this one. Okay, so unified architecture was a major achievement 466.71s - 472.51s | Previous to the unified architecture you had let's say you had several different types of mainframe boxes 472.87s - 474.87s | They could not speak to each other 475.19s - 480.15s | They didn't have you know similar software or even the language wasn't quite the same 480.15s - 486.61s | And so you'd have to have a person trained up on each one or different people trained on each one and they could not work together 487.29s - 490.93s | But with unified architecture it changed all of that and now you could have you know 490.93s - 494.61s | A few different types of machines and they could communicate together really nice 494.61s - 498.49s | And then of course the


chunk_text:
UNIVAC system. That was for the census 448.23s - 455.35s | I there's 1950 census and then they rolled out the UNIVAC in 1951 to help process that data that they pulled in that year 455.35s - 457.11s | So really cool 457.11s - 458.87s | Time marches on 458.87s - 465.55s | When is this next one? Yes, I oh, I love this one. Okay, so unified architecture was a major achievement 466.71s - 472.51s | Previous to the unified architecture you had let's say you had several different types of mainframe boxes 472.87s - 474.87s | They could not speak to each other 475.19s - 480.15s | They didn't have you know similar software or even the language wasn't quite the same 480.15s - 486.61s | And so you'd have to have a person trained up on each one or different people trained on each one and they could not work together 487.29s - 490.93s | But with unified architecture it changed all of that and now you could have you know 490.93s - 494.61s | A few different types of machines and they could communicate together really nice 494.61s - 498.49s | And then of course the vacuum tubes were replaced by this 499.29s - 503.81s | Sorry, the stall solid-state technology if you have vacuum tubes in an earthquake 504.77s - 508.73s | That's just bad news. Like it's not gonna live. So it got a lot better 509.61s - 514.35s | 1970 the innovation continued we had magnetic ferrite cores replaced by silicon drem memory chips 515.03s - 519.15s | Virtual memory was introduced and dynamic address translation was also introduced 519.15s - 526.03s | So as we're seeing mainframe is really pushing right? It's not lagging behind. It's constantly sort of at this 526.99s - 528.19s | parallel 528.19s - 533.79s | Level with innovation as along with other technologies. It's just maybe not as talked about 535.51s - 540.11s | 1991 the saga continues. This is great. This guy Stuart Alsop. He was 540.87s - 544.59s | He was like a talking head right for for the technology 546.63s - 549.91s | You really wrote new newspaper articles or something but 550.99s - 553.99s | He said that mainframe would be dead that it would be sunset 553.99s - 559.35s | The last one's gonna be unplugged and this very specific date and


chunk_text:
vacuum tubes were replaced by this 499.29s - 503.81s | Sorry, the stall solid-state technology if you have vacuum tubes in an earthquake 504.77s - 508.73s | That's just bad news. Like it's not gonna live. So it got a lot better 509.61s - 514.35s | 1970 the innovation continued we had magnetic ferrite cores replaced by silicon drem memory chips 515.03s - 519.15s | Virtual memory was introduced and dynamic address translation was also introduced 519.15s - 526.03s | So as we're seeing mainframe is really pushing right? It's not lagging behind. It's constantly sort of at this 526.99s - 528.19s | parallel 528.19s - 533.79s | Level with innovation as along with other technologies. It's just maybe not as talked about 535.51s - 540.11s | 1991 the saga continues. This is great. This guy Stuart Alsop. He was 540.87s - 544.59s | He was like a talking head right for for the technology 546.63s - 549.91s | You really wrote new newspaper articles or something but 550.99s - 553.99s | He said that mainframe would be dead that it would be sunset 553.99s - 559.35s | The last one's gonna be unplugged and this very specific date and that was published that date 559.35s - 562.59s | He like stood on that hill and he was very much wrong 563.67s - 567.43s | Because as we can see mainframe is still being used, right? 568.23s - 573.75s | By finance by military health care if you use your debit card today 574.43s - 581.11s | That transaction touched a mainframe if you have ever been to a doctor or you go to a hospital for something 581.11s - 586.75s | Your information is in a mainframe somewhere. It is so now, you know 587.95s - 591.03s | And then we've got the new developments coming along something cool 591.79s - 593.15s | so 593.15s - 596.51s | There's already AI on the I have the z15 597.07s - 601.39s | But this next coming year IBM is releasing a new box. That's gonna have 602.03s - 606.53s | more increased capabilities and what we're gonna see is the the real-time 606.87s - 612.23s | Inferencing is going to step in in such a way that if there's fraud, right? 612.43s - 618.07s | So this actually happened to my family pretty recently like someone's at home and then


chunk_text:
that was published that date 559.35s - 562.59s | He like stood on that hill and he was very much wrong 563.67s - 567.43s | Because as we can see mainframe is still being used, right? 568.23s - 573.75s | By finance by military health care if you use your debit card today 574.43s - 581.11s | That transaction touched a mainframe if you have ever been to a doctor or you go to a hospital for something 581.11s - 586.75s | Your information is in a mainframe somewhere. It is so now, you know 587.95s - 591.03s | And then we've got the new developments coming along something cool 591.79s - 593.15s | so 593.15s - 596.51s | There's already AI on the I have the z15 597.07s - 601.39s | But this next coming year IBM is releasing a new box. That's gonna have 602.03s - 606.53s | more increased capabilities and what we're gonna see is the the real-time 606.87s - 612.23s | Inferencing is going to step in in such a way that if there's fraud, right? 612.43s - 618.07s | So this actually happened to my family pretty recently like someone's at home and then they get a call 10 or 15 minutes later 618.07s - 621.47s | Hey, are you at Legoland? Did you just spend $800? No, okay 621.47s - 623.75s | We're gonna cancel your card and reissue a new one 623.75s - 628.63s | It's this whole process and then that company has to eat that cost because you as you know 628.63s - 631.03s | The account holder and there's fraud you're not gonna pay for that 631.03s - 635.47s | Hopefully you shouldn't pay for that and then are they gonna catch the person who did the fraud likely? 635.47s - 638.79s | No, so these companies are just eating all these fraud costs constantly 638.91s - 645.07s | Well, if they can catch the fraudulent charge as it's occurring instead of you know, even five minutes later 645.23s - 647.23s | It's gonna really reduce 647.35s - 651.15s | That cost that inconvenience having to get a new card. I 652.11s - 656.25s | Love it. All right. So why do people use mainframe now? 657.91s - 659.31s | Why do we care 659.31s - 662.95s | There are three reasons you'll hear this acronym in the mainframe


chunk_text:
they get a call 10 or 15 minutes later 618.07s - 621.47s | Hey, are you at Legoland? Did you just spend $800? No, okay 621.47s - 623.75s | We're gonna cancel your card and reissue a new one 623.75s - 628.63s | It's this whole process and then that company has to eat that cost because you as you know 628.63s - 631.03s | The account holder and there's fraud you're not gonna pay for that 631.03s - 635.47s | Hopefully you shouldn't pay for that and then are they gonna catch the person who did the fraud likely? 635.47s - 638.79s | No, so these companies are just eating all these fraud costs constantly 638.91s - 645.07s | Well, if they can catch the fraudulent charge as it's occurring instead of you know, even five minutes later 645.23s - 647.23s | It's gonna really reduce 647.35s - 651.15s | That cost that inconvenience having to get a new card. I 652.11s - 656.25s | Love it. All right. So why do people use mainframe now? 657.91s - 659.31s | Why do we care 659.31s - 662.95s | There are three reasons you'll hear this acronym in the mainframe community 662.95s - 668.19s | It's kind of like sell sales talking points, but reliability availability and serviceability 668.19s - 672.19s | So if you're looking at the New York Stock Exchange or Nasdaq something like that 672.19s - 678.83s | They have to have what is called the five nines of reliability. So it's ninety nine point nine nine nine percent uptime 678.83s - 683.83s | They cannot have more than five and a half minutes of downtime in a given year 684.95s - 691.19s | They cannot right and so mainframe is able to do this. It's got well, it's not gonna go through 691.35s - 697.03s | Let's break out the slides a little more built-in redundancy across your hardware levels your input output paths your power supply 697.47s - 701.99s | You've got error detection correction. You've got these machines that are so robust 702.39s - 707.55s | They can withstand up to seven magnitude earthquakes, right? The vacuum tubes are gone. They're strong now 709.31s - 712.11s | Availability, right? We want to make sure that the machine itself 713.67s - 718.87s | Beyond it just being strong you can still actually get your data


chunk_text:
community 662.95s - 668.19s | It's kind of like sell sales talking points, but reliability availability and serviceability 668.19s - 672.19s | So if you're looking at the New York Stock Exchange or Nasdaq something like that 672.19s - 678.83s | They have to have what is called the five nines of reliability. So it's ninety nine point nine nine nine percent uptime 678.83s - 683.83s | They cannot have more than five and a half minutes of downtime in a given year 684.95s - 691.19s | They cannot right and so mainframe is able to do this. It's got well, it's not gonna go through 691.35s - 697.03s | Let's break out the slides a little more built-in redundancy across your hardware levels your input output paths your power supply 697.47s - 701.99s | You've got error detection correction. You've got these machines that are so robust 702.39s - 707.55s | They can withstand up to seven magnitude earthquakes, right? The vacuum tubes are gone. They're strong now 709.31s - 712.11s | Availability, right? We want to make sure that the machine itself 713.67s - 718.87s | Beyond it just being strong you can still actually get your data out of it and it's accurate data at any given time, right? 718.87s - 724.11s | It's available to you. So you've got transaction rollback checkpoint restart complex job scheduling 724.15s - 728.11s | they have a hundred ninety configurable cores in this one specific example of the 728.83s - 734.19s | Z15 right so you can basically finally tune your machine you make like a bespoke system for yourself 734.87s - 738.67s | Basically out of the box you can start tuning it and fitting it to your specific use case 738.91s - 743.51s | And again with the unified architecture, they can all talk to each other. So we love it and then the service ability 743.51s - 749.27s | This is actually one of my favorite features. They're modular by design. Okay, so and then I mentioned parallel sysplex 749.27s - 755.71s | It means if you have a workflow or process that is relegated to one L power one logical partition, right? It's like the virtual 756.95s - 758.87s | segmentation within your mainframe 758.87s - 765.87s | You can just swap those workflows over to another section of your box without any interruption without any


chunk_text:
out of it and it's accurate data at any given time, right? 718.87s - 724.11s | It's available to you. So you've got transaction rollback checkpoint restart complex job scheduling 724.15s - 728.11s | they have a hundred ninety configurable cores in this one specific example of the 728.83s - 734.19s | Z15 right so you can basically finally tune your machine you make like a bespoke system for yourself 734.87s - 738.67s | Basically out of the box you can start tuning it and fitting it to your specific use case 738.91s - 743.51s | And again with the unified architecture, they can all talk to each other. So we love it and then the service ability 743.51s - 749.27s | This is actually one of my favorite features. They're modular by design. Okay, so and then I mentioned parallel sysplex 749.27s - 755.71s | It means if you have a workflow or process that is relegated to one L power one logical partition, right? It's like the virtual 756.95s - 758.87s | segmentation within your mainframe 758.87s - 765.87s | You can just swap those workflows over to another section of your box without any interruption without any issues 765.87s - 770.79s | So if you need to change a card out or you need to do some kind of repair the machine itself never has to go 770.79s - 778.27s | Down ever you just move the pieces you need to move when you need to move them because they're so modular. It's intentional 778.87s - 784.59s | Got the in-depth logging for problem-solving on-site accessible for repair maintenance. So I 785.67s - 792.75s | Live by a Google plant, right and you know, they're just what is the clouds just other people's computers. We understand this 792.75s - 799.03s | So I'm driving home and it's dark and I'm on the freeway and I can see the plant kind of over near the river 799.03s - 803.43s | and there are all these police cars and a couple fire engines an 803.71s - 808.79s | Ambulance and all the lights are going like this and then keep driving like what's going on and then the road to get to the plant 808.79s - 814.43s | Same thing it's blocked off. I don't know what's going on if your data is there. Are they gonna tell you?


chunk_text:
issues 765.87s - 770.79s | So if you need to change a card out or you need to do some kind of repair the machine itself never has to go 770.79s - 778.27s | Down ever you just move the pieces you need to move when you need to move them because they're so modular. It's intentional 778.87s - 784.59s | Got the in-depth logging for problem-solving on-site accessible for repair maintenance. So I 785.67s - 792.75s | Live by a Google plant, right and you know, they're just what is the clouds just other people's computers. We understand this 792.75s - 799.03s | So I'm driving home and it's dark and I'm on the freeway and I can see the plant kind of over near the river 799.03s - 803.43s | and there are all these police cars and a couple fire engines an 803.71s - 808.79s | Ambulance and all the lights are going like this and then keep driving like what's going on and then the road to get to the plant 808.79s - 814.43s | Same thing it's blocked off. I don't know what's going on if your data is there. Are they gonna tell you? 815.27s - 817.03s | We're like, oh, well, that's just one region 817.03s - 817.23s | well 817.23s - 818.19s | what if there was I mean 818.19s - 819.51s | I don't know if it was a 819.51s - 824.83s | Physical breach or if there was a fire if there's some other kind of problem and they'll never tell you like well 824.83s - 826.63s | Oh, well, it's a redundancy. We have different regions 826.63s - 826.87s | Okay 826.87s - 832.07s | what if there was a coordinated attack against multiple regions at the same time and they just so happen to be the regions that 832.07s - 834.07s | your data 834.27s - 835.71s | Are stored in 835.71s - 842.75s | something to think about if it's on-site and you have incredibly sensitive business critical data and 843.39s - 845.39s | You can protect it with your own security 845.39s - 850.07s | You know if there's a fire, you know, your organization knows if there's some kind of physical breach 850.71s - 852.71s | You're gonna you have a better 852.95s - 856.59s | Just you have more insight into the security of


chunk_text:
815.27s - 817.03s | We're like, oh, well, that's just one region 817.03s - 817.23s | well 817.23s - 818.19s | what if there was I mean 818.19s - 819.51s | I don't know if it was a 819.51s - 824.83s | Physical breach or if there was a fire if there's some other kind of problem and they'll never tell you like well 824.83s - 826.63s | Oh, well, it's a redundancy. We have different regions 826.63s - 826.87s | Okay 826.87s - 832.07s | what if there was a coordinated attack against multiple regions at the same time and they just so happen to be the regions that 832.07s - 834.07s | your data 834.27s - 835.71s | Are stored in 835.71s - 842.75s | something to think about if it's on-site and you have incredibly sensitive business critical data and 843.39s - 845.39s | You can protect it with your own security 845.39s - 850.07s | You know if there's a fire, you know, your organization knows if there's some kind of physical breach 850.71s - 852.71s | You're gonna you have a better 852.95s - 856.59s | Just you have more insight into the security of your own systems 856.87s - 857.79s | You're not you know 857.79s - 863.87s | Hoping Azure is gonna call you and say hey somebody broken and start a bunch of fires and hopefully didn't affect your stuff. So 864.95s - 866.47s | and 866.47s - 872.39s | This is this I love this. Okay. So this is a little demo. Oh, I wonder if it'll play. Oh, I wish it will 873.39s - 881.07s | It may not darn well basically it's not gonna play they do this testing I'll just simulate 887.75s - 891.15s | So in New Jersey about eight months ago there was a 891.99s - 898.11s | 4.5 magnitude earthquake and there's a campus near there. I mean that earthquake went up the coast as well. It affected a lot of places 898.67s - 905.83s | There is a campus with 200 mainframes and not a single one was affected there was no damage whatsoever 906.51s - 908.51s | You want to start an earthquake? 909.35s - 911.83s | In your server room and see how it goes 912.71s - 914.63s | Probably not, right? 914.63s - 919.87s | Yeah, yeah a little bit scary


chunk_text:
your own systems 856.87s - 857.79s | You're not you know 857.79s - 863.87s | Hoping Azure is gonna call you and say hey somebody broken and start a bunch of fires and hopefully didn't affect your stuff. So 864.95s - 866.47s | and 866.47s - 872.39s | This is this I love this. Okay. So this is a little demo. Oh, I wonder if it'll play. Oh, I wish it will 873.39s - 881.07s | It may not darn well basically it's not gonna play they do this testing I'll just simulate 887.75s - 891.15s | So in New Jersey about eight months ago there was a 891.99s - 898.11s | 4.5 magnitude earthquake and there's a campus near there. I mean that earthquake went up the coast as well. It affected a lot of places 898.67s - 905.83s | There is a campus with 200 mainframes and not a single one was affected there was no damage whatsoever 906.51s - 908.51s | You want to start an earthquake? 909.35s - 911.83s | In your server room and see how it goes 912.71s - 914.63s | Probably not, right? 914.63s - 919.87s | Yeah, yeah a little bit scary mainframes can do that. They're literally built to do that 919.99s - 923.07s | So apologies for the lack of the shaking I can show you later 924.07s - 926.07s | All right, so 926.23s - 932.15s | We've gotten a little bit of an understanding about why people care about mainframe why they use it. What are the benefits of it? 932.87s - 936.87s | What are the things that can affect it? What are we scared of? Why? 937.55s - 939.67s | Do we need to think about the security? So 940.59s - 946.23s | One of the big things that affects mainframe are the integrations, right? We see a lot of 946.39s - 948.39s | Entry 948.47s - 953.67s | Into the mainframe environment not by not starting at the mainframe level, of course 953.67s - 959.15s | But with things like web applications that connect to it or just the general network in this case 959.15s - 963.65s | Even it was the Wi-Fi network. So the TJX company's data breach payment card data breach 964.59s - 970.75s | 45.7 million user cards were affected exfiltrated. This is a weakness in the wireless network. That's how


chunk_text:
mainframes can do that. They're literally built to do that 919.99s - 923.07s | So apologies for the lack of the shaking I can show you later 924.07s - 926.07s | All right, so 926.23s - 932.15s | We've gotten a little bit of an understanding about why people care about mainframe why they use it. What are the benefits of it? 932.87s - 936.87s | What are the things that can affect it? What are we scared of? Why? 937.55s - 939.67s | Do we need to think about the security? So 940.59s - 946.23s | One of the big things that affects mainframe are the integrations, right? We see a lot of 946.39s - 948.39s | Entry 948.47s - 953.67s | Into the mainframe environment not by not starting at the mainframe level, of course 953.67s - 959.15s | But with things like web applications that connect to it or just the general network in this case 959.15s - 963.65s | Even it was the Wi-Fi network. So the TJX company's data breach payment card data breach 964.59s - 970.75s | 45.7 million user cards were affected exfiltrated. This is a weakness in the wireless network. That's how that one kicked off 970.75s - 973.87s | We're gonna see a trend here Heartland payment systems breach 974.59s - 980.23s | Doubled the last hundred million cards compromised. This is at the hands of a global cyber fraud operation 980.31s - 983.91s | Okay, and this was a combined attack of network and application vulnerabilities 984.31s - 986.31s | Then we see the Equifax data breach 986.63s - 992.03s | Okay, this was now a hundred and forty seven million users exposed which is just goes up every single time 992.15s - 997.51s | It's worse every time in this instance. It was the web application that provided the initial foothold 998.27s - 1004.11s | And this one is a little bit harder to find information on this is the logica 1004.51s - 1007.67s | Data breach this was in Sweden and it affected the government 1008.19s - 1014.35s | And it was so bad and word got out that the government just published the documents. They just put everything public 1014.35s - 1019.07s | They said just here go ahead and find it. You can find it if you want to it's in Swedish 1019.11s - 1021.55s |


chunk_text:
that one kicked off 970.75s - 973.87s | We're gonna see a trend here Heartland payment systems breach 974.59s - 980.23s | Doubled the last hundred million cards compromised. This is at the hands of a global cyber fraud operation 980.31s - 983.91s | Okay, and this was a combined attack of network and application vulnerabilities 984.31s - 986.31s | Then we see the Equifax data breach 986.63s - 992.03s | Okay, this was now a hundred and forty seven million users exposed which is just goes up every single time 992.15s - 997.51s | It's worse every time in this instance. It was the web application that provided the initial foothold 998.27s - 1004.11s | And this one is a little bit harder to find information on this is the logica 1004.51s - 1007.67s | Data breach this was in Sweden and it affected the government 1008.19s - 1014.35s | And it was so bad and word got out that the government just published the documents. They just put everything public 1014.35s - 1019.07s | They said just here go ahead and find it. You can find it if you want to it's in Swedish 1019.11s - 1021.55s | But you can find all the documents about this 1021.63s - 1023.63s | This 1023.63s - 1028.59s | This was initial access to be in the FTP network so unencrypted protocol, okay 1029.27s - 1034.23s | The hackers use something like Hercules, which is an emulator. I use an emulator in my testing 1034.23s - 1035.83s | I use x 3270 1035.83s - 1041.19s | But I tell you this to say it's not that hard to get some of these tools to start getting into the places that maybe 1041.19s - 1042.67s | You shouldn't be getting into 1042.67s - 1049.67s | this attack specifically leveraged some zero days, which may be a little more difficult to you know make happen, but 1050.51s - 1052.95s | They were based on default configurations 1053.51s - 1058.95s | Right, so this is something that is easy to fix and not have in your environment 1058.95s - 1063.35s | Please if just as soon as you have something new turn off your default configurations 1064.15s - 1066.15s | Change it as soon as possible 1067.63s - 1069.27s | 120,000 username stolen from rack F 1069.27s - 1075.99s | Rack F is like


chunk_text:
But you can find all the documents about this 1021.63s - 1023.63s | This 1023.63s - 1028.59s | This was initial access to be in the FTP network so unencrypted protocol, okay 1029.27s - 1034.23s | The hackers use something like Hercules, which is an emulator. I use an emulator in my testing 1034.23s - 1035.83s | I use x 3270 1035.83s - 1041.19s | But I tell you this to say it's not that hard to get some of these tools to start getting into the places that maybe 1041.19s - 1042.67s | You shouldn't be getting into 1042.67s - 1049.67s | this attack specifically leveraged some zero days, which may be a little more difficult to you know make happen, but 1050.51s - 1052.95s | They were based on default configurations 1053.51s - 1058.95s | Right, so this is something that is easy to fix and not have in your environment 1058.95s - 1063.35s | Please if just as soon as you have something new turn off your default configurations 1064.15s - 1066.15s | Change it as soon as possible 1067.63s - 1069.27s | 120,000 username stolen from rack F 1069.27s - 1075.99s | Rack F is like a security management tool in the mainframe environment and the guy you know what guy head guy who's in charge of it? 1075.99s - 1079.43s | He was in Cambodia at the time stole a bunch of money. It was it was very bad 1079.43s - 1082.51s | It was very bad and the entire government made all these new policies 1083.27s - 1085.55s | specifically because of this this breach 1086.71s - 1090.19s | Okay, so next up. I'm going to show you a demo. I'll give a little information on it 1090.95s - 1093.63s | What you'll see me doing. Hopefully you'll be able to see it is 1093.63s - 1101.35s | I'm authenticating to an L power to a logical partition right assume that the endpoints that I navigate to have already been enumerated 1101.95s - 1107.03s | Previously during the engagement, so I'm not gonna you don't see the enumeration part in this demo 1107.03s - 1110.15s | But you'll see me sort of navigate to some endpoints. That's why 1111.03s - 1117.27s | The user I am that you'll see is a lower level user. This is not an admin user, right? 1117.27s - 1120.99s


chunk_text:
a security management tool in the mainframe environment and the guy you know what guy head guy who's in charge of it? 1075.99s - 1079.43s | He was in Cambodia at the time stole a bunch of money. It was it was very bad 1079.43s - 1082.51s | It was very bad and the entire government made all these new policies 1083.27s - 1085.55s | specifically because of this this breach 1086.71s - 1090.19s | Okay, so next up. I'm going to show you a demo. I'll give a little information on it 1090.95s - 1093.63s | What you'll see me doing. Hopefully you'll be able to see it is 1093.63s - 1101.35s | I'm authenticating to an L power to a logical partition right assume that the endpoints that I navigate to have already been enumerated 1101.95s - 1107.03s | Previously during the engagement, so I'm not gonna you don't see the enumeration part in this demo 1107.03s - 1110.15s | But you'll see me sort of navigate to some endpoints. That's why 1111.03s - 1117.27s | The user I am that you'll see is a lower level user. This is not an admin user, right? 1117.27s - 1120.99s | So of course it means there are specific resources that should they should not be able to access 1121.55s - 1123.55s | Okay, so the goal of this 1124.19s - 1126.19s | Hack was to try to access 1127.15s - 1129.71s | of course more privileged information, so 1131.19s - 1133.87s | Okay, and we're up and running okay, so 1134.87s - 1137.19s | This is me logging in 1138.51s - 1140.51s | Got TSO here 1140.95s - 1142.19s | All right is PF 1142.19s - 1148.51s | And then now you're gonna see me begin to access a command-line utility which is a Unix like feature within the mainframe environment 1149.39s - 1150.95s | through OMVS 1150.95s - 1154.59s | All right 1154.59s - 1159.07s | So it's if it looks familiar to you a Unix base. You can just use your similar commands, right? 1159.11s - 1164.19s | So I'm gonna navigate to this opt secrets location. I'm gonna see what's in there 1167.10s - 1170.58s | List it out. We've got a readme.txt and an SSH key 1170.90s - 1174.94s | We're gonna cat the readme.txt file says this is the SSH private key 1174.94s -


chunk_text:
| So of course it means there are specific resources that should they should not be able to access 1121.55s - 1123.55s | Okay, so the goal of this 1124.19s - 1126.19s | Hack was to try to access 1127.15s - 1129.71s | of course more privileged information, so 1131.19s - 1133.87s | Okay, and we're up and running okay, so 1134.87s - 1137.19s | This is me logging in 1138.51s - 1140.51s | Got TSO here 1140.95s - 1142.19s | All right is PF 1142.19s - 1148.51s | And then now you're gonna see me begin to access a command-line utility which is a Unix like feature within the mainframe environment 1149.39s - 1150.95s | through OMVS 1150.95s - 1154.59s | All right 1154.59s - 1159.07s | So it's if it looks familiar to you a Unix base. You can just use your similar commands, right? 1159.11s - 1164.19s | So I'm gonna navigate to this opt secrets location. I'm gonna see what's in there 1167.10s - 1170.58s | List it out. We've got a readme.txt and an SSH key 1170.90s - 1174.94s | We're gonna cat the readme.txt file says this is the SSH private key 1174.94s - 1177.18s | You need to log on as an admin do not share well 1177.18s - 1180.30s | Can I just cat SSH key and just maybe access it anyway? 1180.78s - 1183.66s | No permission denied game over right wrong 1183.66s - 1189.90s | I used the same IP that the LPAR is on and just navigated it to it in the web browser over 8080, right? 1190.90s - 1196.18s | Again we already had the endpoints enumerated. Okay, so this specific location 1197.10s - 1200.22s | The requests that are generated pull information 1200.90s - 1202.90s | From the mainframe, right? 1203.02s - 1209.84s | So just open up the network tab and you can look at the requests that have made and maybe modify it and see what happens 1209.84s - 1210.78s | Okay 1210.78s - 1216.66s | So I'm generating the request it makes a post request that pulls information from the mainframe. All right, we're gonna crack that open 1217.54s - 1223.64s | You don't even need to use an intercepting tool for this you really can just use the network tab in your browser 1223.80s - 1225.52s | It's a little bit insane 1225.52s


chunk_text:
1177.18s | You need to log on as an admin do not share well 1177.18s - 1180.30s | Can I just cat SSH key and just maybe access it anyway? 1180.78s - 1183.66s | No permission denied game over right wrong 1183.66s - 1189.90s | I used the same IP that the LPAR is on and just navigated it to it in the web browser over 8080, right? 1190.90s - 1196.18s | Again we already had the endpoints enumerated. Okay, so this specific location 1197.10s - 1200.22s | The requests that are generated pull information 1200.90s - 1202.90s | From the mainframe, right? 1203.02s - 1209.84s | So just open up the network tab and you can look at the requests that have made and maybe modify it and see what happens 1209.84s - 1210.78s | Okay 1210.78s - 1216.66s | So I'm generating the request it makes a post request that pulls information from the mainframe. All right, we're gonna crack that open 1217.54s - 1223.64s | You don't even need to use an intercepting tool for this you really can just use the network tab in your browser 1223.80s - 1225.52s | It's a little bit insane 1225.52s - 1228.92s | So in the message body, there's a request for a specific file 1229.64s - 1236.16s | Modify that to point to what was disallowed earlier. Keep in mind. I have not authenticated. This is simply in the web browser 1237.04s - 1243.52s | Okay, got a 200. Okay, that sounds promising. There's the endpoint I went to with that SSH key 1244.28s - 1246.28s | Let's see what's in the response 1247.57s - 1249.57s | There it is 1250.53s - 1252.53s | I 1261.41s - 1265.97s | Will just say within the past year to be somewhat vague and it was not an SSH key 1265.97s - 1274.09s | But it was definitely some very very private information completely unauthenticated access not even on within the mainframe emulated environments 1274.13s - 1275.97s | Just over the browser 1275.97s - 1280.13s | So this is why I'm saying we need to look at the entire topology 1280.65s - 1286.97s | And make sure we're investigating the integrations with the mainframe because people say well mainframe is it's older. It's safe 1287.49s - 1293.05s | Yes, and no. All right. So we've talked about integration once what about the


chunk_text:
- 1228.92s | So in the message body, there's a request for a specific file 1229.64s - 1236.16s | Modify that to point to what was disallowed earlier. Keep in mind. I have not authenticated. This is simply in the web browser 1237.04s - 1243.52s | Okay, got a 200. Okay, that sounds promising. There's the endpoint I went to with that SSH key 1244.28s - 1246.28s | Let's see what's in the response 1247.57s - 1249.57s | There it is 1250.53s - 1252.53s | I 1261.41s - 1265.97s | Will just say within the past year to be somewhat vague and it was not an SSH key 1265.97s - 1274.09s | But it was definitely some very very private information completely unauthenticated access not even on within the mainframe emulated environments 1274.13s - 1275.97s | Just over the browser 1275.97s - 1280.13s | So this is why I'm saying we need to look at the entire topology 1280.65s - 1286.97s | And make sure we're investigating the integrations with the mainframe because people say well mainframe is it's older. It's safe 1287.49s - 1293.05s | Yes, and no. All right. So we've talked about integration once what about the mainframe itself? 1293.05s - 1298.37s | If you're just looking at the mainframe, we're gonna stay in this little box of the mainframe. Is it safe all by itself? 1299.25s - 1304.89s | These are things we find on a regular basis within our pen tests. Okay local file include 1305.97s - 1307.97s | We find insecure 1308.33s - 1309.41s | Insecure 1309.41s - 1312.93s | Protocols all the time. There's so much 23. It's yeah 1313.65s - 1316.73s | Unauthenticated access happens. So there been instances where I will 1317.53s - 1323.97s | Begin the authentication process and then back out of it not complete authenticating and I can still run kicks CICS commands 1324.37s - 1329.29s | Or you know run Kim's things like this, which you should you should be authenticated to run these 1329.85s - 1334.25s | So we do find this a lot injection sequel injection into DB to databases 1334.89s - 1339.17s | JCL job job control language injections or rec scripts injections if you're able to 1339.89s - 1343.01s | Use these when you're not supposed to you could delete modify 1343.89s - 1345.89s | erase entire data sets 1346.37s - 1350.65s |


chunk_text:
mainframe itself? 1293.05s - 1298.37s | If you're just looking at the mainframe, we're gonna stay in this little box of the mainframe. Is it safe all by itself? 1299.25s - 1304.89s | These are things we find on a regular basis within our pen tests. Okay local file include 1305.97s - 1307.97s | We find insecure 1308.33s - 1309.41s | Insecure 1309.41s - 1312.93s | Protocols all the time. There's so much 23. It's yeah 1313.65s - 1316.73s | Unauthenticated access happens. So there been instances where I will 1317.53s - 1323.97s | Begin the authentication process and then back out of it not complete authenticating and I can still run kicks CICS commands 1324.37s - 1329.29s | Or you know run Kim's things like this, which you should you should be authenticated to run these 1329.85s - 1334.25s | So we do find this a lot injection sequel injection into DB to databases 1334.89s - 1339.17s | JCL job job control language injections or rec scripts injections if you're able to 1339.89s - 1343.01s | Use these when you're not supposed to you could delete modify 1343.89s - 1345.89s | erase entire data sets 1346.37s - 1350.65s | Bad news. Okay, and then we do see security misconfigurations 1350.65s - 1358.37s | I I don't see a lot of default credentials thankfully, but it does occur weak password policies often. I will see 1359.21s - 1361.65s | They'll allow mixed case passwords 1361.65s - 1363.81s | So let's say you're supposed to have a cap 1363.81s - 1370.13s | but like your actual password is capital this and lowercase this and some numbers and whatever else you can switch the case around and do 1370.13s - 1372.13s | Whatever you want and we'll still accept it 1372.13s - 1373.89s | It's like don't do that 1373.89s - 1374.93s | and 1374.93s - 1382.97s | Not using external security management tools like raka for top secret. Thankfully most shops that have mainframe are implementing these things 1383.97s - 1389.09s | But it's just as a safeguard as a you know, just make sure that you're using these these things 1389.89s - 1393.05s | Okay, and then now the promised ways to secure 1393.85s - 1399.01s | From the blue team side properly configure your network topology as a whole. I can't stress that enough 1399.13s - 1403.21s | Please


chunk_text:
Bad news. Okay, and then we do see security misconfigurations 1350.65s - 1358.37s | I I don't see a lot of default credentials thankfully, but it does occur weak password policies often. I will see 1359.21s - 1361.65s | They'll allow mixed case passwords 1361.65s - 1363.81s | So let's say you're supposed to have a cap 1363.81s - 1370.13s | but like your actual password is capital this and lowercase this and some numbers and whatever else you can switch the case around and do 1370.13s - 1372.13s | Whatever you want and we'll still accept it 1372.13s - 1373.89s | It's like don't do that 1373.89s - 1374.93s | and 1374.93s - 1382.97s | Not using external security management tools like raka for top secret. Thankfully most shops that have mainframe are implementing these things 1383.97s - 1389.09s | But it's just as a safeguard as a you know, just make sure that you're using these these things 1389.89s - 1393.05s | Okay, and then now the promised ways to secure 1393.85s - 1399.01s | From the blue team side properly configure your network topology as a whole. I can't stress that enough 1399.13s - 1403.21s | Please mainframe is not its own weird thing off to the side 1403.21s - 1408.93s | It is part of your stack treated as such make appropriate use of your logical partitions 1408.93s - 1415.25s | Make sure if a user has access to L par one, they can't also somehow navigate to L part two and three and four 1416.77s - 1422.33s | Your regions your ESM tools and see this again disallow unencrypted protocols secure with compliance 1422.89s - 1425.45s | the CIS benchmarking is really great for 1426.17s - 1433.37s | Regular auditing purposes and then the DSA stigs. These are your Department of Defense guides from NIST. I've used these on a test 1433.45s - 1437.17s | I've actually it's really nice. So I had a DB to test where 1437.65s - 1439.65s | It's basically sequel based and 1440.09s - 1444.41s | They have whole lists of commands you can run to check. Okay. Well if I run this command 1444.41s - 1446.89s | Can I access this when I shouldn't if I run this command? 1446.89s - 1452.69s | Can I elevate my privileges and so on and like this is this is great. I


chunk_text:
mainframe is not its own weird thing off to the side 1403.21s - 1408.93s | It is part of your stack treated as such make appropriate use of your logical partitions 1408.93s - 1415.25s | Make sure if a user has access to L par one, they can't also somehow navigate to L part two and three and four 1416.77s - 1422.33s | Your regions your ESM tools and see this again disallow unencrypted protocols secure with compliance 1422.89s - 1425.45s | the CIS benchmarking is really great for 1426.17s - 1433.37s | Regular auditing purposes and then the DSA stigs. These are your Department of Defense guides from NIST. I've used these on a test 1433.45s - 1437.17s | I've actually it's really nice. So I had a DB to test where 1437.65s - 1439.65s | It's basically sequel based and 1440.09s - 1444.41s | They have whole lists of commands you can run to check. Okay. Well if I run this command 1444.41s - 1446.89s | Can I access this when I shouldn't if I run this command? 1446.89s - 1452.69s | Can I elevate my privileges and so on and like this is this is great. I love this very helpful helpful tools 1452.93s - 1459.77s | Secure the ongoing reviews. This is real basic stuff that everybody should be doing regardless of its mainframe or something else 1460.17s - 1463.33s | Audit your identity and access management on a regular basis, right? 1463.77s - 1468.25s | Establish recurring audits for all features and do recurring pen tests 1468.25s - 1472.81s | I love a good internal team literally like you're closer to your stack 1472.81s - 1478.29s | You're rolling out new features you sort of understand what's going on and you need to be there, right? 1478.89s - 1482.77s | But you know, I am biased again because I'm third-party pen tester 1482.77s - 1489.81s | Which is I think is incredibly important to get fresh eyes on your about five minutes. Okay. Thank you. I'm hurry up here 1491.05s - 1493.05s | fresh set of eyes 1494.01s - 1500.01s | Not having the source code being you know, somewhat unfamiliar with the environment and then getting in and just 1500.81s - 1505.83s | Gently breaking it so you can help the company fix it. I think is really really nice 1505.83s - 1511.01s |


chunk_text:
love this very helpful helpful tools 1452.93s - 1459.77s | Secure the ongoing reviews. This is real basic stuff that everybody should be doing regardless of its mainframe or something else 1460.17s - 1463.33s | Audit your identity and access management on a regular basis, right? 1463.77s - 1468.25s | Establish recurring audits for all features and do recurring pen tests 1468.25s - 1472.81s | I love a good internal team literally like you're closer to your stack 1472.81s - 1478.29s | You're rolling out new features you sort of understand what's going on and you need to be there, right? 1478.89s - 1482.77s | But you know, I am biased again because I'm third-party pen tester 1482.77s - 1489.81s | Which is I think is incredibly important to get fresh eyes on your about five minutes. Okay. Thank you. I'm hurry up here 1491.05s - 1493.05s | fresh set of eyes 1494.01s - 1500.01s | Not having the source code being you know, somewhat unfamiliar with the environment and then getting in and just 1500.81s - 1505.83s | Gently breaking it so you can help the company fix it. I think is really really nice 1505.83s - 1511.01s | It's a special place to be I love it. So again, what have we learned today? 1511.01s - 1513.29s | We're gonna cover it real quick and a few bullet points 1514.17s - 1518.01s | Mainframe is not going away anytime soon. Okay, please keep paying attention to it 1518.01s - 1525.11s | We like we rely on it globally to support finance health care government all these critical industries 1525.93s - 1531.85s | Okay, so we need to keep securing it. There are more possible vulnerabilities now due to the prevalence of integrations 1531.85s - 1533.53s | It's just gonna keep increasing 1533.53s - 1540.01s | But if we work together we can combat it. So thank you so much for coming to learn about mainframe


chunk_text:
It's a special place to be I love it. So again, what have we learned today? 1511.01s - 1513.29s | We're gonna cover it real quick and a few bullet points 1514.17s - 1518.01s | Mainframe is not going away anytime soon. Okay, please keep paying attention to it 1518.01s - 1525.11s | We like we rely on it globally to support finance health care government all these critical industries 1525.93s - 1531.85s | Okay, so we need to keep securing it. There are more possible vulnerabilities now due to the prevalence of integrations 1531.85s - 1533.53s | It's just gonna keep increasing 1533.53s - 1540.01s | But if we work together we can combat it. So thank you so much for coming to learn about mainframe


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=6SNy0u6pYOc", "title": "DEF CON 32 - The Darkest Side of Bug Bounty - Jason Haddix", "description": "Bug bounty is an intricate game between the bug hunter, the clients, and the intermediary.\n\nLike any game, it can be hacked. Like some games, it can be unfair.\n\nJoin Jason as he walks you through the darker secrets of bug bounty , tips and tricks to address them, and in some cases, commiserate that there are just bad realities to the game.\n\nJason will address the problems hardly talked about in the system, from a hacker, program owner, and platform runner.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1949, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 6.51s - 8.51s | This text was transcribed using whisper model: large-v2 Thank you, thank you so much. 8.51s - 10.51s | My name is Jason. 10.51s - 12.51s | I'm going to try to keep my energy up for this talk. 12.51s - 14.51s | I usually do when I speak, 14.51s - 16.51s | but I have a little bit of a 16.51s - 18.51s | situation going on right now at home. 18.51s - 20.51s | My wife's in the ER. 20.51s - 22.51s | My kids are watching, my other kids, 22.51s - 24.51s | and I've done four talks this week already. 24.51s - 26.51s | So I'm going to try to keep it up, but if I'm a little bit 26.51s - 28.51s | less than super, super 28.51s - 30.51s | Jason Haddix, I'm sorry. 30.51s - 32.51s | But I'm going to do my best. 32.51s - 34.51s | This talk I've wanted to do for a long time. 34.51s - 36.51s | It's called The Dark Side of Bug Bounty. 36.51s - 38.51s | And it is a collection 38.51s - 40.51s | of notes around 40.51s - 42.51s | the kind of worst possible 42.51s - 44.51s | scenarios that can happen in bug bounty programs. 44.51s - 46.51s | So we did a little survey 46.51s - 48.51s | originally about what you guys do, but 48.51s - 50.51s | there are 50.51s - 52.51s | four primary types of people, or three primary 52.51s - 54.51s | types of people in the 54.51s - 56.51s | equation of bug bounty. So there are 56.51s - 58.51s | bug bounty hunters, people who find 58.51s - 60.51s | vulnerabilities. How many


chunk_text:
my other kids, 22.51s - 24.51s | and I've done four talks this week already. 24.51s - 26.51s | So I'm going to try to keep it up, but if I'm a little bit 26.51s - 28.51s | less than super, super 28.51s - 30.51s | Jason Haddix, I'm sorry. 30.51s - 32.51s | But I'm going to do my best. 32.51s - 34.51s | This talk I've wanted to do for a long time. 34.51s - 36.51s | It's called The Dark Side of Bug Bounty. 36.51s - 38.51s | And it is a collection 38.51s - 40.51s | of notes around 40.51s - 42.51s | the kind of worst possible 42.51s - 44.51s | scenarios that can happen in bug bounty programs. 44.51s - 46.51s | So we did a little survey 46.51s - 48.51s | originally about what you guys do, but 48.51s - 50.51s | there are 50.51s - 52.51s | four primary types of people, or three primary 52.51s - 54.51s | types of people in the 54.51s - 56.51s | equation of bug bounty. So there are 56.51s - 58.51s | bug bounty hunters, people who find 58.51s - 60.51s | vulnerabilities. How many bug bounty hunters do we have 60.51s - 62.51s | in here? Okay, 62.51s - 64.51s | good amount. There are 64.51s - 66.51s | program owners, so they work 66.51s - 68.51s | at the company that runs the bug bounty program. 68.51s - 70.51s | Who are those people in the audience? 70.51s - 72.51s | You could be triage, you could be program management, 72.51s - 74.51s | you could be vulnerability management, stuff like 74.51s - 76.51s | that. And then you have people that work on 76.51s - 78.51s | the platform that do the triage, or any platform 78.51s - 80.51s | people in here, like Bug Crowd, SYNAC, 80.51s - 82.51s | HackerOne, Integrity, things like that. 82.51s - 84.51s | Do we have any of those people in here? 84.51s - 86.51s | You wouldn't want to raise your hand for this one. 86.51s - 88.51s | I'm just kidding. 88.51s - 90.51s | Okay, so why am I uniquely 90.51s - 92.51s | situated to give this talk? 92.51s - 94.51s | Because I've been 94.51s - 96.51s | on all sides of the equation. So 96.51s - 98.51s | I


chunk_text:
bug bounty hunters do we have 60.51s - 62.51s | in here? Okay, 62.51s - 64.51s | good amount. There are 64.51s - 66.51s | program owners, so they work 66.51s - 68.51s | at the company that runs the bug bounty program. 68.51s - 70.51s | Who are those people in the audience? 70.51s - 72.51s | You could be triage, you could be program management, 72.51s - 74.51s | you could be vulnerability management, stuff like 74.51s - 76.51s | that. And then you have people that work on 76.51s - 78.51s | the platform that do the triage, or any platform 78.51s - 80.51s | people in here, like Bug Crowd, SYNAC, 80.51s - 82.51s | HackerOne, Integrity, things like that. 82.51s - 84.51s | Do we have any of those people in here? 84.51s - 86.51s | You wouldn't want to raise your hand for this one. 86.51s - 88.51s | I'm just kidding. 88.51s - 90.51s | Okay, so why am I uniquely 90.51s - 92.51s | situated to give this talk? 92.51s - 94.51s | Because I've been 94.51s - 96.51s | on all sides of the equation. So 96.51s - 98.51s | I am ranked number 98.51s - 100.51s | 57th overall on Bug 100.51s - 102.51s | Crowd as a hacker. I have been 102.51s - 104.51s | hacking on Bug Crowd for a long, long time. 104.51s - 106.51s | Recently I've started to build up 106.51s - 108.51s | my rep on Integrity as well. I've 108.51s - 110.51s | done HackerOne live events, I've done 110.51s - 112.51s | Bug Crowd live events. I'm pretty much 112.51s - 114.51s | well versed in the hacker area 114.51s - 116.51s | of bug bounties. 116.51s - 118.51s | I have also been on 118.51s - 120.51s | the platform side. I worked at 120.51s - 122.51s | Bug Crowd for six years. 122.51s - 124.51s | Four of them as 124.51s - 126.51s | the head of operations, 126.51s - 128.51s | meaning I managed the triage team globally. 128.51s - 130.51s | So that means I got to see 130.51s - 132.51s | every bug bounty program that they ran. 132.51s - 134.51s | Through my tenure I saw 134.51s - 136.51s | tens of thousands of bugs filter 136.51s - 138.51s | through the queue at Bug Crowd


chunk_text:
am ranked number 98.51s - 100.51s | 57th overall on Bug 100.51s - 102.51s | Crowd as a hacker. I have been 102.51s - 104.51s | hacking on Bug Crowd for a long, long time. 104.51s - 106.51s | Recently I've started to build up 106.51s - 108.51s | my rep on Integrity as well. I've 108.51s - 110.51s | done HackerOne live events, I've done 110.51s - 112.51s | Bug Crowd live events. I'm pretty much 112.51s - 114.51s | well versed in the hacker area 114.51s - 116.51s | of bug bounties. 116.51s - 118.51s | I have also been on 118.51s - 120.51s | the platform side. I worked at 120.51s - 122.51s | Bug Crowd for six years. 122.51s - 124.51s | Four of them as 124.51s - 126.51s | the head of operations, 126.51s - 128.51s | meaning I managed the triage team globally. 128.51s - 130.51s | So that means I got to see 130.51s - 132.51s | every bug bounty program that they ran. 132.51s - 134.51s | Through my tenure I saw 134.51s - 136.51s | tens of thousands of bugs filter 136.51s - 138.51s | through the queue at Bug Crowd and managed 138.51s - 140.51s | my teams to triage them. 140.51s - 142.51s | I've 142.51s - 144.51s | also known triagers that have gone 144.51s - 146.51s | to other platforms and stay in touch with them. 146.51s - 148.51s | Some of this stuff is not my direct experience, 148.51s - 150.51s | it's notes from other people on other platforms. 150.51s - 152.51s | I don't mention any platforms in this. 152.51s - 154.51s | I think that all the platforms have 154.51s - 156.51s | a lot of the same problems that I'm going 156.51s - 158.51s | to talk about in these slides. 158.51s - 160.51s | And then I've also been a program owner. 160.51s - 162.51s | I've run a multinational company 162.51s - 164.51s | as a CISO and so I had to purchase 164.51s - 166.51s | Bug Bounty as a part of 166.51s - 168.51s | a security program, as part of a vulnerability management 168.51s - 170.51s | program and assessment program. 170.51s - 172.51s | So we had to build a scope 172.51s - 174.51s | and deal with running 174.51s - 176.51s | a program just


chunk_text:
and managed 138.51s - 140.51s | my teams to triage them. 140.51s - 142.51s | I've 142.51s - 144.51s | also known triagers that have gone 144.51s - 146.51s | to other platforms and stay in touch with them. 146.51s - 148.51s | Some of this stuff is not my direct experience, 148.51s - 150.51s | it's notes from other people on other platforms. 150.51s - 152.51s | I don't mention any platforms in this. 152.51s - 154.51s | I think that all the platforms have 154.51s - 156.51s | a lot of the same problems that I'm going 156.51s - 158.51s | to talk about in these slides. 158.51s - 160.51s | And then I've also been a program owner. 160.51s - 162.51s | I've run a multinational company 162.51s - 164.51s | as a CISO and so I had to purchase 164.51s - 166.51s | Bug Bounty as a part of 166.51s - 168.51s | a security program, as part of a vulnerability management 168.51s - 170.51s | program and assessment program. 170.51s - 172.51s | So we had to build a scope 172.51s - 174.51s | and deal with running 174.51s - 176.51s | a program just like everybody else does. 176.51s - 178.51s | So I've got to see this 178.51s - 180.51s | ecosystem grow from its 180.51s - 182.51s | infancy to its adulthood 182.51s - 184.51s | and got to see every skeleton in the 184.51s - 186.51s | closet basically. So we're going to talk about some of the 186.51s - 188.51s | notes I have. They're a little bit scattered but 188.51s - 190.51s | hopefully they're fun to talk about. 190.51s - 192.51s | The first thing we're going to talk about 192.51s - 194.51s | is some of the really crappy things 194.51s - 196.51s | that are going on right now in the 196.51s - 198.51s | bug bounty industry in general. 198.51s - 200.51s | And this is kind of 200.51s - 202.51s | goes back to a thing that me and my friend 202.51s - 204.51s | talk about is that 204.51s - 206.51s | a lot of people have pivoted from 206.51s - 208.51s | celebrating the creativity 208.51s - 210.51s | of the bug bounty hunters who are 210.51s - 212.51s | submitting really cool vulnerabilities 212.51s - 214.51s | and scaling your security


chunk_text:
like everybody else does. 176.51s - 178.51s | So I've got to see this 178.51s - 180.51s | ecosystem grow from its 180.51s - 182.51s | infancy to its adulthood 182.51s - 184.51s | and got to see every skeleton in the 184.51s - 186.51s | closet basically. So we're going to talk about some of the 186.51s - 188.51s | notes I have. They're a little bit scattered but 188.51s - 190.51s | hopefully they're fun to talk about. 190.51s - 192.51s | The first thing we're going to talk about 192.51s - 194.51s | is some of the really crappy things 194.51s - 196.51s | that are going on right now in the 196.51s - 198.51s | bug bounty industry in general. 198.51s - 200.51s | And this is kind of 200.51s - 202.51s | goes back to a thing that me and my friend 202.51s - 204.51s | talk about is that 204.51s - 206.51s | a lot of people have pivoted from 206.51s - 208.51s | celebrating the creativity 208.51s - 210.51s | of the bug bounty hunters who are 210.51s - 212.51s | submitting really cool vulnerabilities 212.51s - 214.51s | and scaling your security program in a way 214.51s - 216.51s | that you really couldn't do before. 216.51s - 218.51s | You had to really consult with pen testers and stuff like that 218.51s - 220.51s | before. Now they're starting to 220.51s - 222.51s | exploit them a little bit. And so we're going to talk about 222.51s - 224.51s | two things that I think are kind of shitty 224.51s - 226.51s | in that way. You guys don't mind if I drop 226.51s - 228.51s | a curse word every once in a while, right? 228.51s - 230.51s | Alright. 230.51s - 232.51s | The first thing I'm going to talk about is AI. 232.51s - 234.51s | So right now at all of the platforms 234.51s - 236.51s | what they're doing is 236.51s - 238.51s | they're taking bug bounty hunters 238.51s - 240.51s | attack traffic and they're training 240.51s - 242.51s | AI models on this attack traffic. 242.51s - 244.51s | And what they're doing is they're building services out of it. 244.51s - 246.51s | They're building threat intel feeds for 246.51s - 248.51s | program owners to understand 248.51s - 250.51s | what


chunk_text:
program in a way 214.51s - 216.51s | that you really couldn't do before. 216.51s - 218.51s | You had to really consult with pen testers and stuff like that 218.51s - 220.51s | before. Now they're starting to 220.51s - 222.51s | exploit them a little bit. And so we're going to talk about 222.51s - 224.51s | two things that I think are kind of shitty 224.51s - 226.51s | in that way. You guys don't mind if I drop 226.51s - 228.51s | a curse word every once in a while, right? 228.51s - 230.51s | Alright. 230.51s - 232.51s | The first thing I'm going to talk about is AI. 232.51s - 234.51s | So right now at all of the platforms 234.51s - 236.51s | what they're doing is 236.51s - 238.51s | they're taking bug bounty hunters 238.51s - 240.51s | attack traffic and they're training 240.51s - 242.51s | AI models on this attack traffic. 242.51s - 244.51s | And what they're doing is they're building services out of it. 244.51s - 246.51s | They're building threat intel feeds for 246.51s - 248.51s | program owners to understand 248.51s - 250.51s | what type of attacks exist 250.51s - 252.51s | in hardware hacking, web hacking, all kinds 252.51s - 254.51s | of different hackings. And 254.51s - 256.51s | then they're also building vulnerability scanners 256.51s - 258.51s | out of training off of these models 258.51s - 260.51s | on this attack traffic. 260.51s - 262.51s | And what's happening is that they're basically stealing 262.51s - 264.51s | attack data and research data from 264.51s - 266.51s | researchers and they give no payments to 266.51s - 268.51s | the bug hunters for this. 268.51s - 270.51s | We get nothing for it basically. 270.51s - 272.51s | So for instance 272.51s - 274.51s | I find a zero day tomorrow 274.51s - 276.51s | on SAP 276.51s - 278.51s | or something like that. And I submit it to a bug bounty 278.51s - 280.51s | platform. They will automatically train on it 280.51s - 282.51s | with the attack string I used. And then 282.51s - 284.51s | they'll either turn it into a threat feed or a scanner 284.51s - 286.51s | give the benefit to all of their 286.51s - 288.51s | customers but never give


chunk_text:
type of attacks exist 250.51s - 252.51s | in hardware hacking, web hacking, all kinds 252.51s - 254.51s | of different hackings. And 254.51s - 256.51s | then they're also building vulnerability scanners 256.51s - 258.51s | out of training off of these models 258.51s - 260.51s | on this attack traffic. 260.51s - 262.51s | And what's happening is that they're basically stealing 262.51s - 264.51s | attack data and research data from 264.51s - 266.51s | researchers and they give no payments to 266.51s - 268.51s | the bug hunters for this. 268.51s - 270.51s | We get nothing for it basically. 270.51s - 272.51s | So for instance 272.51s - 274.51s | I find a zero day tomorrow 274.51s - 276.51s | on SAP 276.51s - 278.51s | or something like that. And I submit it to a bug bounty 278.51s - 280.51s | platform. They will automatically train on it 280.51s - 282.51s | with the attack string I used. And then 282.51s - 284.51s | they'll either turn it into a threat feed or a scanner 284.51s - 286.51s | give the benefit to all of their 286.51s - 288.51s | customers but never give me any 288.51s - 290.51s | kickback on that vulnerability. So I only get 290.51s - 292.51s | paid once and maybe they found hundreds of 292.51s - 294.51s | thousands of instances of that vulnerability. 294.51s - 296.51s | So this is a really shitty part of the 296.51s - 298.51s | industry and I'm hoping that this changes. 298.51s - 300.51s | I'm hoping that we can move towards a model 300.51s - 302.51s | where 302.51s - 304.51s | if that happened and I didn't have 304.51s - 306.51s | access to a program where 306.51s - 308.51s | I couldn't submit that SAP vulnerability 308.51s - 310.51s | that they would automatically be able to tell 310.51s - 312.51s | me and say hey we did locate 312.51s - 314.51s | this on 35 other customers 314.51s - 316.51s | here's a 20% kickback 316.51s - 318.51s | because it was your vulnerability research. 318.51s - 320.51s | So this is how I'm hoping this changes 320.51s - 322.51s | but right now there's no indication that that's going to happen 322.51s - 324.51s | and they will continue stealing 324.51s - 329.07s | from bug


chunk_text:
me any 288.51s - 290.51s | kickback on that vulnerability. So I only get 290.51s - 292.51s | paid once and maybe they found hundreds of 292.51s - 294.51s | thousands of instances of that vulnerability. 294.51s - 296.51s | So this is a really shitty part of the 296.51s - 298.51s | industry and I'm hoping that this changes. 298.51s - 300.51s | I'm hoping that we can move towards a model 300.51s - 302.51s | where 302.51s - 304.51s | if that happened and I didn't have 304.51s - 306.51s | access to a program where 306.51s - 308.51s | I couldn't submit that SAP vulnerability 308.51s - 310.51s | that they would automatically be able to tell 310.51s - 312.51s | me and say hey we did locate 312.51s - 314.51s | this on 35 other customers 314.51s - 316.51s | here's a 20% kickback 316.51s - 318.51s | because it was your vulnerability research. 318.51s - 320.51s | So this is how I'm hoping this changes 320.51s - 322.51s | but right now there's no indication that that's going to happen 322.51s - 324.51s | and they will continue stealing 324.51s - 329.07s | from bug hunters. 329.07s - 331.07s | Another one is cloud 331.07s - 333.07s | WAFs. So 333.07s - 335.07s | in the industry obviously you have 335.07s - 337.07s | companies that are cloud based 337.07s - 339.07s | web application firewalls or cloud based 339.07s - 341.07s | protection suites. These 341.07s - 343.07s | products are ubiquitous to 343.07s - 345.07s | every application these days and 345.07s - 347.07s | all of your internet connected infrastructure. 347.07s - 349.07s | These are things like Akamai and CloudFlare 349.07s - 351.07s | and 351.07s - 353.07s | some of the other firewall vendors have these type of things. 353.07s - 355.07s | So 355.07s - 357.07s | a couple weeks ago 357.07s - 359.07s | a friend of mine was streaming 359.07s - 361.07s | and he's streaming on Twitch 361.07s - 363.07s | and he's streaming hacking stuff 363.07s - 365.07s | and we're talking 365.07s - 367.07s | in Twitch chat because we all like to support 367.07s - 369.07s | each other and he's like a content creator slash 369.07s - 371.07s | streamer and we get to talking 371.07s - 373.07s | and we're talking


chunk_text:
hunters. 329.07s - 331.07s | Another one is cloud 331.07s - 333.07s | WAFs. So 333.07s - 335.07s | in the industry obviously you have 335.07s - 337.07s | companies that are cloud based 337.07s - 339.07s | web application firewalls or cloud based 339.07s - 341.07s | protection suites. These 341.07s - 343.07s | products are ubiquitous to 343.07s - 345.07s | every application these days and 345.07s - 347.07s | all of your internet connected infrastructure. 347.07s - 349.07s | These are things like Akamai and CloudFlare 349.07s - 351.07s | and 351.07s - 353.07s | some of the other firewall vendors have these type of things. 353.07s - 355.07s | So 355.07s - 357.07s | a couple weeks ago 357.07s - 359.07s | a friend of mine was streaming 359.07s - 361.07s | and he's streaming on Twitch 361.07s - 363.07s | and he's streaming hacking stuff 363.07s - 365.07s | and we're talking 365.07s - 367.07s | in Twitch chat because we all like to support 367.07s - 369.07s | each other and he's like a content creator slash 369.07s - 371.07s | streamer and we get to talking 371.07s - 373.07s | and we're talking about a 373.07s - 375.07s | new AI tool that we're going to build 375.07s - 377.07s | and live in chat a representative 377.07s - 379.07s | from one of these 379.07s - 381.07s | companies basically says 381.07s - 383.07s | oh that's really cool I'm going to build a defense against 383.07s - 385.07s | that and take it. So then 385.07s - 387.07s | we end up talking to a whole bunch of 387.07s - 389.07s | researchers around 389.07s - 391.07s | kind of around the scene 391.07s - 393.07s | and we compare some notes 393.07s - 395.07s | and some conversations we've had 395.07s - 397.07s | and it turns out that there's 397.07s - 399.07s | a lot of kind of nefarious 399.07s - 401.07s | stuff going on. So 401.07s - 403.07s | if you're a bug bounty hunter and you submit 403.07s - 405.07s | attack traffic sometimes 405.07s - 407.07s | the platforms ask you to put a web header in there 407.07s - 409.07s | so they can recognize it's you. 409.07s - 411.07s | Now anybody between your home 411.07s - 413.07s | machine and the client


chunk_text:
about a 373.07s - 375.07s | new AI tool that we're going to build 375.07s - 377.07s | and live in chat a representative 377.07s - 379.07s | from one of these 379.07s - 381.07s | companies basically says 381.07s - 383.07s | oh that's really cool I'm going to build a defense against 383.07s - 385.07s | that and take it. So then 385.07s - 387.07s | we end up talking to a whole bunch of 387.07s - 389.07s | researchers around 389.07s - 391.07s | kind of around the scene 391.07s - 393.07s | and we compare some notes 393.07s - 395.07s | and some conversations we've had 395.07s - 397.07s | and it turns out that there's 397.07s - 399.07s | a lot of kind of nefarious 399.07s - 401.07s | stuff going on. So 401.07s - 403.07s | if you're a bug bounty hunter and you submit 403.07s - 405.07s | attack traffic sometimes 405.07s - 407.07s | the platforms ask you to put a web header in there 407.07s - 409.07s | so they can recognize it's you. 409.07s - 411.07s | Now anybody between your home 411.07s - 413.07s | machine and the client you're attacking 413.07s - 415.07s | and the bug bounty hunting 415.07s - 417.07s | company when you submit the report 417.07s - 419.07s | can identify you by that header. It's a unique 419.07s - 421.07s | header. It's usually 421.07s - 423.07s | like hacker one something or whatever 423.07s - 425.07s | you know. Now we didn't 425.07s - 427.07s | know until very recently is that 427.07s - 429.07s | Akamai, CloudFlare 429.07s - 431.07s | is like this. Do any of you work for Akamai or CloudFlare? 433.07s - 435.07s | They're monitoring 435.07s - 437.07s | about a list of 437.07s - 439.07s | 250 of the best bug bounty hunters 439.07s - 441.07s | in the world. They're monitoring 441.07s - 443.07s | our traffic, our attack patterns, what we're 443.07s - 445.07s | doing and they're trying to build just in time 445.07s - 447.07s | protections for the type of attacks we're doing 447.07s - 449.07s | and sell it as part of their rule set 449.07s - 451.07s | without giving us any credit. 451.07s - 453.07s | They're also 453.07s - 455.07s | sending representatives to watch our streams


chunk_text:
you're attacking 413.07s - 415.07s | and the bug bounty hunting 415.07s - 417.07s | company when you submit the report 417.07s - 419.07s | can identify you by that header. It's a unique 419.07s - 421.07s | header. It's usually 421.07s - 423.07s | like hacker one something or whatever 423.07s - 425.07s | you know. Now we didn't 425.07s - 427.07s | know until very recently is that 427.07s - 429.07s | Akamai, CloudFlare 429.07s - 431.07s | is like this. Do any of you work for Akamai or CloudFlare? 433.07s - 435.07s | They're monitoring 435.07s - 437.07s | about a list of 437.07s - 439.07s | 250 of the best bug bounty hunters 439.07s - 441.07s | in the world. They're monitoring 441.07s - 443.07s | our traffic, our attack patterns, what we're 443.07s - 445.07s | doing and they're trying to build just in time 445.07s - 447.07s | protections for the type of attacks we're doing 447.07s - 449.07s | and sell it as part of their rule set 449.07s - 451.07s | without giving us any credit. 451.07s - 453.07s | They're also 453.07s - 455.07s | sending representatives to watch our streams 455.07s - 457.07s | monitor our 457.07s - 459.07s | GitHub commits, go to our talks 459.07s - 461.07s | that's why I asked if anybody was in here 461.07s - 463.07s | and monitor our chats 463.07s - 465.07s | on the 465.07s - 467.07s | open bug bounty discords and slacks. 467.07s - 469.07s | Then they 469.07s - 471.07s | take this data and they share it with each other 471.07s - 473.07s | so they have agreements 473.07s - 475.07s | with each other to share attack data so that they can 475.07s - 477.07s | do analytics on it. And in some of the 477.07s - 479.07s | worst cases we've had, bug bounty 479.07s - 481.07s | hunters have released tools 481.07s - 483.07s | that were really, really good tools in the offensive 483.07s - 485.07s | security space and these 485.07s - 487.07s | vendors have gone out and strong armed 487.07s - 489.07s | young impressionable researchers and 489.07s - 491.07s | forced them to take these tools offline 491.07s - 493.07s | or at least pressured them to do so. 493.07s - 495.07s | So this is the kind of


chunk_text:
455.07s - 457.07s | monitor our 457.07s - 459.07s | GitHub commits, go to our talks 459.07s - 461.07s | that's why I asked if anybody was in here 461.07s - 463.07s | and monitor our chats 463.07s - 465.07s | on the 465.07s - 467.07s | open bug bounty discords and slacks. 467.07s - 469.07s | Then they 469.07s - 471.07s | take this data and they share it with each other 471.07s - 473.07s | so they have agreements 473.07s - 475.07s | with each other to share attack data so that they can 475.07s - 477.07s | do analytics on it. And in some of the 477.07s - 479.07s | worst cases we've had, bug bounty 479.07s - 481.07s | hunters have released tools 481.07s - 483.07s | that were really, really good tools in the offensive 483.07s - 485.07s | security space and these 485.07s - 487.07s | vendors have gone out and strong armed 487.07s - 489.07s | young impressionable researchers and 489.07s - 491.07s | forced them to take these tools offline 491.07s - 493.07s | or at least pressured them to do so. 493.07s - 495.07s | So this is the kind of stuff we deal 495.07s - 497.07s | with. Now the solutions here 497.07s - 499.07s | are just better 499.07s - 501.07s | communication and a technical 501.07s - 503.07s | solution to bug bounty hunting. 503.07s - 505.07s | I'm a big believer that 505.07s - 507.07s | that's top 250 507.07s - 509.07s | people that they feel like they need to monitor 509.07s - 511.07s | for that kind of stuff. 511.07s - 513.07s | First of all, they just get in our way. They're 513.07s - 515.07s | free by obscurity. It doesn't take 515.07s - 517.07s | me long to bypass one of those cloud 517.07s - 519.07s | based wafts. It's just kind of an annoyance. 519.07s - 521.07s | But I don't feel good about 521.07s - 523.07s | the data sharing between companies. 523.07s - 525.07s | And so if they want to just 525.07s - 527.07s | put some research time rather 527.07s - 529.07s | into doing all this against us and just 529.07s - 531.07s | make a global header that allows 531.07s - 533.07s | a background checked bug bounty 533.07s - 535.07s | researcher who is well


chunk_text:
stuff we deal 495.07s - 497.07s | with. Now the solutions here 497.07s - 499.07s | are just better 499.07s - 501.07s | communication and a technical 501.07s - 503.07s | solution to bug bounty hunting. 503.07s - 505.07s | I'm a big believer that 505.07s - 507.07s | that's top 250 507.07s - 509.07s | people that they feel like they need to monitor 509.07s - 511.07s | for that kind of stuff. 511.07s - 513.07s | First of all, they just get in our way. They're 513.07s - 515.07s | free by obscurity. It doesn't take 515.07s - 517.07s | me long to bypass one of those cloud 517.07s - 519.07s | based wafts. It's just kind of an annoyance. 519.07s - 521.07s | But I don't feel good about 521.07s - 523.07s | the data sharing between companies. 523.07s - 525.07s | And so if they want to just 525.07s - 527.07s | put some research time rather 527.07s - 529.07s | into doing all this against us and just 529.07s - 531.07s | make a global header that allows 531.07s - 533.07s | a background checked bug bounty 533.07s - 535.07s | researcher who is well known in the community 535.07s - 537.07s | to bypass all this stuff 537.07s - 539.07s | and they don't have to monitor and I'll just work with them. 539.07s - 541.07s | I'd much rather have a community that worked like that 541.07s - 543.07s | than one that works like this. 543.07s - 547.86s | Okay. Let's talk about 547.86s - 549.86s | triage in bug bounty. 549.86s - 554.86s | Okay. So if you've ever run a bug bounty 554.86s - 556.86s | how budget works 556.86s - 558.86s | in a bug bounty is and how you purchase 558.86s - 560.86s | a bug bounty is usually you go into 560.86s - 562.86s | the bug bounty platform and you're like, hey, I want 562.86s - 564.86s | to negotiate. I want to buy bug bounty. 564.86s - 566.86s | And what you're buying when you buy bug bounty 566.86s - 568.86s | is you're buying the platform 568.86s - 570.86s | to ingest the bugs usually. 570.86s - 572.86s | And then you're buying maybe triage 572.86s - 574.86s | associated to that. You're getting triage 574.86s - 576.86s | from the platform. 576.86s -


chunk_text:
known in the community 535.07s - 537.07s | to bypass all this stuff 537.07s - 539.07s | and they don't have to monitor and I'll just work with them. 539.07s - 541.07s | I'd much rather have a community that worked like that 541.07s - 543.07s | than one that works like this. 543.07s - 547.86s | Okay. Let's talk about 547.86s - 549.86s | triage in bug bounty. 549.86s - 554.86s | Okay. So if you've ever run a bug bounty 554.86s - 556.86s | how budget works 556.86s - 558.86s | in a bug bounty is and how you purchase 558.86s - 560.86s | a bug bounty is usually you go into 560.86s - 562.86s | the bug bounty platform and you're like, hey, I want 562.86s - 564.86s | to negotiate. I want to buy bug bounty. 564.86s - 566.86s | And what you're buying when you buy bug bounty 566.86s - 568.86s | is you're buying the platform 568.86s - 570.86s | to ingest the bugs usually. 570.86s - 572.86s | And then you're buying maybe triage 572.86s - 574.86s | associated to that. You're getting triage 574.86s - 576.86s | from the platform. 576.86s - 578.86s | And then you're also paying 578.86s - 580.86s | your reward pool 580.86s - 582.86s | in the initial payment. 582.86s - 584.86s | And so it's usually structured as a one year deal 584.86s - 586.86s | or a three year deal. 586.86s - 588.86s | You get a price break if you go 588.86s - 590.86s | for a three year deal with the platforms. 590.86s - 592.86s | Now the reason that 592.86s - 594.86s | you pay for all of these things 594.86s - 596.86s | in one lump sum is 596.86s - 598.86s | usually because you're trying to skirt your 598.86s - 600.86s | finance group at your company. 600.86s - 602.86s | So it's a 602.86s - 604.86s | financial 604.86s - 606.86s | trap to 606.86s - 608.86s | pay bug bounty hunters out 608.86s - 610.86s | from your company. It requires a whole 610.86s - 612.86s | bunch of tax paperwork for each bug 612.86s - 614.86s | that you pay out individually. This is why 614.86s - 616.86s | people use the platforms a lot. 616.86s - 618.86s | So what you 618.86s - 620.86s | do


chunk_text:
578.86s | And then you're also paying 578.86s - 580.86s | your reward pool 580.86s - 582.86s | in the initial payment. 582.86s - 584.86s | And so it's usually structured as a one year deal 584.86s - 586.86s | or a three year deal. 586.86s - 588.86s | You get a price break if you go 588.86s - 590.86s | for a three year deal with the platforms. 590.86s - 592.86s | Now the reason that 592.86s - 594.86s | you pay for all of these things 594.86s - 596.86s | in one lump sum is 596.86s - 598.86s | usually because you're trying to skirt your 598.86s - 600.86s | finance group at your company. 600.86s - 602.86s | So it's a 602.86s - 604.86s | financial 604.86s - 606.86s | trap to 606.86s - 608.86s | pay bug bounty hunters out 608.86s - 610.86s | from your company. It requires a whole 610.86s - 612.86s | bunch of tax paperwork for each bug 612.86s - 614.86s | that you pay out individually. This is why 614.86s - 616.86s | people use the platforms a lot. 616.86s - 618.86s | So what you 618.86s - 620.86s | do is you pay for the platform, you pay for the triage 620.86s - 622.86s | and then you pay for your first 622.86s - 624.86s | year of bug bounty rewards all as 624.86s - 626.86s | one lump sum to the platform. 626.86s - 628.86s | And then they hold an escrow 628.86s - 630.86s | the money for the payouts to the hackers. 630.86s - 632.86s | And so that's called the reward pool. 632.86s - 634.86s | And 634.86s - 636.86s | that way it's just one lump 636.86s - 638.86s | sum that your finance team sees and 638.86s - 640.86s | you don't have to do the taxes. BugCrowd has 640.86s - 642.86s | to do the taxes or HackerOne has to do 642.86s - 644.86s | the taxes for each bug 644.86s - 646.86s | payout which is a tremendous 646.86s - 648.86s | benefit to your financial teams. 648.86s - 650.86s | And so that's kind of how budgeting 650.86s - 652.86s | works and how payment works for a program. 652.86s - 656.27s | Now 656.27s - 658.27s | a very common situation 658.27s - 660.27s | in the worst part of


chunk_text:
is you pay for the platform, you pay for the triage 620.86s - 622.86s | and then you pay for your first 622.86s - 624.86s | year of bug bounty rewards all as 624.86s - 626.86s | one lump sum to the platform. 626.86s - 628.86s | And then they hold an escrow 628.86s - 630.86s | the money for the payouts to the hackers. 630.86s - 632.86s | And so that's called the reward pool. 632.86s - 634.86s | And 634.86s - 636.86s | that way it's just one lump 636.86s - 638.86s | sum that your finance team sees and 638.86s - 640.86s | you don't have to do the taxes. BugCrowd has 640.86s - 642.86s | to do the taxes or HackerOne has to do 642.86s - 644.86s | the taxes for each bug 644.86s - 646.86s | payout which is a tremendous 646.86s - 648.86s | benefit to your financial teams. 648.86s - 650.86s | And so that's kind of how budgeting 650.86s - 652.86s | works and how payment works for a program. 652.86s - 656.27s | Now 656.27s - 658.27s | a very common situation 658.27s - 660.27s | in the worst part of bug bounty 660.27s - 662.27s | is that you start a bug 662.27s - 664.27s | bounty and you haven't had enough security testing 664.27s - 666.27s | yet or you just didn't 666.27s - 668.27s | know that you had a whole bunch of assets out there 668.27s - 670.27s | or you just mis 670.27s - 672.27s | kind of judged 672.27s - 674.27s | how bad you were going to get crushed 674.27s - 676.27s | by the bug bounty hunters. 676.27s - 678.27s | And this happens so often. 678.27s - 680.27s | So you open a public program 680.27s - 682.27s | and you get hundreds 682.27s - 684.27s | of submissions 684.27s - 686.27s | like hundreds, like 800 to 686.27s - 688.27s | maybe even 1,200. I've seen programs 688.27s - 690.27s | I've saw a program once get 690.27s - 692.27s | 8,000 submissions in a week 692.27s - 694.27s | from the bug bounty hunter community. 694.27s - 696.27s | Now obviously your triagers at the 696.27s - 698.27s | platform are there to lessen that 698.27s - 700.27s | load but it's still a lot of load 700.27s - 702.27s


chunk_text:
bug bounty 660.27s - 662.27s | is that you start a bug 662.27s - 664.27s | bounty and you haven't had enough security testing 664.27s - 666.27s | yet or you just didn't 666.27s - 668.27s | know that you had a whole bunch of assets out there 668.27s - 670.27s | or you just mis 670.27s - 672.27s | kind of judged 672.27s - 674.27s | how bad you were going to get crushed 674.27s - 676.27s | by the bug bounty hunters. 676.27s - 678.27s | And this happens so often. 678.27s - 680.27s | So you open a public program 680.27s - 682.27s | and you get hundreds 682.27s - 684.27s | of submissions 684.27s - 686.27s | like hundreds, like 800 to 686.27s - 688.27s | maybe even 1,200. I've seen programs 688.27s - 690.27s | I've saw a program once get 690.27s - 692.27s | 8,000 submissions in a week 692.27s - 694.27s | from the bug bounty hunter community. 694.27s - 696.27s | Now obviously your triagers at the 696.27s - 698.27s | platform are there to lessen that 698.27s - 700.27s | load but it's still a lot of load 700.27s - 702.27s | on your team and 702.27s - 704.27s | you've made a contract and 704.27s - 706.27s | you've opened a program and all these bugs come 706.27s - 708.27s | rushing in at once immediately 708.27s - 710.27s | your scope or 710.27s - 712.27s | immediately your budget, it gets exhausted 712.27s - 714.27s | like it's gone within a day 714.27s - 716.27s | like a lot of people grossly underestimate 716.27s - 718.27s | how much it's going to take to run 718.27s - 720.27s | a public bug bounty. A lot of people 720.27s - 722.27s | go in thinking I'm going to spend 722.27s - 724.27s | the first year maybe 80k 724.27s - 726.27s | on bug bounty payouts. 726.27s - 728.27s | The reality is if you have a large scale program 728.27s - 730.27s | you're going to spend somewhere between 730.27s - 732.27s | 300 to 500k. 732.27s - 734.27s | If you keep it open and you don't 734.27s - 736.27s | pause it and you don't do some of the shitty things I'm about 736.27s - 738.27s | to tell you that some people do. 738.27s - 740.27s


chunk_text:
| on your team and 702.27s - 704.27s | you've made a contract and 704.27s - 706.27s | you've opened a program and all these bugs come 706.27s - 708.27s | rushing in at once immediately 708.27s - 710.27s | your scope or 710.27s - 712.27s | immediately your budget, it gets exhausted 712.27s - 714.27s | like it's gone within a day 714.27s - 716.27s | like a lot of people grossly underestimate 716.27s - 718.27s | how much it's going to take to run 718.27s - 720.27s | a public bug bounty. A lot of people 720.27s - 722.27s | go in thinking I'm going to spend 722.27s - 724.27s | the first year maybe 80k 724.27s - 726.27s | on bug bounty payouts. 726.27s - 728.27s | The reality is if you have a large scale program 728.27s - 730.27s | you're going to spend somewhere between 730.27s - 732.27s | 300 to 500k. 732.27s - 734.27s | If you keep it open and you don't 734.27s - 736.27s | pause it and you don't do some of the shitty things I'm about 736.27s - 738.27s | to tell you that some people do. 738.27s - 740.27s | So what happens 740.27s - 742.27s | in this situation with the worst customers 742.27s - 744.27s | is they get 744.27s - 746.27s | really scared about the bug bounty and 746.27s - 748.27s | their budget getting exhausted 748.27s - 750.27s | and they get really conservative with payouts. 750.27s - 752.27s | And so what they do 752.27s - 754.27s | is they take the contextual 754.27s - 756.27s | ratings of CVSS 756.27s - 758.27s | which most of the platforms use 758.27s - 760.27s | to rate the impact of a bug 760.27s - 762.27s | and they start downgrading little edge cases 762.27s - 764.27s | out of them. I'll highlight the specific ones 764.27s - 766.27s | that they downgrade. 766.27s - 768.27s | But the customers will downgrade these to make the bug 768.27s - 770.27s | fall to a lower payout level so that 770.27s - 772.27s | they can have more remaining budget 772.27s - 774.27s | on the other side. 774.27s - 776.27s | The other way that they try to protect against 776.27s - 778.27s | budget exhaustion when they get crushed by a 778.27s - 780.27s


chunk_text:
| So what happens 740.27s - 742.27s | in this situation with the worst customers 742.27s - 744.27s | is they get 744.27s - 746.27s | really scared about the bug bounty and 746.27s - 748.27s | their budget getting exhausted 748.27s - 750.27s | and they get really conservative with payouts. 750.27s - 752.27s | And so what they do 752.27s - 754.27s | is they take the contextual 754.27s - 756.27s | ratings of CVSS 756.27s - 758.27s | which most of the platforms use 758.27s - 760.27s | to rate the impact of a bug 760.27s - 762.27s | and they start downgrading little edge cases 762.27s - 764.27s | out of them. I'll highlight the specific ones 764.27s - 766.27s | that they downgrade. 766.27s - 768.27s | But the customers will downgrade these to make the bug 768.27s - 770.27s | fall to a lower payout level so that 770.27s - 772.27s | they can have more remaining budget 772.27s - 774.27s | on the other side. 774.27s - 776.27s | The other way that they try to protect against 776.27s - 778.27s | budget exhaustion when they get crushed by a 778.27s - 780.27s | bug bounty program 780.27s - 782.27s | is they try to group bugs together. 782.27s - 784.27s | So instead of individually paying out every 784.27s - 786.27s | XSS that they find, they'll be 786.27s - 788.27s | like, oh, we're just going to 788.27s - 790.27s | pay out the first few and we're going to say 790.27s - 792.27s | that holistically XSS is a problem 792.27s - 794.27s | and we're not going to pay out XSS anymore. 794.27s - 796.27s | And they're going to say, oh yeah, 796.27s - 798.27s | it's because of a framework 798.27s - 800.27s | level problem. And once we fix the framework 800.27s - 802.27s | level problem, all XSS will be fixed, 802.27s - 804.27s | which is a bunch of bullshit. 804.27s - 806.27s | But they do this very often. 806.27s - 808.27s | Sometimes even at the 808.27s - 810.27s | suggestion of the platforms, which is kind 810.27s - 816.66s | of nefarious. 816.66s - 818.66s | So in triage, clients get 818.66s - 820.66s | in the loop with the triage after 820.66s - 822.66s | the platform does. 822.66s -


chunk_text:
| bug bounty program 780.27s - 782.27s | is they try to group bugs together. 782.27s - 784.27s | So instead of individually paying out every 784.27s - 786.27s | XSS that they find, they'll be 786.27s - 788.27s | like, oh, we're just going to 788.27s - 790.27s | pay out the first few and we're going to say 790.27s - 792.27s | that holistically XSS is a problem 792.27s - 794.27s | and we're not going to pay out XSS anymore. 794.27s - 796.27s | And they're going to say, oh yeah, 796.27s - 798.27s | it's because of a framework 798.27s - 800.27s | level problem. And once we fix the framework 800.27s - 802.27s | level problem, all XSS will be fixed, 802.27s - 804.27s | which is a bunch of bullshit. 804.27s - 806.27s | But they do this very often. 806.27s - 808.27s | Sometimes even at the 808.27s - 810.27s | suggestion of the platforms, which is kind 810.27s - 816.66s | of nefarious. 816.66s - 818.66s | So in triage, clients get 818.66s - 820.66s | in the loop with the triage after 820.66s - 822.66s | the platform does. 822.66s - 824.66s | So the platform triage usually helps 824.66s - 826.66s | rewrite the bug, 826.66s - 828.66s | decide if the bug 828.66s - 830.66s | is valid, and then 830.66s - 835.54s | passes it on to the customer. 835.54s - 837.54s | When customers get in the 837.54s - 839.54s | loop, 839.54s - 841.54s | stuff can get real crazy. 841.54s - 843.54s | So if a customer is not 843.54s - 845.54s | technical enough, 845.54s - 847.54s | just on accident, they can 847.54s - 849.54s | mess up the scoring of the impact of a vulnerability. 849.54s - 851.54s | And most often, 851.54s - 853.54s | either the nefarious downgrade of a vulnerability 853.54s - 855.54s | or the accidental downgrade 855.54s - 857.54s | of a vulnerability, sorry about the typo, 857.54s - 859.54s | is in four sections in CBSS4. 859.54s - 861.54s | It's the access requirements, 861.54s - 863.54s | attack requirements, user interaction 863.54s - 865.54s | requirements, and privilege requirements 865.54s - 867.54s | in CBSS4. 867.54s - 869.54s | These are all dials that you turn on CBSS4. 869.54s - 871.54s | And whether you


chunk_text:
824.66s | So the platform triage usually helps 824.66s - 826.66s | rewrite the bug, 826.66s - 828.66s | decide if the bug 828.66s - 830.66s | is valid, and then 830.66s - 835.54s | passes it on to the customer. 835.54s - 837.54s | When customers get in the 837.54s - 839.54s | loop, 839.54s - 841.54s | stuff can get real crazy. 841.54s - 843.54s | So if a customer is not 843.54s - 845.54s | technical enough, 845.54s - 847.54s | just on accident, they can 847.54s - 849.54s | mess up the scoring of the impact of a vulnerability. 849.54s - 851.54s | And most often, 851.54s - 853.54s | either the nefarious downgrade of a vulnerability 853.54s - 855.54s | or the accidental downgrade 855.54s - 857.54s | of a vulnerability, sorry about the typo, 857.54s - 859.54s | is in four sections in CBSS4. 859.54s - 861.54s | It's the access requirements, 861.54s - 863.54s | attack requirements, user interaction 863.54s - 865.54s | requirements, and privilege requirements 865.54s - 867.54s | in CBSS4. 867.54s - 869.54s | These are all dials that you turn on CBSS4. 869.54s - 871.54s | And whether you 871.54s - 873.54s | say that you need 873.54s - 875.54s | to have network access or you need to have 875.54s - 877.54s | authenticated access or something like that, 877.54s - 879.54s | the bug severity goes up and down. 879.54s - 881.54s | Now a lot of customers 881.54s - 883.54s | make the first mistake just because 883.54s - 885.54s | they don't understand CBSS. They say, 885.54s - 887.54s | oh, the privilege requirements 887.54s - 889.54s | are that you have 889.54s - 891.54s | to be authenticated. 891.54s - 893.54s | And they 893.54s - 895.54s | consider that not 895.54s - 897.54s | self-signup. They consider that employee 897.54s - 899.54s | level access. And so they think, 899.54s - 901.54s | oh, well, 901.54s - 903.54s | they had to self-register 903.54s - 905.54s | for the site to get access 905.54s - 907.54s | to this function and then hack this site. 907.54s - 909.54s | But when that's free registration, really 909.54s - 911.54s | that's open access. Anybody can register 911.54s - 913.54s | for a website, get an account, 913.54s - 915.54s | find a bug. And


chunk_text:
871.54s - 873.54s | say that you need 873.54s - 875.54s | to have network access or you need to have 875.54s - 877.54s | authenticated access or something like that, 877.54s - 879.54s | the bug severity goes up and down. 879.54s - 881.54s | Now a lot of customers 881.54s - 883.54s | make the first mistake just because 883.54s - 885.54s | they don't understand CBSS. They say, 885.54s - 887.54s | oh, the privilege requirements 887.54s - 889.54s | are that you have 889.54s - 891.54s | to be authenticated. 891.54s - 893.54s | And they 893.54s - 895.54s | consider that not 895.54s - 897.54s | self-signup. They consider that employee 897.54s - 899.54s | level access. And so they think, 899.54s - 901.54s | oh, well, 901.54s - 903.54s | they had to self-register 903.54s - 905.54s | for the site to get access 905.54s - 907.54s | to this function and then hack this site. 907.54s - 909.54s | But when that's free registration, really 909.54s - 911.54s | that's open access. Anybody can register 911.54s - 913.54s | for a website, get an account, 913.54s - 915.54s | find a bug. And so they'll 915.54s - 917.54s | do this on accident. They'll underscore 917.54s - 919.54s | this. So there's several ways that they can do this by accident. 919.54s - 921.54s | There's also 921.54s - 923.54s | this world, and I've seen it 923.54s - 925.54s | many times, where 925.54s - 927.54s | the second level of triage at the 927.54s - 929.54s | client is done by a security 929.54s - 931.54s | engineer at the client site. 931.54s - 933.54s | And, you know, 933.54s - 935.54s | they're probably a really good security engineer, 935.54s - 937.54s | but they're jaded because they have 800 937.54s - 939.54s | submissions in the queue. 939.54s - 941.54s | And so they start rating 941.54s - 943.54s | bugs with a custom rubric that 943.54s - 945.54s | they make themselves. 945.54s - 947.54s | And it is 947.54s - 949.54s | not very 949.54s - 951.54s | data-driven. And so 951.54s - 953.54s | what they'll do is they'll start 953.54s - 955.54s | triaging based on 955.54s - 957.54s | how long it takes to 957.54s - 959.54s | exploit the bug, which shouldn't 959.54s


chunk_text:
so they'll 915.54s - 917.54s | do this on accident. They'll underscore 917.54s - 919.54s | this. So there's several ways that they can do this by accident. 919.54s - 921.54s | There's also 921.54s - 923.54s | this world, and I've seen it 923.54s - 925.54s | many times, where 925.54s - 927.54s | the second level of triage at the 927.54s - 929.54s | client is done by a security 929.54s - 931.54s | engineer at the client site. 931.54s - 933.54s | And, you know, 933.54s - 935.54s | they're probably a really good security engineer, 935.54s - 937.54s | but they're jaded because they have 800 937.54s - 939.54s | submissions in the queue. 939.54s - 941.54s | And so they start rating 941.54s - 943.54s | bugs with a custom rubric that 943.54s - 945.54s | they make themselves. 945.54s - 947.54s | And it is 947.54s - 949.54s | not very 949.54s - 951.54s | data-driven. And so 951.54s - 953.54s | what they'll do is they'll start 953.54s - 955.54s | triaging based on 955.54s - 957.54s | how long it takes to 957.54s - 959.54s | exploit the bug, which shouldn't 959.54s - 961.54s | matter, how 961.54s - 963.54s | technical the bug is. 963.54s - 965.54s | Sometimes you find really stupid stuff 965.54s - 967.54s | like a website that 967.54s - 969.54s | has a default password 969.54s - 971.54s | and that lets a hacker into your systems. 971.54s - 973.54s | But the impact 973.54s - 975.54s | of that is what you should be, which should be 975.54s - 977.54s | generating value for that, right? 977.54s - 979.54s | And so if that DevSecOps panel 979.54s - 981.54s | that had a default password on it 981.54s - 983.54s | got them access to all your customer 983.54s - 985.54s | data or all of your DevSecOps data 985.54s - 987.54s | or all your logs or something, that 987.54s - 989.54s | should be the end-all be-all way 989.54s - 991.54s | that you triage a bug like that. 991.54s - 993.54s | And then 993.54s - 995.54s | sometimes they lower triage 995.54s - 997.54s | or they lower impact 997.54s - 999.54s | by saying that there was mitigating 999.54s - 1001.54s | controls behind 1001.54s - 1003.54s | the controls


chunk_text:
- 961.54s | matter, how 961.54s - 963.54s | technical the bug is. 963.54s - 965.54s | Sometimes you find really stupid stuff 965.54s - 967.54s | like a website that 967.54s - 969.54s | has a default password 969.54s - 971.54s | and that lets a hacker into your systems. 971.54s - 973.54s | But the impact 973.54s - 975.54s | of that is what you should be, which should be 975.54s - 977.54s | generating value for that, right? 977.54s - 979.54s | And so if that DevSecOps panel 979.54s - 981.54s | that had a default password on it 981.54s - 983.54s | got them access to all your customer 983.54s - 985.54s | data or all of your DevSecOps data 985.54s - 987.54s | or all your logs or something, that 987.54s - 989.54s | should be the end-all be-all way 989.54s - 991.54s | that you triage a bug like that. 991.54s - 993.54s | And then 993.54s - 995.54s | sometimes they lower triage 995.54s - 997.54s | or they lower impact 997.54s - 999.54s | by saying that there was mitigating 999.54s - 1001.54s | controls behind 1001.54s - 1003.54s | the controls that 1003.54s - 1005.54s | were passed, which there's no way for a 1005.54s - 1007.54s | bug hunter to verify that. 1007.54s - 1009.54s | And so a lot of times you get in a 1009.54s - 1011.54s | lot of arbitration and 1011.54s - 1013.54s | kind of bad 1013.54s - 1015.54s | situations between people are like, 1015.54s - 1017.54s | oh, we would have noticed that in our logs, or 1017.54s - 1019.54s | we had a mitigating 1019.54s - 1021.54s | manual check of this process. 1021.54s - 1023.54s | And so the bug hunter doesn't know that. 1023.54s - 1025.54s | They accessed your system, 1025.54s - 1027.54s | accessed your logs, they had it, or 1027.54s - 1029.54s | they exploited this vulnerability. 1029.54s - 1031.54s | Pretty sure that it counts 1031.54s - 1033.54s | for a bug bounty. 1033.54s - 1035.54s | The other one that they can do, that really 1035.54s - 1037.54s | shitty clients can do, is they can say there was an 1037.54s - 1039.54s | existing issue in their backlog, 1039.54s - 1041.54s | which I have seen outright 1041.54s - 1043.54s | customers lie about.


chunk_text:
that 1003.54s - 1005.54s | were passed, which there's no way for a 1005.54s - 1007.54s | bug hunter to verify that. 1007.54s - 1009.54s | And so a lot of times you get in a 1009.54s - 1011.54s | lot of arbitration and 1011.54s - 1013.54s | kind of bad 1013.54s - 1015.54s | situations between people are like, 1015.54s - 1017.54s | oh, we would have noticed that in our logs, or 1017.54s - 1019.54s | we had a mitigating 1019.54s - 1021.54s | manual check of this process. 1021.54s - 1023.54s | And so the bug hunter doesn't know that. 1023.54s - 1025.54s | They accessed your system, 1025.54s - 1027.54s | accessed your logs, they had it, or 1027.54s - 1029.54s | they exploited this vulnerability. 1029.54s - 1031.54s | Pretty sure that it counts 1031.54s - 1033.54s | for a bug bounty. 1033.54s - 1035.54s | The other one that they can do, that really 1035.54s - 1037.54s | shitty clients can do, is they can say there was an 1037.54s - 1039.54s | existing issue in their backlog, 1039.54s - 1041.54s | which I have seen outright 1041.54s - 1043.54s | customers lie about. 1043.54s - 1045.54s | They say, oh yeah, we knew about this issue. 1045.54s - 1047.54s | It came from our pen testers two years 1047.54s - 1049.54s | ago. We just haven't had time to fix it. 1049.54s - 1051.54s | Well, if it was two fucking years ago, 1051.54s - 1053.54s | that's bad. 1053.54s - 1055.54s | And anyway, show me proof. 1055.54s - 1057.54s | This is a very common one. 1057.54s - 1059.54s | And again, I'm not saying 1059.54s - 1061.54s | this is you guys. I'm saying this is the worst of all 1061.54s - 1063.54s | customers I've ever seen. But there 1063.54s - 1068.38s | are some shitty customers out there. 1068.38s - 1070.38s | Okay, so another thing shitty 1070.38s - 1072.38s | customers do is they make 1072.38s - 1074.38s | payout ranges. And so 1074.38s - 1076.38s | they'll say, hey, a critical bug is 1076.38s - 1078.38s | worth like 20k 1078.38s - 1080.38s | to us, or 50k, or 1080.38s - 1082.38s | 100k if they're going ham. 1082.38s - 1084.38s | And 1084.38s - 1089.97s | sorry, give me one second. 1089.97s - 1091.97s |


chunk_text:
1043.54s - 1045.54s | They say, oh yeah, we knew about this issue. 1045.54s - 1047.54s | It came from our pen testers two years 1047.54s - 1049.54s | ago. We just haven't had time to fix it. 1049.54s - 1051.54s | Well, if it was two fucking years ago, 1051.54s - 1053.54s | that's bad. 1053.54s - 1055.54s | And anyway, show me proof. 1055.54s - 1057.54s | This is a very common one. 1057.54s - 1059.54s | And again, I'm not saying 1059.54s - 1061.54s | this is you guys. I'm saying this is the worst of all 1061.54s - 1063.54s | customers I've ever seen. But there 1063.54s - 1068.38s | are some shitty customers out there. 1068.38s - 1070.38s | Okay, so another thing shitty 1070.38s - 1072.38s | customers do is they make 1072.38s - 1074.38s | payout ranges. And so 1074.38s - 1076.38s | they'll say, hey, a critical bug is 1076.38s - 1078.38s | worth like 20k 1078.38s - 1080.38s | to us, or 50k, or 1080.38s - 1082.38s | 100k if they're going ham. 1082.38s - 1084.38s | And 1084.38s - 1089.97s | sorry, give me one second. 1089.97s - 1091.97s | And so they'll make 1091.97s - 1093.97s | these ranges for payment. They'll say 1093.97s - 1095.97s | anything between 10 and 1095.97s - 1097.97s | 40k, depending on what we decide, 1097.97s - 1099.97s | right? Less than 15% 1099.97s - 1101.97s | of clients who use 1101.97s - 1103.97s | ranges, sorry about the typos. I made the slides 1103.97s - 1105.97s | last night. Less than 15% 1105.97s - 1107.97s | of clients who use ranges pay anything above 1107.97s - 1109.97s | the minimum of that range ever. 1109.97s - 1111.97s | You have some gold star customers who do 1111.97s - 1113.97s | that, like Google and Meta, and they 1113.97s - 1115.97s | really have a vulnerability rating board 1115.97s - 1117.97s | internally in the company. 1117.97s - 1119.97s | But most of the time, they just pay 1119.97s - 1121.97s | the bare minimum. And so setting 1121.97s - 1123.97s | as a career hacker who's going to do bug bounty, 1123.97s - 1125.97s | you can 1125.97s - 1127.97s | really get kind of skunked on 1127.97s - 1129.97s | what you think is going 1129.97s - 1131.97s | to be


chunk_text:
And so they'll make 1091.97s - 1093.97s | these ranges for payment. They'll say 1093.97s - 1095.97s | anything between 10 and 1095.97s - 1097.97s | 40k, depending on what we decide, 1097.97s - 1099.97s | right? Less than 15% 1099.97s - 1101.97s | of clients who use 1101.97s - 1103.97s | ranges, sorry about the typos. I made the slides 1103.97s - 1105.97s | last night. Less than 15% 1105.97s - 1107.97s | of clients who use ranges pay anything above 1107.97s - 1109.97s | the minimum of that range ever. 1109.97s - 1111.97s | You have some gold star customers who do 1111.97s - 1113.97s | that, like Google and Meta, and they 1113.97s - 1115.97s | really have a vulnerability rating board 1115.97s - 1117.97s | internally in the company. 1117.97s - 1119.97s | But most of the time, they just pay 1119.97s - 1121.97s | the bare minimum. And so setting 1121.97s - 1123.97s | as a career hacker who's going to do bug bounty, 1123.97s - 1125.97s | you can 1125.97s - 1127.97s | really get kind of skunked on 1127.97s - 1129.97s | what you think is going 1129.97s - 1131.97s | to be a great program, and then you get wrecked. 1131.97s - 1133.97s | This is very common right now in the web 1133.97s - 1135.97s | 3 space. So there are 1135.97s - 1137.97s | a lot of web 3 bounties that want 1137.97s - 1139.97s | to make a splash in the press and say, 1139.97s - 1141.97s | if you can hack our crypto 1141.97s - 1143.97s | system, we will give you 1143.97s - 1145.97s | a million dollars. There's several of these 1145.97s - 1147.97s | going on right now. And then 1147.97s - 1149.97s | I've had several bug hunters break 1149.97s - 1151.97s | into their sites, get all their customer 1151.97s - 1153.97s | data, have the ability to backdoor their 1153.97s - 1155.97s | algorithms, and basically mess 1155.97s - 1157.97s | up their whole exchange. But 1157.97s - 1159.97s | because the bug wasn't a 1159.97s - 1161.97s | crypto-related bug, like a smart 1161.97s - 1163.97s | contract bug, because it was a web 1163.97s - 1165.97s | bug, they got paid 1165.97s - 1167.97s | 20K instead of a million. 1167.97s - 1169.97s | And so there is 1169.97s -


chunk_text:
a great program, and then you get wrecked. 1131.97s - 1133.97s | This is very common right now in the web 1133.97s - 1135.97s | 3 space. So there are 1135.97s - 1137.97s | a lot of web 3 bounties that want 1137.97s - 1139.97s | to make a splash in the press and say, 1139.97s - 1141.97s | if you can hack our crypto 1141.97s - 1143.97s | system, we will give you 1143.97s - 1145.97s | a million dollars. There's several of these 1145.97s - 1147.97s | going on right now. And then 1147.97s - 1149.97s | I've had several bug hunters break 1149.97s - 1151.97s | into their sites, get all their customer 1151.97s - 1153.97s | data, have the ability to backdoor their 1153.97s - 1155.97s | algorithms, and basically mess 1155.97s - 1157.97s | up their whole exchange. But 1157.97s - 1159.97s | because the bug wasn't a 1159.97s - 1161.97s | crypto-related bug, like a smart 1161.97s - 1163.97s | contract bug, because it was a web 1163.97s - 1165.97s | bug, they got paid 1165.97s - 1167.97s | 20K instead of a million. 1167.97s - 1169.97s | And so there is 1169.97s - 1171.97s | some really shady stuff going on like 1171.97s - 1173.97s | that right now in the industry. 1173.97s - 1175.97s | And those million dollar 1175.97s - 1177.97s | payouts, they're mostly for marketing. 1177.97s - 1179.97s | They're mostly a marketing 1179.97s - 1181.97s | ploy to make the company look like they're more 1181.97s - 1183.97s | secure. The only people I've seen 1183.97s - 1185.97s | that pay million dollar bugs 1185.97s - 1187.97s | at least recently, or close 1187.97s - 1189.97s | to a million dollars, has been 1189.97s - 1191.97s | T-Mobile has a really forward-facing 1191.97s - 1193.97s | bug bounty program, and they've paid out really 1193.97s - 1195.97s | high rewards for bug hunters 1195.97s - 1197.97s | who did very specific things. 1197.97s - 1201.89s | All right. So some of these 1201.89s - 1203.89s | same things happen 1203.89s - 1205.89s | at live events. So if you've never 1205.89s - 1207.89s | been to a live event, how many of you have been to a live event 1207.89s - 1209.89s | before, a hacker live event? 1209.89s - 1211.89s | Cool. So some of you, yeah.


chunk_text:
1171.97s | some really shady stuff going on like 1171.97s - 1173.97s | that right now in the industry. 1173.97s - 1175.97s | And those million dollar 1175.97s - 1177.97s | payouts, they're mostly for marketing. 1177.97s - 1179.97s | They're mostly a marketing 1179.97s - 1181.97s | ploy to make the company look like they're more 1181.97s - 1183.97s | secure. The only people I've seen 1183.97s - 1185.97s | that pay million dollar bugs 1185.97s - 1187.97s | at least recently, or close 1187.97s - 1189.97s | to a million dollars, has been 1189.97s - 1191.97s | T-Mobile has a really forward-facing 1191.97s - 1193.97s | bug bounty program, and they've paid out really 1193.97s - 1195.97s | high rewards for bug hunters 1195.97s - 1197.97s | who did very specific things. 1197.97s - 1201.89s | All right. So some of these 1201.89s - 1203.89s | same things happen 1203.89s - 1205.89s | at live events. So if you've never 1205.89s - 1207.89s | been to a live event, how many of you have been to a live event 1207.89s - 1209.89s | before, a hacker live event? 1209.89s - 1211.89s | Cool. So some of you, yeah. 1211.89s - 1213.89s | So if you haven't been, 1213.89s - 1215.89s | live events at BugCrowd, HackerOne, Integrity, 1215.89s - 1217.89s | Let'sHack, or 1217.89s - 1219.89s | YesWeHack, 1219.89s - 1221.89s | they're basically giant hacker 1221.89s - 1223.89s | parties where 1223.89s - 1225.89s | you fly out a whole bunch of really 1225.89s - 1227.89s | good, really high-scoring, really well-known 1227.89s - 1229.89s | bug hunters to a location 1229.89s - 1231.89s | and they 1231.89s - 1233.89s | basically focus on a single 1233.89s - 1235.89s | company, and they 1235.89s - 1237.89s | increase the rewards substantially 1237.89s - 1239.89s | for this period, and 1239.89s - 1241.89s | they open up NewScope. 1241.89s - 1243.89s | Now several live events, 1243.89s - 1245.89s | and you can talk to a bunch of the bug bounty 1245.89s - 1247.89s | hunters, but 1247.89s - 1249.89s | several live events have been the most 1249.89s - 1251.89s | disastrous thing ever, where 1251.89s - 1253.89s | the client puts in NewScope into the 1253.89s - 1255.89s | program for the live event 1255.89s - 1257.89s | and says, hey, 1257.89s - 1259.89s | we're


chunk_text:
1211.89s - 1213.89s | So if you haven't been, 1213.89s - 1215.89s | live events at BugCrowd, HackerOne, Integrity, 1215.89s - 1217.89s | Let'sHack, or 1217.89s - 1219.89s | YesWeHack, 1219.89s - 1221.89s | they're basically giant hacker 1221.89s - 1223.89s | parties where 1223.89s - 1225.89s | you fly out a whole bunch of really 1225.89s - 1227.89s | good, really high-scoring, really well-known 1227.89s - 1229.89s | bug hunters to a location 1229.89s - 1231.89s | and they 1231.89s - 1233.89s | basically focus on a single 1233.89s - 1235.89s | company, and they 1235.89s - 1237.89s | increase the rewards substantially 1237.89s - 1239.89s | for this period, and 1239.89s - 1241.89s | they open up NewScope. 1241.89s - 1243.89s | Now several live events, 1243.89s - 1245.89s | and you can talk to a bunch of the bug bounty 1245.89s - 1247.89s | hunters, but 1247.89s - 1249.89s | several live events have been the most 1249.89s - 1251.89s | disastrous thing ever, where 1251.89s - 1253.89s | the client puts in NewScope into the 1253.89s - 1255.89s | program for the live event 1255.89s - 1257.89s | and says, hey, 1257.89s - 1259.89s | we're going to pay $20k 1259.89s - 1261.89s | per critical vulnerability, 1261.89s - 1263.89s | and then in 40 minutes 1263.89s - 1265.89s | you get 1265.89s - 1267.89s | 40 critical vulnerabilities and completely 1267.89s - 1269.89s | exhaust the whole live event budget. 1269.89s - 1271.89s | And this is before, this hacking, 1271.89s - 1273.89s | you have two weeks before you even go on-site 1273.89s - 1275.89s | to do some of this hacking, so the budget 1275.89s - 1277.89s | gets exhausted, like we saw 1277.89s - 1279.89s | in previous slides, before the live event really 1279.89s - 1281.89s | even happens. And then you 1281.89s - 1283.89s | fly all these hackers out there, and then the customers 1283.89s - 1285.89s | are nickel-and-diming the hackers, downgrading 1285.89s - 1287.89s | their reports, out-of-scoping 1287.89s - 1289.89s | their reports, combining them with other reports, 1289.89s - 1291.89s | really unfairly, because they 1291.89s - 1293.89s | basically have no budget left for the 1293.89s - 1295.89s | project. 1295.89s - 1297.89s | And it's kind of the fault, 1297.89s - 1299.89s | in this case, of both 1299.89s - 1301.89s | the


chunk_text:
going to pay $20k 1259.89s - 1261.89s | per critical vulnerability, 1261.89s - 1263.89s | and then in 40 minutes 1263.89s - 1265.89s | you get 1265.89s - 1267.89s | 40 critical vulnerabilities and completely 1267.89s - 1269.89s | exhaust the whole live event budget. 1269.89s - 1271.89s | And this is before, this hacking, 1271.89s - 1273.89s | you have two weeks before you even go on-site 1273.89s - 1275.89s | to do some of this hacking, so the budget 1275.89s - 1277.89s | gets exhausted, like we saw 1277.89s - 1279.89s | in previous slides, before the live event really 1279.89s - 1281.89s | even happens. And then you 1281.89s - 1283.89s | fly all these hackers out there, and then the customers 1283.89s - 1285.89s | are nickel-and-diming the hackers, downgrading 1285.89s - 1287.89s | their reports, out-of-scoping 1287.89s - 1289.89s | their reports, combining them with other reports, 1289.89s - 1291.89s | really unfairly, because they 1291.89s - 1293.89s | basically have no budget left for the 1293.89s - 1295.89s | project. 1295.89s - 1297.89s | And it's kind of the fault, 1297.89s - 1299.89s | in this case, of both 1299.89s - 1301.89s | the expectations of the clients, 1301.89s - 1303.89s | the non-understanding of the 1303.89s - 1305.89s | scope, and non-understanding 1305.89s - 1307.89s | about how effective live events are at 1307.89s - 1315.97s | finding vulnerabilities. 1315.97s - 1317.97s | So, there was a panel 1317.97s - 1319.97s | earlier this week at the Bug Bounty Village, 1319.97s - 1321.97s | there's a Bug Bounty Village here if you didn't know, 1321.97s - 1323.97s | and the panel was 1323.97s - 1325.97s | some of my closest friends 1325.97s - 1327.97s | on this panel, and so I don't want 1327.97s - 1329.97s | to, like, crap on them, really. 1329.97s - 1331.97s | But they said something that really pissed me off. 1331.97s - 1333.97s | So, basically 1333.97s - 1335.97s | I'm paraphrasing here, but they said, like, 1335.97s - 1337.97s | going public or tweeting or making 1337.97s - 1339.97s | the platform's job harder 1339.97s - 1341.97s | in any way will make them not 1341.97s - 1343.97s | want to work with you and not get invited to 1343.97s - 1345.97s | programs, which I think is a bunch 1345.97s - 1347.97s | of bullshit,


chunk_text:
expectations of the clients, 1301.89s - 1303.89s | the non-understanding of the 1303.89s - 1305.89s | scope, and non-understanding 1305.89s - 1307.89s | about how effective live events are at 1307.89s - 1315.97s | finding vulnerabilities. 1315.97s - 1317.97s | So, there was a panel 1317.97s - 1319.97s | earlier this week at the Bug Bounty Village, 1319.97s - 1321.97s | there's a Bug Bounty Village here if you didn't know, 1321.97s - 1323.97s | and the panel was 1323.97s - 1325.97s | some of my closest friends 1325.97s - 1327.97s | on this panel, and so I don't want 1327.97s - 1329.97s | to, like, crap on them, really. 1329.97s - 1331.97s | But they said something that really pissed me off. 1331.97s - 1333.97s | So, basically 1333.97s - 1335.97s | I'm paraphrasing here, but they said, like, 1335.97s - 1337.97s | going public or tweeting or making 1337.97s - 1339.97s | the platform's job harder 1339.97s - 1341.97s | in any way will make them not 1341.97s - 1343.97s | want to work with you and not get invited to 1343.97s - 1345.97s | programs, which I think is a bunch 1345.97s - 1347.97s | of bullshit, because we are the product. 1347.97s - 1349.97s | All you have, if you are a 1349.97s - 1351.97s | platform, is a goddamn webpage. 1351.97s - 1353.97s | You don't have any way of finding vulnerabilities. 1353.97s - 1355.97s | The hackers are the product. 1355.97s - 1357.97s | And so if you think that 1357.97s - 1359.97s | sharing data between platforms 1359.97s - 1361.97s | and stuff is right, and, like, kind of blackballing 1361.97s - 1363.97s | researchers, 1363.97s - 1365.97s | you have grossly 1365.97s - 1367.97s | not oriented 1367.97s - 1369.97s | kind of your whole company the right way. 1369.97s - 1371.97s | Your hackers are the only thing you really have. 1371.97s - 1373.97s | Otherwise, you're a glorified 1373.97s - 1375.97s | ticketing system. 1375.97s - 1377.97s | Now, this happens 1377.97s - 1379.97s | because platform triage 1379.97s - 1381.97s | gets burnt out. They handle 1381.97s - 1383.97s | hundreds of thousands of bugs a week. 1383.97s - 1385.97s | I mean, I've managed these 1385.97s - 1387.97s | teams, but it is a 1387.97s - 1389.97s | core 1389.97s - 1391.97s | need for that 1391.97s -


chunk_text:
because we are the product. 1347.97s - 1349.97s | All you have, if you are a 1349.97s - 1351.97s | platform, is a goddamn webpage. 1351.97s - 1353.97s | You don't have any way of finding vulnerabilities. 1353.97s - 1355.97s | The hackers are the product. 1355.97s - 1357.97s | And so if you think that 1357.97s - 1359.97s | sharing data between platforms 1359.97s - 1361.97s | and stuff is right, and, like, kind of blackballing 1361.97s - 1363.97s | researchers, 1363.97s - 1365.97s | you have grossly 1365.97s - 1367.97s | not oriented 1367.97s - 1369.97s | kind of your whole company the right way. 1369.97s - 1371.97s | Your hackers are the only thing you really have. 1371.97s - 1373.97s | Otherwise, you're a glorified 1373.97s - 1375.97s | ticketing system. 1375.97s - 1377.97s | Now, this happens 1377.97s - 1379.97s | because platform triage 1379.97s - 1381.97s | gets burnt out. They handle 1381.97s - 1383.97s | hundreds of thousands of bugs a week. 1383.97s - 1385.97s | I mean, I've managed these 1385.97s - 1387.97s | teams, but it is a 1387.97s - 1389.97s | core 1389.97s - 1391.97s | need for that 1391.97s - 1393.97s | team to be the stalwart defenders 1393.97s - 1395.97s | of the hackers. The triage team at 1395.97s - 1397.97s | the platform needs to make sure at every 1397.97s - 1399.97s | opportunity the hackers are treated like rock stars 1399.97s - 1401.97s | and they are stood up for. 1401.97s - 1403.97s | Because if any time that any of these 1403.97s - 1405.97s | hackers decide to not work on the program, they have 1405.97s - 1407.97s | nothing to sell. And so 1407.97s - 1409.97s | this paraphrase here of 1409.97s - 1411.97s | those leaders at those companies 1411.97s - 1413.97s | really made me mad, even though I knew them. 1413.97s - 1415.97s | And so this goes back to the idea 1415.97s - 1417.97s | that the hackers are the product and they're 1417.97s - 1419.97s | being kind of mistreated in a lot of ways. 1419.97s - 1421.97s | On some programs, not all. 1421.97s - 1427.30s | The worst scenario of all 1427.30s - 1429.30s | time that's happened at least once 1429.30s - 1431.30s | documented was that internal 1431.30s - 1433.30s | triagers at a platform 1433.30s


chunk_text:
1393.97s | team to be the stalwart defenders 1393.97s - 1395.97s | of the hackers. The triage team at 1395.97s - 1397.97s | the platform needs to make sure at every 1397.97s - 1399.97s | opportunity the hackers are treated like rock stars 1399.97s - 1401.97s | and they are stood up for. 1401.97s - 1403.97s | Because if any time that any of these 1403.97s - 1405.97s | hackers decide to not work on the program, they have 1405.97s - 1407.97s | nothing to sell. And so 1407.97s - 1409.97s | this paraphrase here of 1409.97s - 1411.97s | those leaders at those companies 1411.97s - 1413.97s | really made me mad, even though I knew them. 1413.97s - 1415.97s | And so this goes back to the idea 1415.97s - 1417.97s | that the hackers are the product and they're 1417.97s - 1419.97s | being kind of mistreated in a lot of ways. 1419.97s - 1421.97s | On some programs, not all. 1421.97s - 1427.30s | The worst scenario of all 1427.30s - 1429.30s | time that's happened at least once 1429.30s - 1431.30s | documented was that internal 1431.30s - 1433.30s | triagers at a platform 1433.30s - 1435.30s | stole research from 1435.30s - 1437.30s | a bug hunter and then resubmitted 1437.30s - 1439.30s | it to other bug bounty programs in their own 1439.30s - 1441.30s | name. So this has happened 1441.30s - 1443.30s | at least once that we know of 1443.30s - 1445.30s | and it is absolutely 1445.30s - 1447.30s | atrocious. And so it caused 1447.30s - 1449.30s | a kickoff of 1449.30s - 1451.30s | basically a whole bunch of process 1451.30s - 1453.30s | at this place where this happened. 1453.30s - 1455.30s | And so 1455.30s - 1457.30s | I would like to say that I 1457.30s - 1459.30s | thought that that was the only instance that ever 1459.30s - 1461.30s | happened was the one that got caught and publicized. 1461.30s - 1463.30s | But I don't think it is. 1463.30s - 1465.30s | I think that triage 1465.30s - 1467.30s | jobs 1467.30s - 1469.30s | they 1469.30s - 1471.30s | basically those people get 1471.30s - 1473.30s | to see all the research and it should be 1473.30s - 1475.30s | held to a very high ethical standard for 1475.30s - 1477.30s


chunk_text:
- 1435.30s | stole research from 1435.30s - 1437.30s | a bug hunter and then resubmitted 1437.30s - 1439.30s | it to other bug bounty programs in their own 1439.30s - 1441.30s | name. So this has happened 1441.30s - 1443.30s | at least once that we know of 1443.30s - 1445.30s | and it is absolutely 1445.30s - 1447.30s | atrocious. And so it caused 1447.30s - 1449.30s | a kickoff of 1449.30s - 1451.30s | basically a whole bunch of process 1451.30s - 1453.30s | at this place where this happened. 1453.30s - 1455.30s | And so 1455.30s - 1457.30s | I would like to say that I 1457.30s - 1459.30s | thought that that was the only instance that ever 1459.30s - 1461.30s | happened was the one that got caught and publicized. 1461.30s - 1463.30s | But I don't think it is. 1463.30s - 1465.30s | I think that triage 1465.30s - 1467.30s | jobs 1467.30s - 1469.30s | they 1469.30s - 1471.30s | basically those people get 1471.30s - 1473.30s | to see all the research and it should be 1473.30s - 1475.30s | held to a very high ethical standard for 1475.30s - 1477.30s | keeping that vulnerability data 1477.30s - 1482.82s | private. 1482.82s - 1484.82s | Another thing that happens 1484.82s - 1486.82s | in the bug bounty industry that's kind of crappy 1486.82s - 1488.82s | is celebrity. And I'm guilty of this. 1488.82s - 1490.82s | I am an infosex celebrity. I have 1490.82s - 1492.82s | 160,000 Twitter followers. 1492.82s - 1494.82s | I connect with everybody on LinkedIn. 1494.82s - 1496.82s | But I earned it. I have been 1496.82s - 1498.82s | doing work and research for 20 1498.82s - 1500.82s | years. And a lot of the big 1500.82s - 1502.82s | bug hunters earn it. But what it 1502.82s - 1504.82s | does is it creates a power disparity 1504.82s - 1506.82s | with newer bug hunters who don't have 1506.82s - 1508.82s | that celebrity. So let me give you some 1508.82s - 1510.82s | examples of the advantages celebrity gives you 1510.82s - 1512.82s | in bug bounty. Big names 1512.82s - 1514.82s | get big service. So for instance 1514.82s - 1516.82s | if I submit a bug, I 1516.82s - 1518.82s | know Casey Ellis. He is the CTO 1518.82s -


chunk_text:
| keeping that vulnerability data 1477.30s - 1482.82s | private. 1482.82s - 1484.82s | Another thing that happens 1484.82s - 1486.82s | in the bug bounty industry that's kind of crappy 1486.82s - 1488.82s | is celebrity. And I'm guilty of this. 1488.82s - 1490.82s | I am an infosex celebrity. I have 1490.82s - 1492.82s | 160,000 Twitter followers. 1492.82s - 1494.82s | I connect with everybody on LinkedIn. 1494.82s - 1496.82s | But I earned it. I have been 1496.82s - 1498.82s | doing work and research for 20 1498.82s - 1500.82s | years. And a lot of the big 1500.82s - 1502.82s | bug hunters earn it. But what it 1502.82s - 1504.82s | does is it creates a power disparity 1504.82s - 1506.82s | with newer bug hunters who don't have 1506.82s - 1508.82s | that celebrity. So let me give you some 1508.82s - 1510.82s | examples of the advantages celebrity gives you 1510.82s - 1512.82s | in bug bounty. Big names 1512.82s - 1514.82s | get big service. So for instance 1514.82s - 1516.82s | if I submit a bug, I 1516.82s - 1518.82s | know Casey Ellis. He is the CTO 1518.82s - 1520.82s | of Bug Crowd. I worked with him for five years 1520.82s - 1522.82s | at Bug Crowd. If I think I'm being treated unfairly 1522.82s - 1524.82s | if I really want to go out of my way 1524.82s - 1526.82s | I can DM him and be like, 1526.82s - 1528.82s | yo, why are you guys being stupid? 1528.82s - 1530.82s | This is a good bug. I'm submitting it. 1530.82s - 1532.82s | Talk to the triage team. 1532.82s - 1534.82s | And so a lot of big name bug 1534.82s - 1536.82s | hunters have this power. They know 1536.82s - 1538.82s | internal employees. Some of them 1538.82s - 1540.82s | at the platforms get their own CS reps. 1540.82s - 1542.82s | So they get an actual CS rep 1542.82s - 1544.82s | assigned to them to help them 1544.82s - 1546.82s | get their bugs pushed through faster. 1546.82s - 1548.82s | So they'll get out of band or instant 1548.82s - 1550.82s | support. And 1550.82s - 1552.82s | basically what it means is that these people 1552.82s - 1554.82s | have like an unfair power dynamic 1554.82s - 1556.82s


chunk_text:
1520.82s | of Bug Crowd. I worked with him for five years 1520.82s - 1522.82s | at Bug Crowd. If I think I'm being treated unfairly 1522.82s - 1524.82s | if I really want to go out of my way 1524.82s - 1526.82s | I can DM him and be like, 1526.82s - 1528.82s | yo, why are you guys being stupid? 1528.82s - 1530.82s | This is a good bug. I'm submitting it. 1530.82s - 1532.82s | Talk to the triage team. 1532.82s - 1534.82s | And so a lot of big name bug 1534.82s - 1536.82s | hunters have this power. They know 1536.82s - 1538.82s | internal employees. Some of them 1538.82s - 1540.82s | at the platforms get their own CS reps. 1540.82s - 1542.82s | So they get an actual CS rep 1542.82s - 1544.82s | assigned to them to help them 1544.82s - 1546.82s | get their bugs pushed through faster. 1546.82s - 1548.82s | So they'll get out of band or instant 1548.82s - 1550.82s | support. And 1550.82s - 1552.82s | basically what it means is that these people 1552.82s - 1554.82s | have like an unfair power dynamic 1554.82s - 1556.82s | to somebody who's just coming up. In which 1556.82s - 1558.82s | I've learned some but I still think there's a system 1558.82s - 1560.82s | in where no name people 1560.82s - 1562.82s | who don't have any rep or any research 1562.82s - 1564.82s | to their name but find really really good bugs 1564.82s - 1566.82s | which is the spirit of Bug Bounty. Anybody 1566.82s - 1568.82s | can find a bug. I mean there was 1568.82s - 1570.82s | there was this guy one time who had never done 1570.82s - 1572.82s | Bug Bounty. He was a developer. I was working 1572.82s - 1574.82s | on the platform. 1574.82s - 1576.82s | And he's now a very famous 1576.82s - 1578.82s | Bug Bounty hunter but he started off as a developer. And he found 1578.82s - 1580.82s | the most amazing SSO 1580.82s - 1582.82s | misconfiguration I've ever seen. 1582.82s - 1584.82s | Completely wrecked this program 1584.82s - 1586.82s | by basically being able to log in 1586.82s - 1588.82s | as anyone in their whole SSO 1588.82s - 1590.82s | kind of staple. Anyone in the company. 1590.82s -


chunk_text:
| to somebody who's just coming up. In which 1556.82s - 1558.82s | I've learned some but I still think there's a system 1558.82s - 1560.82s | in where no name people 1560.82s - 1562.82s | who don't have any rep or any research 1562.82s - 1564.82s | to their name but find really really good bugs 1564.82s - 1566.82s | which is the spirit of Bug Bounty. Anybody 1566.82s - 1568.82s | can find a bug. I mean there was 1568.82s - 1570.82s | there was this guy one time who had never done 1570.82s - 1572.82s | Bug Bounty. He was a developer. I was working 1572.82s - 1574.82s | on the platform. 1574.82s - 1576.82s | And he's now a very famous 1576.82s - 1578.82s | Bug Bounty hunter but he started off as a developer. And he found 1578.82s - 1580.82s | the most amazing SSO 1580.82s - 1582.82s | misconfiguration I've ever seen. 1582.82s - 1584.82s | Completely wrecked this program 1584.82s - 1586.82s | by basically being able to log in 1586.82s - 1588.82s | as anyone in their whole SSO 1588.82s - 1590.82s | kind of staple. Anyone in the company. 1590.82s - 1592.82s | And that's the kind of 1592.82s - 1594.82s | bugs you want. You want people coming out of the blue 1594.82s - 1596.82s | and just finding amazing stuff. 1596.82s - 1598.82s | But sometimes it doesn't happen like that 1598.82s - 1600.82s | because nobody knows who they are. 1600.82s - 1602.82s | So there should be a better system 1602.82s - 1607.18s | for this. Other things that 1607.18s - 1609.18s | really suck about the process is that after 1609.18s - 1611.18s | after you have a couple 1611.18s - 1613.18s | rounds of conversation with the platform 1613.18s - 1615.18s | really it's done. The door is closed. 1615.18s - 1617.18s | Like if you have two comments on 1617.18s - 1619.18s | a submission and you disagree with 1619.18s - 1621.18s | the rating or anything happens 1621.18s - 1623.18s | there's no more recourse for you. They just shut you down. 1623.18s - 1625.18s | Like that's it. You can comment 1625.18s - 1627.18s | 50 more times 1627.18s - 1629.18s | and they can see it in the back end. They get alerts 1629.18s - 1631.18s | but they just won't


chunk_text:
1592.82s | And that's the kind of 1592.82s - 1594.82s | bugs you want. You want people coming out of the blue 1594.82s - 1596.82s | and just finding amazing stuff. 1596.82s - 1598.82s | But sometimes it doesn't happen like that 1598.82s - 1600.82s | because nobody knows who they are. 1600.82s - 1602.82s | So there should be a better system 1602.82s - 1607.18s | for this. Other things that 1607.18s - 1609.18s | really suck about the process is that after 1609.18s - 1611.18s | after you have a couple 1611.18s - 1613.18s | rounds of conversation with the platform 1613.18s - 1615.18s | really it's done. The door is closed. 1615.18s - 1617.18s | Like if you have two comments on 1617.18s - 1619.18s | a submission and you disagree with 1619.18s - 1621.18s | the rating or anything happens 1621.18s - 1623.18s | there's no more recourse for you. They just shut you down. 1623.18s - 1625.18s | Like that's it. You can comment 1625.18s - 1627.18s | 50 more times 1627.18s - 1629.18s | and they can see it in the back end. They get alerts 1629.18s - 1631.18s | but they just won't reply to you. 1631.18s - 1633.18s | So at some point there's really no 1633.18s - 1635.18s | recourse for bug hunters when they think that they've 1635.18s - 1639.20s | been treated unfairly. 1639.20s - 1641.20s | Five minutes right? 1641.20s - 1643.20s | So I'm going to roll through this. 1643.20s - 1645.20s | The worst form of Bug Bounty runner 1645.20s - 1647.20s | is somebody who does a public VDP 1647.20s - 1649.20s | to get free bugs and then runs a private 1649.20s - 1651.20s | paid program 1651.20s - 1653.20s | to basically funnel people into. 1653.20s - 1655.20s | It's basically farming free work from bug hunters. 1655.20s - 1657.20s | So that kind of sucks for 1657.20s - 1659.20s | the community in general. 1659.20s - 1661.20s | Let's see here. 1661.20s - 1663.20s | Some other shitty things 1663.20s - 1665.20s | are the platforms treat 1665.20s - 1667.20s | hackers as the product in more than just 1667.20s - 1669.20s | the hacking ways. They also 1669.20s - 1671.20s | have in several 1671.20s - 1673.20s | instances used them 1673.20s - 1675.20s | as marketing tools as 1675.20s -


chunk_text:
reply to you. 1631.18s - 1633.18s | So at some point there's really no 1633.18s - 1635.18s | recourse for bug hunters when they think that they've 1635.18s - 1639.20s | been treated unfairly. 1639.20s - 1641.20s | Five minutes right? 1641.20s - 1643.20s | So I'm going to roll through this. 1643.20s - 1645.20s | The worst form of Bug Bounty runner 1645.20s - 1647.20s | is somebody who does a public VDP 1647.20s - 1649.20s | to get free bugs and then runs a private 1649.20s - 1651.20s | paid program 1651.20s - 1653.20s | to basically funnel people into. 1653.20s - 1655.20s | It's basically farming free work from bug hunters. 1655.20s - 1657.20s | So that kind of sucks for 1657.20s - 1659.20s | the community in general. 1659.20s - 1661.20s | Let's see here. 1661.20s - 1663.20s | Some other shitty things 1663.20s - 1665.20s | are the platforms treat 1665.20s - 1667.20s | hackers as the product in more than just 1667.20s - 1669.20s | the hacking ways. They also 1669.20s - 1671.20s | have in several 1671.20s - 1673.20s | instances used them 1673.20s - 1675.20s | as marketing tools as 1675.20s - 1677.20s | many celebrities and they very 1677.20s - 1679.20s | rarely pay them for that work or 1679.20s - 1681.20s | anything like that. 1681.20s - 1683.20s | Okay some tips and tricks 1683.20s - 1685.20s | if you are a bounty hunter. Some of you did raise your 1685.20s - 1687.20s | hand. I think like maybe 20 of you. 1687.20s - 1689.20s | So if you want to engage in debating 1689.20s - 1691.20s | criticality, one of my tips is 1691.20s - 1693.20s | pre-provide your justification 1693.20s - 1695.20s | in CVS 4.0 1695.20s - 1697.20s | in the original submission. So don't let 1697.20s - 1699.20s | them make the mistake. 1699.20s - 1701.20s | Pre-write it out. Here is why this is 1701.20s - 1703.20s | access level this. Here is why privileges 1703.20s - 1705.20s | required are this. 1705.20s - 1707.20s | If you want your bug to get triaged 1707.20s - 1709.20s | with high impact 1709.20s - 1711.20s | also do some research on what 1711.20s - 1713.20s | compliance they may be subject to and 1713.20s - 1715.20s | reference that the bug might cause them to be


chunk_text:
1677.20s | many celebrities and they very 1677.20s - 1679.20s | rarely pay them for that work or 1679.20s - 1681.20s | anything like that. 1681.20s - 1683.20s | Okay some tips and tricks 1683.20s - 1685.20s | if you are a bounty hunter. Some of you did raise your 1685.20s - 1687.20s | hand. I think like maybe 20 of you. 1687.20s - 1689.20s | So if you want to engage in debating 1689.20s - 1691.20s | criticality, one of my tips is 1691.20s - 1693.20s | pre-provide your justification 1693.20s - 1695.20s | in CVS 4.0 1695.20s - 1697.20s | in the original submission. So don't let 1697.20s - 1699.20s | them make the mistake. 1699.20s - 1701.20s | Pre-write it out. Here is why this is 1701.20s - 1703.20s | access level this. Here is why privileges 1703.20s - 1705.20s | required are this. 1705.20s - 1707.20s | If you want your bug to get triaged 1707.20s - 1709.20s | with high impact 1709.20s - 1711.20s | also do some research on what 1711.20s - 1713.20s | compliance they may be subject to and 1713.20s - 1715.20s | reference that the bug might cause them to be 1715.20s - 1717.20s | out of compliance with X, Y, and 1717.20s - 1719.20s | Z. And then write out your impact 1719.20s - 1721.20s | scenario in your bug really 1721.20s - 1723.20s | really well. Scare the shit out of them if 1723.20s - 1725.20s | you can. Use chat GPT if you have to 1725.20s - 1727.20s | do it. But do this 1727.20s - 1729.20s | and you will get paid more consistently. 1729.20s - 1732.86s | If you have a bug 1732.86s - 1734.86s | that is in a multi-use platform 1734.86s - 1736.86s | don't submit 1736.86s - 1738.86s | it to everything all at once. 1738.86s - 1740.86s | Submit it to one program 1740.86s - 1742.86s | get it paid, wait 1742.86s - 1744.86s | for a little bit and then submit it to another program 1744.86s - 1746.86s | and then wait for a little bit and then submit it 1746.86s - 1748.86s | to another program to make sure that 1748.86s - 1750.86s | they're not doing anything nefarious like sharing 1750.86s - 1752.86s | your attack strings among their customers 1752.86s - 1754.86s | and just kind of visit


chunk_text:
1715.20s - 1717.20s | out of compliance with X, Y, and 1717.20s - 1719.20s | Z. And then write out your impact 1719.20s - 1721.20s | scenario in your bug really 1721.20s - 1723.20s | really well. Scare the shit out of them if 1723.20s - 1725.20s | you can. Use chat GPT if you have to 1725.20s - 1727.20s | do it. But do this 1727.20s - 1729.20s | and you will get paid more consistently. 1729.20s - 1732.86s | If you have a bug 1732.86s - 1734.86s | that is in a multi-use platform 1734.86s - 1736.86s | don't submit 1736.86s - 1738.86s | it to everything all at once. 1738.86s - 1740.86s | Submit it to one program 1740.86s - 1742.86s | get it paid, wait 1742.86s - 1744.86s | for a little bit and then submit it to another program 1744.86s - 1746.86s | and then wait for a little bit and then submit it 1746.86s - 1748.86s | to another program to make sure that 1748.86s - 1750.86s | they're not doing anything nefarious like sharing 1750.86s - 1752.86s | your attack strings among their customers 1752.86s - 1754.86s | and just kind of visit 1754.86s - 1756.86s | and just kind of make sure that 1756.86s - 1758.86s | you can stagger your bug. 1758.86s - 1760.86s | A lot of times what customers will do is they'll say 1760.86s - 1762.86s | oh we're going to 1762.86s - 1764.86s | make one fix and it'll fix all 1764.86s - 1766.86s | these things if you shoot 1766.86s - 1768.86s | a vulnerability class at them. 1768.86s - 1770.86s | So if you stagger your reports 1770.86s - 1772.86s | and then they give you that answer 1772.86s - 1774.86s | or if you stagger your reports 1774.86s - 1776.86s | they'll fix the one bug and then you can wait a little while 1776.86s - 1778.86s | and send another one and then eventually 1778.86s - 1780.86s | if they say hey we're going to do one fix for all of this 1780.86s - 1782.86s | then you can test after 1782.86s - 1784.86s | that too. And then revisit all your old 1784.86s - 1786.86s | bugs for bypasses as well. 1786.86s - 1793.66s | Let's see here. 1793.66s - 1795.66s | Some tips if you 1795.66s - 1797.66s | want to


chunk_text:
1754.86s - 1756.86s | and just kind of make sure that 1756.86s - 1758.86s | you can stagger your bug. 1758.86s - 1760.86s | A lot of times what customers will do is they'll say 1760.86s - 1762.86s | oh we're going to 1762.86s - 1764.86s | make one fix and it'll fix all 1764.86s - 1766.86s | these things if you shoot 1766.86s - 1768.86s | a vulnerability class at them. 1768.86s - 1770.86s | So if you stagger your reports 1770.86s - 1772.86s | and then they give you that answer 1772.86s - 1774.86s | or if you stagger your reports 1774.86s - 1776.86s | they'll fix the one bug and then you can wait a little while 1776.86s - 1778.86s | and send another one and then eventually 1778.86s - 1780.86s | if they say hey we're going to do one fix for all of this 1780.86s - 1782.86s | then you can test after 1782.86s - 1784.86s | that too. And then revisit all your old 1784.86s - 1786.86s | bugs for bypasses as well. 1786.86s - 1793.66s | Let's see here. 1793.66s - 1795.66s | Some tips if you 1795.66s - 1797.66s | want to kind of go out of scope every once in a while 1797.66s - 1799.66s | or you find something that you think is out of scope 1799.66s - 1801.66s | I have used a submission 1801.66s - 1803.66s | just to ask the client a question 1803.66s - 1805.66s | which puts the bug bounty platform in a little 1805.66s - 1807.66s | bit of a weird way. I don't care it doesn't hurt 1807.66s - 1809.66s | my submission score a lot but like here's 1809.66s - 1811.66s | an example. So for State Farm 1811.66s - 1813.66s | they didn't have creds on 1813.66s - 1815.66s | GitHub in their scope 1815.66s - 1817.66s | and so I just burned a submission 1817.66s - 1819.66s | and I said hey I think I found like 20 creds 1819.66s - 1821.66s | for people in 1821.66s - 1823.66s | GitHub. 1823.66s - 1825.66s | Do you want me to submit this? 1825.66s - 1827.66s | And so then the triage team 1827.66s - 1829.66s | has to forward it to the customer and they have to answer 1829.66s - 1831.66s | it honestly. Now it has to be worded


chunk_text:
kind of go out of scope every once in a while 1797.66s - 1799.66s | or you find something that you think is out of scope 1799.66s - 1801.66s | I have used a submission 1801.66s - 1803.66s | just to ask the client a question 1803.66s - 1805.66s | which puts the bug bounty platform in a little 1805.66s - 1807.66s | bit of a weird way. I don't care it doesn't hurt 1807.66s - 1809.66s | my submission score a lot but like here's 1809.66s - 1811.66s | an example. So for State Farm 1811.66s - 1813.66s | they didn't have creds on 1813.66s - 1815.66s | GitHub in their scope 1815.66s - 1817.66s | and so I just burned a submission 1817.66s - 1819.66s | and I said hey I think I found like 20 creds 1819.66s - 1821.66s | for people in 1821.66s - 1823.66s | GitHub. 1823.66s - 1825.66s | Do you want me to submit this? 1825.66s - 1827.66s | And so then the triage team 1827.66s - 1829.66s | has to forward it to the customer and they have to answer 1829.66s - 1831.66s | it honestly. Now it has to be worded 1831.66s - 1833.66s | carefully because otherwise that could seem 1833.66s - 1835.66s | like extortion and I'm going to give 1835.66s - 1837.66s | them the bugs anyway. That's what I'm going to do. 1837.66s - 1839.66s | If they say no I'm going to be like cool 1839.66s - 1841.66s | sucks you don't take it here's 20 1841.66s - 1843.66s | things. So I'm never 1843.66s - 1845.66s | on the edge of extortion but at 1845.66s - 1847.66s | least they see it and have the opportunity to 1847.66s - 1849.66s | say okay yeah this is cool 1849.66s - 1851.66s | we'll pay this guy. That's a tip there. 1853.66s - 1855.66s | When push comes 1855.66s - 1857.66s | to shove at the end when 1857.66s - 1859.66s | you are locked out you can't make any more 1859.66s - 1861.66s | comments you've done all kinds of escalations on the 1861.66s - 1863.66s | platforms the customer is not agreeing 1863.66s - 1865.66s | with you but you still have a good bug 1865.66s - 1867.66s | well then you can ask for disclosure 1867.66s - 1869.66s | or you can just YOLO


chunk_text:
1831.66s - 1833.66s | carefully because otherwise that could seem 1833.66s - 1835.66s | like extortion and I'm going to give 1835.66s - 1837.66s | them the bugs anyway. That's what I'm going to do. 1837.66s - 1839.66s | If they say no I'm going to be like cool 1839.66s - 1841.66s | sucks you don't take it here's 20 1841.66s - 1843.66s | things. So I'm never 1843.66s - 1845.66s | on the edge of extortion but at 1845.66s - 1847.66s | least they see it and have the opportunity to 1847.66s - 1849.66s | say okay yeah this is cool 1849.66s - 1851.66s | we'll pay this guy. That's a tip there. 1853.66s - 1855.66s | When push comes 1855.66s - 1857.66s | to shove at the end when 1857.66s - 1859.66s | you are locked out you can't make any more 1859.66s - 1861.66s | comments you've done all kinds of escalations on the 1861.66s - 1863.66s | platforms the customer is not agreeing 1863.66s - 1865.66s | with you but you still have a good bug 1865.66s - 1867.66s | well then you can ask for disclosure 1867.66s - 1869.66s | or you can just YOLO disclose the bug 1869.66s - 1871.66s | via a blog post or Twitter. 1871.66s - 1873.66s | And so 1873.66s - 1875.66s | this happens often when companies 1875.66s - 1877.66s | think it's out of scope or NA 1877.66s - 1879.66s | a bug not applicable 1879.66s - 1881.66s | a bug 1881.66s - 1883.66s | and so if they think it's out of scope 1883.66s - 1885.66s | or not applicable or no security impact 1885.66s - 1887.66s | these are all the three ways they can rate it 1887.66s - 1889.66s | then by contract 1889.66s - 1891.66s | I actually don't have the right to blog about 1891.66s - 1893.66s | it on the platforms. As soon as I press 1893.66s - 1895.66s | the submit button for a vulnerability on a platform 1895.66s - 1897.66s | it belongs to the platform that data 1897.66s - 1899.66s | and that is the contract I have to sign 1899.66s - 1901.66s | but I think that we should have the right 1901.66s - 1903.66s | as bug bounty hunters to disclose if someone 1903.66s - 1905.66s | thinks it's out of scope or they don't care about


chunk_text:
disclose the bug 1869.66s - 1871.66s | via a blog post or Twitter. 1871.66s - 1873.66s | And so 1873.66s - 1875.66s | this happens often when companies 1875.66s - 1877.66s | think it's out of scope or NA 1877.66s - 1879.66s | a bug not applicable 1879.66s - 1881.66s | a bug 1881.66s - 1883.66s | and so if they think it's out of scope 1883.66s - 1885.66s | or not applicable or no security impact 1885.66s - 1887.66s | these are all the three ways they can rate it 1887.66s - 1889.66s | then by contract 1889.66s - 1891.66s | I actually don't have the right to blog about 1891.66s - 1893.66s | it on the platforms. As soon as I press 1893.66s - 1895.66s | the submit button for a vulnerability on a platform 1895.66s - 1897.66s | it belongs to the platform that data 1897.66s - 1899.66s | and that is the contract I have to sign 1899.66s - 1901.66s | but I think that we should have the right 1901.66s - 1903.66s | as bug bounty hunters to disclose if someone 1903.66s - 1905.66s | thinks it's out of scope or they don't care about it 1905.66s - 1907.66s | we should be able to write about it we spent time 1907.66s - 1909.66s | researching it and trying to help them 1909.66s - 1911.66s | and so I hope that changes over the years. 1911.66s - 1913.66s | Closing thoughts 1913.66s - 1915.66s | platforms are nothing 1915.66s - 1917.66s | without their product the hackers 1917.66s - 1919.66s | heavy education needs to happen 1919.66s - 1921.66s | to clients on what kind of the core 1921.66s - 1923.66s | of the bug bounty contract is 1923.66s - 1925.66s | better communication needs to improve 1925.66s - 1927.66s | on all platform features 1927.66s - 1929.66s | and every function of a bug bounty in the 1929.66s - 1931.66s | triage cycle and in the 1931.66s - 1933.66s | creation cycle needs to be documented 1933.66s - 1935.66s | just like source code is just like you can 1935.66s - 1937.66s | review a revision history to keep everybody 1937.66s - 1939.66s | honest 1939.66s - 1941.66s | that's it


chunk_text:
it 1905.66s - 1907.66s | we should be able to write about it we spent time 1907.66s - 1909.66s | researching it and trying to help them 1909.66s - 1911.66s | and so I hope that changes over the years. 1911.66s - 1913.66s | Closing thoughts 1913.66s - 1915.66s | platforms are nothing 1915.66s - 1917.66s | without their product the hackers 1917.66s - 1919.66s | heavy education needs to happen 1919.66s - 1921.66s | to clients on what kind of the core 1921.66s - 1923.66s | of the bug bounty contract is 1923.66s - 1925.66s | better communication needs to improve 1925.66s - 1927.66s | on all platform features 1927.66s - 1929.66s | and every function of a bug bounty in the 1929.66s - 1931.66s | triage cycle and in the 1931.66s - 1933.66s | creation cycle needs to be documented 1933.66s - 1935.66s | just like source code is just like you can 1935.66s - 1937.66s | review a revision history to keep everybody 1937.66s - 1939.66s | honest 1939.66s - 1941.66s | that's it


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=3y_6oSZwLr0", "title": "DEF CON 32 - Relative Path File Injection The Next Evolution in RPO - Ian Hickey", "description": "Most web security professionals are familiar with Relative Path Overwrite (RPO) attacks that allow injecting malicious CSS via a quirk in how browsers handle paths. But what if you could use a similar technique to get victims to download malicious files by clicking an innocuous looking download link on a trusted site? In this presentation, we'll unveil a new attack vector dubbed Relative Path File Injection (RPFI) that abuses path handling to turn benign websites into malware delivery platforms. Attendees will learn the anatomy of an RPFI attack, see demos of it in action, and learn how to detect this overlooked vulnerability class in the wild. We'll also release an open source GitHub repo with proof of concepts for users to try for themselves. RPFI represents a new breed of polyglot-based attack that exploits gaps between web specifications and real-world implementations.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1750, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 5.00s | This text was transcribed using whisper model: large-v2 So it is my pleasure to welcome Ian Hickey to the stage talking about relative path file 8.54s - 15.46s | injection, the next evolution in relative path. Right? Okay. Let's give it up. 25.24s - 30.44s | Thank you for having me today at the AppSec Village, DEF CON 32. Thank you for having 30.44s - 35.44s | AppSec Village here as well. I'm a software developer. I don't work in security. I work in 39.00s - 44.74s | ed tech. But every once in a while I like to spend some brain power looking at some 44.74s - 52.03s | security things. And the last time I was doing this in April or May, I had a couple of 52.03s - 58.87s | discoveries that I thought were interesting and I'm going to share them with you today. So 58.87s - 63.67s | many of you know that there's something called relative path overwrite. That was 63.67s - 68.67s | discovered in 2014 by Gareth Hayes of Port Swigger Research. And relative path overwrite 71.55s - 76.55s | is a way to if you can inject CSS onto an HTML page and if a website is vulnerable to path 83.13s - 88.13s | confusion, then you can actually get the default link tag


chunk_text:
path file 8.54s - 15.46s | injection, the next evolution in relative path. Right? Okay. Let's give it up. 25.24s - 30.44s | Thank you for having me today at the AppSec Village, DEF CON 32. Thank you for having 30.44s - 35.44s | AppSec Village here as well. I'm a software developer. I don't work in security. I work in 39.00s - 44.74s | ed tech. But every once in a while I like to spend some brain power looking at some 44.74s - 52.03s | security things. And the last time I was doing this in April or May, I had a couple of 52.03s - 58.87s | discoveries that I thought were interesting and I'm going to share them with you today. So 58.87s - 63.67s | many of you know that there's something called relative path overwrite. That was 63.67s - 68.67s | discovered in 2014 by Gareth Hayes of Port Swigger Research. And relative path overwrite 71.55s - 76.55s | is a way to if you can inject CSS onto an HTML page and if a website is vulnerable to path 83.13s - 88.13s | confusion, then you can actually get the default link tag in HTML to interpret the current 88.89s - 93.89s | HTML page as a CSS style sheet and under some circumstances it will execute the CSS in older 105.67s - 111.01s | Internet Explorer, used to be able to use things like an expression tag and execute 111.01s - 116.01s | JavaScript from CSS. So it was a pretty ‑‑ it was a pretty interesting way to do that. 118.25s - 123.25s | To get JavaScript execution. So what I've been looking at is Port Swigger Research has these 128.21s - 132.51s | impossible labs and one of these impossible labs I've been looking at for a couple of 132.51s - 136.71s | years and I'll go back and I'll play with different things and just see if I can make any 136.71s - 141.71s | progress on it. In this case it was ‑‑ there's context in HTML where you can't execute 142.71s - 147.71s | JavaScript. The browser won't let you. And some of those places are no scripts or within a 151.55s - 156.55s | frame set tag. It interprets ‑‑ it interprets any HTML that you can inject as just plain 161.51s - 169.70s | text.


chunk_text:
in HTML to interpret the current 88.89s - 93.89s | HTML page as a CSS style sheet and under some circumstances it will execute the CSS in older 105.67s - 111.01s | Internet Explorer, used to be able to use things like an expression tag and execute 111.01s - 116.01s | JavaScript from CSS. So it was a pretty ‑‑ it was a pretty interesting way to do that. 118.25s - 123.25s | To get JavaScript execution. So what I've been looking at is Port Swigger Research has these 128.21s - 132.51s | impossible labs and one of these impossible labs I've been looking at for a couple of 132.51s - 136.71s | years and I'll go back and I'll play with different things and just see if I can make any 136.71s - 141.71s | progress on it. In this case it was ‑‑ there's context in HTML where you can't execute 142.71s - 147.71s | JavaScript. The browser won't let you. And some of those places are no scripts or within a 151.55s - 156.55s | frame set tag. It interprets ‑‑ it interprets any HTML that you can inject as just plain 161.51s - 169.70s | text. And because it's plain text, you can't do anything with it. So the first insight 169.70s - 174.70s | that I had into this was ‑‑ see here, here's an example of a B tag but it's just text. You 177.20s - 183.54s | can't display anything. The first interesting sort of insights I had into this was actually 187.54s - 192.54s | you can execute JavaScript but you would have to have AngularJS installed. And you'd have 195.84s - 200.84s | to be using AngularJS and it's been end of life for quite some time. But you can't 201.62s - 206.62s | ‑‑ there is a way to do it. So if you have a no frames tag inside of a frame set tag and 209.34s - 214.34s | there happens to be AngularJS on the page, then you can just instantiate AngularJS and 217.50s - 222.50s | execute some JavaScript. That's cool. In the original relative path overwrite, if you needed 223.50s - 228.50s | to inject CSS into the page, and again, it didn't matter where you did it. Because in both 236.22s - 241.22s | cases, those parsers are not taking into consideration the rules that


chunk_text:
And because it's plain text, you can't do anything with it. So the first insight 169.70s - 174.70s | that I had into this was ‑‑ see here, here's an example of a B tag but it's just text. You 177.20s - 183.54s | can't display anything. The first interesting sort of insights I had into this was actually 187.54s - 192.54s | you can execute JavaScript but you would have to have AngularJS installed. And you'd have 195.84s - 200.84s | to be using AngularJS and it's been end of life for quite some time. But you can't 201.62s - 206.62s | ‑‑ there is a way to do it. So if you have a no frames tag inside of a frame set tag and 209.34s - 214.34s | there happens to be AngularJS on the page, then you can just instantiate AngularJS and 217.50s - 222.50s | execute some JavaScript. That's cool. In the original relative path overwrite, if you needed 223.50s - 228.50s | to inject CSS into the page, and again, it didn't matter where you did it. Because in both 236.22s - 241.22s | cases, those parsers are not taking into consideration the rules that the browser follows. 246.08s - 251.08s | Angular will happily execute JavaScript anywhere on the page it finds it. And in this case, 252.80s - 257.80s | when it's interpreting a HTML page as a style sheet, it doesn't care where it finds CSS, it 258.64s - 263.42s | will just execute it. So that was a starting point. And then the epiphany was sort of, okay, 263.42s - 269.30s | well, you can use other parsers to execute JavaScript within these contexts where you're not 269.30s - 275.22s | supposed to be able to do it. So what other parsers are there that will do the same thing? 275.22s - 281.46s | One thing to note about both of these things is that they're lenient parsers. Meaning it does 281.46s - 288.22s | not matter that there's HTML surrounding the thing that they're looking for. All that it 288.22s - 293.42s | matters is that it eventually finds it. So that was my starting point. What else is there? So 293.42s - 298.42s | I started making a list of all the different types of parsers there are. There's SVG parsers 301.22s - 306.22s | and XML and PDF


chunk_text:
the browser follows. 246.08s - 251.08s | Angular will happily execute JavaScript anywhere on the page it finds it. And in this case, 252.80s - 257.80s | when it's interpreting a HTML page as a style sheet, it doesn't care where it finds CSS, it 258.64s - 263.42s | will just execute it. So that was a starting point. And then the epiphany was sort of, okay, 263.42s - 269.30s | well, you can use other parsers to execute JavaScript within these contexts where you're not 269.30s - 275.22s | supposed to be able to do it. So what other parsers are there that will do the same thing? 275.22s - 281.46s | One thing to note about both of these things is that they're lenient parsers. Meaning it does 281.46s - 288.22s | not matter that there's HTML surrounding the thing that they're looking for. All that it 288.22s - 293.42s | matters is that it eventually finds it. So that was my starting point. What else is there? So 293.42s - 298.42s | I started making a list of all the different types of parsers there are. There's SVG parsers 301.22s - 306.22s | and XML and PDF and rich text and markdown and after spending more time than I would care to 306.78s - 311.78s | admit with markdown parsers, I started thinking about PDF a lot. PDF can actually be 316.90s - 321.40s | handwritten. A lot of people think of it as a binary format and there might be binary mixed in 321.40s - 326.40s | with it but you can actually just write a PDF file and as plain text. So if you have plain text 327.40s - 333.75s | injection like we're talking about here in one of these contexts such as no script, no frames, 341.55s - 346.55s | then you can inject PDF. Well, PDF can execute JavaScript. PDF can submit forms. PDF can 351.75s - 356.75s | there's tons of research into malicious PDFs. So I started playing with it. I started 357.75s - 362.75s | using it. And the second big epiphany that I had that just really surprised the shit out of me is 364.89s - 369.89s | that PDFs are also super lenient because PDFs start with these magic characters and end with 373.39s - 378.13s | magic characters. It doesn't really care what it finds before


chunk_text:
and rich text and markdown and after spending more time than I would care to 306.78s - 311.78s | admit with markdown parsers, I started thinking about PDF a lot. PDF can actually be 316.90s - 321.40s | handwritten. A lot of people think of it as a binary format and there might be binary mixed in 321.40s - 326.40s | with it but you can actually just write a PDF file and as plain text. So if you have plain text 327.40s - 333.75s | injection like we're talking about here in one of these contexts such as no script, no frames, 341.55s - 346.55s | then you can inject PDF. Well, PDF can execute JavaScript. PDF can submit forms. PDF can 351.75s - 356.75s | there's tons of research into malicious PDFs. So I started playing with it. I started 357.75s - 362.75s | using it. And the second big epiphany that I had that just really surprised the shit out of me is 364.89s - 369.89s | that PDFs are also super lenient because PDFs start with these magic characters and end with 373.39s - 378.13s | magic characters. It doesn't really care what it finds before and after that. So you can 378.13s - 385.13s | actually take this HTML document with PDF persistently injected into it and you can save 385.13s - 390.13s | this as a PDF and it will actually execute. And this is what this is here. This is just an 394.13s - 399.13s | embedded HTML file renamed as PDF and it displays as a PDF and it executes JavaScript. How 404.30s - 409.30s | many people how are you going to convince people to download an HTML file as a PDF? Like are 410.18s - 415.18s | you going to put something on the page that says right click here, save it as whatever? They 420.34s - 425.34s | just won't do it. So I started thinking about ways to get people to download these PDFs 430.72s - 435.72s | without me having to explicitly convince them of anything. And when I started thinking about 436.72s - 441.72s | the original relative path overwrite which interprets the current page as a CSS style sheet, 443.84s - 449.48s | well, the reason why it does that is because the browsers are stupid. They just whenever you 449.48s - 454.98s | return


chunk_text:
and after that. So you can 378.13s - 385.13s | actually take this HTML document with PDF persistently injected into it and you can save 385.13s - 390.13s | this as a PDF and it will actually execute. And this is what this is here. This is just an 394.13s - 399.13s | embedded HTML file renamed as PDF and it displays as a PDF and it executes JavaScript. How 404.30s - 409.30s | many people how are you going to convince people to download an HTML file as a PDF? Like are 410.18s - 415.18s | you going to put something on the page that says right click here, save it as whatever? They 420.34s - 425.34s | just won't do it. So I started thinking about ways to get people to download these PDFs 430.72s - 435.72s | without me having to explicitly convince them of anything. And when I started thinking about 436.72s - 441.72s | the original relative path overwrite which interprets the current page as a CSS style sheet, 443.84s - 449.48s | well, the reason why it does that is because the browsers are stupid. They just whenever you 449.48s - 454.98s | return back from the server it's going to use and if you happen to be using a server that when 454.98s - 460.90s | you add a forward slash at the ends returns the current page back, well, if the current page 460.90s - 465.90s | happens to be have PDF injected into it, then that's what you're going to get. So that's exactly 471.86s - 476.86s | what I did and I'm going to show you how it works now and before we even get into it, just so 479.96s - 484.96s | everyone sees because it's easier to simply see what's happening than to explain it. Someone 485.88s - 490.88s | goes to a website. There is a download link on the website and the download link happens to use a 499.88s - 506.58s | relative path. Well, if you click this download link, all that's going to happen is it's going to 506.58s - 514.12s | download whatever the file was that you intended to download and if we open this up, all this 514.82s - 524.71s | is is, you know, oh, sorry, sorry. Let's see if I can make that bigger for you. Sorry, let me


chunk_text:
back from the server it's going to use and if you happen to be using a server that when 454.98s - 460.90s | you add a forward slash at the ends returns the current page back, well, if the current page 460.90s - 465.90s | happens to be have PDF injected into it, then that's what you're going to get. So that's exactly 471.86s - 476.86s | what I did and I'm going to show you how it works now and before we even get into it, just so 479.96s - 484.96s | everyone sees because it's easier to simply see what's happening than to explain it. Someone 485.88s - 490.88s | goes to a website. There is a download link on the website and the download link happens to use a 499.88s - 506.58s | relative path. Well, if you click this download link, all that's going to happen is it's going to 506.58s - 514.12s | download whatever the file was that you intended to download and if we open this up, all this 514.82s - 524.71s | is is, you know, oh, sorry, sorry. Let's see if I can make that bigger for you. Sorry, let me go to, 543.92s - 548.92s | whoop, whoop, one second. Okay. Good PDF download. So I've downloaded this PDF and I'm 552.04s - 557.04s | going to open it with Google Chrome. It's just a normal harmless PDF. No big deal. However, all you 562.98s - 567.98s | have to do is add a forward slash at the ends and you notice it lost its styling. The reason it lost 570.66s - 575.66s | its styling is because now the browser is confused. If you look in the, if you look at what it's 576.52s - 581.52s | actually trying to include as the style sheet, what you find now is it's actually getting the 586.76s - 591.76s | current page that's relative path over it. It's confused so it's returning this back. The effect 594.10s - 599.10s | of that, once it loses its styling, is that if you now click this, it's actually going to return the 599.82s - 604.82s | current page as the PDF. Which means when someone opens this, it's not going to be the same PDF 609.10s - 618.71s | that, that they expected to open. Instead, it's going to execute JavaScript. So what


chunk_text:
go to, 543.92s - 548.92s | whoop, whoop, one second. Okay. Good PDF download. So I've downloaded this PDF and I'm 552.04s - 557.04s | going to open it with Google Chrome. It's just a normal harmless PDF. No big deal. However, all you 562.98s - 567.98s | have to do is add a forward slash at the ends and you notice it lost its styling. The reason it lost 570.66s - 575.66s | its styling is because now the browser is confused. If you look in the, if you look at what it's 576.52s - 581.52s | actually trying to include as the style sheet, what you find now is it's actually getting the 586.76s - 591.76s | current page that's relative path over it. It's confused so it's returning this back. The effect 594.10s - 599.10s | of that, once it loses its styling, is that if you now click this, it's actually going to return the 599.82s - 604.82s | current page as the PDF. Which means when someone opens this, it's not going to be the same PDF 609.10s - 618.71s | that, that they expected to open. Instead, it's going to execute JavaScript. So what just 623.11s - 628.11s | happened? Where did, where did the new PDF come from? Well, the PDF lives on the server because 629.05s - 634.05s | the HTML lives on the server and you've persistently saved PDF content into that HTML page, 639.73s - 644.73s | right? And it's sufficiently confused so when they go to download, it downloads what you want 645.57s - 650.57s | them to download instead of whatever they were trying to download. I mean, this is dangerous. If 652.07s - 657.07s | you think about it, what if this was a, what if this was a text PDF site? What if this was a text 658.11s - 663.11s | PDF site or something? It's not going to be just one link that this happens with. It'll be every 663.11s - 668.11s | link on the page that uses a relative download. As soon as they click it, it's going to download 668.11s - 674.13s | whatever that PDF is. So the things that you can do with PDF are pretty interesting, right? 674.13s - 679.13s | Depending on the PDF reader that the user happens to be using. So you have, you have something


chunk_text:
just 623.11s - 628.11s | happened? Where did, where did the new PDF come from? Well, the PDF lives on the server because 629.05s - 634.05s | the HTML lives on the server and you've persistently saved PDF content into that HTML page, 639.73s - 644.73s | right? And it's sufficiently confused so when they go to download, it downloads what you want 645.57s - 650.57s | them to download instead of whatever they were trying to download. I mean, this is dangerous. If 652.07s - 657.07s | you think about it, what if this was a, what if this was a text PDF site? What if this was a text 658.11s - 663.11s | PDF site or something? It's not going to be just one link that this happens with. It'll be every 663.11s - 668.11s | link on the page that uses a relative download. As soon as they click it, it's going to download 668.11s - 674.13s | whatever that PDF is. So the things that you can do with PDF are pretty interesting, right? 674.13s - 679.13s | Depending on the PDF reader that the user happens to be using. So you have, you have something 680.13s - 685.13s | like Fox Pro, I think it's called, that allows you to do commands when the PDF opens, right? You 693.37s - 699.21s | can execute shell commands. So there's nothing stopping you to simply populate your PDF with a 699.21s - 706.21s | launch command that executes shell commands as long as the user has permission to be doing it to do 706.21s - 711.21s | whatever you want, right? You can run scripts. You can download new scripts. You can, you know, 713.47s - 717.97s | whatever. In fact, if you want to stay in the web context, I imagine you could probably open a 717.97s - 724.15s | Chrome browser headless with the user's data set as their data and then just go explore the 724.15s - 729.15s | Internet as them, right? Because why couldn't you? So it's pretty dangerous. But thinking this 729.87s - 734.87s | through a little bit more, it's interesting that you can do it with PDF and all I did here was this 740.15s - 745.15s | would be, you know, say it's a profile page and you have some public, you know, blurb about 747.75s - 752.75s


chunk_text:
680.13s - 685.13s | like Fox Pro, I think it's called, that allows you to do commands when the PDF opens, right? You 693.37s - 699.21s | can execute shell commands. So there's nothing stopping you to simply populate your PDF with a 699.21s - 706.21s | launch command that executes shell commands as long as the user has permission to be doing it to do 706.21s - 711.21s | whatever you want, right? You can run scripts. You can download new scripts. You can, you know, 713.47s - 717.97s | whatever. In fact, if you want to stay in the web context, I imagine you could probably open a 717.97s - 724.15s | Chrome browser headless with the user's data set as their data and then just go explore the 724.15s - 729.15s | Internet as them, right? Because why couldn't you? So it's pretty dangerous. But thinking this 729.87s - 734.87s | through a little bit more, it's interesting that you can do it with PDF and all I did here was this 740.15s - 745.15s | would be, you know, say it's a profile page and you have some public, you know, blurb about 747.75s - 752.75s | yourself that you've put this PDF in. However you get the persistent content injection onto the 753.55s - 758.55s | page. But as long as it's there in some capacity and as long as you can save it as a PDF, which we can, 762.79s - 769.17s | because there's a simple download link, then it will execute. So in the original relative path 769.17s - 774.17s | overwrite, what you needed was a link tag with a relative with a relative path to the style sheet. In 775.07s - 780.07s | this case, you need an anchor tag with a relative path to the PDF. And if it's not HTML, the 787.35s - 792.35s | download has to be fully qualified. Meaning if you don't have sample PDF here as download, then it 794.65s - 799.65s | won't accept downloading the HTML as a PDF. The content disposition will be wrong. So that's the 799.65s - 804.65s | basic requirement for executing this. It has to be a page. So think like a, you know, PDF 810.39s - 816.93s | library or, you know, places where you can inject content and then it says, hey, save your whole


chunk_text:
| yourself that you've put this PDF in. However you get the persistent content injection onto the 753.55s - 758.55s | page. But as long as it's there in some capacity and as long as you can save it as a PDF, which we can, 762.79s - 769.17s | because there's a simple download link, then it will execute. So in the original relative path 769.17s - 774.17s | overwrite, what you needed was a link tag with a relative with a relative path to the style sheet. In 775.07s - 780.07s | this case, you need an anchor tag with a relative path to the PDF. And if it's not HTML, the 787.35s - 792.35s | download has to be fully qualified. Meaning if you don't have sample PDF here as download, then it 794.65s - 799.65s | won't accept downloading the HTML as a PDF. The content disposition will be wrong. So that's the 799.65s - 804.65s | basic requirement for executing this. It has to be a page. So think like a, you know, PDF 810.39s - 816.93s | library or, you know, places where you can inject content and then it says, hey, save your whole 816.93s - 821.93s | history or something like that. But this technique is going to be more useful the more file types 821.93s - 828.34s | that we find that you can do this with, right? So so PDF is great. If they happen to be using a PDF 837.42s - 843.56s | viewer that supports executing shell commands, et cetera. But there has to be other lenient 843.56s - 849.86s | parsers and lenient file types that you can use to do similar things. So then I started exploring 849.86s - 864.74s | that. So Gareth Hayes, I was talking to him about this just to make sure that he hadn't heard of it 864.74s - 870.62s | being discovered before either. And he suggested I talk to a gentleman by the name of Orange 870.62s - 875.62s | Albertini who specializes in polyglot file types. He's he's a maven. He's the type of guy that his 879.16s - 884.16s | business card, you can put it into a super Nintendo emulator. And even though it's a PDF, it'll still 884.48s - 889.48s | play in the emulator. It's crazy. And we were brainstorming other types of lenient file


chunk_text:
816.93s - 821.93s | history or something like that. But this technique is going to be more useful the more file types 821.93s - 828.34s | that we find that you can do this with, right? So so PDF is great. If they happen to be using a PDF 837.42s - 843.56s | viewer that supports executing shell commands, et cetera. But there has to be other lenient 843.56s - 849.86s | parsers and lenient file types that you can use to do similar things. So then I started exploring 849.86s - 864.74s | that. So Gareth Hayes, I was talking to him about this just to make sure that he hadn't heard of it 864.74s - 870.62s | being discovered before either. And he suggested I talk to a gentleman by the name of Orange 870.62s - 875.62s | Albertini who specializes in polyglot file types. He's he's a maven. He's the type of guy that his 879.16s - 884.16s | business card, you can put it into a super Nintendo emulator. And even though it's a PDF, it'll still 884.48s - 889.48s | play in the emulator. It's crazy. And we were brainstorming other types of lenient file types where 894.70s - 901.28s | this sort of thing might work with. And we went, you know, zip file types to tar. Tar is another 901.28s - 906.24s | like plain text one that you can sort of hand write. And it took me down this road looking at that. 906.24s - 910.46s | And while I was exploring it, I was thinking about, well, what would you put in it? Shell scripts. 910.46s - 915.46s | And then anyone who's dealt with enough shell scripts knows that shell scripts can actually be really 917.02s - 922.02s | lenient when they're run too. So what this means is if you happen to be what the user is trying to download 927.98s - 932.98s | is a shell script, and you have some sort of content injection, you can actually get them to get them to 933.50s - 938.50s | download, you know, whatever, PowerShell file or a batch file or, you know, batch scripts. And in some 951.40s - 956.40s | Linux distributions, and I'm looking at especially Windows sub WSL2 with U12, et cetera, you can 963.04s - 968.04s | actually get them to download. And with some


chunk_text:
types where 894.70s - 901.28s | this sort of thing might work with. And we went, you know, zip file types to tar. Tar is another 901.28s - 906.24s | like plain text one that you can sort of hand write. And it took me down this road looking at that. 906.24s - 910.46s | And while I was exploring it, I was thinking about, well, what would you put in it? Shell scripts. 910.46s - 915.46s | And then anyone who's dealt with enough shell scripts knows that shell scripts can actually be really 917.02s - 922.02s | lenient when they're run too. So what this means is if you happen to be what the user is trying to download 927.98s - 932.98s | is a shell script, and you have some sort of content injection, you can actually get them to get them to 933.50s - 938.50s | download, you know, whatever, PowerShell file or a batch file or, you know, batch scripts. And in some 951.40s - 956.40s | Linux distributions, and I'm looking at especially Windows sub WSL2 with U12, et cetera, you can 963.04s - 968.04s | actually get them to download. And with some of these things, it will actually happily execute an HTML 969.34s - 974.42s | file as a shell script. And it will error on every single line until it gets to something that it 974.42s - 979.42s | understands and then it will execute it. But if someone's going to a site looking to download a shell 980.80s - 985.80s | script, it's going to say, hey, download this code and then run it as a super user, right, because that's 986.46s - 991.46s | what they always say. So if they do that, and the link that they clicked happens to have a forward 995.30s - 1000.30s | slash at the end, it's susceptible to, you know, path confusion, et cetera, then the script that they 1003.54s - 1008.54s | get is an HTML page, and when they run it, it's going to run. And what that looks like is what that 1009.40s - 1015.80s | looks like is something like this where every single line, HTML, the head, all of it, errors, line by 1028.38s - 1034.66s | line by line, and then it gets to echo hello world and it executes it and then it exits and


chunk_text:
of these things, it will actually happily execute an HTML 969.34s - 974.42s | file as a shell script. And it will error on every single line until it gets to something that it 974.42s - 979.42s | understands and then it will execute it. But if someone's going to a site looking to download a shell 980.80s - 985.80s | script, it's going to say, hey, download this code and then run it as a super user, right, because that's 986.46s - 991.46s | what they always say. So if they do that, and the link that they clicked happens to have a forward 995.30s - 1000.30s | slash at the end, it's susceptible to, you know, path confusion, et cetera, then the script that they 1003.54s - 1008.54s | get is an HTML page, and when they run it, it's going to run. And what that looks like is what that 1009.40s - 1015.80s | looks like is something like this where every single line, HTML, the head, all of it, errors, line by 1028.38s - 1034.66s | line by line, and then it gets to echo hello world and it executes it and then it exits and that's it. 1034.66s - 1040.22s | By the time they realize something happened, it's going to be too late, right? So I managed to get 1040.24s - 1045.24s | this working with WSL2. I managed to get it working with PowerShell, which does the exact same thing, 1048.58s - 1054.62s | right? It will execute every single line of the HTML file because it's a PS1 file or whatever, and then 1054.62s - 1060.62s | it gets to hello world, it executes it, and then it continues, you know, just executing nonsense. The 1060.62s - 1065.64s | closest I could get it with regular Linux shells is you have to be able to inject something right after 1066.04s - 1071.04s | HTML, so it's far-fetched, but I threw it in there in case anyone has any ideas on how to get that 1075.18s - 1080.18s | working. I did actually get this similar thing working on OSX and Linux if a user is using, you know, 1086.72s - 1091.72s | Box Pro or whatever it is, because you can have a launch command that simply reads whatever it is in 1092.72s - 1097.72s | its own file and then, you


chunk_text:
that's it. 1034.66s - 1040.22s | By the time they realize something happened, it's going to be too late, right? So I managed to get 1040.24s - 1045.24s | this working with WSL2. I managed to get it working with PowerShell, which does the exact same thing, 1048.58s - 1054.62s | right? It will execute every single line of the HTML file because it's a PS1 file or whatever, and then 1054.62s - 1060.62s | it gets to hello world, it executes it, and then it continues, you know, just executing nonsense. The 1060.62s - 1065.64s | closest I could get it with regular Linux shells is you have to be able to inject something right after 1066.04s - 1071.04s | HTML, so it's far-fetched, but I threw it in there in case anyone has any ideas on how to get that 1075.18s - 1080.18s | working. I did actually get this similar thing working on OSX and Linux if a user is using, you know, 1086.72s - 1091.72s | Box Pro or whatever it is, because you can have a launch command that simply reads whatever it is in 1092.72s - 1097.72s | its own file and then, you know, executes it line by line. So it can be done. It can be done. And so 1105.10s - 1110.10s | that's, so now we have two, three, four types of files. Ideally we would have dozens, hundreds. 1113.56s - 1118.56s | There's so many file types out there to get this type of stuff working well. So I kept on, you know, 1121.74s - 1126.74s | I kept on investigating other things. What does not mind there being HTML, right? What will 1128.04s - 1133.04s | someone simply download from the internet and then throw into something and have it execute, right? 1134.72s - 1139.72s | So pretty much all server-side, server-side templating languages are like this, right? So if 1145.26s - 1150.26s | someone's looking for, you know, a Ruby or a whatever, a cold fusion script or a, you know, a 1152.20s - 1157.20s | anything else, they're probably going to grab it and then just throw it into whatever it is to test 1160.54s - 1165.88s | it, at which point it's already executed anything it needs to execute, right? And the cool thing 1165.88s - 1171.38s | there is that any of the server-side languages,


chunk_text:
know, executes it line by line. So it can be done. It can be done. And so 1105.10s - 1110.10s | that's, so now we have two, three, four types of files. Ideally we would have dozens, hundreds. 1113.56s - 1118.56s | There's so many file types out there to get this type of stuff working well. So I kept on, you know, 1121.74s - 1126.74s | I kept on investigating other things. What does not mind there being HTML, right? What will 1128.04s - 1133.04s | someone simply download from the internet and then throw into something and have it execute, right? 1134.72s - 1139.72s | So pretty much all server-side, server-side templating languages are like this, right? So if 1145.26s - 1150.26s | someone's looking for, you know, a Ruby or a whatever, a cold fusion script or a, you know, a 1152.20s - 1157.20s | anything else, they're probably going to grab it and then just throw it into whatever it is to test 1160.54s - 1165.88s | it, at which point it's already executed anything it needs to execute, right? And the cool thing 1165.88s - 1171.38s | there is that any of the server-side languages, they don't, they're expecting there to be HTML, 1171.38s - 1175.92s | right? They're expecting there to be all this, all this other stuff in there so they won't 1175.92s - 1180.92s | complain. And so these are the ones that I found that it would work with out of box, right? So 1182.56s - 1187.56s | you have this PHP. Similar thing right here, if we look at this vulnerable PHP. So all this is 1194.44s - 1199.44s | going to do, if we go here, is the safe download, let's unblock this, safe download goes ahead 1208.21s - 1213.21s | and it downloads this PHP file, open it up, show you what this, it's generated. And what this did is 1219.52s - 1224.52s | because it's server-side it already executed this and it says welcome user, no big deal. We do it 1226.26s - 1242.11s | the other way, forward slash, all of a sudden they download it, this time welcome bad guy, right? 1244.95s - 1249.95s | So there's nothing stopping you, it doesn't have to be bad guy, it could be read the contents of a 1251.29s - 1256.29s | password file, whatever, send it somewhere,


chunk_text:
they don't, they're expecting there to be HTML, 1171.38s - 1175.92s | right? They're expecting there to be all this, all this other stuff in there so they won't 1175.92s - 1180.92s | complain. And so these are the ones that I found that it would work with out of box, right? So 1182.56s - 1187.56s | you have this PHP. Similar thing right here, if we look at this vulnerable PHP. So all this is 1194.44s - 1199.44s | going to do, if we go here, is the safe download, let's unblock this, safe download goes ahead 1208.21s - 1213.21s | and it downloads this PHP file, open it up, show you what this, it's generated. And what this did is 1219.52s - 1224.52s | because it's server-side it already executed this and it says welcome user, no big deal. We do it 1226.26s - 1242.11s | the other way, forward slash, all of a sudden they download it, this time welcome bad guy, right? 1244.95s - 1249.95s | So there's nothing stopping you, it doesn't have to be bad guy, it could be read the contents of a 1251.29s - 1256.29s | password file, whatever, send it somewhere, anything you want it to. If you can get people, the 1258.99s - 1263.33s | thing that's sort of insidious about this, even though there's like user interaction that could take 1263.33s - 1268.33s | place, is that the user's going to a server that's trusted, right? There's nothing untrusted about this 1271.71s - 1277.35s | server, they've been to it a thousand times and they're clicking a download link. There's no 1277.37s - 1282.37s | difference if that, if you were able to just break into the server and replace the file, right? 1282.37s - 1287.37s | Because the effect's the same. And, but what would be really interesting is if you didn't have to do 1293.67s - 1298.67s | this whole download portion of it at all, right? And that's the hardest part, is how do you get someone 1299.67s - 1304.67s | to, you know, if someone's going to go download a PDF, click on a link and download a PDF, there's a 1309.55s - 1314.75s | high chance that they're going to go look at the PDF, right? I mean, that's what it's intended for, 1314.75s - 1319.39s | they're going to trust that whatever's in


chunk_text:
anything you want it to. If you can get people, the 1258.99s - 1263.33s | thing that's sort of insidious about this, even though there's like user interaction that could take 1263.33s - 1268.33s | place, is that the user's going to a server that's trusted, right? There's nothing untrusted about this 1271.71s - 1277.35s | server, they've been to it a thousand times and they're clicking a download link. There's no 1277.37s - 1282.37s | difference if that, if you were able to just break into the server and replace the file, right? 1282.37s - 1287.37s | Because the effect's the same. And, but what would be really interesting is if you didn't have to do 1293.67s - 1298.67s | this whole download portion of it at all, right? And that's the hardest part, is how do you get someone 1299.67s - 1304.67s | to, you know, if someone's going to go download a PDF, click on a link and download a PDF, there's a 1309.55s - 1314.75s | high chance that they're going to go look at the PDF, right? I mean, that's what it's intended for, 1314.75s - 1319.39s | they're going to trust that whatever's in there, it should be, you make a PDF that looks like a tax 1319.39s - 1325.81s | document and submits back to your server, whatever. But it would be great if they didn't have to 1325.83s - 1331.29s | download the thing in the first place. So I started thinking about how that could possibly work. 1331.29s - 1336.29s | And that's pretty tricky, right? But there's been a rise in all of these HTML over the wire sort of 1344.13s - 1349.81s | frameworks. There's live wire, there's hot wire, there's HTMX. And all of these things, what 1349.81s - 1354.81s | they're doing is they're getting HTML from the server instead of putting all the HTML client side, 1359.81s - 1364.91s | right? And the HTML they get from the server could be, you know, pre-rendered with, like, the 1364.91s - 1370.41s | user's profile picture and, you know, user name or something like that. But they're going to suffer 1373.91s - 1379.79s | the same, the same type of issue if they happen to be on a server that returns the current 1379.79s - 1385.79s | page when there's a forward slash at the end. So something


chunk_text:
there, it should be, you make a PDF that looks like a tax 1319.39s - 1325.81s | document and submits back to your server, whatever. But it would be great if they didn't have to 1325.83s - 1331.29s | download the thing in the first place. So I started thinking about how that could possibly work. 1331.29s - 1336.29s | And that's pretty tricky, right? But there's been a rise in all of these HTML over the wire sort of 1344.13s - 1349.81s | frameworks. There's live wire, there's hot wire, there's HTMX. And all of these things, what 1349.81s - 1354.81s | they're doing is they're getting HTML from the server instead of putting all the HTML client side, 1359.81s - 1364.91s | right? And the HTML they get from the server could be, you know, pre-rendered with, like, the 1364.91s - 1370.41s | user's profile picture and, you know, user name or something like that. But they're going to suffer 1373.91s - 1379.79s | the same, the same type of issue if they happen to be on a server that returns the current 1379.79s - 1385.79s | page when there's a forward slash at the end. So something like that, what it would look like is, 1396.58s - 1402.58s | so I'm not using any of the frameworks. This is just straight jQuery. But what this does is, when 1405.00s - 1411.00s | the, when the page loads, it attempts to get some, get some DOM element and then inject it into 1417.44s - 1423.44s | this main div, right? And again, it's the same thing. All we're doing is, you know, doing a, you 1429.28s - 1435.28s | don't need to do this. All it's doing is just, you know, using jQuery HTML, just setting the HTML. 1437.28s - 1449.36s | No big deal. And if we go look at what this script does, what's that? There's nothing on this page. 1450.36s - 1456.36s | There's literally nothing on this page. So all this does is it doesn't do anything initially. You can 1460.78s - 1469.59s | see when it goes to get the, let me see if I can make this bigger. Excuse me? Oh, gotcha, gotcha. 1473.63s - 1480.17s | So, so nothing too interesting is happening on this page yet. It gets jQuery. It reaches out and 1480.17s - 1485.37s | it gets this


chunk_text:
like that, what it would look like is, 1396.58s - 1402.58s | so I'm not using any of the frameworks. This is just straight jQuery. But what this does is, when 1405.00s - 1411.00s | the, when the page loads, it attempts to get some, get some DOM element and then inject it into 1417.44s - 1423.44s | this main div, right? And again, it's the same thing. All we're doing is, you know, doing a, you 1429.28s - 1435.28s | don't need to do this. All it's doing is just, you know, using jQuery HTML, just setting the HTML. 1437.28s - 1449.36s | No big deal. And if we go look at what this script does, what's that? There's nothing on this page. 1450.36s - 1456.36s | There's literally nothing on this page. So all this does is it doesn't do anything initially. You can 1460.78s - 1469.59s | see when it goes to get the, let me see if I can make this bigger. Excuse me? Oh, gotcha, gotcha. 1473.63s - 1480.17s | So, so nothing too interesting is happening on this page yet. It gets jQuery. It reaches out and 1480.17s - 1485.37s | it gets this thing that says welcome user. No big deal. And then it tries to inject the welcome 1485.37s - 1491.37s | user into the page. But you add a forward slash on to the end and now it actually gets the current 1494.71s - 1505.77s | page. And one second. Let's see what just happened. What did I do? Oh, there it goes. So, so in 1506.35s - 1516.12s | this case what just happened is when it reached out to get it, the, the ID that it found was for a 1527.96s - 1534.36s | frame set and HTML is probably the most lenient parser of all because it has this really weird 1534.36s - 1540.36s | behavior where if you try to inject HTML tags into other HTML tags that it doesn't like, it will 1541.70s - 1547.70s | simply strip those tags away. And that's exactly what happened here is because when it 1550.98s - 1563.16s | founds, whoop, it's not letting me leave. Okay. Whoop. Yeah, so when it founds the, the string 1570.54s - 1576.54s | frame set, it, when it injected it into this main tag, it actually stripped the frame set away. So 1577.74s


chunk_text:
thing that says welcome user. No big deal. And then it tries to inject the welcome 1485.37s - 1491.37s | user into the page. But you add a forward slash on to the end and now it actually gets the current 1494.71s - 1505.77s | page. And one second. Let's see what just happened. What did I do? Oh, there it goes. So, so in 1506.35s - 1516.12s | this case what just happened is when it reached out to get it, the, the ID that it found was for a 1527.96s - 1534.36s | frame set and HTML is probably the most lenient parser of all because it has this really weird 1534.36s - 1540.36s | behavior where if you try to inject HTML tags into other HTML tags that it doesn't like, it will 1541.70s - 1547.70s | simply strip those tags away. And that's exactly what happened here is because when it 1550.98s - 1563.16s | founds, whoop, it's not letting me leave. Okay. Whoop. Yeah, so when it founds the, the string 1570.54s - 1576.54s | frame set, it, when it injected it into this main tag, it actually stripped the frame set away. So 1577.74s - 1582.70s | even though the browser is saying hey, this frame set is completely innocuous, we're just going to 1582.70s - 1588.70s | treat it like text, the framework itself can take that and inject it automatically. So, there's 1590.12s - 1596.70s | places where maybe you weren't concerned about people getting content injection before but now you 1596.70s - 1600.48s | have to be worried about it. And how do you mitigate something like this? Well, there's all the 1600.48s - 1606.48s | standard ways to mitigate it. Like one, you have to stop using, either use a base tag so that things 1608.90s - 1614.82s | aren't relative. They have a, things aren't relative. You can make them root relative by adding a 1614.82s - 1620.82s | forward slash at the beginning, right? Content security policy, all these things, you have to do 1621.06s - 1627.06s | something. But also educating people, you can't actually trust a file download if it's using a 1628.90s - 1634.90s | relative, if it's using a relative path. So, basic mitigations in place. Yeah. All the, all the 1635.72s - 1644.38s | basic mitigations, so path handling, it's important to check


chunk_text:
- 1582.70s | even though the browser is saying hey, this frame set is completely innocuous, we're just going to 1582.70s - 1588.70s | treat it like text, the framework itself can take that and inject it automatically. So, there's 1590.12s - 1596.70s | places where maybe you weren't concerned about people getting content injection before but now you 1596.70s - 1600.48s | have to be worried about it. And how do you mitigate something like this? Well, there's all the 1600.48s - 1606.48s | standard ways to mitigate it. Like one, you have to stop using, either use a base tag so that things 1608.90s - 1614.82s | aren't relative. They have a, things aren't relative. You can make them root relative by adding a 1614.82s - 1620.82s | forward slash at the beginning, right? Content security policy, all these things, you have to do 1621.06s - 1627.06s | something. But also educating people, you can't actually trust a file download if it's using a 1628.90s - 1634.90s | relative, if it's using a relative path. So, basic mitigations in place. Yeah. All the, all the 1635.72s - 1644.38s | basic mitigations, so path handling, it's important to check if the server that you're using is 1657.06s - 1663.30s | vulnerable to this type of path handling. If you add a forward slash at the end of the URL and it 1663.30s - 1669.30s | loses all of its styling, it's a pretty good indication that it has this issue. Default PHP 1669.30s - 1675.30s | server has this issue. I did make a GitHub for this. If anyone wants to play with it themselves, 1675.30s - 1683.63s | you can find it on GitHub. Yeah. So, this is a novel file injection vector. I figured out a 1683.91s - 1689.91s | number of server side scripts, shell scripts, PDFs, but there has to be, there has to be dozens 1700.37s - 1707.29s | more if, you know, people want to explore it. I rarely do bug bounties because I don't work in 1707.33s - 1713.33s | security. So I do do it sometimes. But it feels like a job to me. So, so I try not to. I would 1715.25s - 1721.83s | imagine there's a number of these vulnerabilities that you can go and find. If you're so 1721.83s - 1727.83s | inclined, no one's ever looked


chunk_text:
if the server that you're using is 1657.06s - 1663.30s | vulnerable to this type of path handling. If you add a forward slash at the end of the URL and it 1663.30s - 1669.30s | loses all of its styling, it's a pretty good indication that it has this issue. Default PHP 1669.30s - 1675.30s | server has this issue. I did make a GitHub for this. If anyone wants to play with it themselves, 1675.30s - 1683.63s | you can find it on GitHub. Yeah. So, this is a novel file injection vector. I figured out a 1683.91s - 1689.91s | number of server side scripts, shell scripts, PDFs, but there has to be, there has to be dozens 1700.37s - 1707.29s | more if, you know, people want to explore it. I rarely do bug bounties because I don't work in 1707.33s - 1713.33s | security. So I do do it sometimes. But it feels like a job to me. So, so I try not to. I would 1715.25s - 1721.83s | imagine there's a number of these vulnerabilities that you can go and find. If you're so 1721.83s - 1727.83s | inclined, no one's ever looked for them before. So, yeah. I think, I think that there's a lot 1730.61s - 1736.21s | more that can be done there with the shell scripts on Linux to figure out how to get them to 1736.21s - 1742.21s | execute. And, yeah. I think if any of you do bug bounties, you should go out and try to find 1743.95s - 1745.71s | it. And that is my talk.


chunk_text:
for them before. So, yeah. I think, I think that there's a lot 1730.61s - 1736.21s | more that can be done there with the shell scripts on Linux to figure out how to get them to 1736.21s - 1742.21s | execute. And, yeah. I think if any of you do bug bounties, you should go out and try to find 1743.95s - 1745.71s | it. And that is my talk.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=bVKtcu82a8w", "title": "DEF CON 32 -Ticking SQLi - Iggy", "description": "Explore the intricacies of time-based SQL injection through the lens of Operation GhostShell. This session delves into the methods used by attackers to exploit time delays for data extraction, highlighting real-world examples and the impact of these breaches on major universities. Attendees will gain a deep understanding of the technical aspects, see live demonstrations, and learn practical defense strategies to safeguard against such vulnerabilities. Perfect for security professionals seeking to enhance their knowledge of advanced SQLi techniques and mitigation.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1508, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.66s - 7.68s | This text was transcribed using whisper model: large-v2 Alright folks, it is that time. If you have a seat that is in between you, please collapse 7.68s - 14.18s | down. Specifically you sir, thank you very much. If you would bring it in close. Alright 14.18s - 18.96s | with that we are gonna go ahead and kick everything off. I would like to introduce Iggy to the 18.96s - 20.96s | stage. Thank you. 20.96s - 35.44s | So hello DEF CON and welcome to my talk called Ticking SQLI. And we will begin. So what's 35.44s - 41.36s | in it for you today? Today we will explore types of SQL injection. We will focus a bit 41.36s - 48.40s | on time based SQL injection. We will see the impact team Ghost Shell did in the past using 48.40s - 53.08s | these kinds of techniques. We will understand why it's still relevant today and you will 53.08s - 60.20s | have a good time with a pretty much good presenter today. So who am I? My name is Igor but please 60.20s - 66.60s | call me Iggy. It's my nickname since childhood. I'm a security engineer at Axonius. One sentence 66.60s - 74.56s | about Axonius is it's a cyber security asset management platform that maps all your digital 74.56s - 79.72s | assets across your organization, normalize them, deduplicate them and give you comprehensive 79.72s - 85.24s | insights about them and much more. And why I'm here today? I'm here today because I love 85.24s - 92.32s | learning stuff and especially in cyber security. Since from low level to high level, from lock 92.32s - 98.88s | picking to RFIDs and I'm studying a lot


chunk_text:
will begin. So what's 35.44s - 41.36s | in it for you today? Today we will explore types of SQL injection. We will focus a bit 41.36s - 48.40s | on time based SQL injection. We will see the impact team Ghost Shell did in the past using 48.40s - 53.08s | these kinds of techniques. We will understand why it's still relevant today and you will 53.08s - 60.20s | have a good time with a pretty much good presenter today. So who am I? My name is Igor but please 60.20s - 66.60s | call me Iggy. It's my nickname since childhood. I'm a security engineer at Axonius. One sentence 66.60s - 74.56s | about Axonius is it's a cyber security asset management platform that maps all your digital 74.56s - 79.72s | assets across your organization, normalize them, deduplicate them and give you comprehensive 79.72s - 85.24s | insights about them and much more. And why I'm here today? I'm here today because I love 85.24s - 92.32s | learning stuff and especially in cyber security. Since from low level to high level, from lock 92.32s - 98.88s | picking to RFIDs and I'm studying a lot and for my studies I came to this idea to talk 98.88s - 104.28s | about this topic today. And the last thing about me, it's the first time I'm presenting 104.28s - 110.00s | so thank you AppSecVillage for giving me this opportunity today to be in such an honorable 110.00s - 117.28s | stage as AppSecVillage and DEF CON. I truly appreciate it. And we'll begin. We'll begin 117.28s - 123.88s | by introducing what is SQL injection. SQL injection is a technique where attackers insert 123.88s - 130.88s | malicious SQL code into some input fields. It can be login forms, search boxes or URL 130.88s - 139.00s | parameters and they do it mainly to retrieve sensitive information from the database for 139.00s - 147.32s | the application. They can retrieve sensitive information, delete tables and a lot of things 147.32s - 154.16s | that we'll see in the next slides. But the bottom line here is the attackers using some 154.16s - 159.92s | malicious SQL payload to manipulate the web application and the database behind it to 159.92s - 175.84s | retrieve some and to do some sensitive operations. The example that I like


chunk_text:
and for my studies I came to this idea to talk 98.88s - 104.28s | about this topic today. And the last thing about me, it's the first time I'm presenting 104.28s - 110.00s | so thank you AppSecVillage for giving me this opportunity today to be in such an honorable 110.00s - 117.28s | stage as AppSecVillage and DEF CON. I truly appreciate it. And we'll begin. We'll begin 117.28s - 123.88s | by introducing what is SQL injection. SQL injection is a technique where attackers insert 123.88s - 130.88s | malicious SQL code into some input fields. It can be login forms, search boxes or URL 130.88s - 139.00s | parameters and they do it mainly to retrieve sensitive information from the database for 139.00s - 147.32s | the application. They can retrieve sensitive information, delete tables and a lot of things 147.32s - 154.16s | that we'll see in the next slides. But the bottom line here is the attackers using some 154.16s - 159.92s | malicious SQL payload to manipulate the web application and the database behind it to 159.92s - 175.84s | retrieve some and to do some sensitive operations. The example that I like the most to show what 175.88s - 181.20s | it is SQL injection is to see how it looks through the code. We have a query where the username 181.20s - 186.76s | and the password flows to its parameters. In the UI it looks something like this. You get a 186.76s - 193.68s | login form. It's like to demonstrate the most basic type of SQL injection. You have the 193.68s - 199.72s | username, you can enter admin and some malicious payload to the password that basically means 199.72s - 207.68s | a single quote and some old condition that always evaluates to true. This flows to the query. 207.68s - 213.52s | The username gets the admin and the password gets some payload that always evaluates to true 213.52s - 219.80s | and by that the attacker can bypass the authentication because it's sending it to the web 219.80s - 229.91s | application that's sending it to its database and it retrieves authentication bypass. We have 229.91s - 236.95s | some different types of SQL injection. First type called in-band or classic what essentially 236.95s - 244.55s | it means that you see the results of your


chunk_text:
the most to show what 175.88s - 181.20s | it is SQL injection is to see how it looks through the code. We have a query where the username 181.20s - 186.76s | and the password flows to its parameters. In the UI it looks something like this. You get a 186.76s - 193.68s | login form. It's like to demonstrate the most basic type of SQL injection. You have the 193.68s - 199.72s | username, you can enter admin and some malicious payload to the password that basically means 199.72s - 207.68s | a single quote and some old condition that always evaluates to true. This flows to the query. 207.68s - 213.52s | The username gets the admin and the password gets some payload that always evaluates to true 213.52s - 219.80s | and by that the attacker can bypass the authentication because it's sending it to the web 219.80s - 229.91s | application that's sending it to its database and it retrieves authentication bypass. We have 229.91s - 236.95s | some different types of SQL injection. First type called in-band or classic what essentially 236.95s - 244.55s | it means that you see the results of your payload directly in HTTP response. Actually it also 244.55s - 252.03s | can be served as self-category but I want to stick as many resources I'll state in it. So we 252.03s - 257.47s | have the in-band that you see the response directly into the web application. It also divided 257.51s - 267.51s | into two categories. One of them is error-based. Error-based what it means is that you rely on 267.51s - 276.31s | errors that you retrieve from the database to see some sensitive information and you have a 276.31s - 282.31s | union-based type. What it means in general we will in a second see demonstration for this but in 282.31s - 290.63s | one sentence union-based is concatenating two data, two data or tables into one that contains 290.63s - 297.95s | both of them or we can say that it's two select statements that combined into one result. We 297.95s - 306.15s | combine to some expected data additional concatenation of a table that retrieves sensitive 306.19s - 313.99s | information. We will see it in the next slides. So to demonstrate error-based SQL injection we 313.99s - 321.99s | can see that we


chunk_text:
payload directly in HTTP response. Actually it also 244.55s - 252.03s | can be served as self-category but I want to stick as many resources I'll state in it. So we 252.03s - 257.47s | have the in-band that you see the response directly into the web application. It also divided 257.51s - 267.51s | into two categories. One of them is error-based. Error-based what it means is that you rely on 267.51s - 276.31s | errors that you retrieve from the database to see some sensitive information and you have a 276.31s - 282.31s | union-based type. What it means in general we will in a second see demonstration for this but in 282.31s - 290.63s | one sentence union-based is concatenating two data, two data or tables into one that contains 290.63s - 297.95s | both of them or we can say that it's two select statements that combined into one result. We 297.95s - 306.15s | combine to some expected data additional concatenation of a table that retrieves sensitive 306.19s - 313.99s | information. We will see it in the next slides. So to demonstrate error-based SQL injection we 313.99s - 321.99s | can see that we we should try to probe the application. Most of the times we will try through 321.99s - 326.83s | one single quote and two single quotes is the most type of entry points but you have additional 326.83s - 333.19s | entry points and comments and you starting to get a sense of some error-based attack when you 333.19s - 341.95s | get from the one single quote uh five hundred internal server error and and for the double 341.95s - 347.27s | single quotes uh two hundred okay. What it means that the SQL query behind it in the backend 347.27s - 355.35s | cannot uh uh process the uh the query correctly because it's not expected to receive five 355.35s - 361.15s | hundred internal server error and if you close it in single quotes it suddenly is okay. So there 361.15s - 367.03s | are some probably manipulation that you can do on on the SQL. So we'll try to do some 367.03s - 373.39s | manipulation. We can send a curl command that uh looks a bit messy but it's very simple. It's 373.39s - 378.95s | uh trying to convert the version uh function that


chunk_text:
we should try to probe the application. Most of the times we will try through 321.99s - 326.83s | one single quote and two single quotes is the most type of entry points but you have additional 326.83s - 333.19s | entry points and comments and you starting to get a sense of some error-based attack when you 333.19s - 341.95s | get from the one single quote uh five hundred internal server error and and for the double 341.95s - 347.27s | single quotes uh two hundred okay. What it means that the SQL query behind it in the backend 347.27s - 355.35s | cannot uh uh process the uh the query correctly because it's not expected to receive five 355.35s - 361.15s | hundred internal server error and if you close it in single quotes it suddenly is okay. So there 361.15s - 367.03s | are some probably manipulation that you can do on on the SQL. So we'll try to do some 367.03s - 373.39s | manipulation. We can send a curl command that uh looks a bit messy but it's very simple. It's 373.39s - 378.95s | uh trying to convert the version uh function that you send to the database to retrieve its 378.95s - 385.35s | version. You try to convert it to an integer and compare it to one just the so the well 385.35s - 390.43s | closed will operate correctly. Uh it will look something like this when it flows to the 390.43s - 400.43s | query and you get the error uh conversion conversion failed. You get the MySQL that the 400.43s - 406.07s | server uses MySQL with a specific version and by this by this will retrieve a sensitive 406.07s - 411.35s | information. Uh I want to state here that uh something important. I stick to this example 411.35s - 416.09s | of uh of retrieving the version of the database in many additional slides that you will see 416.09s - 420.73s | later. I like this example because it's not too basic and not too advanced. It's something in 420.73s - 425.73s | the middle so it's easy to show it but in this techniques you can do something even more 425.73s - 431.21s | advanced to retrieve hash passwords and so on. So but we'll stick to the version because it's 431.21s - 438.41s |


chunk_text:
you send to the database to retrieve its 378.95s - 385.35s | version. You try to convert it to an integer and compare it to one just the so the well 385.35s - 390.43s | closed will operate correctly. Uh it will look something like this when it flows to the 390.43s - 400.43s | query and you get the error uh conversion conversion failed. You get the MySQL that the 400.43s - 406.07s | server uses MySQL with a specific version and by this by this will retrieve a sensitive 406.07s - 411.35s | information. Uh I want to state here that uh something important. I stick to this example 411.35s - 416.09s | of uh of retrieving the version of the database in many additional slides that you will see 416.09s - 420.73s | later. I like this example because it's not too basic and not too advanced. It's something in 420.73s - 425.73s | the middle so it's easy to show it but in this techniques you can do something even more 425.73s - 431.21s | advanced to retrieve hash passwords and so on. So but we'll stick to the version because it's 431.21s - 438.41s | truly a real world example on one hand but on the other hand it's not too complex. So now we'll 438.41s - 443.41s | move to the union based as we showed before and this uh presenting uh expected regular uh 446.15s - 452.15s | curl command to a server that I build. We send query equals to Alice and we'll retrieve some 452.15s - 458.33s | expected information. But when we try to manipulate with a union uh attack we will edit a 458.33s - 463.33s | union select the first oh the user that is currently connected to the database uh through the 464.33s - 469.33s | web application uh we of course need to encode it and send it to the server and that's what we 472.97s - 479.97s | get. We get the Alice the query equals to Alice as we see so before and we get the current user 479.97s - 485.17s | that's connected to the database for the web application and this is information that not 485.17s - 490.19s | supposed to be retrieved especially so easy so this is how union based attack looks like. 491.19s - 498.19s | After that we


chunk_text:
truly a real world example on one hand but on the other hand it's not too complex. So now we'll 438.41s - 443.41s | move to the union based as we showed before and this uh presenting uh expected regular uh 446.15s - 452.15s | curl command to a server that I build. We send query equals to Alice and we'll retrieve some 452.15s - 458.33s | expected information. But when we try to manipulate with a union uh attack we will edit a 458.33s - 463.33s | union select the first oh the user that is currently connected to the database uh through the 464.33s - 469.33s | web application uh we of course need to encode it and send it to the server and that's what we 472.97s - 479.97s | get. We get the Alice the query equals to Alice as we see so before and we get the current user 479.97s - 485.17s | that's connected to the database for the web application and this is information that not 485.17s - 490.19s | supposed to be retrieved especially so easy so this is how union based attack looks like. 491.19s - 498.19s | After that we have many resources uh dividing into these categories uh one of them is out of 498.19s - 503.19s | band I won't uh elaborate about it too much because it's something not so popular but to say it uh to 506.57s - 511.81s | explain it in one or two sentences out of band attacks are the kind of attacks that you cannot 511.81s - 516.91s | communicate with the web application the server directly and you need to utilize some external 516.93s - 523.33s | server to exfiltrate data through the database and you use uh some HTTP request and DNS 523.33s - 530.11s | queries to exfiltrate this data but it's something much uh not so common so we won't elaborate 530.11s - 535.11s | about it too much. Uh the third kind uh inferential or blind uh type of SQL injection is in 537.25s - 543.69s | general a bit of the opposite of the in band of course it's type of attacks that you cannot um uh 543.71s - 548.91s | see your payload or the results of your payload directly in the webpage and you need to infill the 548.91s - 555.15s | results of


chunk_text:
have many resources uh dividing into these categories uh one of them is out of 498.19s - 503.19s | band I won't uh elaborate about it too much because it's something not so popular but to say it uh to 506.57s - 511.81s | explain it in one or two sentences out of band attacks are the kind of attacks that you cannot 511.81s - 516.91s | communicate with the web application the server directly and you need to utilize some external 516.93s - 523.33s | server to exfiltrate data through the database and you use uh some HTTP request and DNS 523.33s - 530.11s | queries to exfiltrate this data but it's something much uh not so common so we won't elaborate 530.11s - 535.11s | about it too much. Uh the third kind uh inferential or blind uh type of SQL injection is in 537.25s - 543.69s | general a bit of the opposite of the in band of course it's type of attacks that you cannot um uh 543.71s - 548.91s | see your payload or the results of your payload directly in the webpage and you need to infill the 548.91s - 555.15s | results of your payload uh from the behavior of the web application. It is divided to two 555.15s - 560.15s | categories one of them is boolean based uh I will explain that by example uh but generally 563.49s - 569.53s | speaking it's evaluates your payload to true or false uh in some way of behavior of the web 569.57s - 576.31s | application and like that you can infill the results uh to see example of it uh I will show you by 576.31s - 581.31s | demonstrating on B-Web it's a buggy web application it's a cool application to practice on you can 583.55s - 588.55s | see here a payload of substring uh to the version of the database uh in short what it means it's uh 590.89s - 595.89s | takes the version, checks the fields character and compare it's uh to six in this case and comments 596.29s - 601.29s | all the rest. We flow it to the search field and we see that the movie does not exist. But when we 607.47s - 613.53s | change the six to a five and we'll flow it again to the search box we get that the


chunk_text:
your payload uh from the behavior of the web application. It is divided to two 555.15s - 560.15s | categories one of them is boolean based uh I will explain that by example uh but generally 563.49s - 569.53s | speaking it's evaluates your payload to true or false uh in some way of behavior of the web 569.57s - 576.31s | application and like that you can infill the results uh to see example of it uh I will show you by 576.31s - 581.31s | demonstrating on B-Web it's a buggy web application it's a cool application to practice on you can 583.55s - 588.55s | see here a payload of substring uh to the version of the database uh in short what it means it's uh 590.89s - 595.89s | takes the version, checks the fields character and compare it's uh to six in this case and comments 596.29s - 601.29s | all the rest. We flow it to the search field and we see that the movie does not exist. But when we 607.47s - 613.53s | change the six to a five and we'll flow it again to the search box we get that the movie does 613.53s - 618.71s | exist. So we can infill by that that when you're comparing to fives the first character of the 618.71s - 624.59s | version of the database is starting with a five. And this kind of uh in this kind of blind SQL 624.59s - 629.59s | injections uh you need uh enumerate uh enumerate uh each character and uh until you get the whole 632.67s - 640.64s | picture uh but that's how it looks like. And the last type of uh influential blind that we'll focus 642.98s - 648.98s | a bit more today called time based. Time based is in a way it's similar to Boolean based but it relies 648.98s - 653.98s | on a time delays that you get from the server and that's how you can infill your uh SQL payload uh 654.48s - 659.48s | by sending a time delay of for example uh ten seconds the database is delayed with this it's 662.72s - 668.52s | response for ten seconds and that's how you can infill if your payload was evaluated to true or 668.52s - 676.12s | false. Uh and that's how a time blind SQL


chunk_text:
movie does 613.53s - 618.71s | exist. So we can infill by that that when you're comparing to fives the first character of the 618.71s - 624.59s | version of the database is starting with a five. And this kind of uh in this kind of blind SQL 624.59s - 629.59s | injections uh you need uh enumerate uh enumerate uh each character and uh until you get the whole 632.67s - 640.64s | picture uh but that's how it looks like. And the last type of uh influential blind that we'll focus 642.98s - 648.98s | a bit more today called time based. Time based is in a way it's similar to Boolean based but it relies 648.98s - 653.98s | on a time delays that you get from the server and that's how you can infill your uh SQL payload uh 654.48s - 659.48s | by sending a time delay of for example uh ten seconds the database is delayed with this it's 662.72s - 668.52s | response for ten seconds and that's how you can infill if your payload was evaluated to true or 668.52s - 676.12s | false. Uh and that's how a time blind SQL injection will look like. Uh to my web server I added uh a 679.70s - 685.00s | parameter of elapsed time to see how much it takes to the server to respond. So in particular 685.02s - 690.02s | query uh where it equals to Alice the elapsed time was immediate but when we try to run a time based 692.70s - 697.70s | payload uh uh for example that will look like this with uh closing single quote uh so the SQL uh 700.30s - 705.84s | payload will operate uh normally and a sleep command that causes the the server to delay for five 705.84s - 710.84s | seconds we encode it and we will uh construct in the URL sending it back and we can suddenly see that 715.02s - 720.32s | with the sleep command of five seconds the elapsed time was five seconds. So in general what it 720.32s - 725.32s | means that the time delay was successfully executed. Uh before we continue about time delays I want to 727.00s - 732.00s | elaborate a bit about tools to be connected. Uh there are many tools to uh uncover SQL injection 734.50s - 739.50s


chunk_text:
injection will look like. Uh to my web server I added uh a 679.70s - 685.00s | parameter of elapsed time to see how much it takes to the server to respond. So in particular 685.02s - 690.02s | query uh where it equals to Alice the elapsed time was immediate but when we try to run a time based 692.70s - 697.70s | payload uh uh for example that will look like this with uh closing single quote uh so the SQL uh 700.30s - 705.84s | payload will operate uh normally and a sleep command that causes the the server to delay for five 705.84s - 710.84s | seconds we encode it and we will uh construct in the URL sending it back and we can suddenly see that 715.02s - 720.32s | with the sleep command of five seconds the elapsed time was five seconds. So in general what it 720.32s - 725.32s | means that the time delay was successfully executed. Uh before we continue about time delays I want to 727.00s - 732.00s | elaborate a bit about tools to be connected. Uh there are many tools to uh uncover SQL injection 734.50s - 739.50s | one of them is a bit less popular uh called Havij. I decided to include it because when I research 740.14s - 745.14s | about Tim Goschel uh some resources stated they use this tool and I never met it before and it's a 749.32s - 754.32s | tool that was used back then uh few years ago but it's still uh people can use it today but it's much 755.66s - 760.66s | less popular or good tool. Uh we have uh many dust tools like uh uh personally here is uh a 761.66s - 766.66s | belt suit by Paul Swigel that can scan your site uh it's a dust tool and find SQL injection as we 773.04s - 779.18s | see here in the picture that I scanned my uh web server. But the most uh common tool for SQL 779.18s - 784.18s | injection and uncovering them is called SQL map. Uh I'm so happy that I uh zoomed in on what's 784.88s - 789.88s | relevant so SQL map will look something like this. Uh you'll run SQL command on the URL that you 793.88s - 798.86s | want to scan. In this example


chunk_text:
| one of them is a bit less popular uh called Havij. I decided to include it because when I research 740.14s - 745.14s | about Tim Goschel uh some resources stated they use this tool and I never met it before and it's a 749.32s - 754.32s | tool that was used back then uh few years ago but it's still uh people can use it today but it's much 755.66s - 760.66s | less popular or good tool. Uh we have uh many dust tools like uh uh personally here is uh a 761.66s - 766.66s | belt suit by Paul Swigel that can scan your site uh it's a dust tool and find SQL injection as we 773.04s - 779.18s | see here in the picture that I scanned my uh web server. But the most uh common tool for SQL 779.18s - 784.18s | injection and uncovering them is called SQL map. Uh I'm so happy that I uh zoomed in on what's 784.88s - 789.88s | relevant so SQL map will look something like this. Uh you'll run SQL command on the URL that you 793.88s - 798.86s | want to scan. In this example we see batch command that what it means is uh non-interactive 798.86s - 803.86s | command that uh won't interfere in the process of executing and please retrieve us the database 805.62s - 810.64s | version. When we run it we can see that uh SQL map uncovers that we have a Boolean based uh time 811.10s - 816.10s | based and union union attack seal and we see the stuff that we wanted to retrieve that the 819.34s - 824.34s | database uses uh SQLite behind the curtain. Uh to show you of course SQL map can do a bit more 826.78s - 831.78s | advanced stuff like in this example uh we can execute SQL map with uh time delay of five 832.44s - 837.44s | seconds. I'll run it with a batch command as before and leave please uh return us the banner of 843.48s - 848.48s | the database and we can see that it successfully works. We can retrieve the banner of uh the 850.92s - 857.83s | two equals to eight point three point zero. And before I continue to the next slides I want to 857.91s - 863.95s | emphasize something important that


chunk_text:
we see batch command that what it means is uh non-interactive 798.86s - 803.86s | command that uh won't interfere in the process of executing and please retrieve us the database 805.62s - 810.64s | version. When we run it we can see that uh SQL map uncovers that we have a Boolean based uh time 811.10s - 816.10s | based and union union attack seal and we see the stuff that we wanted to retrieve that the 819.34s - 824.34s | database uses uh SQLite behind the curtain. Uh to show you of course SQL map can do a bit more 826.78s - 831.78s | advanced stuff like in this example uh we can execute SQL map with uh time delay of five 832.44s - 837.44s | seconds. I'll run it with a batch command as before and leave please uh return us the banner of 843.48s - 848.48s | the database and we can see that it successfully works. We can retrieve the banner of uh the 850.92s - 857.83s | two equals to eight point three point zero. And before I continue to the next slides I want to 857.91s - 863.95s | emphasize something important that uh for my personal opinion we cannot realize on uh many 863.95s - 870.09s | automation tools. Uh we always need to have the ability to write our own scripts to some 870.09s - 875.79s | particular cases we don't need to be afraid and like in a perfect world we need to master a 875.79s - 882.07s | combination of the two. We can master the automating tools and writing our own scripts. And a 882.07s - 888.35s | script of uh executing time delay can look something uh simple as as this. We can have a 888.35s - 894.33s | script with of course some constants and uh some expected parameters but in general it will be 894.33s - 900.13s | divided to three functions. One function that will check the delay of the HTTP response and 900.13s - 905.97s | will record it. The second function will extract the version character it uh takes the position 905.97s - 911.91s | that we are checking in our payload uh it compares it to the character, character uh 911.91s - 917.21s | enumerates for all the ASCII's. It compares to the position in the version that we want to


chunk_text:
uh for my personal opinion we cannot realize on uh many 863.95s - 870.09s | automation tools. Uh we always need to have the ability to write our own scripts to some 870.09s - 875.79s | particular cases we don't need to be afraid and like in a perfect world we need to master a 875.79s - 882.07s | combination of the two. We can master the automating tools and writing our own scripts. And a 882.07s - 888.35s | script of uh executing time delay can look something uh simple as as this. We can have a 888.35s - 894.33s | script with of course some constants and uh some expected parameters but in general it will be 894.33s - 900.13s | divided to three functions. One function that will check the delay of the HTTP response and 900.13s - 905.97s | will record it. The second function will extract the version character it uh takes the position 905.97s - 911.91s | that we are checking in our payload uh it compares it to the character, character uh 911.91s - 917.21s | enumerates for all the ASCII's. It compares to the position in the version that we want to 917.21s - 922.23s | retrieve. If it got the sleep time then it means that we successfully executed it or if not uh it 924.55s - 929.57s | didn't work. And the first function it's uh uh continues to enumerate all the next indexes in 930.43s - 937.61s | the version number and recalls the version that we are retrieving of the database. And 937.61s - 944.62s | eventually it will look something like this when we're running it. Extracting the database 944.62s - 952.62s | version. So it's very simple, simple as that uh as we can see. Uh to move to a bit uh more real 957.06s - 964.06s | world examples I want to show you uh few stuff. One of them a real world example uh of a 964.06s - 970.62s | guy called Mola here is uh YouTube and uh his uh site. I really like to learn about uh real 970.62s - 976.02s | world examples because it uh really demonstrates what's what's we need, what's truly 976.02s - 983.16s | important. And here he claims that he earned a bounty of five thousand dollars uh finding the 983.16s - 990.04s | next payload


chunk_text:
917.21s - 922.23s | retrieve. If it got the sleep time then it means that we successfully executed it or if not uh it 924.55s - 929.57s | didn't work. And the first function it's uh uh continues to enumerate all the next indexes in 930.43s - 937.61s | the version number and recalls the version that we are retrieving of the database. And 937.61s - 944.62s | eventually it will look something like this when we're running it. Extracting the database 944.62s - 952.62s | version. So it's very simple, simple as that uh as we can see. Uh to move to a bit uh more real 957.06s - 964.06s | world examples I want to show you uh few stuff. One of them a real world example uh of a 964.06s - 970.62s | guy called Mola here is uh YouTube and uh his uh site. I really like to learn about uh real 970.62s - 976.02s | world examples because it uh really demonstrates what's what's we need, what's truly 976.02s - 983.16s | important. And here he claims that he earned a bounty of five thousand dollars uh finding the 983.16s - 990.04s | next payload that you will see to in a first billing uh site. He uh what he claims that he did 990.06s - 996.80s | to execute this bounty he ran a sleep command that we saw before uh concatenated to some uh 996.80s - 1003.14s | parameter that the site had uh per page equals to one and executed time delay. He got truly uh 1003.14s - 1009.44s | five seconds delay. Then he executed this payload. This this payload is exactly as the substring 1009.44s - 1015.42s | we saw before. The mid is equals to the substring but uh particular to my SQL version. And it 1015.44s - 1020.54s | checks the version fills character uh if it equals to five go to sleep for fifteen seconds. If 1020.54s - 1027.58s | not return zero. And in this case he doesn't he didn't get uh any delay. But when he uh changed 1027.58s - 1033.42s | the five to eight he could successfully gain uh fifteen seconds delay and by that he gained the 1033.42s - 1042.04s | bounty. Just to show you a bit more real world examples uh one of them uh looks something like 1042.08s -


chunk_text:
that you will see to in a first billing uh site. He uh what he claims that he did 990.06s - 996.80s | to execute this bounty he ran a sleep command that we saw before uh concatenated to some uh 996.80s - 1003.14s | parameter that the site had uh per page equals to one and executed time delay. He got truly uh 1003.14s - 1009.44s | five seconds delay. Then he executed this payload. This this payload is exactly as the substring 1009.44s - 1015.42s | we saw before. The mid is equals to the substring but uh particular to my SQL version. And it 1015.44s - 1020.54s | checks the version fills character uh if it equals to five go to sleep for fifteen seconds. If 1020.54s - 1027.58s | not return zero. And in this case he doesn't he didn't get uh any delay. But when he uh changed 1027.58s - 1033.42s | the five to eight he could successfully gain uh fifteen seconds delay and by that he gained the 1033.42s - 1042.04s | bounty. Just to show you a bit more real world examples uh one of them uh looks something like 1042.08s - 1048.52s | this. It's some bounty that uses XOR interesting uh payload that always evaluates to true. And 1048.52s - 1055.16s | some bounty that was discovered in department of uh defense uh in HackerOne system. The second 1055.16s - 1062.14s | one was uh pretty simple uh concatenation to uh expected parameters of uh sleep seven seconds 1062.14s - 1067.14s | also disclosed to HackerOne um and found in the automatic uh website. And the third one my 1067.82s - 1072.82s | favorite uh combines uh script, union, and sleep commands. Uh some build uh combination of 1078.12s - 1086.41s | both of all of them. Uh ah and the third bounty gained uh what I found from uh resources when I 1089.35s - 1094.35s | checked it uh got bounty of two thousand and one hundred dollars. So uh all of the stuff that we 1094.71s - 1099.71s | seen was utilized by uh Tim Goshell in the past uh they used a lot of SQL injection 1104.55s - 1110.29s | especially time delays. Something even uh what they did uh they was they were operating uh in 1110.29s - 1116.67s | two thousand and twelve. And they


chunk_text:
1048.52s | this. It's some bounty that uses XOR interesting uh payload that always evaluates to true. And 1048.52s - 1055.16s | some bounty that was discovered in department of uh defense uh in HackerOne system. The second 1055.16s - 1062.14s | one was uh pretty simple uh concatenation to uh expected parameters of uh sleep seven seconds 1062.14s - 1067.14s | also disclosed to HackerOne um and found in the automatic uh website. And the third one my 1067.82s - 1072.82s | favorite uh combines uh script, union, and sleep commands. Uh some build uh combination of 1078.12s - 1086.41s | both of all of them. Uh ah and the third bounty gained uh what I found from uh resources when I 1089.35s - 1094.35s | checked it uh got bounty of two thousand and one hundred dollars. So uh all of the stuff that we 1094.71s - 1099.71s | seen was utilized by uh Tim Goshell in the past uh they used a lot of SQL injection 1104.55s - 1110.29s | especially time delays. Something even uh what they did uh they was they were operating uh in 1110.29s - 1116.67s | two thousand and twelve. And they utilized even simpler uh SQL commands that we SQL injection 1116.67s - 1123.27s | commands than than what we saw before. And as I said they were operating in two thousand and 1123.29s - 1128.33s | twelve. They are not related to APT39 or some Iranian government. They actually were a 1128.33s - 1133.33s | hacktivist group. Um I'm just curious how many people of you uh know what hacktivism is? Please 1136.27s - 1141.27s | raise your hands. Okay okay not bad. Approximately half. So hacktivism is uh when you attacking 1144.31s - 1150.59s | group that uh trying to promote some uh political change or some social agenda that you believe 1150.67s - 1156.95s | in and you promote it by hacking. And that's what Tim Goshell were. They were a hacktivist 1156.95s - 1163.65s | collective. And just to see what they did and who they were uh they started to operate in two 1163.65s - 1168.63s | thousand and twelve. They hacked the University of Arkansas uh because some one of the guys 1168.63s - 1175.33s | there uh called Zoom was arrested. So they hacked it in terms of protest. Uh after the dead 1175.35s


chunk_text:
utilized even simpler uh SQL commands that we SQL injection 1116.67s - 1123.27s | commands than than what we saw before. And as I said they were operating in two thousand and 1123.29s - 1128.33s | twelve. They are not related to APT39 or some Iranian government. They actually were a 1128.33s - 1133.33s | hacktivist group. Um I'm just curious how many people of you uh know what hacktivism is? Please 1136.27s - 1141.27s | raise your hands. Okay okay not bad. Approximately half. So hacktivism is uh when you attacking 1144.31s - 1150.59s | group that uh trying to promote some uh political change or some social agenda that you believe 1150.67s - 1156.95s | in and you promote it by hacking. And that's what Tim Goshell were. They were a hacktivist 1156.95s - 1163.65s | collective. And just to see what they did and who they were uh they started to operate in two 1163.65s - 1168.63s | thousand and twelve. They hacked the University of Arkansas uh because some one of the guys 1168.63s - 1175.33s | there uh called Zoom was arrested. So they hacked it in terms of protest. Uh after the dead 1175.35s - 1182.85s | Melox uh uh was will appealed was appealed. Uh dead Melox was the admin of the group. He 1182.85s - 1188.15s | appealed in their uh main communication channel uh in Facebin stating that he doesn't in 1188.15s - 1192.63s | ironic way that he doesn't want to fight with FBI or CIA or something like this. But on the 1192.63s - 1197.63s | other hand we we leak bunch of stuff uh in the uh coming year. So as he promised he started uh 1198.61s - 1203.61s | they started to uh make additional hacking projects. Uh they uh had the project Dragonfly 1208.41s - 1215.15s | where they hacked uh China government and leaked uh thousands of uh sensitive information. 1215.15s - 1221.13s | Uh it included like hash passwords, some personal data and like everything they got. Later 1221.13s - 1226.27s | Hellfire in project Hellfire they hacked uh governments, financial sectors and uh other 1226.27s - 1231.35s | companies. In project West Wing they focused on universities around the globe from 1231.35s - 1236.35s | Harvard, Stanford to University of Rome in Tokyo. And they even declared a war uh in project 1238.55s


chunk_text:
- 1182.85s | Melox uh uh was will appealed was appealed. Uh dead Melox was the admin of the group. He 1182.85s - 1188.15s | appealed in their uh main communication channel uh in Facebin stating that he doesn't in 1188.15s - 1192.63s | ironic way that he doesn't want to fight with FBI or CIA or something like this. But on the 1192.63s - 1197.63s | other hand we we leak bunch of stuff uh in the uh coming year. So as he promised he started uh 1198.61s - 1203.61s | they started to uh make additional hacking projects. Uh they uh had the project Dragonfly 1208.41s - 1215.15s | where they hacked uh China government and leaked uh thousands of uh sensitive information. 1215.15s - 1221.13s | Uh it included like hash passwords, some personal data and like everything they got. Later 1221.13s - 1226.27s | Hellfire in project Hellfire they hacked uh governments, financial sectors and uh other 1226.27s - 1231.35s | companies. In project West Wing they focused on universities around the globe from 1231.35s - 1236.35s | Harvard, Stanford to University of Rome in Tokyo. And they even declared a war uh in project 1238.55s - 1243.55s | Black Star against Russia. Uh in in all of these projects they hacked like uh they uh leaked 1248.43s - 1253.43s | uh thousands to millions of uh records from uh personal information to hash passwords as I 1253.73s - 1258.73s | said before but many of this information was publicly already disclosed. Still on this other 1261.83s - 1267.33s | hand it was uh sensitive information that truly was uh released but what they achieved from 1267.33s - 1272.35s | it it uh they achieved their main cause to raise uh awareness to their hacktivism and to their 1274.05s - 1279.89s | operations. So later they in project White Fox they basically hacked everyone to raise 1279.91s - 1284.91s | awareness to hacktivism and they uh introduced their uh new cool logo. Later came Sunrise 1289.25s - 1294.25s | hacked South Africa. Uh 2015 introduced a new term of dark hacktivism that raising the normal 1295.75s - 1300.75s | hacktivism into cyber warfare levels in a much more scale. And in 2016 this story came to an end 1302.39s - 1308.23s | when the dead Melox the leader came clean. He came clean to some uh


chunk_text:
- 1243.55s | Black Star against Russia. Uh in in all of these projects they hacked like uh they uh leaked 1248.43s - 1253.43s | uh thousands to millions of uh records from uh personal information to hash passwords as I 1253.73s - 1258.73s | said before but many of this information was publicly already disclosed. Still on this other 1261.83s - 1267.33s | hand it was uh sensitive information that truly was uh released but what they achieved from 1267.33s - 1272.35s | it it uh they achieved their main cause to raise uh awareness to their hacktivism and to their 1274.05s - 1279.89s | operations. So later they in project White Fox they basically hacked everyone to raise 1279.91s - 1284.91s | awareness to hacktivism and they uh introduced their uh new cool logo. Later came Sunrise 1289.25s - 1294.25s | hacked South Africa. Uh 2015 introduced a new term of dark hacktivism that raising the normal 1295.75s - 1300.75s | hacktivism into cyber warfare levels in a much more scale. And in 2016 this story came to an end 1302.39s - 1308.23s | when the dead Melox the leader came clean. He came clean to some uh newspaper uh send them an 1308.25s - 1313.81s | email that hi it's me I'm uh Eugene the man who behind the dead Melox the leader of Tim 1313.81s - 1320.39s | Goshell he sent his passport and even a picture. They still didn't believe them him so he posted 1320.39s - 1325.19s | on his Twitter account to the uh next web the journal that he came clean to that hello it's 1325.19s - 1331.92s | truly me. So why why they did what they did uh as typical for hacktivism for example Westwind 1332.76s - 1337.76s | the hack to uh raise awareness oops raise awareness to the foreign standards of the education 1342.70s - 1347.70s | today. In Black Star they uh uh claimed that the Russian is a government of tyranny and uh and 1350.34s - 1355.34s | regret they uh criticized their government. In White Fox uh essentially they wanted to promote 1355.68s - 1360.68s | hacktivism worldwide and draw attention to the freedom of uh information and they had many 1364.88s - 1369.88s | other causes like even on Japan they wanted to piss them off just just as it is. So why the


chunk_text:
newspaper uh send them an 1308.25s - 1313.81s | email that hi it's me I'm uh Eugene the man who behind the dead Melox the leader of Tim 1313.81s - 1320.39s | Goshell he sent his passport and even a picture. They still didn't believe them him so he posted 1320.39s - 1325.19s | on his Twitter account to the uh next web the journal that he came clean to that hello it's 1325.19s - 1331.92s | truly me. So why why they did what they did uh as typical for hacktivism for example Westwind 1332.76s - 1337.76s | the hack to uh raise awareness oops raise awareness to the foreign standards of the education 1342.70s - 1347.70s | today. In Black Star they uh uh claimed that the Russian is a government of tyranny and uh and 1350.34s - 1355.34s | regret they uh criticized their government. In White Fox uh essentially they wanted to promote 1355.68s - 1360.68s | hacktivism worldwide and draw attention to the freedom of uh information and they had many 1364.88s - 1369.88s | other causes like even on Japan they wanted to piss them off just just as it is. So why the hell 1372.38s - 1377.86s | the I want you all of you to know this today. I know that you are thinking SQL injection is old 1377.86s - 1384.86s | and Tim Goshell was operated in 2012 but I will show you that what is old is still worth gold. Uh 1384.88s - 1390.22s | we can see some statistics you know as top 10 uh SQL injection is part of the injection section 1390.22s - 1399.10s | it's still on the top uh in many years it was the first one and now it's like the third one. Ah 1399.10s - 1404.10s | whoops I didn't like confuse me for a second. Yes? There was? Okay. NVD is ranking uh SQL 1406.54s - 1411.54s | injection uh ranking it uh in the second place for many many years. Uh it considered one of the 1412.16s - 1417.16s | most stubborn weaknesses ranked in the third place uh by Mitre and um GitHub security 1422.30s - 1427.34s | advisor also stating that and it's truly stated that SQL injection is not relevant to model 1427.34s - 1432.92s | languages like Vue, React, Python and stuff like this but for my


chunk_text:
hell 1372.38s - 1377.86s | the I want you all of you to know this today. I know that you are thinking SQL injection is old 1377.86s - 1384.86s | and Tim Goshell was operated in 2012 but I will show you that what is old is still worth gold. Uh 1384.88s - 1390.22s | we can see some statistics you know as top 10 uh SQL injection is part of the injection section 1390.22s - 1399.10s | it's still on the top uh in many years it was the first one and now it's like the third one. Ah 1399.10s - 1404.10s | whoops I didn't like confuse me for a second. Yes? There was? Okay. NVD is ranking uh SQL 1406.54s - 1411.54s | injection uh ranking it uh in the second place for many many years. Uh it considered one of the 1412.16s - 1417.16s | most stubborn weaknesses ranked in the third place uh by Mitre and um GitHub security 1422.30s - 1427.34s | advisor also stating that and it's truly stated that SQL injection is not relevant to model 1427.34s - 1432.92s | languages like Vue, React, Python and stuff like this but for my opinion what important to know 1432.92s - 1438.42s | here that the concepts or uh the mindset that you set for yourself when you are learning about 1438.44s - 1444.84s | these attacks can be implemented to many other fields because they are all related uh you can use 1444.84s - 1451.12s | similar techniques to other attacks. And if I still didn't convince you, you can earn bug 1451.12s - 1457.22s | bounties easily using those kinds of techniques like this one uh was disclosed critical 1457.22s - 1464.05s | vulnerability to Department of Defense and so we are coming to an end and I want to leave you 1464.05s - 1469.11s | with some homework. I don't want to state here uh 10 resources but I want to state one and good 1469.15s - 1475.09s | one that uh I use, I don't get money by Boltzweigle by the way, I truly recommend them because 1475.09s - 1480.09s | it's free resource uh theoretical and practical combined, very recommended and it dives deep. So 1482.67s - 1489.67s | to recap, it's hard to make a 25 minute lecture because I want to talk about many stuff and I


chunk_text:
opinion what important to know 1432.92s - 1438.42s | here that the concepts or uh the mindset that you set for yourself when you are learning about 1438.44s - 1444.84s | these attacks can be implemented to many other fields because they are all related uh you can use 1444.84s - 1451.12s | similar techniques to other attacks. And if I still didn't convince you, you can earn bug 1451.12s - 1457.22s | bounties easily using those kinds of techniques like this one uh was disclosed critical 1457.22s - 1464.05s | vulnerability to Department of Defense and so we are coming to an end and I want to leave you 1464.05s - 1469.11s | with some homework. I don't want to state here uh 10 resources but I want to state one and good 1469.15s - 1475.09s | one that uh I use, I don't get money by Boltzweigle by the way, I truly recommend them because 1475.09s - 1480.09s | it's free resource uh theoretical and practical combined, very recommended and it dives deep. So 1482.67s - 1489.67s | to recap, it's hard to make a 25 minute lecture because I want to talk about many stuff and I only 1489.67s - 1495.71s | have 25 minutes so I tried my best and if you gain even one small little thing today I will be 1495.71s - 1500.75s | genuinely happy and that's it if you want to connect with me like LinkedIn and Twitter and that's it.


chunk_text:
only 1489.67s - 1495.71s | have 25 minutes so I tried my best and if you gain even one small little thing today I will be 1495.71s - 1500.75s | genuinely happy and that's it if you want to connect with me like LinkedIn and Twitter and that's it.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=WG_oXtUTEoI", "title": "DEF CON 32 - Transforming AppSec Protecting 'Everything as Code' - Kunal Bhattacharya", "description": "The continuous adoption of emerging technological trends like Mobile, IoT, Cloud, Blockchains, and now GenAI has transformed application security from simple threat modeling and SAST/DAST scans to comprehensive proactive prevention and real-time detection of security anomalies. This panel will discuss the dynamic nature of AppSec as the lines between traditional infrastructure and cloud environments blur. We will explore the importance of maintaining a comprehensive security posture within 'everything as code' ecosystems, emphasizing proper configuration and secret management to secure infrastructure effectively.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2698, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.11s - 3.11s | This text was transcribed using whisper model: large-v2 Hi, my name is Kunal Bhattacharya. 3.11s - 6.11s | I'm a senior security leader and advisor. 6.11s - 9.11s | My security journey has been pretty long. 9.11s - 13.11s | Before I came into security, I've done a bunch of different things. 13.11s - 18.11s | I was a developer, was a sysadmin, was a QA architect. 18.11s - 22.11s | I finally moved to security and never looked back. 22.11s - 27.11s | I also have had the privilege of building a homegrown bug bounty program 27.11s - 31.11s | before the likes of HackerOne. I don't know if they are the sponsor. 31.11s - 36.11s | And then eventually moved into a lot of the security stuff. 36.11s - 42.11s | And I just consider myself to be a lifelong learner. 42.11s - 50.11s | Apart from security, I guess I'm an avid runner, swimmer, dad, whatever. 50.11s - 55.11s | Yeah, so that's me. Sarah, you want to introduce yourself? 55.11s - 57.11s | Hey, everyone. My name is Sarah Dharzadeh. 57.11s - 59.11s | I lead vulnerability management at DocuSign. 59.11s - 64.11s | I've been in the vulnerability management space specifically for about five years 64.11s - 67.11s | and really passionate about infrastructure security, 67.11s - 71.11s | about patch automation, and also emergent vulnerability response. 71.11s - 73.11s | As it relates to everything as code, 73.11s - 78.11s | my first introduction to everything as code was infrastructure as code. 78.11s - 81.11s | When I was building patch workflows in AWS, 81.11s - 85.11s | utilizing everything, all of my resources were deployed using CloudFormation. 85.11s -


chunk_text:
have had the privilege of building a homegrown bug bounty program 27.11s - 31.11s | before the likes of HackerOne. I don't know if they are the sponsor. 31.11s - 36.11s | And then eventually moved into a lot of the security stuff. 36.11s - 42.11s | And I just consider myself to be a lifelong learner. 42.11s - 50.11s | Apart from security, I guess I'm an avid runner, swimmer, dad, whatever. 50.11s - 55.11s | Yeah, so that's me. Sarah, you want to introduce yourself? 55.11s - 57.11s | Hey, everyone. My name is Sarah Dharzadeh. 57.11s - 59.11s | I lead vulnerability management at DocuSign. 59.11s - 64.11s | I've been in the vulnerability management space specifically for about five years 64.11s - 67.11s | and really passionate about infrastructure security, 67.11s - 71.11s | about patch automation, and also emergent vulnerability response. 71.11s - 73.11s | As it relates to everything as code, 73.11s - 78.11s | my first introduction to everything as code was infrastructure as code. 78.11s - 81.11s | When I was building patch workflows in AWS, 81.11s - 85.11s | utilizing everything, all of my resources were deployed using CloudFormation. 85.11s - 90.54s | So I'm really passionate about this talk as well. 90.54s - 93.54s | Hi, everyone. My name is Shaka Aman, 93.54s - 97.54s | and I'm the CEO and co-founder of Backslash Security. 97.54s - 103.08s | Backslash is doing reachability-based AppSec. 103.08s - 109.08s | What do I want for AppSec? 109.08s - 111.08s | How about now? Better? 111.08s - 120.91s | Hi. Can you hear me at the back? Perfect. 120.91s - 125.91s | So, again, Shaka Aman, co-founder and CEO of Backslash Security. 125.91s - 131.91s | Previously, I was leading the engineering team of a company called Aqua Security, 131.91s - 135.91s | including the product management for putting out there 135.91s - 138.91s | very nice open-source tools for the community, 138.91s - 141.91s | like Trivi, CubeHunter, if you're using some of those. 141.91s - 145.91s | And most of my career I spent with the enterprise leading engineering team, 145.91s - 150.91s | mainly at SAP, both in Germany and Tel Aviv. 150.91s - 152.91s | Happy to be here today. 152.91s - 157.15s | Thank you, Shahal. 157.15s - 159.15s | Before I introduce myself, 159.15s - 162.15s |


chunk_text:
90.54s | So I'm really passionate about this talk as well. 90.54s - 93.54s | Hi, everyone. My name is Shaka Aman, 93.54s - 97.54s | and I'm the CEO and co-founder of Backslash Security. 97.54s - 103.08s | Backslash is doing reachability-based AppSec. 103.08s - 109.08s | What do I want for AppSec? 109.08s - 111.08s | How about now? Better? 111.08s - 120.91s | Hi. Can you hear me at the back? Perfect. 120.91s - 125.91s | So, again, Shaka Aman, co-founder and CEO of Backslash Security. 125.91s - 131.91s | Previously, I was leading the engineering team of a company called Aqua Security, 131.91s - 135.91s | including the product management for putting out there 135.91s - 138.91s | very nice open-source tools for the community, 138.91s - 141.91s | like Trivi, CubeHunter, if you're using some of those. 141.91s - 145.91s | And most of my career I spent with the enterprise leading engineering team, 145.91s - 150.91s | mainly at SAP, both in Germany and Tel Aviv. 150.91s - 152.91s | Happy to be here today. 152.91s - 157.15s | Thank you, Shahal. 157.15s - 159.15s | Before I introduce myself, 159.15s - 162.15s | it's an absolute honor and privilege to be here 162.15s - 166.15s | and sharing stage with these seasoned leaders. 166.15s - 170.15s | But I do want to take 10 seconds to express silent gratitude 170.15s - 172.15s | to our awesome volunteers. 172.15s - 177.15s | So let's have a big round of applause for our volunteers. 177.15s - 185.13s | You know, they spend a lot of hours for these operations to run smoothly. 185.13s - 188.13s | And I really want to make sure their efforts 188.13s - 193.13s | and all the hard work they put shouldn't get unrecognized. 193.13s - 200.46s | So thank you again, all the awesome volunteers of DEF CON. 200.46s - 202.46s | Everyone, my name is Trukti. 202.46s - 205.46s | I'm director of product security at DocuSign. 205.46s - 211.46s | And before entering the awesome field of software security, 211.46s - 214.46s | 18 years back, I was a mobile game developer. 214.46s - 218.46s | So I'm a developer turned cybersecurity professional. 218.46s - 220.46s | And I absolutely love doing security. 220.46s - 222.46s | I don't know what else I'll do. 222.46s - 224.46s


chunk_text:
it's an absolute honor and privilege to be here 162.15s - 166.15s | and sharing stage with these seasoned leaders. 166.15s - 170.15s | But I do want to take 10 seconds to express silent gratitude 170.15s - 172.15s | to our awesome volunteers. 172.15s - 177.15s | So let's have a big round of applause for our volunteers. 177.15s - 185.13s | You know, they spend a lot of hours for these operations to run smoothly. 185.13s - 188.13s | And I really want to make sure their efforts 188.13s - 193.13s | and all the hard work they put shouldn't get unrecognized. 193.13s - 200.46s | So thank you again, all the awesome volunteers of DEF CON. 200.46s - 202.46s | Everyone, my name is Trukti. 202.46s - 205.46s | I'm director of product security at DocuSign. 205.46s - 211.46s | And before entering the awesome field of software security, 211.46s - 214.46s | 18 years back, I was a mobile game developer. 214.46s - 218.46s | So I'm a developer turned cybersecurity professional. 218.46s - 220.46s | And I absolutely love doing security. 220.46s - 222.46s | I don't know what else I'll do. 222.46s - 224.46s | It's a passion. It's a purpose. 224.46s - 227.46s | I even call this is my Ikegai. 227.46s - 229.46s | When I'm not doing security, 229.46s - 234.46s | I like to paint, do nature work, and meditate. 234.46s - 236.46s | So that's about me. 236.46s - 239.46s | Thanks, everyone, for the introduction. 239.46s - 241.46s | We have some veterans here. 241.46s - 244.46s | So quickly jumping to the topic. 244.46s - 247.46s | AppSec, it's a very loaded term these days. 247.46s - 251.46s | And people ask me, what is AppSec? 251.46s - 255.46s | And why do you want to transform it? 255.46s - 257.46s | So what is AppSec? 257.46s - 260.46s | It is application security, as everyone knows. 260.46s - 265.46s | I want to talk about how AppSec has been in the past 265.46s - 267.46s | and what we are seeing now as trends. 267.46s - 272.46s | And what do we anticipate how things will be going forward? 272.46s - 276.46s | Probably like a prediction from the veterans here. 276.46s - 281.46s | With that said, we'll get to the questions that I had.


chunk_text:
| It's a passion. It's a purpose. 224.46s - 227.46s | I even call this is my Ikegai. 227.46s - 229.46s | When I'm not doing security, 229.46s - 234.46s | I like to paint, do nature work, and meditate. 234.46s - 236.46s | So that's about me. 236.46s - 239.46s | Thanks, everyone, for the introduction. 239.46s - 241.46s | We have some veterans here. 241.46s - 244.46s | So quickly jumping to the topic. 244.46s - 247.46s | AppSec, it's a very loaded term these days. 247.46s - 251.46s | And people ask me, what is AppSec? 251.46s - 255.46s | And why do you want to transform it? 255.46s - 257.46s | So what is AppSec? 257.46s - 260.46s | It is application security, as everyone knows. 260.46s - 265.46s | I want to talk about how AppSec has been in the past 265.46s - 267.46s | and what we are seeing now as trends. 267.46s - 272.46s | And what do we anticipate how things will be going forward? 272.46s - 276.46s | Probably like a prediction from the veterans here. 276.46s - 281.46s | With that said, we'll get to the questions that I had. 281.46s - 284.46s | What are the key challenges in securing everything as code? 284.46s - 286.46s | Nowadays, everything is code. 286.46s - 287.46s | Policy is code. 287.46s - 289.46s | Code is code, for sure. 290.46s - 295.46s | Including things like ISE, GitOps, serverless. 295.46s - 297.46s | What are the bigger challenges that exist today? 297.46s - 301.06s | Sarah, do you want to take that? 301.06s - 305.06s | So I'd say before the popularization of everything as code, 305.06s - 308.06s | I think things were a lot more straightforward and clean-cut. 308.06s - 313.06s | I think in terms of separation of roles and duties, 313.06s - 317.06s | the network engineer versus the application developer 317.06s - 319.06s | versus security versus ops. 319.06s - 323.06s | Those had very specific clean-cut roles and responsibilities. 323.06s - 327.06s | And the understanding of what their assets were 327.06s - 331.06s | and how they applied to them was also really straightforward. 331.06s - 334.06s | And then on the security side, similarly, 334.06s - 336.06s | because of that same asset delineation, 336.06s - 340.06s | I think knowing what we


chunk_text:
281.46s - 284.46s | What are the key challenges in securing everything as code? 284.46s - 286.46s | Nowadays, everything is code. 286.46s - 287.46s | Policy is code. 287.46s - 289.46s | Code is code, for sure. 290.46s - 295.46s | Including things like ISE, GitOps, serverless. 295.46s - 297.46s | What are the bigger challenges that exist today? 297.46s - 301.06s | Sarah, do you want to take that? 301.06s - 305.06s | So I'd say before the popularization of everything as code, 305.06s - 308.06s | I think things were a lot more straightforward and clean-cut. 308.06s - 313.06s | I think in terms of separation of roles and duties, 313.06s - 317.06s | the network engineer versus the application developer 317.06s - 319.06s | versus security versus ops. 319.06s - 323.06s | Those had very specific clean-cut roles and responsibilities. 323.06s - 327.06s | And the understanding of what their assets were 327.06s - 331.06s | and how they applied to them was also really straightforward. 331.06s - 334.06s | And then on the security side, similarly, 334.06s - 336.06s | because of that same asset delineation, 336.06s - 340.06s | I think knowing what we were going to run assessments on 340.06s - 342.06s | tended to be a lot more straightforward. 342.06s - 344.06s | We knew what we were going to run, where we were going to run it, 344.06s - 348.06s | how we were going to run it, what those scans were going to produce. 348.06s - 354.06s | And that made things a lot more easy to process. 354.06s - 358.06s | In terms of today, I see three main challenges with everything as code. 358.06s - 364.06s | I think the first thing is that there's really no longer that separation of duties. 364.06s - 368.06s | So everybody is sort of speaking in similar languages. 368.06s - 371.06s | Some may be more familiar with those languages than others. 371.06s - 376.06s | A lot of people are going to be learning completely new languages, 376.06s - 378.06s | all of us at the same time. 378.06s - 382.06s | And that can present challenges in terms of understanding who owns what, 382.06s - 385.06s | how do we get the right context to the right people, 385.06s - 390.06s | and who's going to ultimately do remediation


chunk_text:
were going to run assessments on 340.06s - 342.06s | tended to be a lot more straightforward. 342.06s - 344.06s | We knew what we were going to run, where we were going to run it, 344.06s - 348.06s | how we were going to run it, what those scans were going to produce. 348.06s - 354.06s | And that made things a lot more easy to process. 354.06s - 358.06s | In terms of today, I see three main challenges with everything as code. 358.06s - 364.06s | I think the first thing is that there's really no longer that separation of duties. 364.06s - 368.06s | So everybody is sort of speaking in similar languages. 368.06s - 371.06s | Some may be more familiar with those languages than others. 371.06s - 376.06s | A lot of people are going to be learning completely new languages, 376.06s - 378.06s | all of us at the same time. 378.06s - 382.06s | And that can present challenges in terms of understanding who owns what, 382.06s - 385.06s | how do we get the right context to the right people, 385.06s - 390.06s | and who's going to ultimately do remediation work. 390.06s - 392.06s | In terms of other challenges that I see, 392.06s - 397.06s | I think data is another big one on the security side. 397.06s - 403.06s | With everything as code, we are just producing a crap ton of data, 403.06s - 405.06s | especially on the vulnerability management side. 406.06s - 410.06s | Unfortunately, I think a lot of security budgets don't include a ton of money 410.06s - 414.06s | for really awesome data architects to help us make sense of it all. 414.06s - 418.06s | So how do we normalize and correlate all of this data? 418.06s - 421.06s | How do we build complex data models? 421.06s - 427.06s | How do we ensure that we have good performance against all of our data sets? 427.06s - 429.06s | That's another really big challenge. 429.06s - 430.06s | Yeah. 430.06s - 431.06s | That's it. 431.06s - 433.06s | Some big things in mind. 433.06s - 434.06s | Thanks, Sarah. 434.06s - 435.06s | That was very good. 435.06s - 438.06s | You talked about the data side, which, of course, goes into AI. 438.06s - 441.06s | So I'm


chunk_text:
work. 390.06s - 392.06s | In terms of other challenges that I see, 392.06s - 397.06s | I think data is another big one on the security side. 397.06s - 403.06s | With everything as code, we are just producing a crap ton of data, 403.06s - 405.06s | especially on the vulnerability management side. 406.06s - 410.06s | Unfortunately, I think a lot of security budgets don't include a ton of money 410.06s - 414.06s | for really awesome data architects to help us make sense of it all. 414.06s - 418.06s | So how do we normalize and correlate all of this data? 418.06s - 421.06s | How do we build complex data models? 421.06s - 427.06s | How do we ensure that we have good performance against all of our data sets? 427.06s - 429.06s | That's another really big challenge. 429.06s - 430.06s | Yeah. 430.06s - 431.06s | That's it. 431.06s - 433.06s | Some big things in mind. 433.06s - 434.06s | Thanks, Sarah. 434.06s - 435.06s | That was very good. 435.06s - 438.06s | You talked about the data side, which, of course, goes into AI. 438.06s - 441.06s | So I'm just going to hold on until I get to that. 441.06s - 446.06s | But, Trupti, what are your views on this? 446.06s - 452.57s | I think our high-tech industry has seen numerous emerging trends. 452.57s - 457.57s | How many of you remember evolution of iPhone and iPhone-based application, 457.57s - 459.57s | the mobile era? 459.57s - 462.57s | How many of you remember the IoT era? 462.57s - 468.88s | And then how many of you remember the cryptocurrency era? 468.88s - 472.88s | Who actually thought they will make enough money that they can retire? 472.88s - 473.88s | Good. 473.88s - 475.88s | All of you are smart. 475.88s - 478.88s | And then recently we saw the Gen AI era, right? 478.88s - 484.88s | So all these emerging trends, and as we move from monolith to microservice 484.88s - 489.88s | and low-code, no-code type of architectural style enterprise application 489.88s - 493.88s | deployed in cloud, what is one thing common? 493.88s - 496.88s | Everything is accessible via API. 496.88s - 497.88s | Everything is API-based. 497.88s - 498.88s | What does that mean? 498.88s - 501.88s | Everything has


chunk_text:
just going to hold on until I get to that. 441.06s - 446.06s | But, Trupti, what are your views on this? 446.06s - 452.57s | I think our high-tech industry has seen numerous emerging trends. 452.57s - 457.57s | How many of you remember evolution of iPhone and iPhone-based application, 457.57s - 459.57s | the mobile era? 459.57s - 462.57s | How many of you remember the IoT era? 462.57s - 468.88s | And then how many of you remember the cryptocurrency era? 468.88s - 472.88s | Who actually thought they will make enough money that they can retire? 472.88s - 473.88s | Good. 473.88s - 475.88s | All of you are smart. 475.88s - 478.88s | And then recently we saw the Gen AI era, right? 478.88s - 484.88s | So all these emerging trends, and as we move from monolith to microservice 484.88s - 489.88s | and low-code, no-code type of architectural style enterprise application 489.88s - 493.88s | deployed in cloud, what is one thing common? 493.88s - 496.88s | Everything is accessible via API. 496.88s - 497.88s | Everything is API-based. 497.88s - 498.88s | What does that mean? 498.88s - 501.88s | Everything has become code, right? 501.88s - 506.88s | So no matter what newer technology comes, everything is code nowadays. 506.88s - 511.88s | And we are supposed to launch our products where APIs are available. 511.88s - 518.88s | So I see for product security, Kunal, that we as a security engineer, 518.88s - 521.88s | product security engineer, we are supposed to quickly learn 521.88s - 526.88s | about the emerging technologies, not only how to secure them, 526.88s - 531.88s | but the business logic context and whatnot, and stay ahead of the game. 531.88s - 533.88s | That's the biggest challenge I see. 533.88s - 536.88s | What about you, Shahar? 536.88s - 538.88s | Yeah, maybe I'll add to that. 538.88s - 541.88s | You know, in the past, things used to be very simple. 541.88s - 544.88s | I remember my days back at SAP. 544.88s - 547.88s | It was a clear separation between the application guys 547.88s - 548.88s | and the infrastructure guys. 548.88s - 550.88s | It was like a huge wall. 550.88s - 553.88s | When you're done with developing, you just throw it over the wall 553.88s - 556.88s |


chunk_text:
become code, right? 501.88s - 506.88s | So no matter what newer technology comes, everything is code nowadays. 506.88s - 511.88s | And we are supposed to launch our products where APIs are available. 511.88s - 518.88s | So I see for product security, Kunal, that we as a security engineer, 518.88s - 521.88s | product security engineer, we are supposed to quickly learn 521.88s - 526.88s | about the emerging technologies, not only how to secure them, 526.88s - 531.88s | but the business logic context and whatnot, and stay ahead of the game. 531.88s - 533.88s | That's the biggest challenge I see. 533.88s - 536.88s | What about you, Shahar? 536.88s - 538.88s | Yeah, maybe I'll add to that. 538.88s - 541.88s | You know, in the past, things used to be very simple. 541.88s - 544.88s | I remember my days back at SAP. 544.88s - 547.88s | It was a clear separation between the application guys 547.88s - 548.88s | and the infrastructure guys. 548.88s - 550.88s | It was like a huge wall. 550.88s - 553.88s | When you're done with developing, you just throw it over the wall 553.88s - 556.88s | to the infrastructure guys. 556.88s - 559.88s | They'll need to deploy it, make sure it's secure, et cetera. 559.88s - 565.88s | And now, with the beasts coming from the infrastructure world 565.88s - 571.88s | into the application space, living in the Git as a code artifact, 571.88s - 574.88s | it brings a very different mindset, not only technology, 574.88s - 576.88s | to the different parts. 576.88s - 580.88s | So maybe just to give one example. 580.88s - 585.88s | In a raise of hands, how many of you have worked with containers? 585.88s - 587.88s | Right, so it's becoming very popular. 587.88s - 592.88s | But it's not that obvious that developers need to take part 592.88s - 597.88s | in the infrastructure layer of the base image, for example. 597.88s - 600.88s | It contains stuff that was not in our responsibility. 600.88s - 602.88s | You know, as developers, we just want things to work. 602.88s - 605.88s | Once they work, we're fine, we're happy. 605.88s - 609.88s | We don't just start looking into vulnerabilities in the operating system, 609.88s - 610.88s | in the core. 610.88s - 613.88s


chunk_text:
to the infrastructure guys. 556.88s - 559.88s | They'll need to deploy it, make sure it's secure, et cetera. 559.88s - 565.88s | And now, with the beasts coming from the infrastructure world 565.88s - 571.88s | into the application space, living in the Git as a code artifact, 571.88s - 574.88s | it brings a very different mindset, not only technology, 574.88s - 576.88s | to the different parts. 576.88s - 580.88s | So maybe just to give one example. 580.88s - 585.88s | In a raise of hands, how many of you have worked with containers? 585.88s - 587.88s | Right, so it's becoming very popular. 587.88s - 592.88s | But it's not that obvious that developers need to take part 592.88s - 597.88s | in the infrastructure layer of the base image, for example. 597.88s - 600.88s | It contains stuff that was not in our responsibility. 600.88s - 602.88s | You know, as developers, we just want things to work. 602.88s - 605.88s | Once they work, we're fine, we're happy. 605.88s - 609.88s | We don't just start looking into vulnerabilities in the operating system, 609.88s - 610.88s | in the core. 610.88s - 613.88s | When it works, we're happy. 613.88s - 617.88s | So the challenge is now responsibility have shifted left, 617.88s - 619.88s | have shifted to where the code lives, 619.88s - 622.88s | also for artifacts that traditionally 622.88s - 625.88s | was not part of the engineering responsibilities. 625.88s - 628.88s | And I think this is one of the biggest challenges 628.88s - 631.88s | to understand that infrastructure has moved 631.88s - 634.88s | and is being maintained in another part of the house. 634.88s - 639.88s | Now, while this is challenging from security point of view, 639.88s - 642.88s | it brings a lot of opportunities and speed 642.88s - 644.88s | into the development hands, right? 644.88s - 647.88s | If you build your new terraform, cloud formation, 647.88s - 649.88s | base images yourself in the team 649.88s - 652.88s | and you have good practices to handle them, 652.88s - 654.88s | you don't need to wait for infrastructure guys 654.88s - 657.88s | to upgrade your VMs, upgrade your base images, etc. 657.88s - 659.88s | You control that. 659.88s - 663.88s | So, you know, as they say, you


chunk_text:
| When it works, we're happy. 613.88s - 617.88s | So the challenge is now responsibility have shifted left, 617.88s - 619.88s | have shifted to where the code lives, 619.88s - 622.88s | also for artifacts that traditionally 622.88s - 625.88s | was not part of the engineering responsibilities. 625.88s - 628.88s | And I think this is one of the biggest challenges 628.88s - 631.88s | to understand that infrastructure has moved 631.88s - 634.88s | and is being maintained in another part of the house. 634.88s - 639.88s | Now, while this is challenging from security point of view, 639.88s - 642.88s | it brings a lot of opportunities and speed 642.88s - 644.88s | into the development hands, right? 644.88s - 647.88s | If you build your new terraform, cloud formation, 647.88s - 649.88s | base images yourself in the team 649.88s - 652.88s | and you have good practices to handle them, 652.88s - 654.88s | you don't need to wait for infrastructure guys 654.88s - 657.88s | to upgrade your VMs, upgrade your base images, etc. 657.88s - 659.88s | You control that. 659.88s - 663.88s | So, you know, as they say, you need brakes in your car 663.88s - 666.88s | to run faster, right? 666.88s - 669.88s | Because without having brakes, you wouldn't go that fast. 669.88s - 672.88s | The same with security and infrastructure, in my opinion. 672.88s - 674.88s | As long as you have the right brakes, 674.88s - 677.88s | you can go as fast as you want with engineering, 677.88s - 680.88s | building and upgrading the artifacts 680.88s - 682.88s | also for the infrastructure part. 682.88s - 684.88s | So these are the two things that are, 684.88s - 687.88s | two insights coming to mind when talking about it. 687.88s - 689.88s | Yeah, thanks, Shahar and Dhrupti. 689.88s - 692.88s | Since you talked about the developer part, 692.88s - 695.88s | one question that comes to mind is basically, 695.88s - 698.88s | how do you guys see the developer education 698.88s - 700.88s | in terms of application security? 701.88s - 704.88s | Because coming from a development background, 704.88s - 707.88s | I feel it gives a different perspective 707.88s - 710.88s | when you can actually see things from a developer perspective 710.88s - 712.88s |


chunk_text:
need brakes in your car 663.88s - 666.88s | to run faster, right? 666.88s - 669.88s | Because without having brakes, you wouldn't go that fast. 669.88s - 672.88s | The same with security and infrastructure, in my opinion. 672.88s - 674.88s | As long as you have the right brakes, 674.88s - 677.88s | you can go as fast as you want with engineering, 677.88s - 680.88s | building and upgrading the artifacts 680.88s - 682.88s | also for the infrastructure part. 682.88s - 684.88s | So these are the two things that are, 684.88s - 687.88s | two insights coming to mind when talking about it. 687.88s - 689.88s | Yeah, thanks, Shahar and Dhrupti. 689.88s - 692.88s | Since you talked about the developer part, 692.88s - 695.88s | one question that comes to mind is basically, 695.88s - 698.88s | how do you guys see the developer education 698.88s - 700.88s | in terms of application security? 701.88s - 704.88s | Because coming from a development background, 704.88s - 707.88s | I feel it gives a different perspective 707.88s - 710.88s | when you can actually see things from a developer perspective 710.88s - 712.88s | and then protect it. 712.88s - 715.88s | But at the same time, there's also emphasis 715.88s - 718.88s | that needs to be laid on developer education. 718.88s - 721.88s | And when we talk about everything as code, 721.88s - 723.88s | things like ISE, 723.88s - 725.88s | I think, Shahar, you touched upon it a little bit, 725.88s - 727.88s | saying that you just throw it over the fence 727.88s - 729.88s | to operations previously. 729.88s - 733.88s | I've still seen that happen with ISE code. 733.88s - 735.88s | Oh, this is just a template. 735.88s - 737.88s | It's not really code. 737.88s - 741.88s | And I've seen security engineers or leaders fight saying, 741.88s - 742.88s | it is code. 742.88s - 745.88s | And how do you guys see that in that context? 745.88s - 748.88s | Yeah, maybe I hope we're not going to start a fight 748.88s - 750.88s | between Dhrupti and myself, 750.88s - 752.88s | but we see things very differently. 752.88s - 753.88s | So from my perspective, 753.88s - 756.88s | leading engineering team for the last 20 years, 756.88s -


chunk_text:
and then protect it. 712.88s - 715.88s | But at the same time, there's also emphasis 715.88s - 718.88s | that needs to be laid on developer education. 718.88s - 721.88s | And when we talk about everything as code, 721.88s - 723.88s | things like ISE, 723.88s - 725.88s | I think, Shahar, you touched upon it a little bit, 725.88s - 727.88s | saying that you just throw it over the fence 727.88s - 729.88s | to operations previously. 729.88s - 733.88s | I've still seen that happen with ISE code. 733.88s - 735.88s | Oh, this is just a template. 735.88s - 737.88s | It's not really code. 737.88s - 741.88s | And I've seen security engineers or leaders fight saying, 741.88s - 742.88s | it is code. 742.88s - 745.88s | And how do you guys see that in that context? 745.88s - 748.88s | Yeah, maybe I hope we're not going to start a fight 748.88s - 750.88s | between Dhrupti and myself, 750.88s - 752.88s | but we see things very differently. 752.88s - 753.88s | So from my perspective, 753.88s - 756.88s | leading engineering team for the last 20 years, 756.88s - 761.88s | I think the exercise of educating developers, 761.88s - 765.88s | being more security aware, kind of failed. 765.88s - 767.88s | I mean, let's face it. 767.88s - 771.88s | Developers, they don't care about security for good reasons. 771.88s - 774.88s | They're passionate about developing features, 774.88s - 775.88s | about going fast, 775.88s - 780.88s | about the functionality that they bring to the world, 780.88s - 781.88s | and they get paid for that. 781.88s - 784.88s | So it's always a burden or a hustle for them 784.88s - 787.88s | to treat security in the right way. 787.88s - 789.88s | We expect them to do that, right? 789.88s - 791.88s | So, and not only security. 791.88s - 794.88s | When we talk to developers these days, 794.88s - 797.88s | they feel like everything is being shifted left. 797.88s - 799.88s | There's no QA paradigm anymore. 799.88s - 801.88s | They need to do it themselves. 801.88s - 802.88s | They need to do security. 802.88s - 804.88s | They need to do documentation of the code. 804.88s - 806.88s | So out of their, you know, 806.88s


chunk_text:
761.88s | I think the exercise of educating developers, 761.88s - 765.88s | being more security aware, kind of failed. 765.88s - 767.88s | I mean, let's face it. 767.88s - 771.88s | Developers, they don't care about security for good reasons. 771.88s - 774.88s | They're passionate about developing features, 774.88s - 775.88s | about going fast, 775.88s - 780.88s | about the functionality that they bring to the world, 780.88s - 781.88s | and they get paid for that. 781.88s - 784.88s | So it's always a burden or a hustle for them 784.88s - 787.88s | to treat security in the right way. 787.88s - 789.88s | We expect them to do that, right? 789.88s - 791.88s | So, and not only security. 791.88s - 794.88s | When we talk to developers these days, 794.88s - 797.88s | they feel like everything is being shifted left. 797.88s - 799.88s | There's no QA paradigm anymore. 799.88s - 801.88s | They need to do it themselves. 801.88s - 802.88s | They need to do security. 802.88s - 804.88s | They need to do documentation of the code. 804.88s - 806.88s | So out of their, you know, 806.88s - 810.88s | 100% of writing code and creating functionality, 810.88s - 812.88s | they need to spend a lot of time on that. 812.88s - 813.88s | This is a challenge. 813.88s - 818.88s | So I think shifting left might have gone too much, 818.88s - 824.88s | expecting developers to create security on their part. 824.88s - 825.88s | I don't think that's fair. 825.88s - 827.88s | I think the gates may have shifted left, 827.88s - 831.88s | and that's very right to put it as part of the CICD, et cetera. 831.88s - 835.88s | But the wisdom and the expertise of doing the right policies, 835.88s - 836.88s | the right security, 836.88s - 838.88s | it's still with the AppSec team, 838.88s - 840.88s | with the DevSecOps guys. 840.88s - 844.88s | It's a profession to be an application security person. 844.88s - 847.88s | This is why we've chosen to be in that profession. 847.88s - 851.88s | And if you're able in a program 851.88s - 855.88s | to get the wisdom of security into the policies 855.88s - 860.88s | and let alone the developers to work under


chunk_text:
- 810.88s | 100% of writing code and creating functionality, 810.88s - 812.88s | they need to spend a lot of time on that. 812.88s - 813.88s | This is a challenge. 813.88s - 818.88s | So I think shifting left might have gone too much, 818.88s - 824.88s | expecting developers to create security on their part. 824.88s - 825.88s | I don't think that's fair. 825.88s - 827.88s | I think the gates may have shifted left, 827.88s - 831.88s | and that's very right to put it as part of the CICD, et cetera. 831.88s - 835.88s | But the wisdom and the expertise of doing the right policies, 835.88s - 836.88s | the right security, 836.88s - 838.88s | it's still with the AppSec team, 838.88s - 840.88s | with the DevSecOps guys. 840.88s - 844.88s | It's a profession to be an application security person. 844.88s - 847.88s | This is why we've chosen to be in that profession. 847.88s - 851.88s | And if you're able in a program 851.88s - 855.88s | to get the wisdom of security into the policies 855.88s - 860.88s | and let alone the developers to work under these policies, 860.88s - 861.88s | that's the balanced way, 861.88s - 863.88s | not just giving them more and more education 863.88s - 867.88s | about SQL injection, past reversal, you name it. 867.88s - 868.88s | I mean, they got it. 869.88s - 873.88s | Second point is that you can educate 99% of your developers, 873.88s - 877.88s | but your security program is only as strong 877.88s - 879.88s | as your weakest developer, right? 879.88s - 881.88s | So you can have one new guy, 881.88s - 883.88s | a junior guy who joined the development team, 883.88s - 884.88s | just added a code. 884.88s - 886.88s | He didn't know exactly how to do that. 886.88s - 888.88s | He was not educated yet, 888.88s - 891.88s | but you've compromised your entire production 891.88s - 893.88s | because of this particular code. 893.88s - 895.88s | So this is where I am right now 895.88s - 897.88s | with my thinking around development 897.88s - 899.88s | and AppSec responsibility. 899.88s - 902.88s | And I'll let Drupty very nicely contradict me. 906.58s - 909.58s | So Shahar, I do understand your


chunk_text:
these policies, 860.88s - 861.88s | that's the balanced way, 861.88s - 863.88s | not just giving them more and more education 863.88s - 867.88s | about SQL injection, past reversal, you name it. 867.88s - 868.88s | I mean, they got it. 869.88s - 873.88s | Second point is that you can educate 99% of your developers, 873.88s - 877.88s | but your security program is only as strong 877.88s - 879.88s | as your weakest developer, right? 879.88s - 881.88s | So you can have one new guy, 881.88s - 883.88s | a junior guy who joined the development team, 883.88s - 884.88s | just added a code. 884.88s - 886.88s | He didn't know exactly how to do that. 886.88s - 888.88s | He was not educated yet, 888.88s - 891.88s | but you've compromised your entire production 891.88s - 893.88s | because of this particular code. 893.88s - 895.88s | So this is where I am right now 895.88s - 897.88s | with my thinking around development 897.88s - 899.88s | and AppSec responsibility. 899.88s - 902.88s | And I'll let Drupty very nicely contradict me. 906.58s - 909.58s | So Shahar, I do understand your concerns 909.58s - 912.58s | about shifting security left completely, 912.58s - 914.58s | but let me ask the audience, 914.58s - 918.58s | how many of you think we can scale product security, 918.58s - 920.58s | application security without developer? 920.58s - 922.58s | Please raise your hand. 923.58s - 925.58s | Not a single hand. 926.58s - 929.58s | So thank you, audience, for being with me. 931.58s - 933.58s | Okay, all right. 935.58s - 937.58s | So, you know, when we provide 937.58s - 940.58s | our developers generic security trainings, 940.58s - 942.58s | obviously they are not going to get, you know, 942.58s - 945.58s | full knowledge that is needed 945.58s - 948.58s | to take those security decisions. 948.58s - 951.58s | So the security champions program that I have designed, 951.58s - 953.58s | I always make sure, 953.58s - 955.58s | depending on the developer's role, 955.58s - 958.58s | the kind of technology they are using, 958.58s - 962.58s | provide that customized contextual training to them 962.58s - 964.58s | so that they understand the attacks 964.58s - 966.58s | which are related to their technology, 966.58s


chunk_text:
concerns 909.58s - 912.58s | about shifting security left completely, 912.58s - 914.58s | but let me ask the audience, 914.58s - 918.58s | how many of you think we can scale product security, 918.58s - 920.58s | application security without developer? 920.58s - 922.58s | Please raise your hand. 923.58s - 925.58s | Not a single hand. 926.58s - 929.58s | So thank you, audience, for being with me. 931.58s - 933.58s | Okay, all right. 935.58s - 937.58s | So, you know, when we provide 937.58s - 940.58s | our developers generic security trainings, 940.58s - 942.58s | obviously they are not going to get, you know, 942.58s - 945.58s | full knowledge that is needed 945.58s - 948.58s | to take those security decisions. 948.58s - 951.58s | So the security champions program that I have designed, 951.58s - 953.58s | I always make sure, 953.58s - 955.58s | depending on the developer's role, 955.58s - 958.58s | the kind of technology they are using, 958.58s - 962.58s | provide that customized contextual training to them 962.58s - 964.58s | so that they understand the attacks 964.58s - 966.58s | which are related to their technology, 966.58s - 969.58s | their application, their SDLC, 969.58s - 973.58s | and they can understand the actionable remediation guidance. 973.58s - 975.58s | What I have seen in my last 10 years 975.58s - 978.58s | of running security champions program, 978.58s - 980.58s | when we provide that level of customized 980.58s - 983.58s | targeted knowledge to our developers, 983.58s - 986.58s | they exactly know how to solve the problem, 986.58s - 989.58s | how to identify security problem and fix it right away. 989.58s - 993.58s | And sometimes developers are so smart, 993.58s - 996.58s | they have identified deeper level of issues 996.58s - 998.58s | that product security engineers have not. 998.58s - 1000.58s | Because product security engineers 1000.58s - 1002.58s | go from application to application, 1002.58s - 1004.58s | one system to another system, 1004.58s - 1008.58s | they rarely develop that deeper level of context. 1008.58s - 1011.58s | So I have seen very successful cases. 1011.58s - 1015.58s | One of the thing that my good friend Sarah brought up, 1015.58s - 1017.58s | if you want to have security checks 1017.58s - 1020.58s | before every PR


chunk_text:
- 969.58s | their application, their SDLC, 969.58s - 973.58s | and they can understand the actionable remediation guidance. 973.58s - 975.58s | What I have seen in my last 10 years 975.58s - 978.58s | of running security champions program, 978.58s - 980.58s | when we provide that level of customized 980.58s - 983.58s | targeted knowledge to our developers, 983.58s - 986.58s | they exactly know how to solve the problem, 986.58s - 989.58s | how to identify security problem and fix it right away. 989.58s - 993.58s | And sometimes developers are so smart, 993.58s - 996.58s | they have identified deeper level of issues 996.58s - 998.58s | that product security engineers have not. 998.58s - 1000.58s | Because product security engineers 1000.58s - 1002.58s | go from application to application, 1002.58s - 1004.58s | one system to another system, 1004.58s - 1008.58s | they rarely develop that deeper level of context. 1008.58s - 1011.58s | So I have seen very successful cases. 1011.58s - 1015.58s | One of the thing that my good friend Sarah brought up, 1015.58s - 1017.58s | if you want to have security checks 1017.58s - 1020.58s | before every PR merge, 1020.58s - 1022.58s | can we have security engineers do that? 1022.58s - 1023.58s | Absolutely not. 1023.58s - 1026.58s | In this way, security becomes the bottlenecks. 1026.58s - 1028.58s | We can't match the speed of innovation. 1028.58s - 1033.58s | So I really think if product security invest enough time 1033.58s - 1035.58s | building and delivering 1035.58s - 1037.58s | those contextual trainings to our developer, 1037.58s - 1041.58s | they absolutely love and welcome this level of knowledge. 1041.58s - 1043.58s | And last thing, 1043.58s - 1045.58s | it's not the developers that we need to target, 1045.58s - 1048.58s | we also need to educate our product managers 1048.58s - 1050.58s | on how to match business requirement 1050.58s - 1052.58s | with security requirement. 1052.58s - 1055.58s | We also need to educate our TPMs, 1055.58s - 1056.58s | engineering managers, 1056.58s - 1059.58s | so that they know how to prioritize security backlog 1059.58s - 1062.58s | and systematically reduce risk. 1062.58s - 1069.34s | I would say that I agree with both of you 1069.34s - 1070.34s | in different ways. 1071.34s - 1073.34s | Realistically, yes. 1073.34s -


chunk_text:
merge, 1020.58s - 1022.58s | can we have security engineers do that? 1022.58s - 1023.58s | Absolutely not. 1023.58s - 1026.58s | In this way, security becomes the bottlenecks. 1026.58s - 1028.58s | We can't match the speed of innovation. 1028.58s - 1033.58s | So I really think if product security invest enough time 1033.58s - 1035.58s | building and delivering 1035.58s - 1037.58s | those contextual trainings to our developer, 1037.58s - 1041.58s | they absolutely love and welcome this level of knowledge. 1041.58s - 1043.58s | And last thing, 1043.58s - 1045.58s | it's not the developers that we need to target, 1045.58s - 1048.58s | we also need to educate our product managers 1048.58s - 1050.58s | on how to match business requirement 1050.58s - 1052.58s | with security requirement. 1052.58s - 1055.58s | We also need to educate our TPMs, 1055.58s - 1056.58s | engineering managers, 1056.58s - 1059.58s | so that they know how to prioritize security backlog 1059.58s - 1062.58s | and systematically reduce risk. 1062.58s - 1069.34s | I would say that I agree with both of you 1069.34s - 1070.34s | in different ways. 1071.34s - 1073.34s | Realistically, yes. 1073.34s - 1075.34s | I don't think that you're going to have... 1075.34s - 1077.34s | I don't think your dev team is going to be very happy 1077.34s - 1080.34s | if your team of five application security engineers 1080.34s - 1082.34s | are the bottleneck for six to 12 hours 1082.34s - 1084.34s | waiting for a PR to be merged 1084.34s - 1086.34s | because it's in the pipeline, 1086.34s - 1087.34s | there's a gate check, 1087.34s - 1090.34s | and they either don't have the context 1090.34s - 1091.34s | to figure it out themselves 1091.34s - 1095.34s | or they need a validation or an exception, 1095.34s - 1096.34s | and they're just waiting. 1096.34s - 1097.34s | That's not realistic. 1098.34s - 1099.34s | And so to that regard, 1099.34s - 1100.34s | I agree with you. 1100.34s - 1102.34s | I think it cannot just be 1102.34s - 1103.34s | application security engineers 1103.34s - 1105.34s | and vulnerability management engineers 1105.34s - 1108.34s | that are performing these tasks 1108.34s - 1111.34s | and doing the validation. 1111.34s - 1113.34s | However, I do also think that 1113.34s - 1114.34s | on the


chunk_text:
1075.34s | I don't think that you're going to have... 1075.34s - 1077.34s | I don't think your dev team is going to be very happy 1077.34s - 1080.34s | if your team of five application security engineers 1080.34s - 1082.34s | are the bottleneck for six to 12 hours 1082.34s - 1084.34s | waiting for a PR to be merged 1084.34s - 1086.34s | because it's in the pipeline, 1086.34s - 1087.34s | there's a gate check, 1087.34s - 1090.34s | and they either don't have the context 1090.34s - 1091.34s | to figure it out themselves 1091.34s - 1095.34s | or they need a validation or an exception, 1095.34s - 1096.34s | and they're just waiting. 1096.34s - 1097.34s | That's not realistic. 1098.34s - 1099.34s | And so to that regard, 1099.34s - 1100.34s | I agree with you. 1100.34s - 1102.34s | I think it cannot just be 1102.34s - 1103.34s | application security engineers 1103.34s - 1105.34s | and vulnerability management engineers 1105.34s - 1108.34s | that are performing these tasks 1108.34s - 1111.34s | and doing the validation. 1111.34s - 1113.34s | However, I do also think that 1113.34s - 1114.34s | on the training side, 1114.34s - 1116.34s | on effectiveness of training, 1116.34s - 1119.34s | I think realistically in the future, 1119.34s - 1120.34s | I wouldn't be surprised 1120.34s - 1123.34s | if most formal structured training 1123.34s - 1125.34s | was really minimized 1125.34s - 1127.34s | while constant learning 1127.34s - 1129.34s | through things like co-pilot, et cetera, 1129.34s - 1131.34s | were much more relevant 1131.34s - 1133.34s | and those reminders in the IDE 1133.34s - 1134.34s | and your linters 1134.34s - 1137.34s | were used as the primary source of training 1137.34s - 1141.34s | on the fly with your actual application code. 1141.34s - 1144.34s | Yeah, training is definitely a very key component. 1144.34s - 1145.34s | I remember one of the organizations 1145.34s - 1146.34s | that I was at, 1146.34s - 1150.34s | we tried to gamify the whole training. 1150.34s - 1152.34s | We put together something 1152.34s - 1154.34s | on the theme of Game of Thrones 1155.34s - 1156.34s | so we had night commanders 1156.34s - 1158.34s | and all of that, 1158.34s - 1160.34s | which went pretty cool. 1160.34s - 1162.34s | So


chunk_text:
training side, 1114.34s - 1116.34s | on effectiveness of training, 1116.34s - 1119.34s | I think realistically in the future, 1119.34s - 1120.34s | I wouldn't be surprised 1120.34s - 1123.34s | if most formal structured training 1123.34s - 1125.34s | was really minimized 1125.34s - 1127.34s | while constant learning 1127.34s - 1129.34s | through things like co-pilot, et cetera, 1129.34s - 1131.34s | were much more relevant 1131.34s - 1133.34s | and those reminders in the IDE 1133.34s - 1134.34s | and your linters 1134.34s - 1137.34s | were used as the primary source of training 1137.34s - 1141.34s | on the fly with your actual application code. 1141.34s - 1144.34s | Yeah, training is definitely a very key component. 1144.34s - 1145.34s | I remember one of the organizations 1145.34s - 1146.34s | that I was at, 1146.34s - 1150.34s | we tried to gamify the whole training. 1150.34s - 1152.34s | We put together something 1152.34s - 1154.34s | on the theme of Game of Thrones 1155.34s - 1156.34s | so we had night commanders 1156.34s - 1158.34s | and all of that, 1158.34s - 1160.34s | which went pretty cool. 1160.34s - 1162.34s | So it really depends upon 1162.34s - 1164.34s | the organization culture. 1164.34s - 1165.34s | But one other thing 1165.34s - 1167.34s | that I would like to say is 1167.34s - 1168.34s | when you talk about shift left, 1168.34s - 1169.34s | that's overtly used 1169.34s - 1171.34s | and sometimes abused. 1171.34s - 1173.34s | But Shahar, what you were talking about 1173.34s - 1175.34s | is basically putting it towards the right. 1175.34s - 1176.34s | I think it's all a cycle. 1176.34s - 1179.34s | So sometimes you need to shift right 1179.34s - 1180.34s | to actually shift left. 1180.34s - 1182.34s | I know it sounds counterproductive, 1182.34s - 1183.34s | but this is the trend 1183.34s - 1185.34s | that I've been seeing for some time 1185.34s - 1188.34s | because let's say you're starting off a program 1188.34s - 1190.34s | at the very early phases. 1190.34s - 1191.34s | You want to stop the bleed. 1191.34s - 1192.34s | So in that case, 1192.34s - 1194.34s | you want to put things to the right 1194.34s - 1196.34s | so that you're able to protect your crown jewels 1196.34s -


chunk_text:
it really depends upon 1162.34s - 1164.34s | the organization culture. 1164.34s - 1165.34s | But one other thing 1165.34s - 1167.34s | that I would like to say is 1167.34s - 1168.34s | when you talk about shift left, 1168.34s - 1169.34s | that's overtly used 1169.34s - 1171.34s | and sometimes abused. 1171.34s - 1173.34s | But Shahar, what you were talking about 1173.34s - 1175.34s | is basically putting it towards the right. 1175.34s - 1176.34s | I think it's all a cycle. 1176.34s - 1179.34s | So sometimes you need to shift right 1179.34s - 1180.34s | to actually shift left. 1180.34s - 1182.34s | I know it sounds counterproductive, 1182.34s - 1183.34s | but this is the trend 1183.34s - 1185.34s | that I've been seeing for some time 1185.34s - 1188.34s | because let's say you're starting off a program 1188.34s - 1190.34s | at the very early phases. 1190.34s - 1191.34s | You want to stop the bleed. 1191.34s - 1192.34s | So in that case, 1192.34s - 1194.34s | you want to put things to the right 1194.34s - 1196.34s | so that you're able to protect your crown jewels 1196.34s - 1199.34s | and then gradually try to find it earlier 1199.34s - 1200.34s | in the cycle. 1200.34s - 1203.34s | So I think both are right to a certain extent. 1203.34s - 1205.34s | Yeah, I have a thought. 1205.34s - 1208.34s | After hearing to all the panelists 1208.34s - 1209.34s | and moderator, 1209.34s - 1211.34s | I genuinely think that we need 1211.34s - 1213.34s | to strengthen our right 1213.34s - 1215.34s | while shifting left like a boss 1215.34s - 1218.34s | and have a really strong governance program 1218.34s - 1221.34s | so that even if our awesome developers 1221.34s - 1224.34s | who are our unsung security warriors 1224.34s - 1227.34s | miss on certain vulnerabilities or fixes, 1227.34s - 1229.34s | we should be able to catch it. 1229.34s - 1230.34s | So yeah, I'm going to reiterate, 1230.34s - 1232.34s | let's strengthen our right 1232.34s - 1235.34s | while shifting left like a boss. 1237.34s - 1238.34s | Thanks, Shruti. 1238.34s - 1240.34s | I know you're very passionate about this. 1240.34s - 1242.34s | Moving on, 1242.34s - 1244.34s | how can organizations leverage, 1244.34s - 1245.34s |


chunk_text:
1199.34s | and then gradually try to find it earlier 1199.34s - 1200.34s | in the cycle. 1200.34s - 1203.34s | So I think both are right to a certain extent. 1203.34s - 1205.34s | Yeah, I have a thought. 1205.34s - 1208.34s | After hearing to all the panelists 1208.34s - 1209.34s | and moderator, 1209.34s - 1211.34s | I genuinely think that we need 1211.34s - 1213.34s | to strengthen our right 1213.34s - 1215.34s | while shifting left like a boss 1215.34s - 1218.34s | and have a really strong governance program 1218.34s - 1221.34s | so that even if our awesome developers 1221.34s - 1224.34s | who are our unsung security warriors 1224.34s - 1227.34s | miss on certain vulnerabilities or fixes, 1227.34s - 1229.34s | we should be able to catch it. 1229.34s - 1230.34s | So yeah, I'm going to reiterate, 1230.34s - 1232.34s | let's strengthen our right 1232.34s - 1235.34s | while shifting left like a boss. 1237.34s - 1238.34s | Thanks, Shruti. 1238.34s - 1240.34s | I know you're very passionate about this. 1240.34s - 1242.34s | Moving on, 1242.34s - 1244.34s | how can organizations leverage, 1244.34s - 1245.34s | we talked about the pipeline, right? 1245.34s - 1247.34s | How can organizations leverage automation 1247.34s - 1250.34s | and a CI-CD pipeline, 1250.34s - 1253.34s | especially in the context of everything as tech, 1253.34s - 1256.34s | things like ISE and GitOps and things? 1258.34s - 1259.34s | Yeah, maybe I can start. 1259.34s - 1260.34s | So as mentioned, 1260.34s - 1265.34s | I think that the trend of having more visibility 1265.34s - 1266.34s | in the pipeline 1266.34s - 1269.34s | to what's going on in terms of security 1269.34s - 1270.34s | is welcome. 1270.34s - 1273.34s | And I didn't see many brave organization 1273.34s - 1274.34s | that actually forces 1274.34s - 1278.34s | and stops the build for the developers 1278.34s - 1279.34s | just for having them, 1279.34s - 1281.34s | you know, fixing their security stuff 1281.34s - 1283.34s | because there are just too many of those. 1283.34s - 1284.34s | You would allow that 1284.34s - 1286.34s | if you have five or four in the CI-CD, 1286.34s - 1288.34s | okay, we'll stop, we understand. 1288.34s - 1291.34s | But then if their request is to


chunk_text:
we talked about the pipeline, right? 1245.34s - 1247.34s | How can organizations leverage automation 1247.34s - 1250.34s | and a CI-CD pipeline, 1250.34s - 1253.34s | especially in the context of everything as tech, 1253.34s - 1256.34s | things like ISE and GitOps and things? 1258.34s - 1259.34s | Yeah, maybe I can start. 1259.34s - 1260.34s | So as mentioned, 1260.34s - 1265.34s | I think that the trend of having more visibility 1265.34s - 1266.34s | in the pipeline 1266.34s - 1269.34s | to what's going on in terms of security 1269.34s - 1270.34s | is welcome. 1270.34s - 1273.34s | And I didn't see many brave organization 1273.34s - 1274.34s | that actually forces 1274.34s - 1278.34s | and stops the build for the developers 1278.34s - 1279.34s | just for having them, 1279.34s - 1281.34s | you know, fixing their security stuff 1281.34s - 1283.34s | because there are just too many of those. 1283.34s - 1284.34s | You would allow that 1284.34s - 1286.34s | if you have five or four in the CI-CD, 1286.34s - 1288.34s | okay, we'll stop, we understand. 1288.34s - 1291.34s | But then if their request is to stop your build 1291.34s - 1295.34s | and go ahead, fix your 1500 vulnerability issues, 1295.34s - 1297.34s | I just wanted to add another button 1297.34s - 1298.34s | to the application. 1298.34s - 1299.34s | That's not going to work. 1299.34s - 1303.34s | And, you know, sometimes we hear the dynamic 1303.34s - 1305.34s | that application security teams ask 1305.34s - 1307.34s | to prioritize the issues. 1307.34s - 1308.34s | And you know what? 1308.34s - 1310.34s | Let's just prioritize them. 1310.34s - 1313.34s | Now, here's the thing with priorities. 1313.34s - 1317.34s | That's sometimes humanly impossible. 1317.34s - 1320.34s | Just think about a list of 10 items 1320.34s - 1323.34s | that you would like to prioritize. 1323.34s - 1324.34s | That's a small list. 1324.34s - 1325.34s | It seems manageable. 1325.34s - 1326.34s | We do it every day. 1326.34s - 1328.34s | But if you want to do it right, 1328.34s - 1330.34s | there are more than 3 million options 1330.34s - 1334.34s | to prioritize a 10 items list, right? 1334.34s - 1336.34s | That's the numbers. 1336.34s - 1337.34s | That's the math behind


chunk_text:
stop your build 1291.34s - 1295.34s | and go ahead, fix your 1500 vulnerability issues, 1295.34s - 1297.34s | I just wanted to add another button 1297.34s - 1298.34s | to the application. 1298.34s - 1299.34s | That's not going to work. 1299.34s - 1303.34s | And, you know, sometimes we hear the dynamic 1303.34s - 1305.34s | that application security teams ask 1305.34s - 1307.34s | to prioritize the issues. 1307.34s - 1308.34s | And you know what? 1308.34s - 1310.34s | Let's just prioritize them. 1310.34s - 1313.34s | Now, here's the thing with priorities. 1313.34s - 1317.34s | That's sometimes humanly impossible. 1317.34s - 1320.34s | Just think about a list of 10 items 1320.34s - 1323.34s | that you would like to prioritize. 1323.34s - 1324.34s | That's a small list. 1324.34s - 1325.34s | It seems manageable. 1325.34s - 1326.34s | We do it every day. 1326.34s - 1328.34s | But if you want to do it right, 1328.34s - 1330.34s | there are more than 3 million options 1330.34s - 1334.34s | to prioritize a 10 items list, right? 1334.34s - 1336.34s | That's the numbers. 1336.34s - 1337.34s | That's the math behind it. 1337.34s - 1338.34s | So just imagine what happens 1338.34s - 1341.34s | when you look at a thousand items list 1341.34s - 1343.34s | and you ask them to prioritize. 1343.34s - 1345.34s | So we've all settled 1345.34s - 1350.34s | on a stateless generic prioritization system 1350.34s - 1353.34s | like CVSS, EPSS from the outside. 1353.34s - 1354.34s | Okay, you know what? 1354.34s - 1355.34s | Let's just do the critical. 1355.34s - 1357.34s | But then the frustration is that 1357.34s - 1358.34s | there's no real correlation 1358.34s - 1361.34s | between my intimate understanding 1361.34s - 1363.34s | of the risk of the application 1363.34s - 1365.34s | and the CVSS scoring outside. 1365.34s - 1366.34s | So here's another triage 1366.34s - 1369.34s | that needs to go for each one of them. 1369.34s - 1371.34s | So it all comes down to the numbers 1371.34s - 1373.34s | that you need to handle. 1373.34s - 1376.34s | You cannot just move everything left 1376.34s - 1377.34s | if you have not cleaned up 1377.34s - 1379.34s | with the right policies. 1379.34s - 1380.34s | What do you want


chunk_text:
it. 1337.34s - 1338.34s | So just imagine what happens 1338.34s - 1341.34s | when you look at a thousand items list 1341.34s - 1343.34s | and you ask them to prioritize. 1343.34s - 1345.34s | So we've all settled 1345.34s - 1350.34s | on a stateless generic prioritization system 1350.34s - 1353.34s | like CVSS, EPSS from the outside. 1353.34s - 1354.34s | Okay, you know what? 1354.34s - 1355.34s | Let's just do the critical. 1355.34s - 1357.34s | But then the frustration is that 1357.34s - 1358.34s | there's no real correlation 1358.34s - 1361.34s | between my intimate understanding 1361.34s - 1363.34s | of the risk of the application 1363.34s - 1365.34s | and the CVSS scoring outside. 1365.34s - 1366.34s | So here's another triage 1366.34s - 1369.34s | that needs to go for each one of them. 1369.34s - 1371.34s | So it all comes down to the numbers 1371.34s - 1373.34s | that you need to handle. 1373.34s - 1376.34s | You cannot just move everything left 1376.34s - 1377.34s | if you have not cleaned up 1377.34s - 1379.34s | with the right policies. 1379.34s - 1380.34s | What do you want to fix 1380.34s - 1381.34s | that it's actionable 1381.34s - 1382.34s | for the developer teams? 1382.34s - 1384.34s | I think that's the right balance. 1384.34s - 1385.34s | If you figure that out, 1385.34s - 1387.34s | this will be a working, 1387.34s - 1390.34s | a successful shift left program. 1390.34s - 1392.82s | Thank you, Shahar, 1392.82s - 1395.82s | for bringing up the prioritization part. 1395.82s - 1398.82s | I want to focus on two other things. 1398.82s - 1400.82s | Before automating your CICD, 1400.82s - 1402.82s | make your SREs and DevOps folks 1402.82s - 1404.82s | your best friend. 1404.82s - 1408.82s | Try to get inventory of your CICD. 1408.82s - 1411.82s | Not all organization have unified CICD, 1411.82s - 1413.82s | especially organizations 1413.82s - 1415.82s | which have legacy systems 1415.82s - 1418.82s | or organizations which are very heavy 1418.82s - 1420.82s | on merger acquisition. 1420.82s - 1423.82s | So we may have multiple flavors of CICD. 1423.82s - 1426.82s | So get the asset inventory first. 1426.82s - 1427.82s | Try to figure out 1427.82s - 1429.82s | how does your CICD look like.


chunk_text:
to fix 1380.34s - 1381.34s | that it's actionable 1381.34s - 1382.34s | for the developer teams? 1382.34s - 1384.34s | I think that's the right balance. 1384.34s - 1385.34s | If you figure that out, 1385.34s - 1387.34s | this will be a working, 1387.34s - 1390.34s | a successful shift left program. 1390.34s - 1392.82s | Thank you, Shahar, 1392.82s - 1395.82s | for bringing up the prioritization part. 1395.82s - 1398.82s | I want to focus on two other things. 1398.82s - 1400.82s | Before automating your CICD, 1400.82s - 1402.82s | make your SREs and DevOps folks 1402.82s - 1404.82s | your best friend. 1404.82s - 1408.82s | Try to get inventory of your CICD. 1408.82s - 1411.82s | Not all organization have unified CICD, 1411.82s - 1413.82s | especially organizations 1413.82s - 1415.82s | which have legacy systems 1415.82s - 1418.82s | or organizations which are very heavy 1418.82s - 1420.82s | on merger acquisition. 1420.82s - 1423.82s | So we may have multiple flavors of CICD. 1423.82s - 1426.82s | So get the asset inventory first. 1426.82s - 1427.82s | Try to figure out 1427.82s - 1429.82s | how does your CICD look like. 1429.82s - 1431.82s | And then second thing is 1431.82s - 1433.82s | many CICD pipelines 1433.82s - 1436.82s | have some inherent native security controls. 1436.82s - 1437.82s | For example, 1437.82s - 1439.82s | GitHub has branch protection. 1439.82s - 1442.82s | So definitely leverage those 1442.82s - 1445.82s | before buying another third-party commercial tool. 1445.82s - 1447.82s | Sarah? 1447.82s - 1449.82s | Yeah. 1449.82s - 1453.82s | I would say that I think generally 1453.82s - 1455.82s | there is so much that CICD 1455.82s - 1457.82s | and policy as code 1457.82s - 1458.82s | and infrastructure as code 1458.82s - 1460.82s | has really opened up the door 1460.82s - 1464.82s | for infrastructure security specifically. 1464.82s - 1466.82s | Immutability wasn't even like a topic 1466.82s - 1468.82s | that was possible before that. 1468.82s - 1470.82s | And so it's really awesome 1470.82s - 1472.82s | to see the sustainability 1472.82s - 1475.82s | that is kind of embedded in that 1475.82s - 1478.82s | and how you use infrastructure as code 1478.82s - 1481.82s | and everything as code in your pipelines. 1481.82s - 1483.82s | I think I would


chunk_text:
1429.82s - 1431.82s | And then second thing is 1431.82s - 1433.82s | many CICD pipelines 1433.82s - 1436.82s | have some inherent native security controls. 1436.82s - 1437.82s | For example, 1437.82s - 1439.82s | GitHub has branch protection. 1439.82s - 1442.82s | So definitely leverage those 1442.82s - 1445.82s | before buying another third-party commercial tool. 1445.82s - 1447.82s | Sarah? 1447.82s - 1449.82s | Yeah. 1449.82s - 1453.82s | I would say that I think generally 1453.82s - 1455.82s | there is so much that CICD 1455.82s - 1457.82s | and policy as code 1457.82s - 1458.82s | and infrastructure as code 1458.82s - 1460.82s | has really opened up the door 1460.82s - 1464.82s | for infrastructure security specifically. 1464.82s - 1466.82s | Immutability wasn't even like a topic 1466.82s - 1468.82s | that was possible before that. 1468.82s - 1470.82s | And so it's really awesome 1470.82s - 1472.82s | to see the sustainability 1472.82s - 1475.82s | that is kind of embedded in that 1475.82s - 1478.82s | and how you use infrastructure as code 1478.82s - 1481.82s | and everything as code in your pipelines. 1481.82s - 1483.82s | I think I would also agree 1483.82s - 1485.82s | that it's hard. 1485.82s - 1486.82s | It's complex. 1486.82s - 1487.82s | The cloud is complex. 1487.82s - 1489.82s | It's going to take a lot of work 1489.82s - 1491.82s | to figure out the right set of rules. 1491.82s - 1494.82s | You have to be really intentional about that. 1494.82s - 1496.82s | You have to probably roll it out pretty slowly. 1496.82s - 1498.82s | You have to think about exceptions 1498.82s - 1500.82s | and how you're going to scale exceptions. 1500.82s - 1502.82s | It's probably not going to be 1502.82s - 1505.82s | by individuals, people responding to exceptions. 1505.82s - 1507.82s | So how are you going to do that at scale? 1507.82s - 1511.82s | And that's a huge topic in enterprise security 1511.82s - 1513.82s | and application security. 1513.82s - 1515.82s | Yeah, totally makes sense. 1515.82s - 1518.82s | Kind of segwaying into something 1518.82s - 1520.82s | which is what you talked about, Sarah, 1520.82s - 1522.82s | and I think, Shahar, you talked about earlier as well, 1522.82s - 1525.82s | which is around ESE. 1525.82s - 1529.82s |


chunk_text:
also agree 1483.82s - 1485.82s | that it's hard. 1485.82s - 1486.82s | It's complex. 1486.82s - 1487.82s | The cloud is complex. 1487.82s - 1489.82s | It's going to take a lot of work 1489.82s - 1491.82s | to figure out the right set of rules. 1491.82s - 1494.82s | You have to be really intentional about that. 1494.82s - 1496.82s | You have to probably roll it out pretty slowly. 1496.82s - 1498.82s | You have to think about exceptions 1498.82s - 1500.82s | and how you're going to scale exceptions. 1500.82s - 1502.82s | It's probably not going to be 1502.82s - 1505.82s | by individuals, people responding to exceptions. 1505.82s - 1507.82s | So how are you going to do that at scale? 1507.82s - 1511.82s | And that's a huge topic in enterprise security 1511.82s - 1513.82s | and application security. 1513.82s - 1515.82s | Yeah, totally makes sense. 1515.82s - 1518.82s | Kind of segwaying into something 1518.82s - 1520.82s | which is what you talked about, Sarah, 1520.82s - 1522.82s | and I think, Shahar, you talked about earlier as well, 1522.82s - 1525.82s | which is around ESE. 1525.82s - 1529.82s | And in the context of the lines getting blurred 1529.82s - 1531.82s | with application code, infrastructure code, 1531.82s - 1534.82s | everything as code, 1534.82s - 1537.82s | where does vulnerability management really fit in? 1537.82s - 1540.82s | Is the concept of unified vulnerability management 1540.82s - 1542.82s | something that would really work? 1542.82s - 1544.82s | Because I worked in organizations 1544.82s - 1546.82s | where you have different SLAs 1546.82s - 1548.82s | for application-level vulnerabilities 1548.82s - 1551.82s | and infrastructure-level vulnerabilities. 1551.82s - 1554.82s | Does this concept of unified vulnerability management 1554.82s - 1556.82s | really resonate in today's world 1556.82s - 1558.82s | with everything becoming code? 1558.82s - 1560.82s | Sarah? 1560.82s - 1563.82s | No, yes, maybe, probably. 1563.82s - 1567.82s | I think that's a really hard question to answer. 1567.82s - 1570.82s | I think, in general, 1570.82s - 1571.82s | you have to know what you mean 1571.82s - 1574.82s | by unified vulnerability management. 1574.82s - 1577.82s | Are we talking about unifying the tooling sets 1577.82s - 1579.82s | of what's performing assessments? 1579.82s - 1583.82s | Or are we talking about unifying data


chunk_text:
And in the context of the lines getting blurred 1529.82s - 1531.82s | with application code, infrastructure code, 1531.82s - 1534.82s | everything as code, 1534.82s - 1537.82s | where does vulnerability management really fit in? 1537.82s - 1540.82s | Is the concept of unified vulnerability management 1540.82s - 1542.82s | something that would really work? 1542.82s - 1544.82s | Because I worked in organizations 1544.82s - 1546.82s | where you have different SLAs 1546.82s - 1548.82s | for application-level vulnerabilities 1548.82s - 1551.82s | and infrastructure-level vulnerabilities. 1551.82s - 1554.82s | Does this concept of unified vulnerability management 1554.82s - 1556.82s | really resonate in today's world 1556.82s - 1558.82s | with everything becoming code? 1558.82s - 1560.82s | Sarah? 1560.82s - 1563.82s | No, yes, maybe, probably. 1563.82s - 1567.82s | I think that's a really hard question to answer. 1567.82s - 1570.82s | I think, in general, 1570.82s - 1571.82s | you have to know what you mean 1571.82s - 1574.82s | by unified vulnerability management. 1574.82s - 1577.82s | Are we talking about unifying the tooling sets 1577.82s - 1579.82s | of what's performing assessments? 1579.82s - 1583.82s | Or are we talking about unifying data and reporting? 1583.82s - 1585.82s | Those are two separate concepts entirely. 1585.82s - 1588.82s | And I think, with tooling, 1588.82s - 1592.82s | it really depends on your business's structure 1592.82s - 1596.82s | and requirements, to your point, Tripti. 1596.82s - 1597.82s | And I think, a lot of times, 1597.82s - 1599.82s | that's going to be a lot harder, 1599.82s - 1604.82s | especially as you grow in size of your company. 1604.82s - 1606.82s | I think it's going to be a lot harder to optimize that, 1606.82s - 1610.82s | but I think it's a worthwhile endeavor for a lot of cases 1610.82s - 1612.82s | because the complexity of all these scans 1612.82s - 1615.82s | becomes very, very nebulous. 1615.82s - 1617.82s | But what's probably more realistic 1617.82s - 1620.82s | in terms of unification is unification of data. 1620.82s - 1623.82s | I mean, ultimately, a lot of this stuff 1623.82s - 1625.82s | is the same conceptually. 1625.82s - 1627.82s | There is a thing that we have found, 1627.82s - 1629.82s | and it needs to be fixed, 1629.82s - 1631.82s | and it needs to be


chunk_text:
and reporting? 1583.82s - 1585.82s | Those are two separate concepts entirely. 1585.82s - 1588.82s | And I think, with tooling, 1588.82s - 1592.82s | it really depends on your business's structure 1592.82s - 1596.82s | and requirements, to your point, Tripti. 1596.82s - 1597.82s | And I think, a lot of times, 1597.82s - 1599.82s | that's going to be a lot harder, 1599.82s - 1604.82s | especially as you grow in size of your company. 1604.82s - 1606.82s | I think it's going to be a lot harder to optimize that, 1606.82s - 1610.82s | but I think it's a worthwhile endeavor for a lot of cases 1610.82s - 1612.82s | because the complexity of all these scans 1612.82s - 1615.82s | becomes very, very nebulous. 1615.82s - 1617.82s | But what's probably more realistic 1617.82s - 1620.82s | in terms of unification is unification of data. 1620.82s - 1623.82s | I mean, ultimately, a lot of this stuff 1623.82s - 1625.82s | is the same conceptually. 1625.82s - 1627.82s | There is a thing that we have found, 1627.82s - 1629.82s | and it needs to be fixed, 1629.82s - 1631.82s | and it needs to be fixed at this time frame, 1631.82s - 1633.82s | and it needs to be fixed by this person. 1633.82s - 1637.82s | And that is something that can be unified. 1637.82s - 1639.82s | But I did talk about some of the data challenges 1639.82s - 1641.82s | embedded into that, 1641.82s - 1644.82s | but that's where I would kind of lean into. 1644.82s - 1647.82s | Just to provide a little bit more color to the question, 1647.82s - 1649.82s | when I talk about unified volume management, 1649.82s - 1651.82s | definitely data is one aspect. 1651.82s - 1653.82s | But when I say volume management, 1653.82s - 1656.82s | most organizations are policy-driven. 1656.82s - 1661.82s | So you have a policy of saying that any issue, 1661.82s - 1664.82s | any vulnerability needs to be fixed in, 1664.82s - 1667.82s | let's say, one day or two days for critical, 1667.82s - 1672.82s | five days for high and medium, so on and so forth. 1672.82s - 1676.82s | So my question was mainly in the context of, 1676.82s - 1678.82s | do you have the same SLAs? 1678.82s - 1680.82s | And if so,


chunk_text:
fixed at this time frame, 1631.82s - 1633.82s | and it needs to be fixed by this person. 1633.82s - 1637.82s | And that is something that can be unified. 1637.82s - 1639.82s | But I did talk about some of the data challenges 1639.82s - 1641.82s | embedded into that, 1641.82s - 1644.82s | but that's where I would kind of lean into. 1644.82s - 1647.82s | Just to provide a little bit more color to the question, 1647.82s - 1649.82s | when I talk about unified volume management, 1649.82s - 1651.82s | definitely data is one aspect. 1651.82s - 1653.82s | But when I say volume management, 1653.82s - 1656.82s | most organizations are policy-driven. 1656.82s - 1661.82s | So you have a policy of saying that any issue, 1661.82s - 1664.82s | any vulnerability needs to be fixed in, 1664.82s - 1667.82s | let's say, one day or two days for critical, 1667.82s - 1672.82s | five days for high and medium, so on and so forth. 1672.82s - 1676.82s | So my question was mainly in the context of, 1676.82s - 1678.82s | do you have the same SLAs? 1678.82s - 1680.82s | And if so, can you put the same logic? 1680.82s - 1683.82s | So, for example, the difference that I would see 1683.82s - 1687.82s | in infrastructure-level vulnerabilities would be, 1687.82s - 1689.82s | you just need to upgrade. 1689.82s - 1691.82s | But there could be thousands of upgrades 1691.82s - 1692.82s | that you would need to do, 1692.82s - 1694.82s | which is where the automation comes into play, 1694.82s - 1696.82s | versus, let's say, on the application level, 1696.82s - 1698.82s | you actually need a design fix. 1698.82s - 1701.82s | So does it really make sense to unify it? 1701.82s - 1702.82s | So that's the... 1705.82s - 1707.82s | No. 1707.82s - 1711.82s | I don't think total unification of SLAs and activities 1711.82s - 1712.82s | makes sense. 1712.82s - 1715.82s | I think there are certain things 1715.82s - 1718.82s | that you can potentially unify around that, 1718.82s - 1722.82s | but perhaps things that you're finding in code 1722.82s - 1724.82s | before it goes into an image 1726.82s - 1728.82s | might have a different risk 1728.82s - 1731.82s | compared to things that are already actively running 1731.82s


chunk_text:
can you put the same logic? 1680.82s - 1683.82s | So, for example, the difference that I would see 1683.82s - 1687.82s | in infrastructure-level vulnerabilities would be, 1687.82s - 1689.82s | you just need to upgrade. 1689.82s - 1691.82s | But there could be thousands of upgrades 1691.82s - 1692.82s | that you would need to do, 1692.82s - 1694.82s | which is where the automation comes into play, 1694.82s - 1696.82s | versus, let's say, on the application level, 1696.82s - 1698.82s | you actually need a design fix. 1698.82s - 1701.82s | So does it really make sense to unify it? 1701.82s - 1702.82s | So that's the... 1705.82s - 1707.82s | No. 1707.82s - 1711.82s | I don't think total unification of SLAs and activities 1711.82s - 1712.82s | makes sense. 1712.82s - 1715.82s | I think there are certain things 1715.82s - 1718.82s | that you can potentially unify around that, 1718.82s - 1722.82s | but perhaps things that you're finding in code 1722.82s - 1724.82s | before it goes into an image 1726.82s - 1728.82s | might have a different risk 1728.82s - 1731.82s | compared to things that are already actively running 1731.82s - 1732.82s | on a container image, 1732.82s - 1735.82s | and you probably need to prioritize those differently, 1735.82s - 1736.82s | for sure. 1736.82s - 1738.82s | So I think there's a lot of, again, complex rule sets 1738.82s - 1740.82s | that have to be embedded, 1740.82s - 1743.82s | and your teams are going to have to sit down 1743.82s - 1746.82s | and identify what those rule sets really look like 1746.82s - 1749.82s | in the context of your business's risk tolerance. 1750.82s - 1752.82s | Yeah, I agree with that. 1752.82s - 1754.82s | Many times, organization, 1754.82s - 1757.82s | for the sake of compliance teams and GRC teams, 1757.82s - 1759.82s | if there are any GRC teams here, 1759.82s - 1761.82s | please don't hate me. 1761.82s - 1765.82s | So, yeah, for the sake of convenience, 1765.82s - 1767.82s | people like to have same SLAs 1767.82s - 1769.82s | for application security vulnerabilities 1769.82s - 1772.82s | as well as infrastructure security vulnerability, 1772.82s - 1776.82s | but if you look at the remediation phases, 1776.82s - 1778.82s | application security vulnerability 1778.82s - 1780.82s | sometimes are


chunk_text:
- 1732.82s | on a container image, 1732.82s - 1735.82s | and you probably need to prioritize those differently, 1735.82s - 1736.82s | for sure. 1736.82s - 1738.82s | So I think there's a lot of, again, complex rule sets 1738.82s - 1740.82s | that have to be embedded, 1740.82s - 1743.82s | and your teams are going to have to sit down 1743.82s - 1746.82s | and identify what those rule sets really look like 1746.82s - 1749.82s | in the context of your business's risk tolerance. 1750.82s - 1752.82s | Yeah, I agree with that. 1752.82s - 1754.82s | Many times, organization, 1754.82s - 1757.82s | for the sake of compliance teams and GRC teams, 1757.82s - 1759.82s | if there are any GRC teams here, 1759.82s - 1761.82s | please don't hate me. 1761.82s - 1765.82s | So, yeah, for the sake of convenience, 1765.82s - 1767.82s | people like to have same SLAs 1767.82s - 1769.82s | for application security vulnerabilities 1769.82s - 1772.82s | as well as infrastructure security vulnerability, 1772.82s - 1776.82s | but if you look at the remediation phases, 1776.82s - 1778.82s | application security vulnerability 1778.82s - 1780.82s | sometimes are very hard to fix, 1780.82s - 1782.82s | especially if it's going to require 1782.82s - 1784.82s | design and architecture change, 1784.82s - 1785.82s | and at that time, 1785.82s - 1788.82s | we really have to be with our developers on their side 1788.82s - 1790.82s | defending, you know, 1790.82s - 1793.82s | why it's going to take four months or five months 1793.82s - 1794.82s | and what it takes, 1794.82s - 1795.82s | because oftentimes, 1795.82s - 1797.82s | those who have never written code 1797.82s - 1799.82s | or never done any development, 1799.82s - 1802.82s | they don't understand what it takes to fix things, right? 1802.82s - 1804.82s | So I genuinely think that we should have 1804.82s - 1806.82s | different set of SLA 1806.82s - 1809.82s | depending on the remediation efforts required. 1809.82s - 1813.26s | Yeah, maybe I'll just add to that shortly. 1813.26s - 1816.26s | I think from management perspective, 1816.26s - 1818.26s | they really like to have one, you know, 1818.26s - 1819.26s | single pane of glass 1819.26s - 1821.26s | on a certain business unit or product, 1821.26s - 1822.26s | but


chunk_text:
very hard to fix, 1780.82s - 1782.82s | especially if it's going to require 1782.82s - 1784.82s | design and architecture change, 1784.82s - 1785.82s | and at that time, 1785.82s - 1788.82s | we really have to be with our developers on their side 1788.82s - 1790.82s | defending, you know, 1790.82s - 1793.82s | why it's going to take four months or five months 1793.82s - 1794.82s | and what it takes, 1794.82s - 1795.82s | because oftentimes, 1795.82s - 1797.82s | those who have never written code 1797.82s - 1799.82s | or never done any development, 1799.82s - 1802.82s | they don't understand what it takes to fix things, right? 1802.82s - 1804.82s | So I genuinely think that we should have 1804.82s - 1806.82s | different set of SLA 1806.82s - 1809.82s | depending on the remediation efforts required. 1809.82s - 1813.26s | Yeah, maybe I'll just add to that shortly. 1813.26s - 1816.26s | I think from management perspective, 1816.26s - 1818.26s | they really like to have one, you know, 1818.26s - 1819.26s | single pane of glass 1819.26s - 1821.26s | on a certain business unit or product, 1821.26s - 1822.26s | but they can see, 1822.26s - 1825.26s | they don't care if you have 500 or 300 issues, 1825.26s - 1826.26s | they want to see the trend. 1826.26s - 1828.26s | You used to have 500, 1828.26s - 1829.26s | one quarter later, 1829.26s - 1831.26s | you have 200 or 300, 1831.26s - 1834.26s | so it's nice to capture them together in one tool, 1834.26s - 1836.26s | but from pragmatic approach, 1836.26s - 1838.26s | I think these are all different beasts. 1838.26s - 1839.26s | If you find, you know, 1839.26s - 1842.26s | a virtual machine you need to fix 1842.26s - 1843.26s | or to patch 1843.26s - 1845.26s | or a container-based image 1845.26s - 1847.26s | or a vulnerability in the code 1847.26s - 1849.26s | where you just need to clean up a parameter 1849.26s - 1851.26s | and that could be very quickly, 1851.26s - 1852.26s | it really needs to be aggregated 1852.26s - 1854.26s | from tool set perspective 1854.26s - 1857.26s | where the actionable item happens, right? 1857.26s - 1860.26s | So developers should have their own view 1860.26s - 1861.26s | on what's fixable for


chunk_text:
they can see, 1822.26s - 1825.26s | they don't care if you have 500 or 300 issues, 1825.26s - 1826.26s | they want to see the trend. 1826.26s - 1828.26s | You used to have 500, 1828.26s - 1829.26s | one quarter later, 1829.26s - 1831.26s | you have 200 or 300, 1831.26s - 1834.26s | so it's nice to capture them together in one tool, 1834.26s - 1836.26s | but from pragmatic approach, 1836.26s - 1838.26s | I think these are all different beasts. 1838.26s - 1839.26s | If you find, you know, 1839.26s - 1842.26s | a virtual machine you need to fix 1842.26s - 1843.26s | or to patch 1843.26s - 1845.26s | or a container-based image 1845.26s - 1847.26s | or a vulnerability in the code 1847.26s - 1849.26s | where you just need to clean up a parameter 1849.26s - 1851.26s | and that could be very quickly, 1851.26s - 1852.26s | it really needs to be aggregated 1852.26s - 1854.26s | from tool set perspective 1854.26s - 1857.26s | where the actionable item happens, right? 1857.26s - 1860.26s | So developers should have their own view 1860.26s - 1861.26s | on what's fixable for them. 1861.26s - 1862.26s | If they cannot do anything 1862.26s - 1865.26s | about patching a certain package 1865.26s - 1866.26s | from the infrastructure, 1866.26s - 1868.26s | why should they care about it? 1868.26s - 1870.26s | Why should they even handle that? 1870.26s - 1872.26s | So reporting is important, 1872.26s - 1873.26s | but where the data sits, 1873.26s - 1878.26s | it really depends how you structure your program. 1878.26s - 1881.26s | And you talked about context being king, right? 1881.26s - 1883.26s | So I think context also matters a lot, 1883.26s - 1886.26s | especially when you talk about, 1886.26s - 1887.26s | you know, for example, 1887.26s - 1890.26s | a library which needs to be upgraded 1890.26s - 1893.26s | that would technically be under an SCA. 1893.26s - 1896.26s | And if that library is actually being utilized 1896.26s - 1898.26s | or a function in the library is being utilized, 1898.26s - 1900.26s | would you really want to patch it if it's not? 1900.26s - 1903.26s | I mean, that's the challenge that we run into, right? 1903.26s - 1905.26s | A lot of times. 1905.26s


chunk_text:
them. 1861.26s - 1862.26s | If they cannot do anything 1862.26s - 1865.26s | about patching a certain package 1865.26s - 1866.26s | from the infrastructure, 1866.26s - 1868.26s | why should they care about it? 1868.26s - 1870.26s | Why should they even handle that? 1870.26s - 1872.26s | So reporting is important, 1872.26s - 1873.26s | but where the data sits, 1873.26s - 1878.26s | it really depends how you structure your program. 1878.26s - 1881.26s | And you talked about context being king, right? 1881.26s - 1883.26s | So I think context also matters a lot, 1883.26s - 1886.26s | especially when you talk about, 1886.26s - 1887.26s | you know, for example, 1887.26s - 1890.26s | a library which needs to be upgraded 1890.26s - 1893.26s | that would technically be under an SCA. 1893.26s - 1896.26s | And if that library is actually being utilized 1896.26s - 1898.26s | or a function in the library is being utilized, 1898.26s - 1900.26s | would you really want to patch it if it's not? 1900.26s - 1903.26s | I mean, that's the challenge that we run into, right? 1903.26s - 1905.26s | A lot of times. 1905.26s - 1907.26s | Thanks, Shah. 1907.26s - 1909.26s | So going to the next steps, 1909.26s - 1912.26s | which is around AI, as I promised, 1912.26s - 1914.26s | do you see AI, 1914.26s - 1916.26s | and this is a very generic kind of question 1916.26s - 1919.26s | when we talk about for the future, right? 1919.26s - 1922.26s | We have been seeing AppSec being in the same state 1922.26s - 1926.26s | of morasses for maybe 20 years now, 1926.26s - 1928.26s | where we have SCA tools, 1928.26s - 1930.26s | we have SAS tools, 1930.26s - 1933.26s | which are kind of struggling 1933.26s - 1935.26s | because there's a lot of context, 1935.26s - 1938.26s | which is really hard to get. 1938.26s - 1941.26s | Do we see AI as a panacea, 1941.26s - 1942.26s | which will solve these problems 1942.26s - 1946.26s | and bring us towards this glorious green future? 1946.26s - 1948.26s | Yeah, maybe I'll start. 1948.26s - 1950.26s | So in a nutshell, 1950.26s - 1953.26s | I think we're going into as an industry 1953.26s - 1957.26s | to the AI era with our


chunk_text:
- 1907.26s | Thanks, Shah. 1907.26s - 1909.26s | So going to the next steps, 1909.26s - 1912.26s | which is around AI, as I promised, 1912.26s - 1914.26s | do you see AI, 1914.26s - 1916.26s | and this is a very generic kind of question 1916.26s - 1919.26s | when we talk about for the future, right? 1919.26s - 1922.26s | We have been seeing AppSec being in the same state 1922.26s - 1926.26s | of morasses for maybe 20 years now, 1926.26s - 1928.26s | where we have SCA tools, 1928.26s - 1930.26s | we have SAS tools, 1930.26s - 1933.26s | which are kind of struggling 1933.26s - 1935.26s | because there's a lot of context, 1935.26s - 1938.26s | which is really hard to get. 1938.26s - 1941.26s | Do we see AI as a panacea, 1941.26s - 1942.26s | which will solve these problems 1942.26s - 1946.26s | and bring us towards this glorious green future? 1946.26s - 1948.26s | Yeah, maybe I'll start. 1948.26s - 1950.26s | So in a nutshell, 1950.26s - 1953.26s | I think we're going into as an industry 1953.26s - 1957.26s | to the AI era with our eyes wide open. 1957.26s - 1959.26s | I mean, we've been there before 1959.26s - 1960.26s | with the machine learning trends, 1960.26s - 1962.26s | this will save everything, right? 1962.26s - 1965.26s | And now every company would put an AI sticker 1965.26s - 1968.26s | on what they can do. 1968.26s - 1971.26s | However, I think there are very specific use cases 1971.26s - 1972.26s | that AI can help us. 1972.26s - 1975.26s | It's not just a generic behind the scenes 1975.26s - 1977.26s | under the hood functionality, 1977.26s - 1978.26s | it's very specific. 1978.26s - 1979.26s | I mean, let's face it, 1979.26s - 1982.26s | in the last two decades, 1982.26s - 1984.26s | the industry with all the money 1984.26s - 1987.26s | put into the industry of application security, 1987.26s - 1988.26s | vendors, et cetera, 1988.26s - 1992.26s | kind of failed fixing the same old things. 1992.26s - 1996.26s | If you look at the top trending vulnerabilities right now, 1996.26s - 1997.26s | same thing. 1997.26s - 2000.26s | I mean, SQL injection, number three, 2000.26s - 2002.26s | out of bound memory, 2002.26s -


chunk_text:
eyes wide open. 1957.26s - 1959.26s | I mean, we've been there before 1959.26s - 1960.26s | with the machine learning trends, 1960.26s - 1962.26s | this will save everything, right? 1962.26s - 1965.26s | And now every company would put an AI sticker 1965.26s - 1968.26s | on what they can do. 1968.26s - 1971.26s | However, I think there are very specific use cases 1971.26s - 1972.26s | that AI can help us. 1972.26s - 1975.26s | It's not just a generic behind the scenes 1975.26s - 1977.26s | under the hood functionality, 1977.26s - 1978.26s | it's very specific. 1978.26s - 1979.26s | I mean, let's face it, 1979.26s - 1982.26s | in the last two decades, 1982.26s - 1984.26s | the industry with all the money 1984.26s - 1987.26s | put into the industry of application security, 1987.26s - 1988.26s | vendors, et cetera, 1988.26s - 1992.26s | kind of failed fixing the same old things. 1992.26s - 1996.26s | If you look at the top trending vulnerabilities right now, 1996.26s - 1997.26s | same thing. 1997.26s - 2000.26s | I mean, SQL injection, number three, 2000.26s - 2002.26s | out of bound memory, 2002.26s - 2004.26s | RAID is one, 2004.26s - 2005.26s | sorry, RAID is one, 2005.26s - 2007.26s | RAID is seven. 2007.26s - 2008.26s | This is the ranking, right? 2008.26s - 2010.26s | We've seen CrowdStrikes, 2010.26s - 2012.26s | out of bound recently, 2012.26s - 2014.26s | past reversal, still trending. 2014.26s - 2015.26s | With all the tools that we have, 2015.26s - 2016.26s | that's the same thing, 2016.26s - 2018.26s | we cannot get rid of them as an industry. 2018.26s - 2021.26s | So I think something fundamental should change 2021.26s - 2023.26s | with our expectation from code writing 2023.26s - 2025.26s | in that perspective. 2025.26s - 2027.26s | All the recent attacks, 2027.26s - 2029.26s | same holes in the application, 2029.26s - 2031.26s | everything stays the same. 2031.26s - 2032.26s | I think there, 2032.26s - 2034.26s | before we even talk about AI, 2034.26s - 2036.26s | and I'll touch it in a second, 2036.26s - 2038.26s | there are so many things that we can do right now 2038.26s - 2041.26s | in order to improve the current situation 2041.26s - 2042.26s | because many people, 2042.26s -


chunk_text:
2004.26s | RAID is one, 2004.26s - 2005.26s | sorry, RAID is one, 2005.26s - 2007.26s | RAID is seven. 2007.26s - 2008.26s | This is the ranking, right? 2008.26s - 2010.26s | We've seen CrowdStrikes, 2010.26s - 2012.26s | out of bound recently, 2012.26s - 2014.26s | past reversal, still trending. 2014.26s - 2015.26s | With all the tools that we have, 2015.26s - 2016.26s | that's the same thing, 2016.26s - 2018.26s | we cannot get rid of them as an industry. 2018.26s - 2021.26s | So I think something fundamental should change 2021.26s - 2023.26s | with our expectation from code writing 2023.26s - 2025.26s | in that perspective. 2025.26s - 2027.26s | All the recent attacks, 2027.26s - 2029.26s | same holes in the application, 2029.26s - 2031.26s | everything stays the same. 2031.26s - 2032.26s | I think there, 2032.26s - 2034.26s | before we even talk about AI, 2034.26s - 2036.26s | and I'll touch it in a second, 2036.26s - 2038.26s | there are so many things that we can do right now 2038.26s - 2041.26s | in order to improve the current situation 2041.26s - 2042.26s | because many people, 2042.26s - 2043.26s | many CISOs, 2043.26s - 2046.26s | head of app security we talked to, 2046.26s - 2049.26s | kind of settled with the current situation. 2049.26s - 2051.26s | So 90% of my code is coming 2051.26s - 2054.26s | probably from open source, right? 2054.26s - 2057.26s | But just recently the industry realized 2057.26s - 2060.26s | that out of the 90%, 2060.26s - 2062.26s | 90% of the packages you bring in 2062.26s - 2065.26s | are not being used by your team, right? 2065.26s - 2067.26s | And all the scanners you'll go to 2067.26s - 2068.26s | will tell you 2068.26s - 2070.26s | you need to fix those vulnerabilities 2070.26s - 2071.26s | although they're not reachable. 2071.26s - 2073.26s | So the poor developer, 2073.26s - 2075.26s | he just brought in a framework 2075.26s - 2077.26s | in order to use a certain functionality. 2077.26s - 2078.26s | This framework brought 2078.26s - 2080.26s | all the transitive dependencies with it, 2080.26s - 2082.26s | around 100, sometimes more. 2082.26s - 2085.26s | And now he has tons of vulnerabilities in the code, 2085.26s - 2086.26s | but no one cares


chunk_text:
2043.26s | many CISOs, 2043.26s - 2046.26s | head of app security we talked to, 2046.26s - 2049.26s | kind of settled with the current situation. 2049.26s - 2051.26s | So 90% of my code is coming 2051.26s - 2054.26s | probably from open source, right? 2054.26s - 2057.26s | But just recently the industry realized 2057.26s - 2060.26s | that out of the 90%, 2060.26s - 2062.26s | 90% of the packages you bring in 2062.26s - 2065.26s | are not being used by your team, right? 2065.26s - 2067.26s | And all the scanners you'll go to 2067.26s - 2068.26s | will tell you 2068.26s - 2070.26s | you need to fix those vulnerabilities 2070.26s - 2071.26s | although they're not reachable. 2071.26s - 2073.26s | So the poor developer, 2073.26s - 2075.26s | he just brought in a framework 2075.26s - 2077.26s | in order to use a certain functionality. 2077.26s - 2078.26s | This framework brought 2078.26s - 2080.26s | all the transitive dependencies with it, 2080.26s - 2082.26s | around 100, sometimes more. 2082.26s - 2085.26s | And now he has tons of vulnerabilities in the code, 2085.26s - 2086.26s | but no one cares about it 2086.26s - 2088.26s | because these areas of the code 2088.26s - 2090.26s | are not reachable, kind of dead. 2090.26s - 2091.26s | So how about just focusing 2091.26s - 2093.26s | on what really is being accessed, 2093.26s - 2095.26s | being approached, et cetera? 2095.26s - 2097.26s | So these are important problems 2097.26s - 2099.26s | we should solve as an industry. 2099.26s - 2101.26s | When it comes to AI, 2101.26s - 2103.26s | I think we can do 2103.26s - 2104.26s | a lot of interesting things 2104.26s - 2106.26s | when it comes to patching 2106.26s - 2108.26s | and fixing the problems. 2108.26s - 2110.26s | So no company will allow 2110.26s - 2111.26s | that any of its code line 2111.26s - 2115.26s | will go into an AI engine, 2115.26s - 2118.26s | let's say JetGPD, whatever, LLM, 2118.26s - 2120.26s | and the code, the IP of the company 2120.26s - 2122.26s | will be extracted there. 2122.26s - 2123.26s | But there is a wisdom there 2123.26s - 2125.26s | that will help you fix and remediate 2125.26s - 2128.26s | and create automatically PR requests


chunk_text:
about it 2086.26s - 2088.26s | because these areas of the code 2088.26s - 2090.26s | are not reachable, kind of dead. 2090.26s - 2091.26s | So how about just focusing 2091.26s - 2093.26s | on what really is being accessed, 2093.26s - 2095.26s | being approached, et cetera? 2095.26s - 2097.26s | So these are important problems 2097.26s - 2099.26s | we should solve as an industry. 2099.26s - 2101.26s | When it comes to AI, 2101.26s - 2103.26s | I think we can do 2103.26s - 2104.26s | a lot of interesting things 2104.26s - 2106.26s | when it comes to patching 2106.26s - 2108.26s | and fixing the problems. 2108.26s - 2110.26s | So no company will allow 2110.26s - 2111.26s | that any of its code line 2111.26s - 2115.26s | will go into an AI engine, 2115.26s - 2118.26s | let's say JetGPD, whatever, LLM, 2118.26s - 2120.26s | and the code, the IP of the company 2120.26s - 2122.26s | will be extracted there. 2122.26s - 2123.26s | But there is a wisdom there 2123.26s - 2125.26s | that will help you fix and remediate 2125.26s - 2128.26s | and create automatically PR requests 2128.26s - 2130.26s | for your developers. 2130.26s - 2131.26s | And I think we're going to see that 2131.26s - 2133.26s | coming in the next couple of years. 2133.26s - 2135.26s | This is kind of obvious use case 2135.26s - 2137.26s | we can leverage. 2137.26s - 2140.26s | Subti, you have any thoughts? 2140.26s - 2142.26s | AI? 2142.26s - 2144.26s | No. 2144.26s - 2146.26s | I think AI has been around 2146.26s - 2148.26s | since 1960s, 2148.26s - 2149.26s | and we have seen different flavors 2149.26s - 2151.26s | like deep learning, 2151.26s - 2154.26s | then the most recent Gen AI. 2154.26s - 2156.26s | And if you look at 2156.26s - 2158.26s | some of the security vendors, 2158.26s - 2159.26s | AI has always been part 2159.26s - 2162.26s | of their product strategy. 2162.26s - 2164.26s | They have been using AI 2164.26s - 2165.26s | to do a better accurate 2165.26s - 2167.26s | vulnerability correlation. 2167.26s - 2170.26s | Then we see a lot of Gen AI usage 2170.26s - 2173.26s | to produce contextual security reports. 2173.26s - 2176.26s | So I think we should


chunk_text:
2128.26s - 2130.26s | for your developers. 2130.26s - 2131.26s | And I think we're going to see that 2131.26s - 2133.26s | coming in the next couple of years. 2133.26s - 2135.26s | This is kind of obvious use case 2135.26s - 2137.26s | we can leverage. 2137.26s - 2140.26s | Subti, you have any thoughts? 2140.26s - 2142.26s | AI? 2142.26s - 2144.26s | No. 2144.26s - 2146.26s | I think AI has been around 2146.26s - 2148.26s | since 1960s, 2148.26s - 2149.26s | and we have seen different flavors 2149.26s - 2151.26s | like deep learning, 2151.26s - 2154.26s | then the most recent Gen AI. 2154.26s - 2156.26s | And if you look at 2156.26s - 2158.26s | some of the security vendors, 2158.26s - 2159.26s | AI has always been part 2159.26s - 2162.26s | of their product strategy. 2162.26s - 2164.26s | They have been using AI 2164.26s - 2165.26s | to do a better accurate 2165.26s - 2167.26s | vulnerability correlation. 2167.26s - 2170.26s | Then we see a lot of Gen AI usage 2170.26s - 2173.26s | to produce contextual security reports. 2173.26s - 2176.26s | So I think we should totally use 2176.26s - 2177.26s | different flavors of AI 2177.26s - 2179.26s | depending on the use case. 2179.26s - 2182.26s | What really scares me is 2182.26s - 2184.26s | allowing our AI agent 2184.26s - 2186.26s | to do auto remediation. 2186.26s - 2189.26s | I think that's a nice goal to have. 2189.26s - 2191.26s | That's a nice state to aspire. 2191.26s - 2192.26s | But we have to move 2192.26s - 2194.26s | in that direction very slowly. 2194.26s - 2197.26s | So let it take three years, five years. 2197.26s - 2200.26s | Today, I am not ready. 2200.26s - 2202.26s | That's fair. 2202.26s - 2205.26s | I try to not be like Rara, 2205.26s - 2207.26s | to be honest. 2207.26s - 2209.26s | But I do think, I mean, 2209.26s - 2211.26s | we already see a lot of people 2211.26s - 2214.26s | utilizing AI related ID components. 2214.26s - 2216.26s | And I think those are legitimate. 2216.26s - 2219.26s | I think the thing about AI 2219.26s - 2221.26s | and considering like auto fixes 2221.26s - 2223.26s | to PRs, et cetera, 2223.26s - 2225.26s |


chunk_text:
totally use 2176.26s - 2177.26s | different flavors of AI 2177.26s - 2179.26s | depending on the use case. 2179.26s - 2182.26s | What really scares me is 2182.26s - 2184.26s | allowing our AI agent 2184.26s - 2186.26s | to do auto remediation. 2186.26s - 2189.26s | I think that's a nice goal to have. 2189.26s - 2191.26s | That's a nice state to aspire. 2191.26s - 2192.26s | But we have to move 2192.26s - 2194.26s | in that direction very slowly. 2194.26s - 2197.26s | So let it take three years, five years. 2197.26s - 2200.26s | Today, I am not ready. 2200.26s - 2202.26s | That's fair. 2202.26s - 2205.26s | I try to not be like Rara, 2205.26s - 2207.26s | to be honest. 2207.26s - 2209.26s | But I do think, I mean, 2209.26s - 2211.26s | we already see a lot of people 2211.26s - 2214.26s | utilizing AI related ID components. 2214.26s - 2216.26s | And I think those are legitimate. 2216.26s - 2219.26s | I think the thing about AI 2219.26s - 2221.26s | and considering like auto fixes 2221.26s - 2223.26s | to PRs, et cetera, 2223.26s - 2225.26s | all those things need context. 2225.26s - 2227.26s | And so if your organization 2227.26s - 2229.26s | does not have its fundamentals, 2229.26s - 2231.26s | correct, around asset management, 2231.26s - 2233.26s | et cetera, your AI 2233.26s - 2235.26s | is not going to generate 2235.26s - 2238.26s | anything better than you could 2238.26s - 2239.26s | or at scale. 2239.26s - 2241.26s | So that's sort of how it feels. 2241.26s - 2243.26s | Get your fundamentals correct first. 2243.26s - 2247.86s | I think not only with the promise of AI 2247.86s - 2249.86s | we'll get some cool new feature 2249.86s - 2250.86s | for the security program, 2250.86s - 2252.86s | it brings a lot of risks 2252.86s - 2254.86s | into our domain as well, right? 2254.86s - 2256.86s | I mean, there's a psychological effect 2256.86s - 2259.86s | of a developer copy paste a code 2259.86s - 2261.86s | from a, you know, 2261.86s - 2263.86s | gen AI generated code. 2263.86s - 2264.86s | It feels like it's safe. 2264.86s - 2265.86s | It's like it takes it 2265.86s - 2267.86s | from a very safe place, 2267.86s


