# Media

url: https://www.youtube.com/watch?v=VTkAx3Ub6-I
title: DEF CON 32 - DIY Pharmaceuticals - Michael Laufer
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=VTkAx3Ub6-I",
  "title": "DEF CON 32 - DIY Pharmaceuticals - Michael Laufer",
  "description": "A quarter million people die from Hepatitis C yearly, and it's getting worse. But for the first time in history there is a cure (not just a treatment) for a virus, and it is for Hepatitis C. Take one 400mg pill of Sofosbuvir every day for twelve weeks, and you will be free of the virus. The catch? Those pills are $1,000 USD apiece because the molecule is the so-called \"Intellectual Property\" of Gilead Pharmaceuticals, and they refuse to share. If you have $84,000 USD, Hep C is not your problem. We have developed a way to make the entire course of treatment for $300 USD. This methodology also applies to other diseases. Like any science, the method of manufacture of drugs can be replicated, and we are going to give you all the necessary tools and show you the process top-to-bottom. Watch it happen live, participate, and learn to do it yourself: Use our digital research assistant to help you navigate the scientific literature, get a chemical synthesis pathway, generate code for the the MicroLab to run, and watch the medicine form in the reaction chamber. Finally, press some tablets. The feds say saving a life this way is BioTerrorism. We say: So Be It.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2868,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 7.12s | This text was transcribed using whisper model: large-v2

 how many people came yesterday to thank you so much i had a great time wasn't that fun i had a
7.12s - 15.36s |  really i had a really good time so um predictably we are having uh some more av issues uh this is
15.36s - 22.08s |  restarting and we've got people who are setting up like actual sciency chemistry stuff and doing
22.08s - 31.12s |  shots over here um so yesterday we did a lot of the why uh we talked a great deal about sort of
31.84s - 40.96s |  what motivates the work and uh what we're hoping to accomplish with it today is more of the
41.84s - 49.44s |  the what and the how so uh hopefully this will pop up in a second um and when it does
50.40s - 61.36s |  um if we're lucky and a bunch of other stuff don't get in the way um we can get started um
62.16s - 65.84s |  we're going to show you the micro lab we're going to show you the online services
66.64s - 74.80s |  and we're going to show you oh and vinny's light works so so you're going to see the um
75.76s - 80.64s |  the micro lab in progress um we're going to talk about how it's put together a hardware
80.64s - 86.64s |  and software stack and additionally you're going to be able to see the online services which will
86.64s - 93.44s |  be running uh live that's sort of the problem that we're having um we will swap over to a
93.44s - 102.24s |  different machine when that happens and um i think we should be good to go here so i gotta stay close
102.24s - 114.30s |  to the mic i gotta remember that um okay dope so if you're trying to do pharmaceuticals diy
114.94s - 118.94s |  there are a number of pieces that have to happen the first thing is you have to actually do the
118.94s - 124.86s |  chemistry and the micro lab which you see being built next to me here is the system that we've
124.86s - 132.62s |  developed for helping that process and making it more automated what that allows for is that
132.62s - 137.82s |  somebody who is not super comfortable with chemistry can still participate a lot of people
137.82s - 144.54s |  look at that sort of thing and get really nervous really fast yesterday i think i likened it to the
144.54s - 149.18s |  difference between building a computer versus using a computer if you're not looking to become
149.18s - 154.14s |  a chemist but you're you you're looking to utilize chemistry somehow to do something
155.50s - 160.62s |  the skill set that you have to acquire is much less and if you have an automated system that
160.62s - 165.34s |  can help you through the hard parts and talk you through the easy parts then you can do that
166.70s - 171.66s |  antecedent to that you need to be able to write the programs that the hardware will actually run
172.54s - 177.82s |  this is the recipe press which you'll also see and this allows you to stack a procedure together
178.62s - 184.86s |  and get code into the machine so that it can execute the procedures that you want to do
185.50s - 190.38s |  antecedent to that you need to figure out what sort of chemistry you're doing you need to do
190.38s - 195.82s |  what's called retrosynthesis how do you start with a starting material and then work your way
195.82s - 200.78s |  from point a to point b and of course before that somewhere you have to actually figure out how
200.78s - 206.86s |  you're addressing your health and what you want as a drug that you want to take so let's take a
206.86s - 212.70s |  quick look at each of these here's how it kind of stacks together this is a flow chart that was sort
212.70s - 218.46s |  of put together you want to again figure out what is wrong in a medical sense that's your first bar
218.46s - 223.98s |  there then you need to figure out what the active pharmaceutical ingredient i know all of you
223.98s - 228.86s |  hackers think of something very different when we say api but api also stands for active
228.86s - 235.02s |  pharmaceutical ingredient then you develop the synthesis pathway you get a procedure for it and
235.02s - 241.18s |  then you develop a file that the machine will run you run the machine and then again at the end you
241.18s - 244.78s |  have to actually turn your active pharmaceutical ingredient into something that you can take
245.58s - 251.74s |  if it's just a white powder i mean some people might want to just snort it but like better if
251.74s - 257.42s |  you put it in a pill or maybe you put it into some sort of solution that becomes an iv drip
257.42s - 263.66s |  eventually you have to compound it some way so let's look at the automated chemistry again
264.54s - 272.26s |  chemical automation is not a new idea these are available commercially but it's closed source all
272.66s - 277.54s |  the problems that come with that of course on top of that they're ridiculously expensive
279.30s - 283.06s |  five five thousand dollars i think for like the cheapest jankiest model which is the one you're
283.06s - 289.42s |  looking at you can't even buy them if you want to pay five thousand dollars because
290.54s - 297.42s |  they're only sold to labs and you know on top of that they aren't modular they don't expand
298.14s - 303.10s |  so if you want something that does something else you need to buy the next model up you can't just
303.10s - 308.14s |  put a new module in and at the end of the day they don't work very well but you can see they're
308.14s - 314.06s |  not terribly complicated there's an inner chamber you can see this blue fluid there there's a little
314.62s - 322.06s |  teflon paddle that stirs outside there's a jacket and that is circulating a fluid that maintains
322.06s - 329.42s |  the temperature of the reaction and on top there is something injecting reagents so we don't like
329.42s - 335.82s |  all these poor features of the commercial version so here's our version again you can see it right
335.82s - 342.14s |  over here and if you'll note they're not that much different because functionally they're doing the
342.14s - 349.18s |  same thing you got something that stirs that's that inner chamber also with a blue fluid there's
349.18s - 355.18s |  a teflon little paddle that spins you've got an outer jar both of these are just mason jars
355.18s - 360.94s |  the outer jar has a circulating fluid and that circulating fluid maintains the temperature
361.82s - 368.62s |  and on the top you have peristaltic pumps which pull from those syringes to inject reagents
368.62s - 374.22s |  and then there's a little box next to it and that is the brain that executes all these commands so
374.22s - 379.82s |  let's see if we can take a look at all the bits and pieces of this uh this of course is entirely
379.82s - 386.54s |  open source you can build it yourself in fact that's the only way you can get it the documentation
386.54s - 390.62s |  team did a phenomenal job and you will get a wonderful walk through if you decide to visit
390.62s - 397.84s |  our github remember documentation or it's not a project you can make this whole thing for 300 bucks
398.40s - 401.60s |  probably less for most of you because you'll have a lot of this stuff lying around
403.52s - 408.24s |  and if you're not the sort of person who feels terribly handy you don't have to worry about it
408.24s - 414.16s |  everything either snaps together or is screw connectors this is not like a fancy difficult
414.16s - 420.40s |  project where you're gonna have to do surface mount rework or anything also there are open ports
421.12s - 426.24s |  you can reconfigure this if you want other things to happen you want to control atmosphere or you
426.24s - 432.32s |  want pressure or you want feedback from a ph meter all these things can be done because it's hackable
432.32s - 437.92s |  because if you can't rebuild it you don't own it so let's look at all the bits and pieces here
437.92s - 444.24s |  oh right and actually it works for those of you who saw what i took yesterday you know
445.20s - 453.04s |  and boy did i have the best glitter poop this morning all right let's take a look so this is
453.04s - 459.12s |  the wonderful logo and tagline for the micro lab this was an off-the-cuff statement but i thought
459.12s - 470.45s |  we should stick with it now the micro lab itself is broken down into an architecture
471.41s - 476.61s |  all of you who are the more technical will recognize these bits and pieces these i will
476.61s - 481.33s |  be able to speak to a little bit but they were all built by people who are more skilled at these
481.33s - 487.89s |  things than i am but if you can look it's not terribly sclerotic but there are a lot of different
487.89s - 495.12s |  things that are happening here's the machine itself and again you're looking at one of them
495.12s - 500.40s |  and again you're looking at one of them to the left and let's look at the pieces so
502.16s - 510.32s |  you have the reaction chamber itself this is two mason jars one which sits within the other
510.32s - 516.88s |  and there's a 3d printed armature it's called the we call it the reactor core which allows these to
516.88s - 521.36s |  screw together so that the inner jar floats while the outer jar can have the circulating fluid
522.08s - 525.12s |  this is what it looks like if you can't see super well
526.72s - 532.00s |  that piece that you see in the top that is the motor that runs the stirring paddle in the bottom
533.44s - 540.56s |  here's the actual core and it comes in three pieces and breaks apart like this snaps together
540.56s - 548.08s |  very nicely easy to construct now if you look at the rest of the armature here that purple box
548.08s - 555.20s |  houses both the circulation pumps for hot and cold fluid it also holds the peristaltic pumps
555.20s - 561.76s |  which pull from the syringes and then there's this armature that holds it all together again
561.76s - 567.92s |  this is what it looks like if you can't see super close let's take a look at the armature real quick
567.92s - 574.56s |  now for those of you who are mechanical engineering inclined you'll notice that it's asymmetric and
574.56s - 578.48s |  you might ask the question well why would that be that doesn't make a whole lot of sense was that
578.48s - 592.13s |  unintentional and yes it was intentional because our designers are awesome so now that we remember
592.13s - 600.16s |  why we're here let's put it back together and let's take a quick look at the brain now the brain
600.16s - 608.64s |  here is uh again 3d printed outside um top pops off and you can see the bits and pieces under the
608.64s - 615.68s |  hood here uh this is a version with an acrylic top again if you're close up or you come up later
615.68s - 620.72s |  you'll be able to actually see it it's sitting right here and you can see that you know there's
620.72s - 626.32s |  a bunch of wires but it's not too much to deal with and we can take a look at each of these
626.32s - 632.48s |  individual pieces so here again you can see how it's wired it's not too terribly much and a lot
632.48s - 637.92s |  of these are already ported the connectors at the top you'll see your screw terminals and these allow
638.64s - 647.60s |  us to connect the brain unit to the armature itself you have a relay board there's an arduino
648.48s - 656.32s |  that controls the pumps the main brain is a raspberry pi and then there's an interface that
656.32s - 661.68s |  is this touch screen these are really slick connectors and it makes it so that you can take
661.68s - 666.88s |  it apart and maybe you notice vinny over here who managed to put this together in 10 minutes just
666.88s - 671.92s |  from bringing it in cases this is a really easy system to use and thank you vinny wherever you are
678.99s - 686.53s |  so here you can see kind of how it's broken out you've got these nice little snap togethers the
686.53s - 694.29s |  relay board again controls a number of things there is a pid module that regulates temperature
694.29s - 699.25s |  and so you've got a heating element that's going to kick on or off as it predicts the curve of
699.25s - 704.29s |  temperature as it moves try and smooth out transitions additionally you've got something
704.29s - 710.29s |  that turns the stir motor on and off and also it's expandable there are a few other things that
710.29s - 715.57s |  you can do um i think we had a light on one of the earlier ones would have been nice in this
716.45s - 722.93s |  room with the mood lighting but um and then again uh the systems run on either 5 or 12 volts and
722.93s - 730.29s |  there's a little controller in there uh you can see also here uh this is an arduino uno and the cnc
730.29s - 736.29s |  shield that believe i said this already but that controls the pumps so those are essentially just
736.29s - 744.45s |  stepper motors and so it's pretty simple to have a g-code interpreter just send commands to say
744.45s - 748.61s |  turn it this much and one of the things that's important about this is that when you're doing
748.61s - 759.49s |  chemistry most steps in most procedures for doing synthesis say add this amount of this thing
760.69s - 766.93s |  this quickly or slowly then bring it to this temperature and stir it for this long and so
766.93s - 771.97s |  one of the things that it allows us to do is a recent update that's really great you can say
772.53s - 776.37s |  add this over this amount of time and this allows for a lot more things to be done
777.57s - 782.13s |  so looking at the bits and pieces here's how they float you can see again the touch screen
782.13s - 788.53s |  snaps into the raspberry pi on the other side you can see the arduino that has the
788.53s - 795.01s |  cnc hat on it the bottom piece is the voltage regulator and the top is the
797.33s - 803.89s |  relay control and again you don't have to build it like this one of the things that's wonderful
803.89s - 807.49s |  is that this is reconfigurable if you don't like it flat and you want a tower instead you can
807.49s - 814.37s |  totally do it the relay board you can actually even snap in between the raspberry pi and the
814.37s - 818.77s |  screen if you want but you have to have a taller box so aesthetic principles apply
819.33s - 825.65s |  remix and revisit as you see fit here you can see how the screen actually snaps in
827.01s - 833.81s |  and here's the cnc board again it's a it's a real simple little unit uh comes in a little kit and
833.81s - 839.17s |  you just snap everything together here again you can see these wonderful connectors they're really
839.17s - 844.53s |  really robust and there are a lot of wires there but you just have to count them in and screw them
844.53s - 850.29s |  down it's not um what is the term rocket surgery uh here's the voltage controller that will give
850.29s - 859.25s |  you out both uh five volts and 12 and again screw terminals for all of these things a really nice
859.25s - 867.89s |  system to work with uh i've enjoyed it so um moving forward i'll see uh this is again that
867.89s - 873.65s |  same connector and are we back all right now here you see it working now you might be able to see it
873.65s - 884.69s |  working here it is currently stirring look at that thing and just so you know this isn't just stirring
884.69s - 891.09s |  nothing both in this video and what you see here is actually manufacturing medicine and you will
891.09s - 898.21s |  watch me extract it at the end here so it's not just a demo proof of concept we've used this for
898.21s - 910.35s |  many things and it works great so i'm excited at the end and what you'll see me do soon is you'll
910.35s - 918.43s |  end up with the inner jar filled with active pharmaceutical ingredient in a solvent of some
918.43s - 925.95s |  sort and then you pour it through a coffee filter and then you let it dry and it basically looks
925.95s - 931.87s |  like this it's a fairly simple thing you dump it out you let it drip for a while now we're not
931.87s - 937.39s |  going to have time to let it dry and watch but once it does you can see there's this little powder
937.39s - 945.07s |  that's left on the bottom and then you peel it open and there's your stuff so anybody who says
945.07s - 950.43s |  you know chemistry is scary or if this sort of makes you nervous you maybe remember some weird
950.43s - 956.59s |  person in high school who abused you with like orbital theory and you know stoichiometric balancing
956.59s - 961.87s |  like yeah if you wanted to pursue a career in chemistry you might have to follow that but if
961.87s - 970.75s |  you just want to use chemistry it's not so bad so um i'm going to have to sort of walk through uh
971.71s - 975.95s |  this system uh these next two systems and then we'll swap computers and then hopefully i'll be
975.95s - 984.67s |  able to show this to you live um one of our guys has a stack of note cards and pens i will take
984.67s - 988.83s |  questions at the end but you got to write them down and then i'll collect them now this is if
988.83s - 994.67s |  you have general questions about anything we're doing and or if when i do the live thing you want
994.67s - 998.99s |  to see if we can figure out a way to synthesize your molecule choice i probably won't be able to
998.99s - 1003.55s |  do a lot of them but if somebody has a good interesting one we'll pull it down and take a
1003.55s - 1010.19s |  look okay so uh who's got the cards so look at this gentleman in the nice shirt here he'll be
1010.19s - 1015.31s |  walking around raise your hand if you want a card and write down your question so if you're trying
1015.31s - 1021.63s |  to figure out a reaction procedure and you go into the chemical literature it's difficult because
1021.63s - 1027.95s |  it's not really a procedure it's just here's how i did it so there's a lot of decoding again it's
1027.95s - 1034.83s |  not necessarily the only way to do it it might be the easy way that somebody found so it's highly
1034.83s - 1040.67s |  subjective of course it also has a bunch of jargon that if you don't have a degree in chemistry
1040.67s - 1045.71s |  might be pretty hard to deal with and on top of that you have to dig through the literature to
1045.71s - 1053.55s |  find it and one of the things that i'm super excited about is once more people start using
1053.55s - 1059.07s |  this if you say hey i figured out how to make xyz on the micro lab and you build a file for it
1059.07s - 1065.23s |  you can just trade it you can just torrent your drug of choice i mean
1067.23s - 1078.19s |  shouldn't you be able to download everything why not medicine so let's look at this wonderful
1078.19s - 1084.75s |  system that's been built this is hard let's look at the easy version this is this wonderful gooey
1084.75s - 1092.51s |  and you'll oh you may have seen this this is our uh little uh little captcha here so uh select
1092.51s - 1097.47s |  our pharmaceutical companies which have not settled for over 500 million us dollars for
1097.47s - 1103.95s |  off-label promotion and kickbacks if there are none clicks yeah yeah okay all right moving on
1105.15s - 1110.51s |  you can see there are two different types of steps here one is the dark blue that's something
1110.51s - 1115.07s |  that's actually automated that's something that the computer is doing then the turquoise
1116.19s - 1120.43s |  that is a human step so of course the machine can't load itself full of chemicals it has to
1120.43s - 1125.55s |  ask you to do that but there's a touch screen and it will talk you through that procedure it says
1125.55s - 1132.19s |  at the beginning do you have the proper ingredients do you have this much is it in the solution okay
1132.19s - 1138.11s |  load it into the proper syringe are you sure you're there and then the hard part for a human
1138.11s - 1144.27s |  which is trying not to watch the water boil while something stirs for 18 hours and making sure that
1144.27s - 1149.39s |  the temperature is just right the computer takes care of again it's a perfect division of labor the
1149.39s - 1155.87s |  way most things should be so you can see we're going to scroll through this is the procedure
1155.87s - 1159.95s |  for sovaldi this was the thing that we were talking about yesterday and you can see there
1159.95s - 1164.19s |  are plenty of automated tasks and at the bottom there's some post-processing that has to happen
1164.19s - 1169.63s |  that's done by the human that's why you see a lot of the turquoise in a row and on the right you
1169.63s - 1176.83s |  can see when a particular step is selected it has parameters and you can go through and say do you
1176.83s - 1183.79s |  want it to stir is it cooling or heating what temperature do we bring it to what degrees and
1183.79s - 1192.99s |  for how long and it's just that easy to edit again it also supports branching this is a big deal
1192.99s - 1200.27s |  because the machine is not going to know if things aren't working but the machine can ask
1200.27s - 1206.43s |  you to check so let's say and this is a fairly common thing in chemistry something just doesn't
1206.43s - 1214.27s |  dissolve right so you've stirred it in solvent for a long time it will say are there still particulates
1214.27s - 1219.71s |  and you can then tell it yes or no and if it says yes then it will continue to stir for you and it
1219.71s - 1226.51s |  says come back in another 20 minutes and let's check again so nice little linear choose your own
1226.51s - 1232.75s |  adventure and you can build branching processes again one other thing about this that i am super
1232.75s - 1239.79s |  excited about is that additionally if you have some sort of chemistry that you want to do that
1239.79s - 1244.99s |  maybe isn't so complicated and doesn't even require something as sophisticated as the micro lab
1244.99s - 1249.55s |  this still supports it if you just need something to talk you through a process
1250.43s - 1257.71s |  and have some contingencies make sure you check xyz you can still trade ideas this way so when
1257.71s - 1262.59s |  we figure things out we can tell each other and we don't even have to meet each other we can all just
1262.59s - 1270.67s |  post it and be friends because i think a lot of us remember having stuff like that when we learned
1270.67s - 1276.51s |  other things but somehow it's not out there for medicine and chemistry yet but it should be
1278.03s - 1283.07s |  so uh this is the moment when i was going to hit the hdmi switch i'm going to instead go through
1283.71s - 1287.79s |  show you the next tool and then at the end we're going to swap to the other machine
1287.79s - 1294.51s |  and we'll show the things uh live so the synthesis pathway this is the
1294.51s - 1302.51s |  the this is chemhacktica this is a system that we started in 2018 i think it's gone through
1302.51s - 1310.43s |  several iterations it's uh got a new kernel it's much more efficient and you can ask it whatever
1310.43s - 1314.99s |  you want so for those of you who have a particular chemical you'd like us to look up this is what
1314.99s - 1319.55s |  it's going to look like we're going to pull up wikipedia we're going to scroll all the way to the
1319.55s - 1327.23s |  bottom we're going to go and look for the smiles code which is an open source system for encoding
1327.23s - 1333.47s |  either both i should say both molecules and chemical reactions into an ascii string
1335.15s - 1342.11s |  you have to click on show and it pops up you grab that you copy you paste it into chemhacktica
1342.11s - 1348.35s |  and it'll draw the molecule for you in fact at the collective we use this just for either
1348.35s - 1354.35s |  generating smiles codes or drawing things it's it's got all sorts of utility and for those of
1354.35s - 1359.23s |  you who are super chemistry geeks you'll see that there are eight other modules within this as well
1360.83s - 1364.03s |  typically what happens which i'm going to show you in a moment here
1364.03s - 1367.87s |  is that you will just ask it to say what is the simplest way i can get from point a to point b
1369.15s - 1374.59s |  but there are so many parameters that you can tweak you can say do not do anything
1375.47s - 1380.43s |  that has a controlled substance as a precursor because those are hard to find
1380.43s - 1388.03s |  you can say don't use any precursors that are too expensive if you want to have safety parameters
1388.03s - 1392.83s |  and say don't use anything as a catalyst that's a heavy metal you can do that as well
1394.11s - 1402.91s |  additionally it will hypothesize if you ask it nicely but for the most part it is not doing that
1402.91s - 1407.31s |  it's looking through the chemical literature all of the chemical literature that's ever been
1407.31s - 1412.11s |  published and it's combinatorially looking for different pieces of the reaction that you're
1412.11s - 1418.67s |  trying to create so you click on perform one step and that's basically shorthand for show me the easy
1418.67s - 1425.47s |  way and when it does that it will pop up either one reaction or a series of reactions and you can
1425.47s - 1432.03s |  go in and ask it to evaluate now what you see here is that one box is in blue that's your target
1432.03s - 1437.23s |  those two green boxes that indicates that those are commercially available and you can just buy
1437.23s - 1442.03s |  them it will come up with things that are not commercially available and those boxes will be
1442.03s - 1447.95s |  red you can then click on those and say expand node which means if i can't buy this how do i
1447.95s - 1452.19s |  make that thing and if you've got something terribly complicated you may have to work your
1452.19s - 1456.83s |  way back a ways that's the thing that says tree builder it'll do all of that automatically in
1456.83s - 1464.19s |  the background if you ask it so when you click on the reaction here you see the smiles code for
1464.19s - 1470.59s |  the reaction come up and it gives you a lot of parameters you can then ask it to evaluate
1470.59s - 1477.31s |  and it will give you the solvents that you need the temperature at which it should work and again
1477.95s - 1486.43s |  how how well it expects it to work so you can get purity and yield guesses which of course
1486.43s - 1490.67s |  are dependent on conditions but it'll give you a a good guess
1492.99s - 1496.11s |  this was sovaldi this was the molecule that we were talking about yesterday
1496.91s - 1501.63s |  and just so you guys can see it again here's what it would look like if you found it in the
1501.63s - 1508.91s |  literature this is the reaction don't get too nervous if chemistry makes you nervous we're
1508.91s - 1513.95s |  starting one step here we asked it to do one step and it showed us a way to do it in one step
1513.95s - 1519.55s |  this ring of fluorines on the right with the oxygen will break off and it will leave an empty
1519.55s - 1524.91s |  space and that space where the oxygen was is going to make friends with this other oxygen on the other
1524.91s - 1532.99s |  side and yes and for those of you who remember this is indeed the thing that we were trying to
1532.99s - 1540.03s |  target um i'll also show you this uh those of you who were here yesterday saw this wonderful 3d
1540.59s - 1544.83s |  version of it but the same thing happens the ring breaks off and then there's that
1544.83s - 1550.99s |  free little stick and there's a little connection and there's your molecule
1553.39s - 1560.27s |  so let's play with this i think that uh if i'm not mistaken we're at the point where we can
1561.47s - 1566.83s |  switch over computers yeah this is this is getting into the biochemistry of sovaldi which
1566.83s - 1572.91s |  is exciting and if you want to hang out we can talk about this at the end but um i'm just going
1572.91s - 1583.55s |  to switch machines real quick and see if they play nice so the thing you're about to see if i can get
1583.55s - 1594.11s |  this machine to play nice is that this hopefully has a live net connection um i'm sorry um one of
1594.11s - 1598.75s |  my guys is out there who said he's going to help me with this so we're actually on a live net
1598.75s - 1603.39s |  connection i'm going to step out of the way while he does this we're accessing our own website
1604.19s - 1609.39s |  you're going to see it happen please don't all jump on there as well like it's live you could
1609.39s - 1616.19s |  but we don't know if it'll support 300 some odd people so just let us get through this and then
1616.19s - 1620.91s |  and then take a look everybody cool all right thank you so bear with us for a moment while we
1620.91s - 1626.43s |  try and get this thing rolling or if it's not rolling maybe my other screen is live and i can
1626.43s - 1633.20s |  talk about something else while this other computer comes back to life you guys see this
1633.20s - 1640.64s |  uh big bunch of ribbons here is that what's on there okay cool so just to talk about sovaldi
1640.64s - 1647.36s |  real quick before we take requests and look at the system in the inside there you'll see a little
1647.36s - 1655.68s |  corkscrewy thing this looks reminiscent of dna it's rna what you're looking at is part of the
1655.68s - 1664.48s |  protein that sits inside of hepatitis c thank you that allows it thank you that allows it to
1664.48s - 1671.60s |  replicate and that bright green bit that's sovaldi and the magic of it is that it comes in and it
1671.60s - 1678.16s |  binds where one of the bases from the rna is and stops the replication in its tracks
1679.12s - 1685.68s |  this is unprecedented it's amazing how it works and again it's so effective that it acts as a cure
1686.32s - 1690.80s |  rather than just a treatment it can work and your immune system can actually catch up
1690.80s - 1697.28s |  and eradicate it from your body so all right let's hope the demo gods smile on us and we're
1697.28s - 1703.52s |  gonna switch over everybody ready i can't see anybody out there there could be like three
1703.52s - 1712.18s |  people so like i need a little more is everybody ready awesome now we're talking so
1716.98s - 1721.14s |  okay i touched it all right here we go yeah i see a little jellyfishy thing
1722.50s - 1729.70s |  okay cool i lost i lost my screen well it'll all right so here we'll just do this from scratch
1729.70s - 1734.10s |  here we go so here's chemactica oh switch the tab i just minimize it where is it
1734.98s - 1742.02s |  i lost it all right never mind i'll do a fresh one here we go come on you can do it
1744.18s - 1746.66s |  maybe you can't do it we had it a second ago
1748.98s - 1757.86s |  uh dude okay i'm i'm struggling here so uh again as soon as this comes back up you'll see that
1757.86s - 1762.58s |  same screen that i showed a second ago i'm just taking this out okay there that's a little better
1762.58s - 1766.34s |  can you guys hear me better this way all right cool thanks i'm just gonna do this i'm more
1766.34s - 1774.34s |  comfortable with it i don't know how i dropped the thing so you'll be faced with a page and it'll
1774.34s - 1783.70s |  have a there it is yeah cool can you guys see it all right cool it's uh the aspect ratio is a little
1783.70s - 1791.46s |  weird but here's what we're gonna do um we're gonna grab wikipedia here and we're just gonna
1791.46s - 1798.50s |  look for your drug of choice and um again soon i'll get a stack of your requests but
1800.10s - 1803.94s |  there you go um and i'll just do sovaldi um
1808.58s - 1811.70s |  i'm typing in the dark but let's see if it'll search
1815.70s - 1819.86s |  you know this makes me so nostalgic for when i was a kid and we had
1819.86s - 1827.06s |  dial-up modems um so yeah i'm not sure how viable this is going to be at this juncture
1827.70s - 1833.14s |  um so while this is loading i'm just going to switch gears uh who has my note cards
1836.29s - 1845.39s |  okay we just passed me some sending a request to intake dash analytics wikimedia.org
1846.35s - 1857.63s |  this may or may not be a slow process but okay cool all right so um i'm gonna start with looking
1857.63s - 1865.31s |  at some of the drug requests somebody says testosterone please um yeah that's a hormone
1866.11s - 1872.19s |  doable can we synthesize estradiol i'm sensing a pattern okay
1875.55s - 1881.71s |  ah vivance somebody here was nice enough to actually point out that there are some problems
1881.71s - 1887.31s |  with this even after the patent has expired last year i still have to pay two hundred dollars a
1887.31s - 1899.55s |  month yeah that sounds fucked let's let's maybe fix that all right this one i don't know uh
1899.55s - 1905.87s |  mometasane furry treats asthma and eczema so i don't know so one thing um yesterday somebody
1905.87s - 1910.27s |  came up and asked me about monoclonal antibodies i'm sure a lot of you have seen monoclonal
1910.27s - 1917.87s |  antibodies in the news they are this miracle thing unfortunately they are too complicated
1917.87s - 1922.27s |  for us to do it's a macromolecule they're gigantic the way that you manufacture them
1922.27s - 1928.51s |  is not the same as small molecule chemistry a rough idea is if you can write it on a napkin
1929.23s - 1936.19s |  then you can probably do it over here if it's big not so much so uh
1938.43s - 1944.59s |  can you get time release capsules for slow relapse meds yes so that's in the compounding
1944.59s - 1949.95s |  phase there are plenty of um ways to do that there's some really cool stuff the
1950.67s - 1956.03s |  interestingly enough i'm going to hazard a guess this is somebody who wants adderall xl okay like
1956.03s - 1965.31s |  just maybe not but in the case that you do here is a trick the way that adderall xl is manufactured
1965.31s - 1969.47s |  is that there are those tiny little spheres that are inside the capsule and half of them
1969.47s - 1974.83s |  are coated and half of them are not coated it just means that some of those dissolve
1974.83s - 1981.71s |  instantaneously and some of them don't it is designed not just practically it is designed
1981.71s - 1988.03s |  specifically only to be the same as taking half of one and then taking the other half four hours
1988.03s - 1999.18s |  later so best time release system look at your watch can you make insulin oh my god isn't this
1999.18s - 2006.22s |  a fucker of all times man so yeah we're super angry about that one too uh insulin is something
2006.22s - 2013.18s |  you have to sort of bioproduce you can do it what we're trying to do right now actually as we speak
2014.14s - 2022.78s |  is replicate a system by which tobacco will manufacture incident endogenously now you can't
2022.78s - 2030.38s |  smoke it but you can dip it um this has been demonstrated to work we're just trying to
2030.38s - 2034.54s |  steal it because it's not commercially available but imagine you just grow some
2034.54s - 2039.98s |  tobacco in your backyard and insulin's free just like in that old tweet
2040.30s - 2048.37s |  we put it too bad do any reactions require cooling yes absolutely are you working on that
2048.37s - 2053.57s |  no we already worked on it so if you look at the machine you'll see this thing under the foil that's
2053.57s - 2058.45s |  the cooling side there are two things that circulate there's a heating module and there's
2058.45s - 2063.49s |  a cooling module often you have to keep things cool if you have an exothermic reaction that's
2063.49s - 2067.33s |  going to not be happy when it gets too hot you have to keep it cool so you will have a system
2067.33s - 2075.41s |  that has either ice and water or ice and acetone or ice and isopropyl alcohol and these will give
2075.41s - 2080.21s |  you different set points that will be able to control your temperature oh look this came up
2080.21s - 2084.85s |  all right cool is everybody cool with this and i'm sort of going back and forth and answering
2084.85s - 2089.81s |  questions as we go all right cool thank you i appreciate the encouragement again it's so dark
2089.81s - 2097.01s |  it looks like i'm here alone could you make injectable medications like insulin or humira
2098.21s - 2104.85s |  so this again is a question not so much of manufacturing of the actual molecule but in
2104.85s - 2110.69s |  terms of compounding you can make injectable meds you take that powder you can put it into
2110.69s - 2118.05s |  injectable form if you do that please be careful when you swallow a pill if it's a little dirty
2118.05s - 2123.33s |  it's not going to be that great if you take a needle that's dirty or a fluid that's dirty and
2123.33s - 2131.33s |  inject it into oh god did i break it again let's hope it comes back all right i'll need somebody
2131.33s - 2138.77s |  to log me back in um if you're compounding things for injection you have to practice sterile
2138.77s - 2143.49s |  technique now this is totally doable okay i don't want to scare anybody and say don't do it
2144.05s - 2149.57s |  be careful no be competent you can learn sterile technique but it is something that requires
2150.53s - 2157.89s |  attention here's an example right standard of practice for sterile sterility training
2158.61s - 2163.65s |  your hands don't leave your line of sight or you've broken sterility and here my hands haven't
2163.65s - 2170.21s |  touched anything and then you adjust your glasses and it's over so a real easy lot of mistakes to
2170.29s - 2181.73s |  make okay okay so that tells me i'm good benzo natate i'm gonna guess that's a like a valium
2182.45s - 2189.89s |  type thing okay yeah um i'm not sure but again if it's a small molecule probably doable somebody
2189.89s - 2198.10s |  else is asking about vivance all right cool we got more stuff all right cool a lot of people
2198.10s - 2204.18s |  asking about vivance oh modafinil if somebody just wants one now just ask me i think i have
2204.18s - 2210.18s |  one in my pocket here somewhere okay cool so let's uh so here i will skip over here and now
2210.18s - 2215.30s |  that wikipedia is making friends let's look at vivance since so many people are asking about it
2215.30s - 2223.70s |  by vans is that the correct spelling by van there's an n in there right vans by vans that correct
2224.66s - 2233.30s |  all right let's give that a try yeah okay cool all right thank you all right um
2235.30s - 2242.50s |  all right okay our hot spot apparently went down all right we've got uh more questions i am a
2242.50s - 2249.38s |  software engineer in a med school dropout how can i help contribute come say hi where are you my god
2249.38s - 2256.66s |  come make friends and like i'm serious i know that a lot of times people will come up on stages
2256.66s - 2260.66s |  like this and say no we really want help from anybody it doesn't matter your skill set we can
2260.66s - 2268.18s |  use the help i'm not lying about that seriously if you say i have no technical skills i'm at
2268.18s - 2274.10s |  defcon because somebody dragged me and i don't know how to use my smartphone but this seems cool
2274.18s - 2282.98s |  seriously come fucking say hi we need all of you no joke oh there you are yes especially you
2285.06s - 2292.66s |  all right do you have more business cards all right yes
2294.90s - 2299.62s |  but this is the important thing yes we have a bunch of business cards if you want some
2299.62s - 2304.42s |  yeah i'll pass them to you but the big deal is not that we made business cards the big deal is
2304.42s - 2310.58s |  that you can make business cards it's really really easy six dots on a piece of paper let
2310.58s - 2318.02s |  it dry and put it in a bag there is a not a person here who can't do that so you want a business card
2318.66s - 2326.90s |  come get one please make a bunch with your friends and if you have some anarchist collective or a
2326.90s - 2332.58s |  bunch of geeky friends who are hanging out somewhere and you want let me know i'll come by
2332.58s - 2337.14s |  and do a workshop and we can all just hang out at each other's houses and make abortion cards
2337.14s - 2340.98s |  does that sound like a good plan all right call me
2346.24s - 2353.71s |  ah there was a second part to this question about purity and dose determining yeah so
2354.67s - 2362.75s |  the thing that's the thing that's hard for most people who have seen modern chemistry to really
2362.75s - 2368.75s |  grok is that it's entirely possible oh we got live ants oh look at that all right cool is that you
2368.75s - 2377.71s |  don't need all the fancy machinery you know you talk to people who work in chemistry and they
2378.27s - 2386.67s |  talk about things like high-performance liquid chromatography gas chromatographs uh nmrs all
2386.67s - 2391.15s |  right so you see this milestone thing here i i think it's against crawlers but you've got to
2391.15s - 2397.55s |  click to show and then you grab it like this and if i can just doop doop doop and then let's click
2397.55s - 2408.83s |  over so here we are let's click this in here we'll do a little paste and may take a minute
2408.83s - 2416.75s |  again it's querying a machine that's very far away um but wet chemistry has been done for hundreds
2416.75s - 2420.91s |  and hundreds of years way before there were electronic machines to check our work there are
2420.91s - 2426.99s |  plenty of ways to check for purity the simplest one is called a steel tube it's a little piece
2426.99s - 2432.99s |  of glass that's a loop and then you take a tiny little thing that looks like a miniature
2434.27s - 2441.31s |  um test tube from like a dollhouse you stick it in and then you start heating it and then you'll
2441.31s - 2447.55s |  see your powder turn from powder to liquid and most things have sharp melting points and if they
2447.55s - 2454.43s |  melt at the temperature that you expect you know that it works and if it's off you can do a little
2454.43s - 2459.39s |  interpolation just a little ratio don't get scared by the math it's just a ratio seriously
2461.07s - 2465.07s |  and you can calculate your purity i'm gonna try and click and see if it'll bounce over
2465.71s - 2473.71s |  um in the meantime i will go back everybody's still cool i know this is like just so dramatic
2473.71s - 2480.99s |  we're gonna figure it out but like you know if um if you're on a regular uh net connection it
2480.99s - 2488.67s |  just pops up it takes like half a minute sometimes depending on how uh complicated okay what cad
2488.67s - 2499.79s |  software does the team use i haven't the foggiest idea um somebody knows yeah free cad all right
2499.79s - 2511.89s |  moving on um this is still working maybe i click it again here you fiddle with that okay
2512.53s - 2519.81s |  would it be different to get these equipment through airports sending or across national
2519.81s - 2530.29s |  or international borders um so this all came from very far away yeah uh east coast uh we
2531.41s - 2536.29s |  i mean not that our people aren't super experienced in smuggling they are but
2536.29s - 2540.45s |  those skills were not required for this people typically don't give you shit it's it's just a
2540.45s - 2545.33s |  bunch of computer stuff they might ask but it's not it's not that weird international
2545.33s - 2556.42s |  borders slightly different thing um i can't talk about it in public but there are maybe some war
2556.42s - 2560.34s |  zones that you've read about in the news where you've been trying to move things you can get
2560.34s - 2566.90s |  them across so we're trying to do our bit that way and if you're doing that it's doable sorry i can't
2566.98s - 2570.74s |  be more specific in public lest i be dragged away before the talk ends
2574.66s - 2581.38s |  everybody's still cool all right thank you is there a crowdsource community for tackling a
2581.38s - 2588.42s |  procedure as a group oh my fucking god there should be now here's the thing there are two
2588.42s - 2595.78s |  subreddits that are like super sleepy um i believe one's called like they both have something like
2595.78s - 2601.38s |  biohacking in the title and there's not much going on there what we would love to see happen
2601.38s - 2608.82s |  is this start now whoever wrote this question please help us start this i'm not kidding this
2608.82s - 2615.38s |  keeps me up at night because all of this stuff that we do if now don't get me wrong i am so
2615.38s - 2619.62s |  grateful that all 300 of you are here but if we are the only people who figure out how to do this
2620.34s - 2625.22s |  we've failed so please let's figure out a way to talk about it if somebody has a way to generate a
2625.22s - 2630.58s |  subreddit or just create a thread where things are popping a little more that would be spectacular
2631.86s - 2639.46s |  um any looking at ozempic wagovi fuck no you shouldn't be taking that shit leave it for
2639.46s - 2647.58s |  people who actually have diabetes i'm sorry also you don't want your retinas to detach
2647.58s - 2655.98s |  it's not a good look ah i was anticipating question this question are you still working
2655.98s - 2662.46s |  on the mouth bacteria how many people know what this is in reference to okay short answer
2663.74s - 2670.14s |  yeah it's done we still need to change one last thing but it functions properly so it's going to
2670.14s - 2676.78s |  be probably a couple of months before we actually release it and i'm getting a notion that this is
2676.78s - 2684.30s |  all toast so here's the thing go to synth.forthesvinegar.org and you can just do the
2684.30s - 2690.70s |  thing that i did and you'll see that it works it's really impressive i'm sorry i couldn't show it to
2690.70s - 2698.70s |  you live but i will answer a few more questions and mention one other thing how do you plan to
2698.70s - 2709.02s |  keep chemhactica up to date well that's a fair question um it does work within the ecosystem
2709.02s - 2715.50s |  of open source software there are we're sort of maintaining one fork the heavy lifting was done
2715.50s - 2723.10s |  by some other people um but there isn't a whole lot to update really it does crawl through a
2723.10s - 2731.10s |  database called reaxis and any time that you recompile if you use that database or i don't
2731.10s - 2734.86s |  think you even have to recompile you just have to point it to the updated version of reaxis and
2734.86s - 2747.18s |  that should do it itself um with the rise of ai oh oh would you utilize ai to make your device
2747.18s - 2755.58s |  better do you think it would make it better i mean i know mansplaining as a service is real
2755.58s - 2762.70s |  popular these days but kind of a bad look um no okay but in all seriousness we have been looking
2762.70s - 2769.42s |  at trying to build some systems that will help you navigate the scientific literature because
2769.42s - 2773.90s |  taking technical jargon and boiling it down is something that the large language models seem to
2773.90s - 2780.46s |  be good at but we've been having trouble trying to get it to work because it makes shit up um
2780.46s - 2786.38s |  oh my goodness all right i know there are still more here i i got a five minute mark let me say
2786.38s - 2800.42s |  one more thing before i step off stage here if this work seems worthwhile to you or interesting
2801.30s - 2812.90s |  or fun come join us we need your help we need it now think for a moment if i were to say somebody's
2812.90s - 2817.46s |  dying outside and you can help me save them i just need you to come with me and help me
2817.46s - 2824.42s |  you do it and if i say now that if you write me an email and we start working together that we
2824.42s - 2830.42s |  could save millions why wouldn't you do that and you don't even have to join us to join us
2830.42s - 2836.82s |  just build your own figure out things that we didn't use it for procedures that we didn't
2837.54s - 2844.42s |  think of make it better make it new and teach people there's no better thing that you can do
2844.42s - 2851.14s |  as a technically adept person than to teach what you know to somebody who doesn't know it yet
2852.90s - 2858.42s |  we can make things so much better all of us together please come chat with me after
2858.98s - 2863.94s |  write to us or don't and just make it yourself thank you all so much for coming


url: https://www.youtube.com/watch?v=OkVNbL7gysI
title: DEF CON 32 - How we built our REDACTED THING this year, 5n4ck3y, && AMA Badge Panel - AND!XOR
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=OkVNbL7gysI",
  "title": "DEF CON 32 -  How we built our REDACTED THING this year, 5n4ck3y, && AMA Badge Panel -  AND!XOR",
  "description": "See talk title, kids these days dont read more than a sentence anyway. Seriously though, we get asked a lot of random custom electronics, hardware hacking, and badge questions, here's your chance to throw them at us while we drink a beer and pretend to know the right answer",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2450,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 4.88s | This text was transcribed using whisper model: large-v2

 So, we're going to talk about how we built our redacted Anodic Sower Badge this year.
7.28s - 10.16s |  Oh, really? I should start with, can you hear me all right?
11.28s - 16.96s |  Now we're golden. And feel free to come closer if you want to ask questions and whatnot.
17.60s - 20.56s |  So yeah, we're going to go over how we did our Anodic Sower Badge this year,
20.56s - 26.08s |  all the fun and challenges we ran into, and reverse engineering snack machines.
26.32s - 26.88s |  First challenge.
29.68s - 34.64s |  Now it's off. We're dying. We've lost mics.
35.84s - 42.16s |  No. Does the mic run on Cox internet? All right.
42.16s - 45.28s |  Our first challenge that we have already that we have a problem is,
45.28s - 47.28s |  it says three people, it's two now.
47.28s - 53.68s |  Yeah. I'm higher on. This is, yeah. Zap's taking care of the snack machine.
54.16s - 58.48s |  So of course, normal disclaimer, this is our fun side thing.
58.48s - 60.48s |  We have employers like most people do.
60.48s - 62.24s |  This does not represent our employers.
62.24s - 65.36s |  But more importantly, this is a community stage.
65.36s - 68.00s |  And we didn't really want to give a talk.
68.00s - 70.40s |  We wanted to treat it like community discussion.
70.40s - 73.60s |  When we're running our contest, tons of people want to talk to us about,
73.60s - 77.76s |  hey, what was it like making the badge, working with Snacky, doing different things.
77.76s - 81.20s |  And you feel bad because you want to have deep conversations about this stuff.
81.76s - 87.44s |  But you're also running a contest with six, seven, 800 people running around and things breaking.
87.44s - 91.76s |  So don't treat this as a talk. Treat it like a town hall.
91.76s - 94.56s |  You know, politely interrupt us, ask questions.
94.56s - 101.20s |  I'll do my best to like hear and repeat it back so others can hear it and group discussion.
101.20s - 103.28s |  But we'll, we'll use the slides to go through it.
103.28s - 106.88s |  And anytime you're curious about something, ask.
107.28s - 107.84s |  Same thing?
107.84s - 109.20s |  Oh, that's good.
109.20s - 109.76s |  All right.
111.12s - 113.04s |  So we're Anodic Zor.
113.04s - 115.52s |  We've been making badges for about nine years.
116.56s - 118.40s |  Different members have come in and out.
118.40s - 123.60s |  But if you take a look at the picture, you can see a lot of the different work we've done over the years.
123.60s - 127.76s |  And yeah, we joke, we make stuff, drink beer, no particular order.
128.32s - 130.64s |  We just have a wide variety of backgrounds.
130.64s - 134.96s |  And we like doing this as a fun, interesting way to get people involved.
135.28s - 138.72s |  And I guess that's like, hey, why do we do this to ourselves?
138.72s - 142.00s |  Because you'll hear people, you know, joke about badges.
142.00s - 143.12s |  What do badges do to you?
143.12s - 144.96s |  What's all the stuff that's involved in it?
144.96s - 148.32s |  And I don't know, for me, it's like, I like learning new things.
149.52s - 153.20s |  Usually on a badge, sometimes we pick stuff that we don't know how to do.
153.20s - 154.64s |  So we have an excuse to learn it.
154.64s - 157.84s |  Yeah, like building stuff and just seeing how
159.44s - 160.80s |  DEF CON just tears it apart.
161.76s - 163.36s |  DEF CON just tears it apart.
163.36s - 166.32s |  DEF CON makes something that's mine, that's mine.
166.32s - 168.08s |  That's why I like to do it.
168.08s - 170.88s |  Also just providing something that people just like to do.
171.60s - 172.64s |  It's something people get to do.
173.76s - 176.56s |  Yeah, and I think like just teaching others, that's always been fun.
176.56s - 179.76s |  Like when we do our CTF, it's usually a mixture of things.
179.76s - 183.44s |  We like putting hardware hacking mostly, but we'll put reverse engineering,
183.44s - 188.40s |  lock picking we've done before, just different side channel attacks and RF cryptography.
188.40s - 190.24s |  Like it's fun to mix it up that way.
190.24s - 194.64s |  It's not fully devoted to one domain of InfoSec or something.
194.64s - 196.00s |  It's just kind of spices it up.
197.76s - 199.60s |  Fun fact, if you have friends with kids
199.60s - 202.24s |  and you're worried if your badge will survive DEF CON,
202.24s - 204.64s |  as soon as you're done, you give your prototype to a three-year-old
204.64s - 206.08s |  and let them play with it for a week.
206.08s - 209.04s |  It will survive drunk hackers at DEF CON sometimes.
210.48s - 212.64s |  And it's good level of response, three-year-old.
214.32s - 219.20s |  So I would say without further ado, yeah, our badge this year plays Doom.
219.92s - 228.48s |  And on the surface, you have a case which resembles a very recognizable
229.92s - 233.20s |  handheld video game device that came out 30 years ago.
234.96s - 236.08s |  It's very nostalgic.
236.96s - 238.48s |  And what would I say?
238.48s - 239.68s |  We did everything in C.
240.80s - 245.12s |  We got firmware that I'll talk about a little bit later, but yeah, it runs Doom.
245.12s - 248.48s |  And if you've never messed with Doom, by the way, if you have questions about Doom later,
248.48s - 249.28s |  throw them out there.
250.08s - 254.72s |  At this point, we're probably 16 forks deep on the version of Doom we're using.
256.00s - 258.80s |  And in a nutshell, where we stood on other's shoulders,
259.92s - 264.00s |  we had to put custom drivers together, rewriting the entire control API
264.00s - 269.60s |  because we do things where it's really hard to see a status bar to play Doom.
269.60s - 272.64s |  So tap into that API and control the LEDs.
272.64s - 274.88s |  So when you get shot, it gets bloody.
274.88s - 275.84s |  The LEDs are red.
275.84s - 277.60s |  When you shoot, go through ammo.
277.60s - 281.44s |  You have like a status of ammunition going downwards, white, et cetera.
283.04s - 287.52s |  We've done some other things, making custom free open source IWOD that can be used.
287.52s - 292.32s |  I'll get into that, what the hell that means and tying it into a CTF.
292.32s - 294.96s |  Do we have slides for the hardware?
294.96s - 296.48s |  We do have slides for the hardware.
298.48s - 302.56s |  We have lights on us now and it's actually more blinding and I can't see anyone.
302.56s - 303.28s |  That's okay.
303.28s - 304.24s |  I appreciate it.
304.96s - 308.96s |  So yeah, if you're curious to have a question, you can like wave your hand on something.
310.40s - 313.20s |  I think I just wanted to go through like what's up with the hardware
313.20s - 314.48s |  and what does it look like at first?
314.48s - 316.48s |  Because that is where it starts to look boring.
319.12s - 321.36s |  You may not be able to tell when it's first put on there,
321.36s - 325.12s |  but that's like our first rev where you just have the form factor, the buttons.
325.12s - 327.12s |  You have a little, oh, of course it can't see it.
328.08s - 332.16s |  Our RP2040, the Raspberry Pi Pico microcontroller.
332.72s - 337.28s |  Um, it may be too small, but I was going to ask folks, do you see what's wrong with it?
338.64s - 341.12s |  I didn't even catch this problem until the final rev.
341.12s - 343.84s |  Does anyone notice what's wrong on the front plate?
346.24s - 348.00s |  No introverts.
348.00s - 352.48s |  What's a that's one start and select our switched.
353.36s - 354.24s |  There's another one.
355.76s - 356.26s |  Yeah.
358.24s - 358.72s |  What's that?
358.88s - 362.24s |  Oh, we don't have SD cards.
363.92s - 364.42s |  Yeah.
365.44s - 366.40s |  Never again.
366.40s - 370.16s |  We we've had a, we've had a bad experience with SD cards.
370.16s - 371.92s |  So we use Winbon flash instead.
373.28s - 375.60s |  Um, yeah.
375.60s - 377.20s |  So it's funny.
380.80s - 386.22s |  No, then you learn there's many variants of Game Boy cases.
386.22s - 388.46s |  Um, yeah, so we didn't catch that.
388.54s - 391.74s |  A and B were flipped because when we were looking at the EDA design tools,
391.74s - 394.86s |  depending on the point of view, you see start, select BA.
395.98s - 399.58s |  And it wasn't until I started working with the firmware and the control that I thought that
399.58s - 400.86s |  the engine was just screwed up.
400.86s - 405.02s |  And I had to remap everything on the inside when it was really, our buttons were backwards.
405.02s - 409.90s |  Um, and you never want to build something into a Game Boy case.
409.90s - 413.66s |  I think our assembly involved 19 different parts and steps.
413.66s - 418.06s |  And the, the shit show gets worse, but it works.
418.06s - 418.78s |  It's fun.
418.78s - 424.94s |  It's a nostalgic, nice hand feel to it, but it doesn't, you have to have tedious.
425.90s - 428.22s |  Devotion to get through assembly base.
428.22s - 428.94s |  It's not fun.
431.34s - 436.06s |  Um, I honestly regret suggesting doing a Game Boy.
437.98s - 438.48s |  Really?
440.06s - 440.38s |  I don't know.
440.38s - 442.06s |  Has anyone ever done Game Boy modding?
442.46s - 446.94s |  Messed them for, yeah, it's, it's, it's a passion.
446.94s - 450.30s |  Um, it doesn't scale well, but we persevered and I think it's fun.
451.02s - 451.90s |  Especially but in doom.
451.90s - 452.40s |  Yeah.
456.51s - 460.99s |  Original question was, uh, in the other formats of game grades, um,
461.71s - 464.27s |  thought about actually doing the original with big brick.
464.27s - 468.99s |  And then I actually, I think what happened was that basically bought
468.99s - 471.31s |  the colors by accident and we just went with that.
472.43s - 473.71s |  Lots of planning, right?
473.71s - 475.31s |  We're like, just roll with it.
475.31s - 478.11s |  Um, and at first it was, it was a nice form factor too.
478.11s - 479.07s |  Cause you're thinking about it.
479.07s - 480.75s |  Like, okay, I can get cases.
480.75s - 482.51s |  It already holds batteries.
482.51s - 486.91s |  Um, we'll get into some of the battery stuff on the later revs, but it, I'll
486.91s - 491.15s |  admit as much as we complain about the cases, they're actually, it's ergonomic.
491.15s - 492.99s |  It uses certain form factors.
492.99s - 495.23s |  So you can only put in the parts in one way.
495.23s - 496.67s |  It's super useful.
496.67s - 502.27s |  Um, in hindsight, like a GBA would have given us better GPIO, especially for doom.
502.35s - 506.11s |  It, it made it a fun challenge of button combos to try to take like an eight
506.11s - 507.95s |  control system and put it on this.
508.83s - 511.55s |  Um, what's interesting is this is our first badge.
511.55s - 514.51s |  We also did lithium for our power source.
514.51s - 519.47s |  Um, usually we use like three triple A's or three double A's, but because
519.47s - 524.03s |  of the form factor, we were limited to just two batteries and the RP2040
524.03s - 528.43s |  is highly overclocked so that doom runs okay-ish on it.
529.31s - 531.63s |  And so it's really, really power hungry.
531.63s - 535.47s |  And so we need the extra lithium to make that work.
536.43s - 536.83s |  Yeah.
536.83s - 539.95s |  Anyone that gets them, like we had to put a, we put a weird sticker on
539.95s - 544.43s |  there just saying like, you know, RTFM don't put double A's in here.
544.43s - 546.67s |  In fact, they shouldn't have to remove the batteries at all.
546.67s - 552.75s |  These are lipos that are in the form factor of a double A battery, but yeah.
553.39s - 556.67s |  So fully charged circuit in there, but if you put in double A's, it just
556.67s - 558.83s |  won't work because they can't provide enough power.
561.49s - 564.21s |  So this is kind of what like the progression looks like from a rev
564.21s - 566.77s |  one to a two, three, you start seeing the yellow.
566.77s - 568.85s |  Um, I know you want to talk about that.
568.85s - 571.09s |  You want, you want to geek about the charging circuit?
571.09s - 571.33s |  Yeah.
571.33s - 574.61s |  So rev two and three was when we were trying to dial in the, uh,
574.61s - 576.69s |  charging circuit, make the lithium work correctly.
577.49s - 581.25s |  I think we were using a slightly different scheme at that point too,
581.25s - 585.33s |  before we settled on that we could not dare, uh, production.
585.33s - 590.53s |  Um, this was, um, I, some SAP did the hardware one, and then I took over for
590.53s - 594.45s |  hardware and finishing hardware two and three, and then eventually four,
594.45s - 596.21s |  which is the production version.
596.21s - 600.45s |  I'm a big background in like in that system.
600.45s - 602.21s |  So I've never used keypad before.
602.21s - 605.09s |  So basically I had to spend about a month and a half learning keypad,
605.09s - 609.33s |  another user tool to basically finish up rev two and then rev three.
610.13s - 616.13s |  Um, we actually didn't have any problems with, uh, like we didn't
616.13s - 617.73s |  have any wire mods or anything like that.
617.73s - 618.77s |  Everything kind of just worked.
618.77s - 621.41s |  It just was trying to get the fit in the case.
621.41s - 623.41s |  And when you get a different case and it just still wouldn't fit,
624.05s - 628.37s |  figuring out all the different locations of cases that it had to fit into.
629.49s - 629.89s |  Yeah.
629.89s - 630.21s |  Okay.
630.21s - 631.73s |  So there's a problem I can think of.
632.53s - 634.13s |  You guys all made fun of me before.
634.13s - 637.89s |  So on, you see on that previous one, I got the breadboard with the two wires and the two buttons.
639.17s - 642.77s |  When you program a Pi Pico, you have to put it in boot select mode.
643.49s - 648.53s |  Those buttons were strategically placed on the very bottom of here.
648.53s - 653.89s |  Um, where there is, uh, you would have an old audio jack and an old DC,
653.89s - 656.93s |  and it's hard to hit them and they were covered by the case.
657.65s - 659.57s |  It's fine when you're designing hardware,
659.57s - 665.97s |  but when you're working on flashing firmware and wads and files, nonstop a hundred times a day,
665.97s - 668.37s |  I can't sit there with a paper clip and push them in.
668.37s - 671.73s |  So I, I yanked out wires and just soldered them in.
671.73s - 673.33s |  So I could tap buttons to do that.
673.89s - 675.49s |  Um, eventually a fun mod.
675.49s - 679.97s |  If you ever develop on a RPi 2040 or any of the Raspberry Pi microcontroller lines,
679.97s - 681.65s |  because now there's multiples of them.
682.21s - 685.73s |  Um, you can mess with the bootloader selecting.
685.73s - 687.41s |  We called it our magic baud rate.
687.41s - 692.05s |  So that if you open a serial connection, you can set it to say,
692.05s - 695.57s |  Hey, if anything ever tries to connect to you at 1200 baud,
695.57s - 698.77s |  we picked 1337 as our magic baud right now.
698.77s - 703.17s |  But if you just hit it with 1337 on a serial terminal,
703.17s - 706.61s |  it will automatically fall into boot select mode and reboot,
707.17s - 709.33s |  which is wonderful if you want to, you know,
709.33s - 711.25s |  speed up your tool chain when you're developing
711.25s - 714.13s |  and then just have a script that runs and knocks it in boot select.
717.73s - 718.77s |  I bitched quite a bit.
721.97s - 723.65s |  So, and there's the final.
723.73s - 723.97s |  Yeah.
723.97s - 727.97s |  So the big difference, the only difference between REV3 and REV4 was the artwork.
728.53s - 732.45s |  And we were actually just shooting without artwork for a really long time.
732.45s - 733.73s |  And I was like, you know how we got to do it.
733.73s - 737.25s |  Uh, so that was the artwork that we did.
737.25s - 741.25s |  Since AI generated, it just kind of left the artifacts in there.
741.25s - 744.37s |  So like you see, it says, it said just doom.
745.09s - 748.29s |  And so we just kind of left that little easter egg in there.
748.29s - 749.49s |  It was funny enough.
749.49s - 749.99s |  Yeah.
750.39s - 753.19s |  It's actually kind of unfortunate that you can't see,
753.19s - 756.31s |  like the clear cases aren't kind of cloudy.
756.31s - 759.59s |  You can't actually see how my set subscreen actually turned out.
761.59s - 761.99s |  True.
761.99s - 762.23s |  Yeah.
762.23s - 765.59s |  I think if people had the clear PCBs, you can actually see them a lot better.
765.59s - 767.43s |  Maybe the black ones, but purple.
767.43s - 768.39s |  I grabbed a teeth.
768.39s - 771.51s |  I was trying to go with like a Miami Vice color, cyan teal.
771.51s - 773.35s |  It blocks the PCB altogether.
773.35s - 775.43s |  Maybe I'm sad, but yeah.
776.71s - 779.67s |  Um, a lot happened the past couple months.
779.75s - 787.43s |  A lot, um, oh yeah, we're full stack.
788.15s - 790.47s |  Got random questions to throw them at us.
791.19s - 793.51s |  So yeah, that's my excuse.
793.51s - 794.79s |  We were looking at the slides.
794.79s - 795.67s |  We're about to turn in.
795.67s - 798.31s |  I was like, oh shit, we didn't finish those, but you know what?
798.31s - 800.23s |  That's good enough for a slide, right?
800.23s - 807.19s |  Um, when, when we were talking earlier, you know, it runs doom and sometimes people are
807.19s - 809.67s |  curious, how do you put doom on something?
809.67s - 813.99s |  You know, what is really going on when you see doom and, and, and different types of
813.99s - 814.31s |  things.
814.31s - 819.91s |  And, um, in general, um, you see a bunch of variants of doom out there.
819.91s - 824.87s |  You'll hear people refer to vanilla doom, chocolate doom, um, cheesy doom.
824.87s - 827.51s |  You get in all these different variants in general.
829.51s - 829.91s |  You know what?
830.71s - 831.91s |  Vanilla is vanilla.
831.91s - 832.47s |  It's plain.
833.11s - 834.47s |  It is what it released.
835.03s - 838.87s |  And chocolate built on it because you're not going to change what it released.
838.87s - 843.03s |  You're, you're going to keep it as close to the original port of doom as possible.
843.03s - 849.03s |  Um, with, with some fixes that are necessary, but not changing the original source.
849.67s - 855.03s |  And what happens over time is you have all of these forks where people want to play original
855.03s - 857.35s |  doom, but they want it in triple, super widescreen.
857.35s - 861.11s |  Um, they don't want sprites that are from six different angles.
861.11s - 863.19s |  They want 32 different angles.
863.91s - 867.91s |  They start doing what's called limit removing because you have faster computers.
867.91s - 873.83s |  So a lot of doom engines out there and wads that are generated out there, uh, they don't
873.83s - 878.95s |  work on embedded systems because they assume a lot of power horse hungry stuff.
879.51s - 881.75s |  So we went with chocolate doom.
881.75s - 886.79s |  Um, there was a variant of chocolate doom that, uh, I believe the hacker's name was
886.79s - 888.31s |  kilogram that put it together.
888.31s - 893.59s |  He pulled in a lot of fixes that came in on a Nordic NRF, like BMD three 50 mod where
894.87s - 898.95s |  back in the day when you'd have doom, doom was very much, um,
901.03s - 903.91s |  not, not so processor intensive, Ram intensive.
903.91s - 908.63s |  And if you go through the source code and statically allocate your variables, you can
908.63s - 913.19s |  shift a lot of that over and shoot through it through processing, which you mentioned,
913.19s - 918.31s |  we doubly overclocked the PI Pico at 192 megahertz.
918.31s - 920.07s |  I can't remember how many megahertz we're running at.
920.63s - 923.99s |  Um, you're just trading processor for Ram.
923.99s - 927.83s |  And so you keep building on these techniques and it makes it a really nice way to throw
927.83s - 929.03s |  doom on an embedded system.
929.59s - 931.11s |  Sometimes I'm sure you see random things.
931.11s - 935.91s |  People put doom on a toothbrush on this, on that, and it's just running the demo.
935.91s - 940.23s |  Um, if you're actually trying to process a lot of other things, networking stack and,
940.31s - 942.31s |  and mega wads, it gets rough.
943.03s - 949.19s |  Um, so yeah, something that we saw in that, that, that this person ran into on one of
949.19s - 953.11s |  the forks we, we picked up on, you start running out of memory.
953.11s - 957.75s |  And the cool thing about doing this is instead of drawing pixels, it's running with scan
957.75s - 959.67s |  lines like you would on a normal CRT.
960.31s - 964.55s |  And you'd only have enough memory to draw about 70, 80% of the screen.
964.55s - 969.35s |  So with it doing scan line drawing, it's actually a lot more efficient to go through
969.51s - 971.03s |  the graphics rendering.
971.03s - 977.11s |  And then on the HUD, we just painted a static image on the HUD because we realized one,
977.11s - 979.11s |  the screen was too small to even read it.
979.67s - 984.31s |  And two, we had needed CTF challenges that actually ran on the badge.
984.31s - 989.51s |  So over there, you actually see a certain hex memory address that's printed into the
989.51s - 995.19s |  status bar that gets updated during the game, uh, amongst other things.
995.19s - 1000.07s |  So it's like we're drawing 70, 80%, drawing a static image, leaving it, and you go through
1000.07s - 1001.67s |  little tricks just to keep memory going up.
1002.31s - 1006.79s |  Um, but yeah, make sure to member finished, uh, fixing the slide.
1006.79s - 1010.87s |  I think one of the other fun things is just tapping into the API that is used to update
1010.87s - 1015.35s |  the status bar, because if you have a badge with bling, why not update it?
1015.35s - 1018.15s |  You know, why not turn it red when you're getting shot?
1018.15s - 1022.15s |  It's, it's a nice visual indicator for someone who's holding a badge playing doom to see
1022.15s - 1026.87s |  it like glowing red as you're getting lit up or, or when you fire, it turns white and
1026.87s - 1029.19s |  flashes for, for you shooting.
1029.19s - 1033.03s |  Um, and then, you know, you just have like ammo and health kind of going up the rim on
1033.03s - 1033.51s |  the side.
1034.71s - 1036.95s |  Figure it's a, it's a nice visual HUD.
1036.95s - 1040.71s |  I don't think anyone ever paid attention to their health or their ammo count when they
1040.71s - 1041.35s |  played doom.
1041.35s - 1044.39s |  They just used it till it ran out and then, okay, I'm going to switch to something else
1044.39s - 1045.43s |  and fire on them anyway.
1047.75s - 1048.55s |  I don't know.
1048.55s - 1052.63s |  Any questions about firmware, doom engines, putting doom on stuff before we get into like
1052.63s - 1053.75s |  the wads and whatnot?
1053.75s - 1053.91s |  Yeah.
1053.91s - 1054.31s |  What's up?
1056.23s - 1056.55s |  Sorry.
1056.55s - 1057.11s |  I can't hear.
1059.03s - 1060.23s |  Did we use the PIOs?
1061.03s - 1065.11s |  Um, I don't think we did.
1065.83s - 1066.07s |  No.
1076.23s - 1076.63s |  Sorry.
1077.59s - 1078.87s |  I will use it next year.
1081.35s - 1084.79s |  So I tried to make this as messy as possible, right?
1095.67s - 1095.91s |  Yeah.
1098.07s - 1100.31s |  So for the most part, it's good.
1100.31s - 1106.55s |  Um, I think a couple of things I would go through is, is this, um, there's a lot
1107.11s - 1111.03s |  there's a lot of modders in the doom community and they've made wonderful tools over the
1111.03s - 1111.67s |  years.
1111.67s - 1113.99s |  Some of those tools are still in use.
1113.99s - 1116.79s |  Some of them are being migrated to bigger tools.
1116.79s - 1120.79s |  Um, one of them that I was primarily using is Slade.
1121.51s - 1122.95s |  Slade is really good.
1122.95s - 1128.79s |  If you are making a wad and I guess I should say wad unless people don't know wad stands
1128.79s - 1135.11s |  for, where's all the data it's, it's how the ed team use doom to store all of the core
1135.11s - 1136.55s |  assets of their game.
1136.55s - 1142.31s |  Those assets are referred to as lumps, but where Slade shines is you make wads with it.
1142.31s - 1144.95s |  You really don't want to make maps with it too much.
1144.95s - 1147.51s |  It has a map editor, but it's not that great.
1147.51s - 1152.39s |  Um, there's, there's better tools for like ultimate doom builder to work on maps.
1152.95s - 1158.95s |  Um, but what you end up with is a number of things being needed to make that successful.
1158.95s - 1166.39s |  So the core I started with was freedom and freedom is free open source doom replacement.
1166.39s - 1170.47s |  I know you see a lot of people make doom mods and put doom on things.
1170.47s - 1172.71s |  The doom engine is open sourced.
1173.67s - 1178.55s |  The IP and the graphics and the music and the, all those lumps that are in that doom
1178.55s - 1183.51s |  one shareware wad are not, they are copyrighted and protected.
1183.51s - 1189.67s |  So freedom is a open source project to, to make a community driven doom alternative where
1189.67s - 1190.79s |  you can drop in the wad.
1191.59s - 1196.87s |  The first problem with that is they rely on limit removing engines that use all these
1196.87s - 1201.27s |  crazy different features and they bundle in doom, doom to hexon.
1201.27s - 1206.23s |  So there's a lot of stuff on there that in their one wad that if, if you're doing this
1206.23s - 1207.75s |  on your computer, it doesn't matter.
1207.75s - 1212.39s |  But if you're putting it on an embedded system where I only have like a wind bond chip, but
1212.39s - 1214.15s |  they makes a flash, it's not going to help.
1214.71s - 1221.11s |  So we started stripping everything out, changing out different sprites, different assets, doing
1221.11s - 1221.91s |  our own editing.
1223.75s - 1228.47s |  Some of the old tools like converting midis to their traditional muse format only run
1228.47s - 1229.03s |  in DOS.
1229.03s - 1233.99s |  So I'm running like DOS box and Linux to run, write my own bash scripts.
1235.35s - 1237.99s |  That's when I learned slate actually had something that did that.
1237.99s - 1241.11s |  And I felt stupid for setting up that tool chain, but yeah, whatever.
1242.39s - 1246.71s |  And then using like Krita and Inkscape, Photoshop to put my different sprites together that
1246.71s - 1250.71s |  I was creating, bundle it all together, bring chocolate doom into VS code.
1252.15s - 1253.67s |  Seems messy, goes through.
1254.79s - 1260.87s |  I think the only other reason I put the meme on the side is in general, you wouldn't mess
1260.87s - 1263.91s |  with the core wad when you work on doom.
1263.91s - 1268.63s |  The way doom works is it assumes that core library assets in the wad exist.
1268.63s - 1271.83s |  And a wad that you're putting out is really a P wad.
1271.83s - 1272.87s |  It's considered a patch.
1273.51s - 1278.55s |  And when you put different assets in there, it's literally patching it in memory and overriding
1278.55s - 1282.71s |  those assets with a subset because it's an embedded system.
1282.71s - 1287.75s |  We don't have the luxury of a file system where I can have multiple wads on there.
1287.75s - 1292.55s |  So if you were to look on doom wiki or go on some of the doom, like the wad creators
1292.55s - 1294.63s |  resources, they will light you up.
1294.63s - 1299.91s |  If you're like, I'm making my own I wad because really people should not be making their own
1299.91s - 1300.55s |  I wad.
1300.55s - 1301.35s |  It's wasteful.
1301.83s - 1305.03s |  Unless you have your own, you know, limited source.
1305.91s - 1312.63s |  The end result of that is we will be open sourcing a, you know, a fork of free doom
1312.63s - 1319.67s |  that maps a full mega wad, one, two, three, with no other doom two or hex and stuff that
1319.67s - 1322.87s |  is completely free and open source and slimmed down.
1322.87s - 1324.47s |  So it's great for embedded systems.
1327.35s - 1328.47s |  Oh, that's backwards.
1329.03s - 1333.83s |  And I pretty much mentioned that, you know, there's what does it look like when you when
1333.83s - 1335.35s |  you're actually editing wads?
1335.35s - 1337.03s |  It's like a memory editor.
1337.03s - 1339.51s |  You know, it may look like a spreadsheet or a database.
1339.51s - 1344.23s |  But if you even sort things, people sometimes forget that there's memory mappings of memory
1344.23s - 1344.87s |  addressings.
1344.87s - 1349.67s |  And if you just copy paste stuff in, you can you can really screw up your doom engine and
1349.67s - 1352.15s |  doom game just by putting things wrong in a wad.
1353.43s - 1357.67s |  And it makes it fun for hiding things in CTS because it's like a giant zip file.
1357.67s - 1362.31s |  I can pad stuff in certain memory locations that, you know, I'm trying to get people to
1362.31s - 1367.11s |  dump ROMs, dump, dig through the source code, dump the wads and look for things that we've
1367.11s - 1367.91s |  hidden on the side.
1369.83s - 1376.07s |  I'm about done with the wads, but I would say the only fun I had is the most fun I had
1376.07s - 1379.51s |  was you look at how assets are made.
1379.51s - 1383.83s |  A lot of people will like open up Blender, you know, take a 3D model, rotate it, take
1383.83s - 1384.79s |  slices.
1384.79s - 1388.63s |  I wanted to make our own rubber chicken weapons, and it's kind of stupid.
1388.63s - 1393.03s |  But, you know, you got a toilet paper tube, some rubber bands and rubber chickens, record
1393.03s - 1395.43s |  a video and then takes time slices.
1395.43s - 1398.63s |  And that turns into what I used in the game.
1403.11s - 1407.67s |  And I have to explain to my wife why I'm like punching rubber chickens in the wall, recording
1407.67s - 1408.07s |  myself.
1408.07s - 1409.19s |  And I'm like, it's for DEF CON.
1409.19s - 1409.99s |  It'll make sense.
1409.99s - 1410.47s |  Trust me.
1411.99s - 1413.19s |  You should all try this.
1413.19s - 1414.31s |  It's actually super fun.
1414.47s - 1416.87s |  I know people like, oh, you know, I want to make my own DOOM wad.
1416.87s - 1421.03s |  I'm like, take something and just record your hand punching and I don't know.
1421.03s - 1424.95s |  I thought it was kind of fun just to try to do my own reverse stop motion on things.
1429.11s - 1432.07s |  Without dragging it out further, because we want to get some more of the snacky stuff,
1433.03s - 1438.95s |  whether you're following us on Twitter or hearing us gripe, we were releasing something
1438.95s - 1440.23s |  like, yeah, we fucked up.
1440.79s - 1445.19s |  Um, normally I'd say a different version or different way to tell what we were talking
1445.19s - 1449.75s |  about was we're usually pretty good about setting a hard date.
1449.75s - 1453.51s |  And it's usually like it was around when we would buy tickets for Derby Con.
1453.51s - 1455.83s |  It would be during the Kentucky Derby, like the first week of May.
1455.83s - 1457.43s |  And that's when we would submit our order.
1458.79s - 1460.23s |  We feature creeped ourselves.
1460.23s - 1463.99s |  Some things fell behind schedule, but we always have plenty of slack and times.
1464.71s - 1469.99s |  And without going through the exhausted list, you have a couple of hurricanes hit.
1470.31s - 1471.91s |  You have different things pop up.
1471.91s - 1473.51s |  It kept eating into our slack.
1473.51s - 1477.35s |  And if we hadn't feature creeped ourselves, I know those things are out of control.
1477.35s - 1483.75s |  But, um, the end result is when the big problems happen, like it went to our fab and they sent
1483.75s - 1489.43s |  us pictures early in the morning showing that, Hey, you have an eight pad thing for LEDs.
1490.23s - 1493.35s |  And we have six on the LEDs.
1493.35s - 1495.03s |  You know, you have the complete wrong part.
1496.47s - 1498.39s |  This was the morning CrowdStrike happens.
1500.47s - 1505.83s |  Try to source LEDs and overnight them to a fab when all air traffic's been grounded, except
1505.83s - 1508.47s |  for UPS or USPS.
1508.47s - 1511.99s |  We use the postal service and it gets delivered to the wrong city three hours away.
1513.67s - 1520.39s |  So, yeah, we've spent the better part of the past two weeks, 20 hour days late at work
1520.39s - 1529.03s |  on third shifts, in hotel rooms, in garages, reflowing, hot airing, hand soldering, 14,000
1529.03s - 1529.53s |  LEDs.
1531.43s - 1532.63s |  I think we got a pretty good deal.
1536.07s - 1539.59s |  So the tail end of some of the badges we were vending, they have little yellow dots.
1539.59s - 1544.63s |  We did our hardest, but I think about the last hundred or so, um, they would have one
1544.63s - 1547.19s |  to many LEDs working.
1547.19s - 1552.39s |  You know, some of them had like all of them, but one in the top corner, or maybe half of
1552.39s - 1554.63s |  them were out because the thing just got cooked.
1554.63s - 1556.79s |  And we figured it plays doom.
1556.79s - 1558.07s |  It still blinks a little bit.
1558.07s - 1559.59s |  People would still rather have them.
1567.91s - 1570.39s |  Yeah, we're, we're going to bring all our spare parts tomorrow.
1571.11s - 1575.35s |  If you want to do like kind of a ad hoc workshop, we'll bring all the parts, all the failed
1575.35s - 1575.67s |  boards.
1575.67s - 1578.55s |  We'll show them to people and be like, do you want to have your hand at assembling one
1578.55s - 1579.19s |  of these boards?
1579.19s - 1581.59s |  You know, assembling everything into a Game Boy case.
1582.15s - 1583.35s |  You think you can fix it?
1583.35s - 1584.07s |  You can have it.
1584.07s - 1585.35s |  Try your, try your best.
1587.03s - 1587.91s |  We'll do that tomorrow.
1588.23s - 1588.39s |  Yeah.
1591.11s - 1593.03s |  Um, yeah.
1593.03s - 1598.63s |  Other than that, I, I, I pretty much summed it up after that, where, uh, things just kept
1598.63s - 1600.07s |  getting more saddled.
1600.07s - 1603.51s |  What was there anything else funny that happened in that whole debacle?
1604.39s - 1605.99s |  Self-deprecating in that sense.
1607.75s - 1610.79s |  Like how many miles the LEDs traveled.
1614.15s - 1614.65s |  Yeah.
1615.61s - 1622.25s |  I know we, I wish we had the actual numbers because he's thinking about the, the, they
1622.25s - 1625.13s |  come from Taiwan, went to San Dimas.
1625.13s - 1629.37s |  They went from San Dimas to Houston and then from Houston to Dallas.
1629.93s - 1631.77s |  They found out they were wrong in Dallas.
1632.49s - 1636.09s |  And then we had to do a split order where more were coming from Taiwan.
1636.09s - 1639.13s |  And another order was coming from Sam Dimas, but it didn't go to Dallas.
1639.13s - 1640.09s |  It went to Houston.
1640.09s - 1644.41s |  And the one that was leaving Taiwan, there was a typhoon and they grounded all DHL.
1644.41s - 1646.73s |  I forgot about the typhoon weather.
1646.73s - 1647.45s |  Isn't our friend.
1648.57s - 1651.21s |  So you're getting five international trips.
1651.21s - 1656.01s |  Then they all come back to California, then back to Houston and then driven to Las Vegas.
1658.09s - 1660.25s |  They've gotten like 30,000 miles on them at least.
1666.01s - 1666.49s |  Oh yeah.
1666.49s - 1669.05s |  Everything on that end goes through Louisville, Kentucky.
1669.05s - 1673.45s |  And because of the tornadoes in Louisville a week and a half ago that got shut down and
1673.45s - 1675.69s |  things were put on hold at the district center.
1683.69s - 1691.85s |  Yeah, you know, different version of that because we're all here at the LBCC this year
1691.85s - 1696.17s |  and whether you're, you're attending as a human or you, you know, you volunteer as a
1696.17s - 1702.89s |  goon or you're in a contest area or a village, there's a lot going on when you're in a new
1702.89s - 1703.37s |  area.
1703.37s - 1707.45s |  Like, you know, we're all trying to fill it out and learn, learn the ropes and new things.
1707.45s - 1710.89s |  And every now and then, you know, everyone's doing different projects and contests and
1710.89s - 1711.13s |  stuff.
1711.13s - 1712.97s |  And we all run into issues.
1712.97s - 1715.61s |  You know, we had some issues with LEDs this year.
1715.61s - 1719.13s |  We were joking about how we had such issues with SD cards in the past.
1719.13s - 1724.09s |  And, you know, people run into technical problems left and right.
1724.09s - 1725.37s |  And that's okay.
1725.93s - 1730.41s |  I think what, what matters is just trying to persevere through it and realize, hey,
1731.05s - 1732.33s |  we're all human.
1732.33s - 1733.61s |  Nothing's perfect.
1733.61s - 1737.29s |  You know, be compassionate and generous towards folks and support them.
1737.29s - 1738.97s |  And maybe you can come.
1738.97s - 1743.21s |  We had friends that never used hot air before.
1743.21s - 1746.65s |  And they're like, hell yeah, I want to learn to hot air something or reflow something.
1746.65s - 1747.37s |  I want to take that.
1747.37s - 1748.89s |  And I think that's awesome.
1748.89s - 1753.21s |  We have people that never picked up a soldering iron or anything before.
1753.21s - 1757.37s |  We taught them how to use technology and send it in a garage.
1757.93s - 1763.53s |  But it's really like, how do you make your problems up?
1766.89s - 1768.01s |  This is interesting.
1768.01s - 1769.05s |  I never want to hear that again.
1769.05s - 1773.61s |  But it's a good trigger.
1775.21s - 1778.49s |  It's making the best decision at the time and making sure it's not a rash decision.
1779.45s - 1781.13s |  So take some time.
1781.13s - 1782.73s |  Think about all the options.
1782.73s - 1783.77s |  Pick which is the best one.
1783.77s - 1785.77s |  It might be the wrong one down the road.
1786.49s - 1787.93s |  There's lots on this field.
1788.65s - 1791.05s |  But at the time, the best decision.
1791.05s - 1793.77s |  You can't look back.
1793.77s - 1796.97s |  You can't beat yourself up at the time you made the best decision.
1796.97s - 1797.21s |  Yeah.
1798.01s - 1800.57s |  But yeah, I think that's the best way to put it.
1801.69s - 1804.09s |  So this is where it's more fun.
1804.09s - 1804.65s |  Snacky.
1805.37s - 1805.69s |  Down.
1807.29s - 1807.85s |  Down button.
1808.81s - 1809.13s |  Yeah.
1811.69s - 1814.33s |  Our CTF centers are snatching.
1817.45s - 1820.17s |  Used to be a FSI model.
1820.17s - 1821.05s |  I think that's 31.
1821.05s - 1821.61s |  59.
1821.61s - 1823.21s |  Clearly read it without my glasses on.
1823.77s - 1825.05s |  Redemption Snack Machine.
1825.77s - 1829.93s |  I picked it up from a KUKA shop that was closing down in Houston, Texas.
1830.49s - 1832.41s |  And it had the image of it.
1836.41s - 1837.37s |  So the first thing was...
1838.25s - 1841.05s |  I ate the candy from the head shop of the old vending machine.
1841.05s - 1841.29s |  Yes.
1844.25s - 1848.49s |  You can see it's on my little tiny 4x8 trailer there.
1848.49s - 1851.37s |  And imagine driving that down the road at 60 miles an hour.
1855.37s - 1855.93s |  But it's mine.
1855.93s - 1856.41s |  It's mine.
1857.77s - 1860.73s |  So first, we're trying to figure out how the snack machine works.
1861.45s - 1865.61s |  So what's interesting about snack machines or any kind of redemption technology,
1866.41s - 1868.73s |  there's not a lot of information out there about it.
1868.73s - 1873.13s |  The companies that build these things aren't very tight on what information exists.
1874.41s - 1877.85s |  You wouldn't be like, hey, I have an exploit on this machine.
1877.85s - 1878.97s |  You'd be like, we'll see.
1878.97s - 1881.69s |  It's like, take that advice.
1881.69s - 1888.57s |  So anyways, so we basically have to reverse engineer how this one particular snack machine
1888.57s - 1888.81s |  works.
1889.85s - 1896.65s |  So the original board there, it uses a bunch of custom ASICs and a bunch of logic.
1897.29s - 1901.61s |  And the upper right part is the whole power subsystem.
1902.41s - 1904.49s |  It has a speaker on it for some reason.
1904.49s - 1905.37s |  It never makes noise.
1908.81s - 1912.09s |  And I come to this one part of the circuit.
1912.09s - 1913.29s |  I wish I could find this guy.
1914.81s - 1920.73s |  My idea was basically to take out the custom ASIC, plug it into my controller subsystem,
1920.73s - 1922.25s |  and change the controls on this logic.
1922.81s - 1925.29s |  But one of the logic chips is an inverter chip.
1925.29s - 1927.93s |  It's a 3D channel inverter.
1927.93s - 1929.69s |  And it would just loop into itself.
1929.69s - 1932.09s |  And I'm like, I have no idea what that's going to do.
1932.09s - 1934.01s |  So I was like, well, we're going to find out one way.
1934.01s - 1935.53s |  We've got to figure out how motors work now.
1936.17s - 1940.97s |  So how these motors work is they have a DC motor matrix.
1940.97s - 1946.73s |  So high side, low side, and then they have a switch on it.
1946.73s - 1949.93s |  You would think the switch is there to let you know you can rotate it once.
1949.93s - 1951.69s |  Like a feedback, you have a limit switch.
1952.33s - 1953.13s |  That's not the case.
1954.01s - 1956.41s |  It actually rotates when it hits the switch.
1956.41s - 1958.89s |  It actually increases the amount of current.
1958.89s - 1960.73s |  It's just increases the amount of current.
1960.73s - 1963.05s |  It's like a resistor there.
1963.05s - 1968.89s |  And so the logic board is actually just looking for these current pulses on the motors.
1969.85s - 1980.97s |  So basically, so this is, I'll talk more about that motor thing when it comes to 40.
1980.97s - 1985.61s |  But this is also like reverse engineering how the rest of the stack machine works.
1985.61s - 1987.05s |  Like how does the keypad work?
1987.05s - 1988.73s |  How does the display work?
1988.73s - 1989.53s |  And all that stuff.
1989.53s - 1991.05s |  So you can see my laptop there.
1991.05s - 1993.61s |  And it's like connected to an Arduino.
1993.61s - 1996.09s |  And it's like zip tied to the side of the machine.
1996.73s - 1998.33s |  And then we put casters on it.
1998.41s - 2001.29s |  Because moving a 800 pound machine, it's really hard by yourself.
2002.41s - 2004.57s |  That's the best design decision on Snacky.
2006.89s - 2010.01s |  If you think about taking something big and heavy to DEF CON,
2010.57s - 2015.53s |  you don't want to drag it, put it on a pallet, or like have six people puff it around.
2016.73s - 2019.05s |  Well, I had to put it on a trailer by myself.
2019.77s - 2021.93s |  And I was like, I'm not doing that.
2021.93s - 2028.73s |  What's interesting is the legs of the stack machine is a standard for casters.
2028.73s - 2032.09s |  So I was like, oh, I actually want the legs of that machine.
2035.37s - 2038.17s |  Oh, we should have had the receipt corrector.
2038.17s - 2041.61s |  This was like when I was trying to figure out how to make it work.
2042.25s - 2047.45s |  And we wanted like, this is what we're trying to make it like more of a standalone machine.
2048.09s - 2049.69s |  We didn't have a contest at the time.
2050.33s - 2054.25s |  And so everything had to be like, be oscurated, be robust.
2054.25s - 2055.69s |  And so we're trying to do stuff like this.
2055.69s - 2058.01s |  We don't want the receipt corrector to just sit off to the side.
2058.01s - 2058.97s |  We need to build it in.
2059.77s - 2062.01s |  So this is a, I can't remember the model.
2062.01s - 2064.65s |  It was a TS thermal printer.
2064.65s - 2066.97s |  But we bought it on eBay.
2066.97s - 2068.41s |  And it was like $200.
2069.53s - 2071.77s |  They had to buy it now, like they offered.
2071.77s - 2074.33s |  They offered $69, and we accepted it.
2074.81s - 2078.01s |  So here's the custom board.
2078.01s - 2082.65s |  So they're basically reverse engineering how all the peripherals in the machine works.
2082.65s - 2087.13s |  We basically built this circuit board to control that circuit.
2087.13s - 2092.09s |  All those, it's called the motors.
2092.09s - 2097.85s |  And so it uses two Arduino Vegas.
2097.85s - 2102.09s |  Because at the time, the world supply chain was in crisis.
2102.33s - 2105.77s |  I had two Arduino Vegas in my drawer, which is what we used.
2106.81s - 2111.21s |  And I just made some use of all the little parts I had for more computer machines and
2111.21s - 2111.77s |  that kind of stuff.
2113.69s - 2120.17s |  Left side, you can see the computer in the middle is like, it's called like the cache
2120.17s - 2124.73s |  area of the machine, where all the components and stuff are stored.
2124.73s - 2127.37s |  So that's where we export all our custom electronics.
2127.37s - 2129.69s |  So you can see where the boards are stacked.
2129.69s - 2131.77s |  They actually use the same part, which is the printer.
2131.77s - 2137.93s |  So it's like they snapped into the original screw boxes in there.
2138.65s - 2140.81s |  And then we have a big power supply.
2141.69s - 2143.61s |  That's the big silver box.
2143.61s - 2146.33s |  We wanted to put lots and lots and lots of electronics.
2148.17s - 2151.05s |  We kind of modified the pointer turn.
2151.05s - 2152.41s |  That's our enter button.
2152.41s - 2154.73s |  Just click to switch on that.
2154.73s - 2159.53s |  And then the right side is like when I finally got the whole thing brought up.
2160.01s - 2163.13s |  So it's kind of our hello world for stacking.
2164.49s - 2165.37s |  Any questions so far?
2178.04s - 2180.12s |  I think the question is, it went down earlier.
2180.12s - 2181.96s |  Is it possible to make it all self-contained?
2183.00s - 2183.40s |  Yeah.
2183.40s - 2184.68s |  So it's an IST machine.
2186.84s - 2189.16s |  So it connects through a database in the cloud.
2189.16s - 2192.36s |  And that's how we know all the codes are.
2197.06s - 2199.14s |  So that's how it knows codes are valid or not.
2199.70s - 2203.54s |  I guess nothing we can do to run that in there, but it's easier to, especially when
2203.54s - 2204.74s |  there's some technical problems.
2204.74s - 2206.02s |  It's just a mechanical device.
2207.06s - 2208.18s |  Verify and that mess.
2208.18s - 2209.30s |  Like I said, I'm like, okay.
2210.42s - 2214.66s |  I mean, it can run disconnected, but it doesn't like it.
2214.66s - 2215.14s |  Yeah.
2215.14s - 2217.06s |  And you get different Venn problems.
2217.06s - 2217.22s |  Yeah.
2217.22s - 2217.86s |  It also runs.
2217.86s - 2219.54s |  It basically runs for like 30 seconds.
2219.54s - 2221.46s |  And it goes, oh, I lost connection to the internet.
2221.46s - 2223.46s |  My database is not up to date anymore.
2223.46s - 2226.66s |  So yeah, but that gives us a full security stack.
2227.22s - 2229.46s |  And it did not crash with CrowdStrike.
2229.46s - 2230.34s |  Yeah, it did not crash.
2231.30s - 2233.38s |  Um, so this is year two.
2233.38s - 2237.22s |  We took a lot of what we've learned from the first year, which was basically, well, the
2237.22s - 2238.82s |  first year it ran on Wi-Fi.
2238.82s - 2240.90s |  We had people deaughtening all the time.
2240.90s - 2242.26s |  We went to hard wire.
2243.78s - 2248.42s |  And then originally it ran on a Raspberry Pi, a control object.
2249.14s - 2254.18s |  And we switched over to just a x86 based, uh, PC.
2254.90s - 2264.34s |  Um, and then we added the marquee display at the top.
2265.62s - 2268.66s |  Certain display gifts, videos, that kind of stuff.
2271.22s - 2279.54s |  And then we added HAL 9000 or Snacky 9000, which is our infrared and Morse code style
2279.54s - 2280.02s |  challenges.
2285.59s - 2288.55s |  And this kind of caused me to have to create more of a cache.
2289.19s - 2289.59s |  Oh, yeah.
2289.59s - 2292.07s |  So here's, like, the current, this is like this year's.
2293.19s - 2294.07s |  We added a speaker.
2294.71s - 2301.11s |  Um, we upgraded our display to a higher resolution to be like that 1920 by 360, which is really
2301.11s - 2303.11s |  weird to make, like, art assets for.
2303.75s - 2307.11s |  Um, it frustrates everyone in the team.
2307.11s - 2309.75s |  So like this year, now you don't have to follow that ratio.
2309.75s - 2311.27s |  You can just make whatever.
2311.27s - 2314.47s |  People letterbox or stretch or whatever.
2314.55s - 2317.67s |  Whatever actually decides to do focus on that image.
2317.67s - 2324.47s |  Uh, we got, we upgraded our, um, heat source for the thermal printer, which we actually
2324.47s - 2327.83s |  think downgrade now because we have problems scanning that.
2329.59s - 2332.63s |  So I had to find the original source of the paper.
2333.51s - 2340.39s |  Um, we added more LEDs and now it has a PoE switch in it for future expansion.
2340.39s - 2344.55s |  So we're hoping to bring like more themes for our contest and hooking up to it.
2346.31s - 2347.35s |  I like that PoE.
2347.35s - 2347.59s |  Yeah.
2347.59s - 2347.83s |  Yeah.
2347.83s - 2350.23s |  We put a transmitter in there too, for all that.
2352.23s - 2355.35s |  So everything kind of add on if things like that, you speak twice.
2355.35s - 2360.55s |  So that's really like we added a speaker and it's really easy and module how we design
2360.55s - 2363.59s |  the software and the hardware solutions.
2363.59s - 2364.79s |  So it's easy to add on.
2365.27s - 2370.23s |  Um, it probably needs a refactor now because it has like one big Python script that runs
2370.23s - 2370.63s |  everything.
2371.27s - 2372.63s |  Um, I probably need to fix that.
2373.27s - 2373.59s |  Yeah.
2375.11s - 2375.35s |  Okay.
2378.60s - 2378.92s |  Perfect.
2379.96s - 2384.84s |  Um, so I actually, this is, first of all, we should update this because we bring that
2384.84s - 2390.44s |  badge, um, but you can still play the CTF right now.
2390.44s - 2396.60s |  I should say, do you want to try and build a badge out of cannibalized parts, which may
2396.60s - 2396.84s |  work.
2397.80s - 2398.76s |  Come visit us tomorrow.
2400.92s - 2403.24s |  Or just come check out Snacky, mess with it, press buttons.
2407.53s - 2407.77s |  Yay.
2409.53s - 2412.81s |  Yo, any questions related or not?
2414.01s - 2416.65s |  You have us for, I don't know.
2416.65s - 2418.17s |  They have to tell me four more minutes.
2424.49s - 2425.05s |  Oh Jesus.
2428.81s - 2429.77s |  I was building my garage.
2440.89s - 2442.01s |  We're getting caned off stage.
2442.81s - 2443.53s |  How about this?
2443.53s - 2449.53s |  If you have questions, follow us right out there.


url: https://www.youtube.com/watch?v=TjdATgKxqiU
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
title:
DEF CON 32 - Got 99 problems but prompt injection ain't pineapple - Chloé Messdaghi, Kasimir Schulz

content:
{
  "webpage_url": "https://www.youtube.com/watch?v=TjdATgKxqiU",
  "title": "DEF CON 32 - Got 99 problems but prompt injection ain't pineapple - Chloe\u0301 Messdaghi, Kasimir Schulz",
  "description": "The ethical and secure disclosure of vulnerabilities in AI has emerged as a pivotal challenge, compounded by the need to address biases and misinformation that often cloud the true nature of these vulnerabilities. This talk delves into the intricate dynamics of vulnerability disclosure within AI, balancing transparency with security. We'll dissect the unique challenges AI presents, such as data bias exploitation and model manipulation, which can amplify the impact of vulnerabilities. Through a lens of real-world examples and recent disclosures, we'll navigate the complexities of responsible vulnerability management in AI. Our discussion will not only aim to shed light on these critical issues but also inspire a unified approach to refining disclosure processes. This concerted effort is vital for enhancing the integrity of AI systems and bolstering public trust in their use.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2406,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 5.44s | This text was transcribed using whisper model: large-v2

 Hi everyone and thank you so much for coming to our talk. We just want to do a quick shout out to
6.00s - 11.04s |  Bike Bounty Village for having this talk and and for DEF CON for the Creator Stage. This is pretty
11.04s - 16.80s |  cool. And just a reminder to everyone, please be nice to your goons and also be nice to all
16.80s - 21.52s |  the volunteers. They're putting so much time and energy in this, so just throwing it out there.
21.52s - 27.20s |  So welcome to I've Got 99 Problems but a Prompt Injection Ain't Pineapple. My name is Chloe
27.20s - 32.96s |  Messiaen. I'm the Head of Threat Intelligence over at Hidden Layer. And I'm Casimir Schultz.
32.96s - 39.09s |  I'm a Zero-Day Researcher over at Hidden Layer as well. So we're going to go on this journey
39.09s - 44.13s |  together, talking first about AI vulnerabilities to make sure that we're all on the same page of
44.13s - 48.69s |  what is out there, what kind of vulnerabilities exist in AI. And then we're going to go into
48.69s - 54.61s |  the public perception of AI vulnerabilities, of course, and the true size of that landscape
54.61s - 60.53s |  where CAS basically owns that type of landscape. And then I'll dive into the open source nature of
60.53s - 69.09s |  AI and the reporting challenges. We did do some research with BugCrowd, HackerOne, and Integrity.
69.09s - 73.97s |  So big thanks for them for being transparent with us about what they're seeing and experiencing.
75.57s - 80.05s |  So when we think about AI vulnerabilities, I don't know about you, but it seems like the
80.05s - 86.29s |  whole world thinks of this, where it's like end of the world. It's, you know, I'll be back. I cannot
86.29s - 91.17s |  do honor roll Schwarzenegger for the life of me, his voice. But you get the point. But even within
91.17s - 95.97s |  our own industry in itself, there's so much misinformation, disinformation out there when
95.97s - 103.25s |  it comes to security for AI. And yes, we know how to spell that is a generated AI image over there.
103.25s - 111.44s |  So they're not good yet. So let's go dive down the rabbit hole of AI vulnerabilities.
112.80s - 116.72s |  And we're going to go into each one of these sections. So we're all on the same page once again.
117.60s - 122.16s |  First, we're going to go down the attacks against the AI algorithms, then we'll go through attacks
122.16s - 128.00s |  against the filters and generative AI. And then I'll be passing the mic over to CAS, and he's going
128.00s - 136.32s |  to go down the AI artifacts and the supply chain attacks. So data poisoning attacks are basically,
136.32s - 142.16s |  think about it as model training is crucial for like AI development, right? And it's incredibly
142.16s - 146.80s |  vulnerable to data poisoning, which is one there's like malicious actors tend to manipulate
146.80s - 154.24s |  or inject doctorate data, or to like bias the models behavior. And continuous learning systems
154.24s - 160.40s |  are especially at risk as they retrain on unvalidated user supply data. Even small
160.40s - 166.16s |  amounts of poison data can actually lead to a bias or incorrect predictions and can be amplified by
166.16s - 172.24s |  public manipulation or botnets. Does anyone remember Tay? Microsoft Tay on Twitter, now
172.24s - 180.16s |  known as X, raise your hand. Okay, for those that aren't familiar, in March 2016, Microsoft introduced
180.16s - 188.72s |  a chat bot on Twitter, which now is known as X. And it was so nice and friendly. It was like,
188.72s - 194.56s |  hello, world, how are you? And you know how the world responded on Twitter, as you can imagine,
194.56s - 200.72s |  it's full of trolls. Well, within 16 hours, this thing became the most racist sexist thing
200.72s - 205.36s |  on the planet. And of course, this was a problem for Microsoft, because you know,
205.36s - 212.08s |  that's not good PR for them, clearly, right. So then we have model evasion attacks. So inference
212.08s - 217.68s |  attacks, they tend to exploit AI models by curing them to extract sensitive information,
217.68s - 223.28s |  often using slightly varied inputs to reconstruct the model that leading to potential model theft
223.28s - 231.44s |  or bypass. So evasion attacks is a type of bypass, use subtle, like really, really subtle
232.64s - 239.28s |  to change the inputs. And this could be basically like adding invisible noise to trick the models
239.28s - 245.60s |  into misclassifications. And these techniques have been used by cyber criminals, and even ourselves
245.60s - 250.96s |  once in a while like testing things out such as bypassing security systems like spam filters,
250.96s - 258.16s |  malware detection and biometric authentication. Has anyone been in a self driving car before?
260.08s - 266.48s |  Okay, raise those hands a little bit higher. How many of you Okay, that's cool. I have not.
267.28s - 271.52s |  But I want you to imagine you're in this self driving car for those that haven't been in one.
271.52s - 279.20s |  And if you've been in one, imagine you're back in that car again. And while you're at the stop sign,
279.20s - 287.36s |  your car does this really weird thing like it just slides to the left, slides to the right,
287.36s - 295.20s |  and then it takes it back y'all. One hop this time, left foot, let's stomp, right foot, let's
295.20s - 299.84s |  stomp and cha-cha real slowly. I know it's a little bit hard to imagine with a car doing it,
299.84s - 304.80s |  but use your imagination. It's been a few days in Las Vegas, we've all lost our minds at this point.
305.52s - 311.44s |  But there's already been examples of this where a car gets to a stop sign self driving car.
312.08s - 319.52s |  And there's stickers that are on the stop sign itself. And so it bypasses that stop sign and
319.52s - 326.32s |  keeps driving forward. That is an example of a model evasion tax. And then you have model theft
326.32s - 331.84s |  attacks. So adversaries target AI models to mislead and steal them lean to intellectual
331.84s - 336.56s |  property theft by replicating or extracting sensitive data. And now you may be wondering
336.56s - 342.24s |  what are those groups of people are trying to do that? Well, nation state, your competitors,
342.24s - 349.20s |  definitely. And then also, you got your criminals out there. So even without public access to
349.20s - 356.80s |  inference attacks via interfaces or API's, it can replicate models or extract valuable info from it.
356.80s - 360.96s |  So there are these things called Oracle tax, and they're known by NIST, and they include three
360.96s - 367.28s |  different types. So extraction attack, which is when you steal the models structure, you have
367.28s - 372.72s |  an inversion attacks, which is to steal the model structure. And then I mean, the training data,
372.72s - 377.68s |  my bad. And then you have membership inference attacks, which is to identify specific data,
378.24s - 385.68s |  and the training set from it. Now, has anyone ever had tick tock on their phone,
385.68s - 389.60s |  any tick tock on your phone, raise your hand. I'm not going to judge you. I'm not going to
389.60s - 400.94s |  point you out. I'm sorry, I have to do it. Why? You're in security. It's okay. It's okay. I mean,
400.94s - 407.34s |  after... Okay, that's fine. Not on your personal device though, right?
409.10s - 414.86s |  Okay, good, good. Okay, we're good. Jeez, okay. Well, anyway, for those that aren't aware,
415.18s - 425.18s |  ByDance owns tick tock, and ByDance got caught trying to replicate the model of chat GPT
425.74s - 433.02s |  end of last year. So yes, and they were banned, of course. So when we think about prompt injection,
433.02s - 437.10s |  I know we're all sick of hearing prompt injection whenever it comes to security for AI, but let's
437.10s - 443.82s |  just do this. So a prompt injection for those that aren't aware, think about you have an adorable niece
444.86s - 452.06s |  and her mom said, do not eat the chocolate on that table. And you know what you do? You go to
452.06s - 458.78s |  your niece and you squat down. You're like, forget what your mom said. Go eat that piece of chocolate.
458.78s - 464.54s |  You deserve it. And the child goes, proceeds and eats the piece of chocolate. So that would be
464.54s - 471.18s |  an example of prompt injection. So generative AI providers use security filters to block harmful
471.18s - 476.54s |  content, illegal info, and misuse to ensure compliance with laws. You may have heard of them,
476.54s - 481.50s |  they're called also guardrails. But these safeguards can actually be bypassed with
481.50s - 487.98s |  prompt injection. And AI bots get tricked into performing these restricted actions. So the
487.98s - 493.90s |  vulnerability varies by model and has raised concern, especially around disclosure and payouts.
494.06s - 500.22s |  And this is would not be a security talk without mentioning supply chain. So supply chain attacks,
500.22s - 506.22s |  they exploit trust by compromising trusted vendors, and they spread malicious components widely.
506.86s - 512.86s |  The complex ML supply chain heightens these type of risk with about 75% of IT leaders
512.86s - 516.62s |  seeing third party AI integrations as particularly vulnerable.
516.62s - 522.38s |  Now, a skilled adversary can inject a neural payload into a pre-trained AI model, which creates
522.38s - 528.70s |  this hidden model backdoor that triggers a specific attacker-defined outputs. And the model works
528.70s - 535.50s |  normally with regular data, but it misbehaves with some manipulated inputs, allowing the attacker
535.50s - 542.78s |  to ensure favorable outcomes like loan approvals or insurance policies. Now, has anyone heard of
542.94s - 551.12s |  HuggingFace? Raise your hand. Nice. Okay. So for those that don't know, HuggingFace, it's
551.12s - 558.08s |  specialized repos. It's where it hosts over like 500, like way over 500,000 models now that are free
558.64s - 563.12s |  pre-trained. So it makes it very easy for developers to integrate these models into their
563.12s - 569.36s |  applications. Now, if an attacker breaches the repo, they can actually replace those models with
569.52s - 575.04s |  hijacked or backdoored versions, which you can imagine leads to some significant downstream
575.04s - 583.54s |  consequences. How many of you do bug bounty hunting? Raise your hand. How many are planning
583.54s - 591.73s |  to get into bug bounty? Raise your hand. Okay. Well, anyone, when it comes to disclosing these
591.73s - 598.05s |  vulnerabilities, it's a little bit tricky because, well, we're all playing a game of catch-up, as you
598.05s - 605.01s |  can see here. We don't really have like established frameworks in AI. We don't really have well-defined
605.01s - 611.09s |  protocols. The collaboration, we are still dealing with that, and that's a mess of its own. And then
611.09s - 614.61s |  you have to worry about response time because everyone's still trying to figure out what is
614.61s - 618.53s |  the severity look like for some of these vulnerabilities and then payouts, how much do I
618.53s - 623.97s |  pay? And then is that actually a vulnerability or is it not? And then safety versus security,
623.97s - 628.77s |  and then is that actually a vulnerability or is it not? And then safety versus security.
628.77s - 634.37s |  So there's been these ongoing problems of trying to figure things out and play a game of catch-up,
634.37s - 638.21s |  and it does remind me back in the day when we would disclose vulnerabilities,
638.21s - 643.09s |  like, you know, say in like 2012 or 2014, it was very much like that, where we were trying to
643.09s - 648.29s |  figure out how much do we pay out, what those vulnerabilities look like, how serious are they,
648.29s - 653.41s |  and the severity of things. So I'm going to hand the mic over to Kaz, and he's going to go down
653.41s - 659.65s |  the true size of an AI vulnerability landscape for you. So Chloe asked how many people here are
659.65s - 663.97s |  bug bounty people, and there weren't that many, but I have a much better question for you. How
663.97s - 670.37s |  many of you like earning easy money? I mean, come on, right? Okay, awesome. So while, you know,
670.37s - 675.81s |  there are a lot of cool AI attacks, something like model poisoning isn't going to be the most
675.81s - 681.09s |  useful for actually getting any payouts, especially if you're just doing it at a smaller scale.
681.17s - 685.97s |  However, there's a much bigger extent to true AI vulnerabilities that a lot of people are
685.97s - 690.13s |  overlooking. We found out that most of you guys have actually used HuggingFace before,
690.13s - 696.05s |  or at least heard of it, and a lot of, so HuggingFace stores these model formats, or model
696.05s - 701.97s |  files, and these dataset files, and that means they're constantly being shared. But not only are
701.97s - 706.69s |  they constantly being shared, these formats are actually generally trusted. So that means a lot
706.69s - 711.89s |  of places will allow you to upload arbitrary files, so these machine learning models. So that
711.89s - 715.97s |  means you can run them, you can do inference. However, a lot of these have vulnerabilities
715.97s - 721.49s |  when they're being parsed and loaded, so you can actually take over a server if they try to load
721.49s - 726.77s |  the model that you uploaded. There's also a fairly low amount of visibility for these AI models and
726.77s - 731.41s |  datasets. You know, if I were to send Chloe some code, and she can easily see, you know,
731.41s - 735.41s |  there might be a system command in there. However, with an AI model, that's just a
735.41s - 740.21s |  giant blob of binary data that's not going to really happen. We also see that there's a lot
740.21s - 745.41s |  of infrastructure around AI that isn't really as secure as a lot of the other infrastructure.
745.41s - 749.65s |  So for those of you who have done bug bounty, you guys have a lot of tools, you guys look for
749.65s - 756.21s |  very specific things, you guys found most of the problems. However, there hasn't been any security
756.21s - 762.53s |  scrutiny for these AI infrastructure components. In fact, some of these don't even have authentication
762.53s - 766.61s |  because they're meant to be hosted internally. And then through showdown searches, we've actually
766.61s - 770.69s |  seen that they're being hosted externally. And I mean, not just one or two, we're seeing hundreds
770.69s - 776.29s |  of services being hosted externally with no authentication that have proprietary data,
776.29s - 781.49s |  HIPAA information, so it's really not great. And then finally, we have AI development framework
781.49s - 786.85s |  vulnerabilities, and these fall into two categories. So the first is anything that's agentic,
786.85s - 792.21s |  which means that we have an LLM hooked up to some sort of backend. That means you ask the LLM to do
792.21s - 798.05s |  something, and then it does an API call for you, it runs a function for you. And a lot of times, the
798.05s - 803.49s |  backend completely trusts what the LLM gives it. So now imagine if instead of saying, you know, go
803.49s - 809.09s |  and grab this data for me, you say, go and write that data for me. Those are vulnerabilities that
809.09s - 812.93s |  are out there. So it's almost like the new SQL injection, but it's really easy to find.
813.65s - 819.17s |  We're also seeing that AI frameworks allow integrations with sensitive data. So we have
819.17s - 824.53s |  things like rags that allow users or that instead of having an access-based control system for the
824.53s - 829.65s |  actual data, the LLM will try to do access-based control. And as you saw earlier, that doesn't
829.65s - 834.53s |  always work very well. So, you know, the little niece is not supposed to eat the candy or chocolate,
834.53s - 839.01s |  and we say, oh yeah, you can just go ahead and do it. And a lot of times, the LLM will go and get
839.01s - 843.89s |  that data for you, even though it's not supposed to. So let's go ahead and talk about some model
843.89s - 848.77s |  format vulnerabilities. How many of you are familiar with serialization? Raise your hand.
848.77s - 853.41s |  Okay. Awesome. So I can go over that pretty quickly. Serialization is if I have a nice,
853.41s - 857.65s |  you know, code object, I want to go ahead and I want to save it off. And then later on I can
857.65s - 861.73s |  load it back up. I can send it over to Chloe. She can load it. She really shouldn't load it
862.37s - 866.45s |  because as you can see of all the formats that are up there, everything that is in orange
866.45s - 871.89s |  is actually potentially vulnerable. So if you see any places that allow you to upload these files,
871.89s - 876.85s |  you should probably try to upload something if you are doing bug bounty. How many people are
876.85s - 883.57s |  familiar with Pickle? Python's Pickle? Okay. So Python has a serialization format called Pickle,
883.57s - 889.65s |  where if you save a file and then load it back up, you can serialize almost any Python code objects.
889.65s - 894.21s |  However, when you load Pickle files back up, there's a chance for arbitrary code execution.
894.21s - 900.37s |  And that's why we see that a lot of these Python machine file formats actually have vulnerabilities
900.37s - 904.13s |  because a lot of them are actually based on that Pickle format, which is something that we'll keep
904.13s - 912.05s |  in mind later. So while you guys might not upload or load an arbitrary Pickle, how many of you have
912.05s - 917.73s |  used JSON before and think it's pretty safe? Right? Yeah. JSON is safe? No? You don't think
917.73s - 924.93s |  JSON is safe? Okay. Well, you're right. So scikit-learn had a safe file format where what
924.93s - 929.49s |  they wanted to do was rather than having people just load Pickle files, they could load these
929.49s - 935.25s |  JSON files that contained the data. However, while the actual loading process itself was safe,
935.25s - 941.41s |  they were only loading strings and numerals, what you can see here is that the way that Scops
941.41s - 947.01s |  treated the loading process is it would reconstruct this tree and then run through that to generate
947.01s - 953.01s |  objects. So you can see here we're able to create an operator function node, then a tuple with an
953.01s - 958.05s |  eval, and then our nice little print statement. So what you might want to look for is a lot of
958.05s - 963.73s |  these formats that people just inherently assume are safe, like JSON, depending on how they're
963.73s - 967.65s |  interacted with in the backend, you might actually be able to use them for exploitation, which is
967.65s - 970.93s |  really great if you're doing bug bounty because other people might have overlooked that.
971.89s - 976.13s |  And then, of course, there's not just Pickle vulnerabilities and Python vulnerabilities.
976.13s - 981.17s |  I mean, anybody who's ever tried to work with C has probably crashed a C program because it's
981.17s - 987.97s |  tough. I really like showing this example here because what you can see here is just how easy
988.45s - 993.57s |  it is to overlook problems when you're doing any sort of parsing. So we can see that there's only
993.57s - 1000.93s |  two dimensions expected because int32t and e is set to size two. However, n dimensions,
1000.93s - 1006.53s |  there's no check to see if that's only two values, which means that we can have an overflow there.
1006.53s - 1012.69s |  So while this one isn't itself vulnerable or exploitable, it does cause a crash. It does show
1012.69s - 1016.77s |  that anywhere where there's any sort of parsing on untrusted data, you might have a really nice
1016.77s - 1022.29s |  attack surface. And what you should also remember is that any model formats are completely untrusted
1022.29s - 1027.01s |  data. So that means anything that's being parsed, any data that's being accessed afterwards,
1027.01s - 1031.41s |  any operations are completely done on your data and data that you control,
1031.41s - 1035.33s |  which is an exact surface that you really don't normally get. And it's not just a few
1035.33s - 1039.81s |  bytes. I mean, these are potentially gigabytes of data where you can do whatever attack you
1039.81s - 1046.69s |  want in them. And then we also see a lot of the old repetitive, uh, vulnerabilities. I mean,
1046.69s - 1052.77s |  how many here have heard of a path traversal? Yeah, exactly. Um, and you'd assume path traversals,
1052.77s - 1059.33s |  you know, they're extinct, right? But no, they're, they're not. Um, yeah. Uh, and what, uh, Onyx is,
1059.33s - 1064.21s |  is Onyx is one of those independent formats, which means that it doesn't matter what programming
1064.21s - 1069.49s |  language you loaded up. It uses Google protobuf. So nice and secure. Uh, you can't really do too
1069.49s - 1074.45s |  much with that. However, what Onyx allows you to do is it allows you to load external data.
1074.45s - 1079.65s |  And the reason for that is because it wanted to have that you could use the computational graph
1079.65s - 1084.77s |  and then instead of having to save off the weights every single time and sending those,
1084.77s - 1089.33s |  somebody could use the model itself with different weights on their own machines.
1089.33s - 1095.17s |  However, it didn't really check to see, you know, where, uh, you were getting the data from you
1095.49s - 1100.29s |  could go out of the directory that the data was supposed to be into and load something like Etsy
1100.29s - 1106.93s |  password. Now imagine if this LLM is now hosted on a server and you can query it and Etsy password
1106.93s - 1112.13s |  is included in your LLM output or your data. So you could query that potentially get the password
1112.13s - 1118.53s |  through something like that. So what do you guys think about when you hear AI infrastructure?
1118.53s - 1123.17s |  So as we heard earlier, most of you guys think model hosting, right? I mean, everyone knows
1123.17s - 1128.21s |  hugging face. However, it doesn't just stop there. We have things like MLOps. And some of
1128.21s - 1131.89s |  these are the ones where I was saying, you know, they might be hosted externally, even though
1131.89s - 1136.93s |  they only have security for internal hosting, but it doesn't stop there. We have our model
1136.93s - 1143.89s |  deployment and model serving. One of these fairly recently had a endpoint available where it was
1143.89s - 1148.69s |  no matter how you hosted something, if the endpoint was active, and if he sent a pickle
1148.69s - 1153.73s |  file to that endpoint, it would just run and execute on the server. It doesn't just stop there.
1153.73s - 1160.05s |  We have vector databases. One of these may or may not have had something where in the filter,
1160.77s - 1165.89s |  instead of doing an actual filter language, it just ran eval on whatever you gave it to do any
1165.89s - 1171.01s |  filtering. Also not great. And then we have project hosting. And I mean, I could keep going and going,
1171.01s - 1176.05s |  but as you can see, it's already a pretty overwhelming list. So this is all attack
1176.05s - 1180.61s |  surface. If you're seeing this, that a company has this infrastructure deployed somewhere,
1180.61s - 1183.73s |  these are all things that you can attack and look for similar things as well.
1185.33s - 1191.89s |  So people are obviously trying to stop this and stop all of these issues from happening. And
1191.89s - 1196.93s |  Hugging Face went and they created a model format called safe tensors. And safe tensors is one of
1196.93s - 1201.65s |  those dumbed down formats. So just like JSON, where it only stores the simple data, in this case,
1201.65s - 1207.09s |  it only stores the weights and the biases of the model. However, they needed people to start
1207.09s - 1211.65s |  adapting it. And for anyone who's ever done something really, really cool, getting people
1211.65s - 1215.17s |  to actually use it is kind of difficult, unless you give them an easy way to do that.
1215.73s - 1220.85s |  So what Hugging Face did is they created a service where you could just log into your
1220.85s - 1226.85s |  Hugging Face account, put in the repository for your Hugging Face model, and then it would take
1226.85s - 1231.97s |  the PyTorch model, load that up, convert it into a safe tensors format, and then just send a pull
1231.97s - 1237.57s |  request to your repository that you could review and accept. However, PyTorch was one of those
1237.57s - 1243.25s |  vulnerable model formats. So what happened was that when you actually loaded up the model,
1243.25s - 1248.29s |  there was arbitrary code execution on their server. And when we were first looking at this,
1248.29s - 1252.85s |  we were trying to see, you know, was there just a way to steal the token of the bot so we could
1252.85s - 1258.21s |  send those requests ourselves? And then we just did a test because we were like, you know,
1258.21s - 1263.25s |  this probably won't happen, but we'll see anyway. And we noticed that the spaces actually had
1263.25s - 1268.77s |  persistence across users. So that meant if I got arbitrary code running on the server, it would
1268.77s - 1278.21s |  also affect any models that Chloe uploaded as well. Which meant that not only could I modify
1278.21s - 1283.33s |  other people's models, so let's say I want to put a backdoor into one of those safe tensors formats,
1283.33s - 1289.09s |  I could also potentially steal private models. Which meant that, you know, you could upload your
1289.09s - 1294.05s |  own private models that you didn't want public, and these have millions of downloads each month
1294.05s - 1298.21s |  for the public ones, but the private ones have millions of dollars behind them for training.
1298.77s - 1304.29s |  And what we can see here is we can see this is one of Google's models. This was not exploited,
1304.93s - 1310.13s |  but you can see that there was the safe tensor conversion happening here, and at the time that
1310.13s - 1316.69s |  we took the screenshot, this one model, just this one, had 3.8 million downloads. Now, remember that
1316.69s - 1323.33s |  number Chloe was telling you earlier about 500,000 plus models on Hugging Face? Now, imagine how many
1323.33s - 1328.21s |  of those, you know, if you could exploit any single one of them, ends up not being great.
1329.09s - 1334.37s |  However, it doesn't just stop there with AI infrastructure. We have our ML Ops solutions,
1334.37s - 1340.37s |  and as I mentioned earlier, security has forgotten the past. People are just trying
1340.37s - 1344.29s |  to rush get these solutions up and running so that they can use them, and they're not really
1344.29s - 1349.73s |  considering all the things that happened in the past, and we're just seeing a lot of vulnerabilities
1349.73s - 1354.69s |  that we really shouldn't be seeing anymore. We're seeing that we have these unsafe serialization
1354.69s - 1360.93s |  libraries like our nice little pickle there, but what we're also seeing is that the known safe
1360.93s - 1367.09s |  formats like JSON are suddenly becoming vulnerable and exploitable. We're seeing missing
1367.09s - 1372.21s |  authentication, hard-coded keys, I mean, SQL injections, XSS, really everything. The list goes
1372.21s - 1376.37s |  actually so long it doesn't even all fit on my slide. You see how it gets cut off there? Really
1376.37s - 1383.33s |  not great. So, obviously, we go through and we try to fix these vulnerabilities wherever we find
1383.33s - 1388.29s |  them, and a lot of these AI development frameworks, they're open source, so it makes them easier to
1388.29s - 1394.37s |  review, and also easier for you to do any auditing for. However, what we've noticed is that when we
1394.37s - 1401.25s |  do any vulnerability disclosure, there tends to be three different types of fields that occur,
1401.25s - 1407.57s |  or things that occur. So, the first is some projects, when we go and disclose the vulnerability,
1407.57s - 1413.81s |  they create a new feature, or they patch it, so that there's now safe by default, which means that
1413.81s - 1420.21s |  whereas the function, when it was first used, it would run whatever arbitrary code, it now, it won't
1420.21s - 1425.17s |  run any arbitrary code unless you give it an optional parameter. However, some people don't,
1425.17s - 1430.13s |  or some projects didn't want to cause issues for current users, so what they did is, rather than
1430.13s - 1435.89s |  adding safe by default, they added a safe option. However, you actually had to know about the safe
1435.89s - 1440.05s |  option and set a parameter to make it safe, and I mean, how many people here actually read
1440.05s - 1447.89s |  documentation? Thank you guys for being honest, and maybe not so honest. Um, so, I mean, yeah, nobody
1447.89s - 1453.73s |  really is going to use a non-safe by default function if they don't know about it, and don't
1453.73s - 1458.53s |  read the documentation, and for some of these, the warnings weren't a big red box. I mean, they were
1458.53s - 1463.41s |  hidden in documentation pretty far down the pages, and then the third type of project that we've been
1463.41s - 1468.21s |  seeing is we've seen that some projects, rather than actually patching the vulnerability, they
1468.21s - 1472.93s |  say that the vulnerability is a feature, and it won't be patched because it would mess with some
1472.93s - 1479.17s |  of the functionality of the project. Now, let's look into some of these projects. So, NumPy load
1479.17s - 1485.25s |  is the first type of project. What NumPy load did is that it used to be, uh, the underlying data
1485.25s - 1491.33s |  structure was a pickle, uh, could potentially be a pickle, and now, if you load it by default, it is
1491.33s - 1496.77s |  no longer vulnerable. However, if you have allow pickle set to true, then the arbitrary code gets
1496.77s - 1502.93s |  executed, and does anybody want to guess just how many unsafe versions of this there are in GitHub?
1503.89s - 1511.89s |  Anybody? No? More than 10,000? More than 10,000? Okay. Well, there was actually 87,000 files on
1511.89s - 1516.53s |  GitHub that used this function incorrectly, and this is one that you actually have to set the
1516.53s - 1522.21s |  parameter to be insecure to use incorrectly. So, you can't use it incorrectly by default.
1522.21s - 1529.81s |  So, if this is, you know, 87,000 for something that you purposefully have to set to be exploitable,
1529.81s - 1535.01s |  what about something like Torch load, where you have a option to make it safe, but by default,
1535.01s - 1540.69s |  it isn't safe? So, once again, we did our nice little search, and we noticed that, unlike the
1540.69s - 1548.45s |  87,000 before, there were now 573,000 files on GitHub that were using this, and not only that,
1548.45s - 1554.77s |  these files existed in projects that are actually being deployed by companies across their
1554.77s - 1558.77s |  infrastructure. So, now that we've kind of talked about some of the vulnerabilities, I'm going to
1558.77s - 1568.50s |  pass it back to Chloe to talk about the open source nature of AI. So, when it comes to verification
1568.50s - 1572.90s |  challenges in open source, the thing to know is that there's so many challenges. All right, we
1572.90s - 1577.46s |  already had challenges in the first place when it came to disclosing things for a while. It's gone
1577.46s - 1584.74s |  better, but it's, like, substantially worse now. I mean, there's challenges with, you know,
1584.74s - 1589.94s |  inconsistent code quality, hidden, like, security vulnerabilities, and then you have complex
1589.94s - 1596.10s |  licensing issues, and then there's biases in the pre-trained models, poor documentation, and then,
1596.10s - 1604.42s |  of course, we just keep creating new products that are AI-based. So, this becomes even harder
1604.42s - 1609.70s |  because now we're obscuring transparency, and we're complicating things even more so
1609.70s - 1616.59s |  to be able to have effective vulnerability management. And to be honest, finding vulnerabilities
1616.59s - 1622.19s |  in open source AI system is aided by, like, accessible code, community efforts, and specialized
1622.19s - 1629.63s |  tools. However, we're not even close to that right now. It's complex contributions. It's rapid,
1629.63s - 1634.99s |  like, evolution, and then also specialized knowledge that can really introduce some security
1634.99s - 1643.39s |  flaws. So, frequent updates, dependencies, and gaps in testing further complicates and contributes to
1643.39s - 1650.35s |  such risks. So, vulnerabilities, they stem from inadequate reviews, poor implementation, dependency
1650.35s - 1655.95s |  issues, backdoors, insufficient security practices, and then you add on that rapid development because
1655.95s - 1660.83s |  everyone has to get those products pushed in, you know, to make their companies happy. You also have
1660.83s - 1667.31s |  misconfigured models and social engineering that can really do increase the security risk altogether.
1669.07s - 1674.67s |  And I think next year we might try to do a talk, and don't steal it, okay? Don't steal it at all,
1674.67s - 1681.23s |  on AI-assisted code reviews because that's been emerging these days. So, that might be a future
1681.23s - 1687.55s |  topic. Don't take it. I'm telling you, I know where you live. Just kidding. But seriously, don't take
1687.55s - 1693.71s |  it. Okay. So, reporting challenges overall. You have to understand it is very, very tough. When we don't
1693.71s - 1701.47s |  have clear messaging, we don't know what to expect. When we don't have clear idea of laws, we don't
1701.47s - 1708.19s |  know what to expect. So, when we're trying to submit anything on disclosures or bug bounties,
1708.19s - 1715.15s |  we don't know how the organization's going to respond. And we're scared of repercussions because
1715.15s - 1722.43s |  there isn't enough good quality communication. And because there isn't any really good ways of
1722.43s - 1728.03s |  reporting things, this becomes another issue. Because back in the day, when you would disclose
1728.03s - 1732.35s |  things, they didn't have vulnerability disclosure policies. So, it always became the game of,
1732.35s - 1737.23s |  how do I reach out to someone? Who do I reach out to? And that's still kind of a problem to this day
1737.23s - 1743.47s |  for traditional security. But imagine you contacting like data scientists or projects on GitHub,
1743.47s - 1747.63s |  where people have never done security their whole life. So, you go to them like, hey,
1749.23s - 1754.75s |  just wanted to let you know, I could possibly do remote code execution on you. And they come
1754.75s - 1759.23s |  back like, oh, that's how it was built. It was built like that. So, as you can imagine,
1759.23s - 1763.79s |  that makes things really challenging. And there's been times where we actually had to reach out to
1763.79s - 1769.39s |  CISA to help us out to make sure that they get disclosed and those really serious vulnerabilities
1769.39s - 1777.25s |  get patched. Now, I did mention we did speak to a couple bug bounty platforms. So, bug crowd in
1777.25s - 1784.45s |  general, I wanted to have open-ended conversation. And I asked, how are things going? Like just a
1784.45s - 1790.61s |  very simple question. How are things going? And what they told me about was the fact that
1790.61s - 1796.05s |  hallucination has been an ongoing concern because there's a lot of hunters out there that are
1796.05s - 1799.73s |  submitting hallucinations. And then they're coming back to them like, well, that's a hallucination.
1799.73s - 1806.53s |  That's not a security vulnerability. And this tends to upset the submitter, of course. But then
1806.53s - 1811.97s |  you also have to deal with biases. So, bug crowd will be like, hey, this researcher found this
1811.97s - 1818.61s |  bias in your model. And then they'll be like, we don't find that racist. So, there are times where
1818.61s - 1823.81s |  you have to work with the organizations to make sure that everyone is aligned when it comes to
1823.81s - 1832.05s |  biases. And then also payouts. Because there isn't really a good like severity scoring at this time,
1832.05s - 1835.81s |  this makes payouts really difficult. So, bug crowd, I don't know if you're familiar with them,
1835.81s - 1840.13s |  they use a vulnerability rating taxonomy that they created themselves. And it was a way to
1840.13s - 1847.89s |  make things a little bit more closer to what companies see when they think of like severity
1847.89s - 1853.89s |  scoring versus just fully relying on CVSS scoring on its own. And so, the thing is that they're
1853.89s - 1859.81s |  still trying to learn from research and then also from how their community is responding
1859.81s - 1865.25s |  and find these vulnerabilities on that severity scoring. And then the one thing that I have to
1865.25s - 1869.97s |  commend them about was I asked them, well, how do you think we're going to get better submissions
1869.97s - 1877.89s |  when it comes to AI vulnerabilities? And they said, it's our fault. We haven't given our
1877.89s - 1884.05s |  researchers guides. We haven't provided them with the education content. We haven't done CTFs that
1884.05s - 1889.97s |  really push the limits of people and their skill set. And I thought that was really good to have
1889.97s - 1897.49s |  that type of ownership that they shared. Now, when it came to HackerOne, their more focused one
1897.49s - 1904.61s |  was on the relationship between the customer and themselves and making sure that communication is
1904.61s - 1909.89s |  clear and concise. Because if it's clear and concise, people know what's in scope. They also
1909.89s - 1915.89s |  know what could possibly be a payout or how bad this vulnerability could be. But there's a lot of
1915.89s - 1922.21s |  issues coming around, like what is safety versus what is security? And then the payouts. So one of
1922.21s - 1927.33s |  their concerns, of course, is if you don't pay people out the amount that they should be getting
1927.33s - 1932.77s |  when they find such serious vulnerabilities in AI, do you think they're going to return? And they're
1932.77s - 1938.93s |  probably not. But having to convince companies to give more can sometimes be a challenge,
1938.93s - 1944.13s |  unfortunately. So they've always been really pushing for researchers to get the amount that
1944.13s - 1950.21s |  they probably deserve, which has been great to hear. But they have been really pushing customers
1950.21s - 1955.25s |  they need to be more specific. And then also letting everyone know that they're all still
1955.25s - 1961.01s |  trying to figure out the payouts amount. And I did ask them if they are dealing with the hallucination
1961.01s - 1967.09s |  situation as well. And they said, yes, they are. It is an issue for them too. And then you have
1967.09s - 1974.21s |  integrity. So integrity was more about trying to make things concise, just like HackerOne was
1974.21s - 1981.25s |  doing in a sense, but also ensuring that there is a reward structure in play. And understanding
1981.25s - 1986.61s |  what is safety, what is security has been one of their top priorities to make sure there's alignment
1986.61s - 1992.13s |  across the customers and also the hunters themselves. And one of the things that was
1992.13s - 1996.45s |  really interesting was they also have been trying their best to do alignment with their
1996.45s - 2002.37s |  customers as well to ensure that everyone is kind of getting heard and seen. So overall,
2003.41s - 2008.61s |  everyone is acknowledging that it is a work in progress and it's not perfect right now.
2008.61s - 2015.41s |  And they could always use the help from community and also to hopefully to have more of an idea of
2015.41s - 2020.45s |  what should be the severity for certain vulnerabilities and how that payout should
2020.45s - 2025.65s |  look like. And then last but not least, make sure that there's alignment with biases, that companies
2025.65s - 2031.25s |  understand that certain things are sexist, certain things are racist, because that would make their
2031.25s - 2037.57s |  life a lot easier as well. And then last but not least, standardizations is one of the things that
2037.57s - 2045.79s |  they're looking for and they're working hard on at this time. So in summary, AI vulnerabilities
2045.79s - 2052.67s |  are complex and distinct. And as you learn from CAS, it could be like going into a candy shop
2052.67s - 2056.75s |  right now. So if you want to go make some money pretty fast, this might be the way to go.
2057.95s - 2064.59s |  But there are threats out there that are more than just prompt injections. So that's the good
2064.59s - 2070.91s |  news and bad news, but also you have data poisoning too. And there are rapid developments happening
2070.91s - 2076.99s |  right now, especially this need of having better reliance and understanding of open source
2076.99s - 2082.83s |  frameworks and hoping that to be more collaborative so then we can reduce the risks that are there.
2082.83s - 2087.87s |  But also managing these vulnerabilities really demands for improving reporting and making sure
2087.87s - 2093.47s |  that people are aware how vulnerability disclosure works and how it has worked and how to share that
2093.47s - 2098.35s |  information with those that aren't aware of vulnerability disclosure policies. And having
2098.35s - 2104.35s |  these strong partnerships such as like CISA is really helping everything out. And of course,
2104.91s - 2110.91s |  you participating in these bug bounty programs also help the more people that report vulnerabilities,
2110.91s - 2116.35s |  the more they learn too from it. So there is a call of action here. We are looking to partner
2116.35s - 2121.31s |  with folks that want to help out in this situation because it is going to take a community to come
2121.31s - 2125.79s |  about to try to make things a little bit better so we can have better standardization, but also
2125.79s - 2131.15s |  better collaboration and be more specific about what are we looking for, what's the severity levels
2131.15s - 2135.63s |  for these vulnerabilities, and make sure that you guys get paid out the amount you're supposed to
2135.63s - 2142.03s |  get paid out for these vulnerabilities as well. I do have cards, so more than happy to also give
2142.03s - 2148.51s |  you my card. I'm going to also just say thank you so much for having us. We'll open it up for Q&A.
2149.47s - 2153.79s |  And yeah, if you ever want to reach out to us, our DMs are open. Feel free to connect with us
2153.79s - 2158.67s |  as well. And thank you so much for existing. And once again, thank you to the Bug Bounty Village
2158.67s - 2185.94s |  and to DEF CON and to all the goons and the volunteers. Any questions? Oh, yeah. No,
2185.94s - 2195.58s |  they basically wanted to replicate it completely for their own project. Pretty much. Yeah. Remember
2195.58s - 2201.50s |  those three groups? The competitors is definitely one of the top ones I would say in AI. There's the
2201.50s - 2206.91s |  group that we're seeing a lot of these kind of attacks. Next question. Yeah.
2213.87s - 2219.47s |  Yeah. So there's a few different vulnerabilities in gguf. They've all been patched at this point.
2219.47s - 2227.15s |  So gguf is normally used for, have you heard of llama CPP? Right. So gguf came from ggml,
2227.15s - 2233.39s |  which is like one of the first open source AI models. It's just C++. A lot of the vulnerabilities
2233.39s - 2239.71s |  that are in that specific one are pretty much all parsing vulnerabilities. So Cisco Talos found
2239.71s - 2244.67s |  one that was fairly exploitable a while back. And what that one was, was there was like a
2245.87s - 2250.83s |  max size and you could set the integer to the max size and then it would overflow when it actually
2250.83s - 2254.59s |  allocated the memory. So it would do like a zero allocation and then would read it into,
2255.23s - 2262.03s |  you know, whatever you had. So you could overflow any memory that way. However, because it is C++
2262.03s - 2268.75s |  or C and C++, and you only really have one attack through that component, what you see is that a lot
2268.75s - 2273.71s |  of time, unless the system doesn't have ASLR, you won't be able to actually exploit it too,
2273.71s - 2284.11s |  too much past DOS. Do you have any other questions about that with gguf? No. So they did fix those
2284.11s - 2294.21s |  vulnerabilities. Yeah. Any other questions? Yeah. So also I've realized I'm going to repeat some of
2294.21s - 2299.01s |  the questions for the camera because they might not be able to hear. So you asked if there was
2299.01s - 2305.73s |  any payoff for the Hugging Face vulnerability. So we are a research organization, which means
2305.73s - 2310.05s |  that we actually disclose everything completely without bug bounty, just because we are doing it
2310.05s - 2317.01s |  as a company. However, if you did do it as a bug bounty hunter, Hugging Face does have a bug bounty
2317.01s - 2343.31s |  program. Any other questions? Yeah. Yeah. So he asked if there were any things AI uses a lot of
2343.31s - 2348.99s |  power, can you do anything with that? So what we've actually seen is that it's less about power
2348.99s - 2355.07s |  usage and more about CPU and GPU cycles. So to actually host these models, it costs quite a bit.
2355.07s - 2360.27s |  So instead of, you know, saying a response taking 10 seconds, if you can make it take two minutes or
2360.27s - 2366.03s |  more, and there are quite a few attacks like that. The most famous is probably the Ouroboros attack.
2366.03s - 2371.39s |  So, you know, say like snake eats tail, and you keep going and get it to generate, and it'll
2371.39s - 2376.19s |  just keep on generating until it hits the token limit. So there's actually a lot of research being
2376.19s - 2384.67s |  done into that. I actually did a talk last year at DEF CON on climate change and the impact on
2384.67s - 2388.91s |  cybersecurity. And I did touch on that. So I recommend checking out. I think the talk was at
2388.91s - 2393.31s |  the Crypto Privacy Village last year. So it's probably posted online. And you can reach out
2393.31s - 2401.81s |  to me if you have questions on that. Any other questions? All right. Well, thank you guys so
2401.81s - 2404.37s |  much for coming and feel free to come up to us afterwards.


url: https://www.youtube.com/watch?v=Z6Wq1iqTyWg
title: DEF CON 32 - Custom, cheap, easy, and safe badges without starting from scratch - securelyfitz
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=Z6Wq1iqTyWg",
  "title": "DEF CON 32  - Custom, cheap, easy, and safe badges without starting from scratch  - securelyfitz",
  "description": "Electronic conference badges are cool and everything, but they're A LOT of time, money, and effort including but not limited to hardware, software and art design, testing, manufacturing, testing, provisioning, and repairing.\n\nI'll share OpenTaxus, a relatively simple, cheap, mass-producible, and open-source badge design. We'll start out by looking at and understanding the design and implementation, highlighting the areas worth customizing (and which to leave as-s). I'll do a walkthrough of a few changes to customize the design - in KiCAD for hardware changes, and in CircuitPython for software changes.\n\nWe'll wrap up with some discussion of how to handle cost reduction to fit in a certain budget, manage badge logistics for events of different sizes, and warn about some of the many pitfalls that electronic badges suffer. You should walk away with the ability to customize a badge to be mass produced for your own event.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2605,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 3.76s | This text was transcribed using whisper model: large-v2

 I haven't spoken at DEF CON in quite a while, so I'm kind of excited to be here.
3.76s - 8.50s |  I'm glad that we're in this room and not one of those other big ones.
8.50s - 11.24s |  How many of you have made badges before?
11.24s - 13.96s |  How many of you have used badges before?
13.96s - 15.68s |  How many of you like badges?
15.68s - 17.72s |  How many of you like badges that work?
17.72s - 19.72s |  How many of you have badges that work?
19.72s - 22.16s |  How many of you have badges that don't work?
22.16s - 23.96s |  Not necessarily this conference, but have you ever been at a conference and you get
23.96s - 25.44s |  a badge and it doesn't work?
25.44s - 27.70s |  Yeah, me too.
27.70s - 29.68s |  How many of you didn't even bother turning it on because you weren't sure it was going
29.68s - 31.22s |  to work anyway?
31.22s - 38.22s |  So the point of this talk is because I have made a few badges and I have a habit of reusing
38.22s - 43.42s |  as much as absolutely possible because the chief virtue of an engineer is laziness, right?
43.42s - 47.22s |  So if I'm going to put the effort into making a badge that I can reuse, I want to make sure
47.22s - 49.70s |  other people know that it's available and they can do that too.
49.70s - 54.66s |  I know there's tons of badges, but like, and many of them are open hardware, open source.
54.66s - 57.88s |  And rather than, of course, you know, just taking an existing open source one, I figured
58.06s - 60.06s |  why not do another open source one?
60.06s - 62.54s |  Because you know, so that's how it goes.
62.54s - 66.94s |  So I'm going to tell you about an open hardware badge design that I've worked on and that
66.94s - 71.42s |  I think will be useful because it's been tested, been through two conferences already.
71.42s - 73.94s |  It's going to be on track for a third one.
73.94s - 77.34s |  And I want it to be open hardware so that anybody who wants to make a badge doesn't
77.34s - 78.34s |  have to start from scratch.
78.34s - 82.74s |  You can just take this open hardware, change it how you want, however you want to do.
82.74s - 83.74s |  Just change the artwork.
83.74s - 84.74s |  You can change software.
84.74s - 86.30s |  You could keep it exactly the same.
86.30s - 90.28s |  Just like change the conference name and you've got a badge.
90.28s - 92.60s |  So a little bit about badges, or me.
92.60s - 93.60s |  I'm Joe.
93.60s - 94.60s |  Hi.
94.60s - 96.72s |  I teach classes on hardware hacking and reverse engineering.
96.72s - 100.56s |  I've been in Las Vegas for a week already because I was doing training at Black Hat.
100.56s - 101.94s |  So I'm a little bit exhausted.
101.94s - 104.84s |  But after this, I'm going to go hang around the pool, which is what I've been looking
104.84s - 106.88s |  forward to for the past week.
106.88s - 111.92s |  Yeah, I do hardware stuff.
111.92s - 114.52s |  So let's talk about, this is what I'm going to talk about today.
114.52s - 118.74s |  Why we have badges, what this thing is that I'm talking about, what my vision for it is,
118.74s - 123.50s |  what we can do today, and some logistics and pitfalls.
123.50s - 127.78s |  And it started out as kind of like a workshop-y thing, but the space and the venue worked
127.78s - 131.48s |  better for us to do kind of more of a talk slash demo.
131.48s - 135.22s |  So I'm going to talk a bit, and then I'm going to show you some software and hardware.
135.22s - 137.14s |  And then we'll have some time for questions.
137.14s - 138.14s |  Sound good?
138.14s - 139.14s |  Any questions?
139.14s - 140.14s |  Everybody ready?
140.14s - 141.14s |  Okay.
141.14s - 142.14s |  Listen carefully.
143.04s - 144.60s |  What are badges?
144.60s - 145.60s |  Why do we have badges?
145.60s - 146.60s |  Pretty much access.
146.60s - 149.62s |  Like, whether it's a wristband or a badge or something that hangs around your neck or
149.62s - 152.64s |  something you tattoo on your forehead, we need a way to know who's supposed to be here
152.64s - 156.40s |  or who's not, who paid, who didn't, who gets free drinks, and who doesn't.
156.40s - 157.96s |  So we're going to have them anyway.
157.96s - 159.82s |  We might as well make use of them.
159.82s - 161.44s |  So we want the cool factor.
161.44s - 163.84s |  This is a handful of badges that I designed.
163.84s - 167.34s |  My first one over here was for B-Sides Portland 10 years ago.
167.34s - 171.08s |  It was a bus pirate, but the PCB shape was changed.
171.08s - 172.80s |  So it was the shape of a Nyan cat.
172.80s - 177.74s |  So the rainbow ribbon cables that come out of the bus pirate were like the trail of rainbow
177.74s - 178.74s |  behind it.
178.74s - 186.38s |  And a couple of these were B-Sides Portland, some 503 Party badges, 44Con in London, TRCon,
186.38s - 191.66s |  which has kind of evolved into the Dan Initiative now.
191.66s - 192.66s |  So yeah.
192.66s - 193.66s |  They look cool.
193.66s - 194.66s |  And you want them to look cool.
194.66s - 198.06s |  And as a conference organizer, you want people to say, oh, this is a cool badge.
198.06s - 199.06s |  Take pictures of it.
199.06s - 200.06s |  Post it on social media.
200.06s - 201.88s |  And say, I can't wait until I come back next year.
201.88s - 207.04s |  And then conference organizers get more people coming, and yada, yada, yada.
207.04s - 208.64s |  Why else do we want badges?
208.64s - 211.86s |  Electronic badges hopefully have some sort of interaction.
211.86s - 220.15s |  And you can do interaction with a paper badge, but electronic badges are a little bit cooler.
220.15s - 226.19s |  So this is a few years ago, Joe Grand's previous DEF CON badge was a little like magic tokens.
226.19s - 228.89s |  They had a piece of stone on the front.
228.89s - 234.25s |  And he used a type of NFC, not like standard NFC, but like a near field communication,
234.25s - 237.09s |  inductive communication method, which is pretty cool.
237.09s - 240.75s |  But what happens, people go around, they go up to people they don't know, they interact
240.75s - 243.05s |  with the badge, they meet people.
243.05s - 247.63s |  That's kind of like the best part about an electronic badge.
247.63s - 249.25s |  And also, like hopefully, there's a lot.
249.25s - 252.35s |  How many of you have ever designed a PCB before?
252.35s - 257.15s |  How many of you have ever written embedded microcontroller code before, right?
257.15s - 260.17s |  How many of you have hacked on a badge, an electronic badge?
260.17s - 263.45s |  So hopefully, the badge is an opportunity for you to get your hands on some hardware
263.45s - 265.11s |  that you might not have otherwise done.
265.11s - 271.07s |  So this one required a somewhat pricey programmer, but like once you had that, you could do whatever
271.07s - 272.07s |  you want.
272.07s - 273.73s |  There was also a serial port that you could interact with it.
273.73s - 279.95s |  But like getting people to interact with tools and learn something is kind of a great goal.
279.95s - 281.85s |  So why open taxes?
281.85s - 284.81s |  So anybody know what a badger is?
284.83s - 287.93s |  American badger, taxidea taxes.
287.93s - 291.91s |  So this is the open badge, open badger, open taxes.
291.91s - 298.63s |  Not tax is, like things you pay, not tax as the big state, but like taxes.
298.63s - 302.07s |  And at some point, I'm going to have a cool logo, and it's going to be like a badger with
302.07s - 305.15s |  a badge on that says open taxes.
305.15s - 307.91s |  But you can just visualize that right now.
307.91s - 311.63s |  Or go ask Dolly to make that during the talk, and we can post it up there.
311.63s - 313.63s |  You can do a pull request.
313.65s - 315.49s |  So it's open, right?
315.49s - 318.31s |  This is the URL right now, open taxes.
318.31s - 322.73s |  And that is kind of like the sanitized, cleaned up version that has like all the strings for
322.73s - 326.01s |  specific events and all the logos and stuff removed.
326.01s - 330.05s |  So you can go and like copy this and make it and not have to worry about like infringing
330.05s - 335.21s |  on anyone's artwork, copyright, or all these detailed crappy things.
335.21s - 338.29s |  So yeah, I'll put this URL up later.
338.29s - 342.93s |  But I think it's the only thing on GitHub called open taxes right now.
342.93s - 345.43s |  So it's custom, right?
345.43s - 349.11s |  Off-the-shelf is kind of cool, like if you have something interesting, but there's really
349.11s - 351.59s |  not a lot of off-the-shelf options.
351.59s - 358.35s |  One cool one we did a few years ago for 503, DC503's badge, was we had these little devices.
358.35s - 360.75s |  They were like this big.
360.75s - 365.67s |  They were smart response things, so they're made for classrooms where you answer questions.
365.67s - 367.39s |  The teacher pops up on the screen.
367.39s - 371.19s |  But we took them, we reflashed the firmware with a couple games and used that as our badge.
371.19s - 372.63s |  So we didn't design hardware.
373.33s - 376.85s |  We just took pre-made hardware and programmed it, which is kind of cool.
376.85s - 377.85s |  But this is the process.
377.85s - 382.73s |  I mean, we go through prototyping phases, we have an actual badge, and then we have
382.73s - 383.73s |  a second iteration.
383.73s - 387.69s |  This is B-side San Francisco's badge, which is essentially the same hardware.
387.69s - 392.89s |  But two conferences, two badges, somewhat similar, but it's okay because there's a lot
392.89s - 396.53s |  of conferences and there's a lot of badges.
396.53s - 400.13s |  So open, custom, and we also want it to be cheap.
400.13s - 404.81s |  My objective is that there's a lot of change in the microcontroller world lately.
404.81s - 410.63s |  This uses the RP2040, which is the predecessor to the fancy chip that's on a DEF CON badge.
410.63s - 412.11s |  It's amazing because it's dirt cheap.
412.11s - 417.43s |  In quantity, it's like 60 cents, and that includes USB interface.
417.43s - 422.87s |  So there's a lot of extra chips you need sometimes to interface with a badge easily, and this
422.87s - 423.87s |  doesn't need them.
423.87s - 426.31s |  So it is extra cheap.
426.31s - 430.11s |  Something else I've learned is when you get stuff assembled overseas, if you go to a manufacturer
430.11s - 435.33s |  that does a lot of it, if you wanted to assemble 100 badges, you need 100 chips.
435.33s - 438.13s |  You buy those chips, you get the 100-chip price.
438.13s - 442.03s |  If you go and get them assembled, and you get 100 badges assembled, they get the chips
442.03s - 450.09s |  at the $1,000 or $10,000 or real price, R-E-E-L, which is also the R-E-A-L price that manufacturers
450.09s - 451.09s |  get to pay.
451.09s - 456.29s |  So I've actually found that for prototyping, it's cheaper for me to get a prototype assembled
456.29s - 461.61s |  than it is for me to get the PCBs and buy the parts and assemble it myself, which is
461.61s - 464.87s |  kind of a weird world we're in.
464.87s - 467.11s |  So yeah, right now, this is the last iteration.
467.11s - 475.63s |  These were $5.70 each, plus some engineering costs, which I think is pretty cool.
475.63s - 479.31s |  $6 for a hardware badge that interacts is kind of a nice target.
479.31s - 480.31s |  I was aiming for $5.
480.31s - 484.25s |  Actually, I started aiming for $10, and then I went and did some cost reduction and managed
484.25s - 487.49s |  to swap out some cheaper components and got it down to almost $5.
487.49s - 489.81s |  So long run, $5 is the goal.
489.81s - 490.81s |  Oops.
490.81s - 491.81s |  Cancel.
491.81s - 492.81s |  Cancel.
492.81s - 496.71s |  Apologies for the AV situation.
496.71s - 498.77s |  It's a little bit interesting.
498.77s - 501.01s |  So I want to encourage interaction.
501.01s - 503.65s |  So a badge has to have a way to communicate.
503.65s - 505.33s |  However, we're hackers.
505.33s - 506.69s |  We're privacy-minded people.
506.69s - 509.21s |  We don't want these things broadcasting all the time, right?
509.21s - 512.01s |  So what I opted for was infrared communication.
512.01s - 516.73s |  What I like about infrared is that you can make it pretty short-range, right?
516.73s - 520.97s |  You can have it only work when you need it to work, and you can, like, you know, not
520.97s - 522.55s |  use it if you don't want to.
522.55s - 529.85s |  So this device has a little IR LED, right, right here, and an IR receiver right here.
529.85s - 535.49s |  So when you line badges up, they, like, kind of flash lights at each other.
535.49s - 541.25s |  And yeah, bill of material costs for the communication on this badge, $0.08.
541.25s - 546.29s |  So compare that to, like, an antenna, which is going to be more than $0.08, or, yeah,
546.29s - 547.29s |  anything else.
547.29s - 552.09s |  So I thought that was kind of awesome that I was able to get it that cheap.
552.09s - 554.21s |  Braden Lane, he's done, like, e-challenge coins.
554.21s - 559.45s |  He actually designed this IR circuit, and I asked him for a schematic and parts, and
559.45s - 560.45s |  he shared it with me.
560.45s - 564.45s |  So, you know, I appreciate his contribution to this, because, like, yeah, he was in the
564.45s - 565.45s |  same boat.
565.45s - 567.89s |  He wanted IR communications, but he wanted it to be cheap.
567.89s - 572.85s |  I literally just got my DEF CON badge, like, an hour ago, so I haven't poked at this infrared
572.85s - 576.65s |  communication, so I don't know what it is, whether it's modulated, but what this does
576.65s - 579.53s |  is it basically speaks, it's a UART connection, you know what UART is?
579.53s - 583.41s |  Serial connection, and, like, nothing fancy, just spit that UART over an LED, and it goes
583.41s - 587.13s |  up and down, none of the modulation, no extra transceivers, and in the other end, you just
587.13s - 588.13s |  have to do a little bit of clean-up.
588.13s - 590.65s |  Downside, it's wicked slow.
590.65s - 592.65s |  Upside, it's dirt cheap.
592.65s - 593.65s |  Trade-offs.
594.37s - 604.05s |  So, I want to encourage learning, and the original idea for this badge came from B-Love,
604.05s - 608.13s |  Brandon Levine, and he wanted to do something in CircuitPython, because he was not an embedded
608.13s - 609.65s |  programmer, but he knew Python.
609.65s - 613.73s |  I had never used CircuitPython before, and so I was introduced, at first, I was like,
613.73s - 617.21s |  yeah, that's a little high overhead for an embedded system, we're gonna do, like, C,
617.21s - 621.05s |  and we're gonna maybe do some hand-coded assembly, but that's because I started doing microcontrollers
621.17s - 626.65s |  20 years ago, when that's the way to do it, 25, 30 years ago, when, you know, you had
626.65s - 632.29s |  to pay for a compiler, and then, you know, I kind of did work for a while, and then when
632.29s - 636.05s |  I left work, it's like, oh, I can play electronics for fun, and Arduino happens, right?
636.05s - 639.25s |  So now we could plug things in with a USB cable, download one thing, get our compiler
639.25s - 644.05s |  and all our tools, and that was great, but now CircuitPython, you don't need a compiler,
644.05s - 647.95s |  you don't need anything, you just plug in a USB cable, you have a USB flash drive that
647.95s - 653.99s |  shows up, and there's a code.py file, and you edit it, and it runs, right?
653.99s - 659.23s |  So your IDE is whatever text editor you want, and, um, yeah, you don't have to download
659.23s - 661.87s |  or install anything, I think it's amazing and wonderful.
661.87s - 665.83s |  It does have trade-offs, but, like, objective here is something accessible, something that
665.83s - 667.19s |  gets people playing with stuff.
667.19s - 669.23s |  How many of you know Python?
669.23s - 672.47s |  How many of you can hack your way through and, like, edit something in Python, even
672.47s - 674.59s |  if you don't call yourself someone who knows Python?
674.91s - 678.51s |  Well, how many of you have used CircuitPython or MicroPython on an embedded device?
678.51s - 679.51s |  Okay.
679.51s - 680.51s |  Give it a try.
680.51s - 684.83s |  I actually, so, I've only got, like, 80 of these with me, but I'll give them out afterwards,
684.83s - 688.35s |  and so if you feel like you want to either tinker with this, or think you might have
688.35s - 691.67s |  interest in contributing anything to this project, I've got them for you.
691.67s - 695.43s |  If you just want something to, like, hang on your neck, then, like, let people who want
695.43s - 698.51s |  to work on them first, get them first, and then we'll have the rest available.
698.51s - 699.51s |  Sound good?
699.51s - 700.51s |  Um, so, easy.
700.51s - 701.51s |  Badges are not easy.
701.51s - 702.51s |  Hardware is not easy.
702.51s - 703.51s |  It's not called easy-ware.
703.51s - 704.51s |  Okay?
704.51s - 705.51s |  So, it's hard.
705.51s - 706.51s |  It's going to be difficult.
706.51s - 707.51s |  You need to go through multiple revisions.
707.51s - 708.51s |  And, yeah, so you should do that.
708.51s - 709.51s |  So, here is, so, actually, the background story for this one.
709.51s - 710.51s |  This is the LabsCon 2023.
710.51s - 711.51s |  LabsCon is a threat intelligence conference down in Phoenix.
711.51s - 712.51s |  It's pretty cool.
712.51s - 713.51s |  It's very unique and niche.
713.51s - 714.51s |  Um, but, uh, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's,
714.51s - 715.51s |  it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's,
746.51s - 747.51s |  uh, all right?
747.51s - 748.51s |  So, um, we've got the cardboard mockup to kind of, like, figure out what we're going
748.51s - 749.51s |  to do.
749.51s - 750.51s |  We've got the little PCB mockup.
750.51s - 753.13s |  Uh, this is the IR communication circuit that I prototyped.
753.13s - 756.15s |  I'm like, okay, I know I can get a Raspberry PI 2040 working.
756.15s - 757.89s |  I can get an IR communication working.
757.89s - 759.71s |  Um, I did a PCB layout.
759.71s - 761.33s |  And I milled a, a sample one.
761.33s - 763.69s |  I didn't actually mill a one that, a functional prototype.
763.69s - 766.83s |  I just kind of used it to make sure I got the sizes and placement right.
766.83s - 772.51s |  Um, and then, uh, QuickTurn, uh, prototyping from, I believe, this one was JLCPCB.
772.51s - 778.71s |  So for, I think these are like under 10 bucks each. I ordered them on Monday, no
778.71s - 782.59s |  Sunday night, so Monday in China. I received them Friday. I was kind of like
782.59s - 786.39s |  amazed. Of course during that time I did like, you know, like little updating
786.39s - 791.55s |  tweaks here and there, added some artwork. But yeah, and of course you see, you, you,
791.55s - 795.31s |  you will make mistakes. So like you see here I've got that little blue, blue wire
795.31s - 802.19s |  that happens to be black, because oops. And DRC is your friend, unless you're
802.19s - 805.83s |  lazy, then you skip it, but whatever. And actually you can see up here I had a pin
805.83s - 810.23s |  out wrong for what I was using at the time, which was an IR transceiver. And
810.23s - 816.35s |  yeah. So I had to add that, change it a little bit. Screen goes on top. I like it
816.35s - 820.67s |  because it hides all the components. And that was, that was the prototype. And it
820.67s - 823.75s |  worked, which was kind of amazing. Just one blue wire and one component. So we
823.75s - 828.95s |  cleaned up that component, got the PCBs made. So what I did at the same time is I
828.95s - 834.95s |  did the bulk order from JLCPCB, as well as like a small batch order. So what
834.95s - 838.63s |  happened is I got the small batch prototypes a week later. You know, I
838.63s - 843.43s |  ordered, so I received Friday, spent all weekend working on it. Monday ordered the
843.43s - 847.91s |  second batch of prototypes, I guess. Thinking they're gonna be perfect and
847.91s - 853.59s |  just work. And those came the following Friday, which is again, is amazing. And in
853.59s - 857.35s |  the meantime, finalized all the artwork and everything for the actual like
857.35s - 861.63s |  production run. I did make a couple other tiny tweaks. Turned out we got the
861.63s - 866.51s |  production run in. Took them two weeks. Was kind of incredible for a few hundred
866.51s - 872.59s |  badges. And they shipped. And actually we had room for a week of customs holdup on
872.59s - 876.99s |  these badges. Because I was renovating my house, so we were living somewhere else.
876.99s - 882.03s |  So apparently it was a unique address that I may, I don't know, maybe customs
882.03s - 885.11s |  just let stuff go to my home address and thought that this was a different
885.11s - 889.27s |  address, so it's not Joe. I don't know. That or they put too high a price on the
889.27s - 894.63s |  invoice. So, but that's the badge we got. I did have to manually solder on the
894.63s - 898.59s |  battery holders and the screens. That was a time constraint issue. I really am
898.59s - 902.35s |  frustrated by screens. It's very difficult to get screens that are
902.35s - 907.35s |  quality and reliable and consistent. So I use modules, right? You can get the modules
907.35s - 911.15s |  cheaper than you can get the bare LCD OLED displays. So I might as well just
911.47s - 918.67s |  use those, right? And the second iteration, so we went from this prototype for what
918.67s - 922.79s |  was LabsCon. And then B-Side San Francisco was looking for a badge and I
922.79s - 928.03s |  had a conversation which roped me into another project. And so basically the
928.03s - 932.03s |  only change in the circuit had to do with the IR circuit. I took off that
932.03s - 937.99s |  transceiver that was up here. That was a IRDA transceiver. It was a three dollar
938.03s - 942.27s |  part. It was there because I had it and tested it and it worked. And that's when
942.27s - 947.39s |  I changed it to these eight cents of components, which were great. So yeah, the
947.39s - 951.71s |  prototype was pretty quick. The production badges took a little longer
951.71s - 955.07s |  than expected. I used a contract manufacturer that I use regularly for
955.07s - 959.19s |  Tigard. Shameless plug, Tigard is a little orange PCB that does JTAG, UART, and
959.19s - 963.35s |  SPI. And I make it and use it for my classes. But apparently other people like
963.35s - 968.67s |  it too. So you can get it on crowd supply. So I had that manufacturer do it
968.67s - 971.91s |  because I've worked with them in the past and they will do stuff like custom
971.91s - 977.15s |  solder mask color. And what they did for this badge, oops, do I not have a
977.15s - 983.39s |  picture of it? No. So what they did for us for the B-Side San Francisco badge is
983.39s - 989.15s |  we had two different colors of silkscreen. So they lined up perfectly.
989.51s - 994.79s |  Actually, I want to do something silly. I'm going to modify my presentation on
994.79s - 1002.94s |  the fly. I'm going to take a picture. You don't see it on the screen yet, but
1002.94s - 1014.80s |  there we go. Can you see it? How come you can't see it? It's right there on
1014.80s - 1020.64s |  the screen. Maybe I have to go back and forth. No? I see it right here on my
1020.64s - 1033.72s |  slides. Oh, I'm very confused right now. I hope that you've been seeing the same
1033.72s - 1037.00s |  thing as me all along because I'm literally looking at my slides right now
1037.00s - 1050.19s |  and it's different from, sorry. Oh well. This badge is cool because it's got two
1050.19s - 1054.15s |  different colors of silkscreen. So it's like a cream kind of off-white grayish
1054.15s - 1059.11s |  solder mask and then a red and a black silkscreen. And, you know, I will talk
1059.11s - 1061.75s |  about it in a second. The reason you pay for a contract manufacturer instead of a
1061.75s - 1065.39s |  quick turn place is they'll do things like make sure those colors line up
1065.39s - 1069.55s |  perfectly and they did an amazing job. It was better than I expected. What you have to
1069.55s - 1073.07s |  realize is PCBs are like precision things. So like there is some effort to
1073.07s - 1077.43s |  make things precise. Silkscreen is kind of like the last thing and it's usually
1077.43s - 1081.43s |  only documentation. It's not like functional. So there's some more slop in
1081.43s - 1086.35s |  the silkscreen than there is in the solder mask and metal layers. Anyway,
1086.43s - 1089.75s |  afterwards you can come up and see some of these badges because, yeah,
1089.75s - 1095.87s |  there's a bunch here. You can ogle the artwork. So what's my vision? I mentioned
1095.87s - 1099.95s |  before like I don't like doing this over again and people are frequently asking
1099.95s - 1104.67s |  me for badges and others. And rather than like have to be involved like in the
1104.67s - 1107.87s |  loop, it'd be really cool if I had a website. You go to the website and you
1107.87s - 1111.59s |  type in your conference name, right? You upload the logo for the concert,
1112.31s - 1117.51s |  concert, conference and you click go. You get your board files, you get your bill
1117.51s - 1122.71s |  of materials, get your code, everything ready to go. Does that sound cool? So what
1122.71s - 1126.35s |  you can do then is instead of having to start from scratch and go through three
1126.35s - 1129.03s |  iterations of prototypes and test everything and find the right components,
1129.03s - 1133.47s |  you start with something that works and change what you want to. If you want to
1133.47s - 1138.15s |  do like board changes and layout changes or add components, you do that. But you
1138.15s - 1141.79s |  start with a board file that's functional and works, right? You want to
1141.79s - 1144.55s |  make just artwork changes, you can do that, but you've already got a board that
1144.55s - 1147.67s |  works. If you want to keep the hardware exactly the same and change the game
1147.67s - 1151.27s |  that it plays or whatever, how it interacts, you can do that. And that's
1151.27s - 1153.99s |  actually what besides Portland's going to likely use the same hardware, but
1153.99s - 1157.75s |  they're going to have a completely different game that it plays. So like
1157.75s - 1161.95s |  customize what you want to do and keep what you want to keep. Make sense? Again,
1161.95s - 1167.27s |  chief virtue of an engineer is laziness. So be as lazy as you think is
1167.27s - 1170.83s |  appropriate and you'll be able to spend your time doing the things you want to
1170.83s - 1177.03s |  do. So how many of you like PCB design? How many of you like embedded software?
1177.03s - 1181.51s |  So you can go like meet up with each other and like work together or like do
1181.51s - 1186.75s |  one or the other. Make sense? Cool. So what can we do today? Because of the AV
1186.75s - 1190.27s |  stuff, I'm going to like finish my slides first and then I'll flip over to my
1190.27s - 1193.79s |  laptop and do some like walkthrough demo-y stuff. I'm not going to build a
1193.79s - 1197.15s |  batch from scratch because it's not there yet, but maybe someone will submit
1197.15s - 1201.71s |  a pull request and we can do that. So what can we do today? If you are a
1201.71s - 1205.35s |  hardware person, right, you can just change the logo. That's easy. You can
1205.35s - 1209.35s |  adjust the board footprint. I find like the cutout shape of the board is really
1209.35s - 1214.75s |  a neat thing to customize a badge because it looks neat. You can rearrange
1214.75s - 1218.47s |  the layout. As it is right now, it's kind of ergonomically designed, right? I
1218.47s - 1222.71s |  happen to be left-handed, right? But I wanted righties to be okay with it too,
1222.71s - 1227.47s |  so I put the button in the middle so you all you people can use it. And it
1227.47s - 1233.75s |  also it hangs down so you see the logo and if you want to use it, okay, I still
1233.75s - 1238.55s |  have power. I'm going to keep talking. You just like you grab it and you point it
1238.55s - 1243.55s |  at someone else and you like you trade, right? Ergonomically, like they hold each
1243.55s - 1246.99s |  other edge to edge. Screen still, yeah, just to make sure the screen is still on. You hold
1246.99s - 1250.67s |  them edge to edge and like they communicate. One of the flaws of the
1250.67s - 1254.55s |  current design is I need to tune the IR transmission a little more because you
1254.55s - 1257.67s |  literally have to hold them together like that for them to communicate. Maybe
1257.67s - 1261.03s |  like a half an inch, but if they're more like an inch or more, they don't work.
1261.03s - 1264.35s |  Which is kind of good because then you're not transmitting and receiving
1264.35s - 1267.91s |  noise and other people's stuff and whatever. Also by using a module, the
1267.91s - 1271.83s |  module kind of shades the IR stuff so like you know even if there's if there
1271.83s - 1275.51s |  happen to be lights, something crazy like that, you don't have it some
1275.51s - 1280.31s |  interference from that. Cool. If anybody's got any questions as I ramble on, please
1280.31s - 1286.43s |  yeah, what's up? Yeah, this is, hmm, maybe we'll do that later. Sorry, unless there's
1286.43s - 1291.51s |  another mic. Nah, okay, sorry. I'll repeat your question if I could hear it, but I
1291.51s - 1295.15s |  hear that more and I don't think he's asking any questions about boards. So
1295.15s - 1298.27s |  what we do, we change the logo, adjust the footprint, we can
1298.27s - 1302.43s |  rearrange the layout. So if we wanted to, you know, have it wider or different
1302.43s - 1305.51s |  layout or if you really wanted to change the infrared to something else, you
1305.51s - 1309.07s |  totally could do that. And you can hack it to pieces. The way I did the layout,
1309.07s - 1311.63s |  I'll show you when I look through a keycad, is I have a bundle that's the
1311.63s - 1315.03s |  microcontroller, I have a bundle that's the power circuit, I have a bundle that's
1315.03s - 1319.39s |  the, what's it called? Infrared circuits. So you can drag those blocks around and
1319.39s - 1322.91s |  route those blocks together or you can drag drag every single little resistor
1322.91s - 1327.75s |  and component together. So if you're a software person, right? You could change
1327.75s - 1331.15s |  strings, right? Like you take the badge instead of being open to access, you call
1331.15s - 1337.55s |  it like b-sides, you know, Gallifrey or something like that. And you know, you can
1337.55s - 1341.07s |  change the game text. Right now the game it plays is kind of, ever played Clue?
1341.07s - 1348.11s |  Yeah? So in Clue you have like a deck of suspects, weapons, and locations, right?
1348.11s - 1351.27s |  And you draw, you shuffle them, you draw one of each and you put them in an envelope to
1351.27s - 1354.79s |  the side and then you deal the rest out to everyone. In the process of the game
1354.79s - 1357.15s |  you're kind of like trying to figure out what everybody else has so you know
1357.15s - 1361.31s |  what's missing, right? Same thing, what it does right now is it deals one clue to
1361.31s - 1365.83s |  each person and, you know, you can trade those around, you meet people, it trades
1365.83s - 1369.43s |  the handle that you put into the badge as well as your clue and when you get
1369.43s - 1373.23s |  them all but one, you know the solution, right? And there's, it's set up for eight
1373.23s - 1377.19s |  games but we won't go into the details of that. B-sides Portland's gonna do a
1377.19s - 1382.87s |  slightly different game as well. You can change all the game text. Right now for
1382.87s - 1388.05s |  B-sides San Francisco, the AI theme they used, so it was a bunch of like AI, it was
1388.05s - 1393.83s |  a bunch of like, like doomsday scenarios and it was a bunch of fixes and so like
1393.83s - 1399.11s |  you'd randomly put those together like, you know, T-800 saved, you know, something
1399.11s - 1405.39s |  from Whopper or some weird thing like that. So badge logistics, this can be very
1405.39s - 1414.21s |  interesting, right? Did I miss a slide there? No, I think I got it. Sorry. So who
1414.21s - 1421.33s |  likes hand soldering? Who likes hand soldering a hundred badges? Who likes
1421.33s - 1429.37s |  hand soldering a thousand badges? So when I solder, I design around 0603
1429.37s - 1432.77s |  surface mount components because I used to be able to see them and do it by hand.
1432.77s - 1439.41s |  I can't anymore because I'm old. And so I use a microscope and I can still do them
1439.41s - 1444.37s |  by hand. But if you're gonna do some, this is designed for mass manufacturing, this
1444.37s - 1447.97s |  is not designed for hand soldering, so I use 0402 components, the really tiny
1448.01s - 1454.01s |  ones, which makes, I can fit them all on there easily and they're small and 0402
1454.01s - 1457.17s |  is a pretty reliable size. Gets smaller than that and sometimes you get a higher
1457.17s - 1462.65s |  failure rate. So if you're gonna hand solder, what I often do is I actually
1462.65s - 1467.77s |  will get the prototypes with all the small components assembled, right? And
1467.77s - 1471.77s |  then I get those prototypes and I solder on the big stuff. For example, if I'm like
1471.77s - 1475.65s |  trying to, you know, fine-tune which microcontroller, I get parts locally that
1475.65s - 1482.01s |  I want to use. Next is small batch. This is like JLCPCB, PCBWay and others,
1482.01s - 1486.13s |  Macrofab in the United States. You just give them your design and tell them a
1486.13s - 1489.85s |  little bit about the parts and they'll make the PCBs, assemble them for you and
1489.85s - 1494.69s |  ship them to you, which is pretty cool. And like I said before, sometimes it's
1494.69s - 1498.49s |  cheaper for me to do that than it is for me to just buy boards and buy parts and
1498.49s - 1503.61s |  waste my time assembling them. And then last is contract
1503.65s - 1507.53s |  manufacturing. This is, you know, basically there's a weakening line
1507.53s - 1510.61s |  between the small batch stuff and the contract manufacturing because a lot of
1510.61s - 1513.89s |  the same companies do the same thing or outsources to each other. Again, I have a
1513.89s - 1517.41s |  contract manufacturer I've used for Tigard and also BitMagic's the logic
1517.41s - 1522.97s |  analyzer. If you've heard of like NETV or the FOMU, like mini FPGA, those were
1522.97s - 1526.13s |  all done by the same folks. The reason why I chose them is because they'll
1526.13s - 1532.57s |  do custom solder mask colors for me. So, yay! But yeah, once you're hitting a
1532.57s - 1536.29s |  threshold of more than a hundred, you probably want to consider this. It will
1536.29s - 1540.05s |  take you longer, it will cost more, but it's more likely to get it right the
1540.05s - 1544.53s |  first time, which is really what you want to do. You know, 100 badges in a
1544.53s - 1550.29s |  contract manufacturer with one mistake is 100 badges you need to rework. And
1550.29s - 1553.57s |  finally, flashing. Like once we've got these badges, even if like we didn't
1553.57s - 1556.57s |  change anything, we still have to provision them. And so I've got like a
1556.57s - 1561.45s |  flashing rig here, which basically you slot the badges in, it pops into a USB
1561.45s - 1566.65s |  port, and they're all connected to like a 7-port USB hub, and I've got a couple
1566.65s - 1569.77s |  scripts in there that will go through, wait for a device to be attached, and
1569.77s - 1574.09s |  flash it. There was a small bug in that though, because what it does is it's a
1574.09s - 1577.49s |  Linux script, and it goes, it says, okay, you've attached a device, let's mount it.
1577.49s - 1584.25s |  What's the mount point? Okay, and now we want to wipe it first. So, RM, like, what's
1584.25s - 1590.53s |  it called? RM mount point slash star, and then dash RF, right? Like, so you want to
1590.53s - 1595.33s |  remove everything on that drive, and force it, right? Which is great, until mount
1595.33s - 1598.17s |  point, uh, for some reason doesn't exist, like you pulled it out before, like you
1598.17s - 1602.77s |  got the mount point, and so that string is blank, so it's RM dash RF, uh, RM
1602.77s - 1606.85s |  star, uh, slash star dash RF, uh, which, or whatever the order of the, yeah, you
1606.85s - 1610.61s |  know what I'm saying. It was bad. Um, luckily, I was using a utility called
1610.61s - 1614.37s |  PMount, which runs as a user, as opposed to having escalated privileges and
1614.37s - 1617.65s |  running it as root and mounting, because that would have been a much worse RM
1617.65s - 1621.85s |  dash RF, slash star. For those of you who are, like, more in the Windows world,
1621.85s - 1625.21s |  that basically, slash star is your root directory, and everything on your system.
1625.21s - 1629.13s |  So, like, it basically would hose your system if you did that. Um, yeah, that
1629.13s - 1631.53s |  was, that would, that could have been a lot worse. Luckily, it was discovered,
1631.53s - 1635.53s |  and found, and fixed, um, before we flashed all of our laptops, instead of the
1635.53s - 1642.97s |  badges. Um, flashing, we just talked about flashing. So, common pitfalls, uh,
1642.97s - 1646.13s |  cool, we got about halfway in, um, which means I want about half the time to go
1646.29s - 1651.21s |  and, and, uh, either look at questions, or, um, walk through the designs. Um,
1651.21s - 1655.73s |  common pitfalls, I'm really gonna emphasize one, uh, schedule. Give
1655.73s - 1658.73s |  yourself more time than you need. Once you've done that, give yourself even more
1658.73s - 1662.77s |  time. Add some buffer for, you know, manufacturing issues. Add buffer for an
1662.77s - 1667.41s |  extra prototype run. Add buffer for, um, you know, testing, and software, and
1667.41s - 1671.09s |  flashing, and whatever. Um, you'll use them. Um, you'll make good use of them,
1671.09s - 1675.29s |  but you'll use them. Uh, and part of the idea here is, like, if you're starting
1675.31s - 1679.89s |  with a known good badge, right, you can go get those started, and get the badges
1679.89s - 1683.15s |  manufactured, and work on the software in parallel. And, uh, then you don't have
1683.15s - 1686.03s |  to worry about getting your hardware, testing it, making sure it works. You
1686.03s - 1692.29s |  know, just remove the steps you don't want to have to deal with. Cool. So, I'm
1692.29s - 1697.21s |  gonna go back, and for those of you who wanted, where did I put it? The URL.
1697.21s - 1702.85s |  Uh, somewhere, I put a URL. It's GitHub. Forget it. I'm gonna switch over to my
1702.87s - 1707.41s |  laptop now. Um, I'll get that set up. I have some, some hardware design and code
1707.41s - 1711.75s |  I can walk through. Um, if any of you have questions, just come on up here, and,
1711.75s - 1714.99s |  like, you can ask a question, and I'll repeat it, and then answer it, um, as I do
1714.99s - 1716.99s |  the walkthrough. So, let, give me a moment. I'll swap up.
1716.99s - 1783.35s |  So, I'm connected to this wire, which goes straight to the TV. It was just when I was on a second ago.
1783.35s - 1805.66s |  First device. Ah, checking that. Looks good. 1080p. What? Input one, I'm outputting to it right now.
1811.91s - 1837.37s |  It's on, uh, that internal Google TV right now. It's showing a Google TV.
1837.37s - 1844.37s |  Well, that's not what I want to show you. But, we know the TV works. So, fingers crossed, one more time.
1844.37s - 1888.02s |  One more. Thank you for your patience. Anything? No?
1888.02s - 1908.87s |  Well, that's what I get for using Linux. So, I'm going to try something, if we can get this back up on the screen.
1908.87s - 1924.27s |  So, let's see. Nope. No, we're good, we're good. Okay. We're doing it live.
1924.27s - 1937.62s |  Can I get a volunteer? Do you want to just hold it and show my screen?
1937.62s - 1940.62s |  Just hold it? Just hold it so we see the screen. Thanks.
1940.62s - 1951.13s |  Everybody see that? I'll make it bigger. So, there's the slides. First, let's look at, can you hear me good?
1951.13s - 1956.13s |  First, let's look at the B-Side San Francisco badge so you can kind of see what's going on.
1956.13s - 1962.13s |  We've got a schematic. I'm not going to go into the details of the schematic. We've got, uh, can you see anything at all?
1962.13s - 1971.13s |  We've got the RP2040, right? We've got some flash. We've got some IO pins. We've got our IR circuit that, you know, just kind of works.
1971.13s - 1978.13s |  And we've got a USB interface that works. USB-C, which is great because everything should be USB-C.
1978.13s - 1985.13s |  But, let's look also, so this is what the finished badge looked like.
1985.13s - 1991.13s |  So, this is just in black because that's what I usually do, but you see it, uh, silkscreen on the front.
1991.13s - 1997.13s |  No components makes it really easy to see, you know, a little closer. Yeah, there we go.
1997.13s - 2001.13s |  Um, makes it, uh, easy to customize it because we don't have to worry about stuff.
2001.13s - 2005.13s |  There are a few holes, like through holes. That's where the battery connector is. That's where the USB connector is.
2005.13s - 2009.13s |  And that's where the string goes on. But I try to keep them near the edge to make it a little better.
2009.13s - 2014.13s |  Um, one thing B-Side San Francisco does is they use stickers to differentiate their badge types, which is kind of cool.
2014.13s - 2020.13s |  So, if you really just wanted to fab this badge as is and just make stickers for your conference, like, you can totally do that.
2020.13s - 2023.13s |  Like, you literally don't even need a logo when you go and order the boards.
2023.13s - 2030.13s |  But, what we've got here is the controller in the middle. Up here, we've got the Raspberry Pi 2040, some flash,
2030.13s - 2034.13s |  an I2C, uh, I2C connector so you can, like, attach things to it.
2034.13s - 2036.13s |  And then, yeah, IR circuits.
2036.13s - 2040.13s |  So, let's look at the layout.
2040.13s - 2042.13s |  How many of you have used KiCad before?
2042.13s - 2046.13s |  How many of you have used any circuit board design software, CAD software?
2046.13s - 2049.13s |  Um, so, basically, it's a whole bunch of layers, right?
2049.13s - 2054.13s |  And, uh, you make a, a schematic and then you make it into the layers of the, the board.
2054.13s - 2056.13s |  And you actually physically place stuff around.
2056.13s - 2059.13s |  I had mentioned before we have, oh, I de, I de-grouped it.
2059.13s - 2062.13s |  Uh, I have most of the things in groups.
2062.13s - 2066.13s |  So, like, we can go and we can grab the, here, we got the IR-TX and RX.
2066.13s - 2072.13s |  So, if you wanted to move that around, you can move this whole bundle at once instead of having to go and move every single component and lay it out.
2072.13s - 2076.13s |  And we'll flip the board over, view, flip board view.
2076.13s - 2081.13s |  Uh, oops, and then we'll, oh boy, the resolution is just kind of making this wild.
2081.13s - 2090.08s |  Um, anyway, uh, what we see here, uh, footprint back, there we go.
2090.08s - 2091.08s |  So, that's the silkscreen.
2091.08s - 2095.08s |  That's the layer that we would want to, you know, we'll, we'll remove and replace.
2095.08s - 2097.08s |  Um, if you wanted to see one example of what it looks like.
2097.08s - 2100.08s |  Of course, you know, your boards are kind of, like, looking top down.
2100.08s - 2102.08s |  So, it gets, uh, flipped and rotated a lot.
2102.08s - 2105.08s |  Um, but, yeah, that's what you do.
2106.08s - 2108.08s |  Uh, next.
2108.08s - 2115.08s |  Um, let's go over to, this is OpenTaxus straight out of the, uh, repository.
2115.08s - 2117.08s |  The question before was what the URL is.
2117.08s - 2121.08s |  Um, securely, uh, github slash securely fits slash OpenTaxus.
2121.08s - 2124.08s |  But if you just search github for OpenTaxus, you should get it.
2124.08s - 2126.08s |  T-A-X-U-S.
2126.08s - 2127.08s |  Um, what's the difference here?
2127.08s - 2129.08s |  Right, there's none of the logos.
2129.08s - 2130.08s |  My logo's not on there.
2130.08s - 2132.08s |  The open hardware's on there.
2132.08s - 2134.08s |  Um, the conference logo isn't on there.
2134.08s - 2136.08s |  There is the URL.
2136.08s - 2139.65s |  So, we can see it.
2139.65s - 2140.65s |  If, take a picture if you want.
2140.65s - 2142.65s |  I'll wait a second.
2142.65s - 2144.65s |  Take a, take a picture of the screen.
2144.65s - 2145.65s |  Showing the tablet.
2145.65s - 2147.65s |  Taking a picture of my laptop.
2147.65s - 2152.65s |  Showing a device that happens to have the URL text rendered as an image.
2152.65s - 2154.65s |  I mean, I think we need to do this anyway.
2154.65s - 2156.65s |  I would take a picture with my phone right now, but I cracked the screen yesterday.
2156.65s - 2157.65s |  So, oops.
2157.65s - 2159.65s |  Um, but, yeah.
2159.65s - 2161.65s |  You can see it's the same layout, same design.
2161.65s - 2163.65s |  And besides, Portland is literally gonna use this exactly the same.
2163.65s - 2165.65s |  Actually, that's not true.
2165.65s - 2169.65s |  We're gonna change R11 to a slightly different resistor value.
2169.65s - 2173.65s |  Um, but we don't need to worry about that right now.
2173.65s - 2174.65s |  So, yeah.
2174.65s - 2177.65s |  And then, again, this is, looks, should look very similar.
2177.65s - 2181.65s |  This is the, get it nice and close so we get the, the screen as the whole screen.
2181.65s - 2182.65s |  There we go.
2182.65s - 2183.65s |  Perfect.
2183.65s - 2184.65s |  So, yeah.
2184.65s - 2185.65s |  Here is the board.
2185.65s - 2187.65s |  Um, black, black, blank on the back.
2187.65s - 2189.65s |  And stuff on the front.
2189.65s - 2195.65s |  Um, one thing I'll mention, uh, some people kind of, uh, like to shortcut and sometimes, oh, you can see me in there too.
2195.65s - 2201.65s |  Um, you try and shortcut and say, oh, well, you know, it's cheaper if we just get the, the plain boards.
2201.65s - 2207.65s |  Um, and the default selection is, uh, uh, HASL, uh, it's a leaded, uh, kind of metal cover.
2207.65s - 2209.65s |  So, it makes it easier to solder on the copper.
2209.65s - 2211.65s |  Um, but that's leaded.
2211.65s - 2215.65s |  And if you're doing these badges and you're handing them out to people, don't use lead.
2215.65s - 2216.65s |  Okay?
2216.65s - 2218.65s |  There are a lot of people who will be like, oh, yeah, I'm old school.
2218.65s - 2220.65s |  I'm just going to use leaded solder because, you know, whatever.
2220.65s - 2222.65s |  It tastes salty when you eat it, but too bad.
2222.65s - 2225.65s |  Um, use unleaded, like, it's, it exists for a reason.
2225.65s - 2229.65s |  And especially if you're going to be handing this to people and kids and they're going to hang it around their neck.
2229.65s - 2230.65s |  And they'll show it to their kids when they get home.
2230.65s - 2231.65s |  And they'll put it in their mouth.
2231.65s - 2235.65s |  Like, you may want to put a bit on there just, you know, to make it like game cartridges.
2235.65s - 2237.65s |  But like, yeah, don't, don't use lead.
2237.65s - 2238.65s |  Uh, figure it out.
2238.65s - 2240.65s |  Uh, get the equipment and learn how.
2241.65s - 2248.65s |  I use, uh, SAC 305, uh, solder, which is 3% silver and 0.5% some lead, tin.
2248.65s - 2249.65s |  Uh, no, not lead.
2249.65s - 2250.65s |  Tin.
2250.65s - 2251.65s |  I don't know.
2251.65s - 2252.65s |  But just do it.
2252.65s - 2254.65s |  Get practice doing it if you're a soldering person.
2254.65s - 2261.65s |  Because, uh, it's the right thing to do for, um, people who would otherwise get injured by lead.
2261.65s - 2262.65s |  Anyway.
2262.65s - 2267.65s |  Uh, so let's look next, uh, and actually I'll skip over because it's a little more visual.
2267.65s - 2269.65s |  This is the, uh, the dock.
2269.65s - 2270.65s |  Right?
2270.65s - 2273.65s |  And so let me try and change it so you can see the dock better.
2273.65s - 2277.65s |  Has anybody ever used OpenSCAD before?
2277.65s - 2280.65s |  I love OpenSCAD because I'm like a console person.
2280.65s - 2284.65s |  And, uh, OpenSCAD is like CAD for console people.
2284.65s - 2285.65s |  There we go.
2285.65s - 2294.94s |  So here, uh, what do I do now?
2294.94s - 2295.94s |  Oh, there's a button down here.
2295.94s - 2297.94s |  Do-do-do-do-do-do.
2297.94s - 2299.94s |  No, that was the wrong button.
2299.94s - 2301.94s |  Uh, there we go.
2301.94s - 2307.94s |  So, uh, OpenSCAD lets you just basically draw boxes and spheres and all that stuff.
2307.94s - 2310.94s |  And what you can see here is I've got, oh, why is it doing this?
2310.94s - 2313.94s |  Um, I must have a sticky key or something.
2313.94s - 2314.94s |  So we'll look at it sideways.
2314.94s - 2315.94s |  Right?
2315.94s - 2317.94s |  I've got a groove for each of the badges to slot in there.
2317.94s - 2320.94s |  Um, what I also have is it's parametric.
2320.94s - 2323.94s |  So we can change the badge size right here without having to worry.
2323.94s - 2325.94s |  So if we change the PCB, it's pretty straightforward.
2325.94s - 2327.94s |  I like to put the USB spot-port in the middle.
2327.94s - 2328.94s |  It just makes it easy.
2328.94s - 2334.94s |  Um, and if we wanted to do, like, a two-column version of it, not 23, uh, we can go do that.
2334.94s - 2336.94s |  And bam, you've got two columns.
2336.94s - 2337.94s |  Right?
2337.94s - 2343.94s |  If we only wanted to do a double one, like, uh, we can do, uh, two columns and one row.
2343.94s - 2344.94s |  Yeah.
2344.94s - 2345.94s |  Bam.
2345.94s - 2346.94s |  Like, just a skinny one.
2346.94s - 2347.94s |  Make sense?
2347.94s - 2350.94s |  So, um, I've got that up here.
2350.94s - 2353.94s |  Um, so when I'm done talking, y'all can come up and take a peek at it.
2353.94s - 2355.94s |  And, uh, yeah, again, I got badges.
2355.94s - 2361.94s |  So if you stick out all the way to the end and you're interested in, like, contributing something or even just want to try these things out, uh, come on up.
2361.94s - 2362.94s |  I didn't bring batteries.
2362.94s - 2363.94s |  I'm sorry.
2363.94s - 2368.94s |  Um, and actually now I'm realizing that there's something in my slides I forgot to mention.
2368.94s - 2370.94s |  But I'll get back to that in a minute.
2370.94s - 2372.94s |  The last thing I want to talk about is code.
2372.94s - 2374.94s |  Um, it's all Python.
2374.94s - 2377.94s |  Does anybody, anybody who's used Python, you look at this, like, okay, we import stuff.
2377.94s - 2381.94s |  We, uh, I have a bunch of libraries that I use specifically for this game.
2381.94s - 2383.94s |  And then it's, it's, it's Python.
2383.94s - 2384.94s |  Right?
2384.94s - 2385.94s |  Python code.
2385.94s - 2387.94s |  And it actually works on hardware.
2387.94s - 2389.94s |  And it's pretty awesome.
2389.94s - 2393.94s |  The downsides of Python on embedded hardware is it sucks power.
2393.94s - 2395.94s |  It uses a lot of battery.
2395.94s - 2399.94s |  Um, which is why I used AA batteries.
2399.94s - 2403.94s |  Um, yeah, no, I'll go back to that later.
2403.94s - 2407.94s |  Um, I use AA batteries, um, because they're cheap.
2407.94s - 2411.94s |  Um, and because they have a battery holder that's inexpensive.
2411.94s - 2413.94s |  You can ship them.
2413.94s - 2414.94s |  You can transport them.
2414.94s - 2416.94s |  You can take them through TSA.
2416.94s - 2420.94s |  You don't have to worry about accidentally puncturing them and starting a fire.
2420.94s - 2425.94s |  Um, so unless you really know what you're doing, stay away from lithium batteries on badges.
2425.94s - 2428.94s |  Um, it's, it's, I mean, it's not as bad as lead on PCBs.
2428.94s - 2433.94s |  But I, I feel like, you know, we've got a badge here that was well done.
2433.94s - 2436.94s |  Where they actually made an enclosure and protected the battery.
2436.94s - 2441.94s |  Um, if you aren't enclosing your, your lipos, then be extra super careful.
2441.94s - 2443.94s |  Anyway, AA, uh, battery.
2443.94s - 2445.94s |  Actually, I started out with a double, uh, triple A.
2445.94s - 2449.94s |  I used a double A because it didn't, uh, last very long the first time I did it.
2449.94s - 2452.94s |  But then I've, uh, added some power save features.
2452.94s - 2455.94s |  Uh, somehow I should be able to look down here.
2455.94s - 2460.94s |  Um, right there, tiny, maybe you can see it, is, uh, some circuitry.
2460.94s - 2463.94s |  And what this does is it takes the 5 volts in over USB and boosts,
2463.94s - 2466.94s |  or sorry, uh, the 1.5 volts from the battery.
2466.94s - 2468.94s |  And boosts it up to 3.3.
2468.94s - 2472.94s |  Which means you can use that battery all the way down to, like, 0.8 volts before the thing cuts out.
2472.94s - 2474.94s |  So, use your whole battery.
2474.94s - 2476.94s |  Like, I used a lot of coin cells in the past.
2476.94s - 2479.94s |  Um, which is great if you have a very small thing.
2479.94s - 2481.94s |  If you're not running CircuitPython, 10 minutes, cool.
2481.94s - 2483.94s |  Uh, let me, like, wrap this up.
2483.94s - 2485.94s |  And we'll chat.
2485.94s - 2487.94s |  So, yeah, uh, it's Python code.
2487.94s - 2490.94s |  If you know Python, you can, you know, learn it pretty quickly.
2490.94s - 2493.94s |  Um, CircuitPython is made by Adafruit.
2493.94s - 2496.94s |  They're a hobbyist electronics company based out of, uh, New York.
2496.94s - 2500.94s |  Um, and they make reference boards, development boards, uh, all sorts of stuff.
2500.94s - 2503.94s |  So, if you want to prototype something, actually that's where we started.
2503.94s - 2505.94s |  We started with a bunch of Adafruit components.
2505.94s - 2507.94s |  Prototyped on, like, breadboards.
2507.94s - 2510.94s |  And ended up here with, uh, custom PCB.
2510.94s - 2515.94s |  So, and the last thing I'm gonna show you is, uh, uh, yeah.
2515.94s - 2517.94s |  So, let's skim through this.
2517.94s - 2519.94s |  This is basically the provisioning.
2519.94s - 2525.66s |  It's, uh, not LSD.
2525.66s - 2526.66s |  There we go.
2526.66s - 2527.66s |  So, this is the configuration.
2527.66s - 2531.66s |  We've got a check.sh, which actually checks when you've got a solution.
2531.66s - 2538.66s |  But the genfiles.py is what, uh, basically generates all the files for the game.
2538.66s - 2542.66s |  So, down below you can see we have, like, our, our strings.
2542.66s - 2543.66s |  Right, so our company options.
2543.66s - 2546.66s |  Terrell Corporation, Neodym Pulsion, Weyland-Yutani.
2546.66s - 2549.66s |  Our, um, the startup is Algify, iTech, whatever.
2549.66s - 2551.66s |  And the tool is, uh, something else.
2551.66s - 2557.66s |  And the string is, blank company has just announced an intent to acquire a startup to build the entry's most advanced AI-powered tool.
2557.66s - 2560.66s |  Right, and that's the, those, the solution is randomly chosen.
2560.66s - 2562.66s |  And, uh, comes out here.
2562.66s - 2566.66s |  The way it does that is, basically, it goes through the options, randomly chooses one.
2566.66s - 2569.66s |  Generates a bunch of files that go on the badges.
2569.66s - 2571.66s |  And then it signs the clues.
2571.66s - 2573.66s |  Right, and gives the public key out.
2573.66s - 2576.66s |  With RSA-512, because just enough to last you a day.
2576.66s - 2578.66s |  Right, without someone wasting a few grand.
2578.66s - 2584.66s |  Um, and, uh, that'll let you make sure that people don't mess with your game by giving out fake clues, which could screw everything up.
2584.66s - 2586.66s |  So, I'm gonna stop here.
2586.66s - 2589.66s |  Uh, I've said all the things I think I wanted to say.
2589.66s - 2591.66s |  If you got some questions, come on up here.
2591.66s - 2594.66s |  Um, and I can, like, continue to talk to those out loud.
2594.66s - 2596.66s |  But you can also come on up and grab some badges if you want.
2596.66s - 2598.66s |  So, yeah, go for it.
2598.66s - 2599.66s |  Thank you.
2599.66s - 2601.66s |  Thank you.


url: https://www.youtube.com/watch?v=GJgTkxL5txw
title: DEF CON 32 - Bypass 102 - Terry Luan & Karen Ng
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=GJgTkxL5txw",
  "title": "DEF CON 32 - Bypass 102 - Terry Luan & Karen Ng",
  "description": "There are loads of ways to get through a door without actually attacking the lock itself, including using the egress hardware, access control hardware, and countless other techniques to gain entry. Learn how to do these attacks in this talk!",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 814,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 0.76s | This text was transcribed using whisper model: large-v2

 All right.
0.76s - 3.32s |  So since we're experiencing technical difficulties,
3.32s - 5.92s |  I'm just going to start talking at you guys
5.92s - 7.24s |  about what we're talking about.
7.24s - 9.76s |  Could you open up my slides?
9.76s - 12.76s |  And yeah, and you guys are just going to have to deal with that.
12.76s - 14.80s |  Yeah, imagine I will be very descriptive.
14.80s - 18.56s |  But the first part of this is intro, and it's just talking.
18.56s - 20.52s |  So let's start with that.
20.52s - 22.20s |  So hello, everybody.
22.20s - 23.76s |  Welcome to Bypass 102.
23.76s - 26.20s |  In this talk, we're going to be covering basic bypass
26.20s - 27.24s |  remediation.
27.24s - 29.64s |  So a general prerequisite for this talk
29.68s - 31.96s |  is I'm hoping that you've seen Bypass 101.
31.96s - 34.28s |  If you haven't, I recommend you watch that later
34.28s - 36.72s |  when it is uploaded.
36.72s - 39.56s |  We were on the creator stage earlier for that talk.
39.56s - 41.88s |  Yeah, and then please keep all questions till the end
41.88s - 43.52s |  if we have time for questions.
43.52s - 47.56s |  So for those that aren't aware, what bypass is
47.56s - 50.44s |  is basically ignoring the lock and trying
50.44s - 52.76s |  to figure out a way to exploit the door
52.76s - 55.32s |  hardware or the surrounding area in order
55.32s - 59.16s |  to gain access into a locked out space.
59.16s - 62.34s |  Here, just let me do that.
62.34s - 65.62s |  So again, this covers basic remediation and retrofits
65.62s - 68.14s |  that'll help you secure your facility from these basic
68.14s - 70.10s |  bypass methods.
70.10s - 73.30s |  So similar to cybersecurity, physical security
73.30s - 76.02s |  vulnerabilities and remediation is basically
76.02s - 78.34s |  an ongoing forever game of cat and mouse.
78.34s - 80.18s |  Every time somebody finds a vulnerability,
80.18s - 81.86s |  someone else comes up with a patch.
81.86s - 84.44s |  And then for that patch, someone finds a new vulnerability,
84.44s - 86.06s |  and it repeats over and over again.
86.06s - 87.90s |  And that's the cycle of security.
87.90s - 91.18s |  Same thing applies for cyber.
91.18s - 93.30s |  So like I mentioned earlier, lock bypass
93.30s - 95.02s |  involves ignoring that lock completely
95.02s - 97.98s |  and finding an alternative way to get that door open
97.98s - 101.18s |  or avoid using the door altogether.
101.18s - 102.98s |  These bypass methods are very often
102.98s - 105.32s |  used in physical security and physical hacking,
105.32s - 106.98s |  and they are generally simple enough
106.98s - 111.72s |  to use by anyone with a little bit of know-how.
111.72s - 113.46s |  In case you guys don't have that know-how,
113.46s - 114.94s |  you can come over to our village and check us out,
114.94s - 116.44s |  and we will teach you that know-how,
116.48s - 118.56s |  and show you how easy it is.
118.56s - 120.92s |  Now I'm going to talk a little bit about latch-targeted
120.92s - 122.84s |  bypasses.
122.84s - 127.24s |  So this applies to all the, oh, looks
127.24s - 129.32s |  like we have the presentation coming up.
129.32s - 135.00s |  But you'll see in the slide what I mean.
135.00s - 138.84s |  So essentially, this is ways to remediate
138.84s - 144.36s |  the bypass, which is called targeting.
144.36s - 147.88s |  So targeting targets a latch that holds the door closed.
147.88s - 150.76s |  And essentially, by carting it, you're
150.76s - 154.68s |  essentially bypassing this dead latch, which prevents
154.68s - 157.24s |  the plunger from moving.
157.24s - 159.60s |  So the best way of bypassing this,
159.60s - 162.64s |  is to install, of remedying this,
162.64s - 173.05s |  is to install the doors properly.
173.05s - 175.33s |  So installing these dead latches,
175.33s - 178.89s |  and especially doors properly, is extremely difficult,
178.89s - 181.81s |  especially if your door is, for example, wooden
181.81s - 187.21s |  or just because they're in order for,
187.21s - 190.33s |  if you guys have watched the Bypass 101 talk,
190.33s - 193.05s |  you guys know that in order for the dead latch to work,
193.05s - 195.25s |  it has to be actuated when the door is closed.
195.25s - 198.45s |  Now the issue is that there are tolerances, right?
198.45s - 202.77s |  So for example, it needs to be installed exactly
202.77s - 208.85s |  the correct way so that, give me one second,
208.85s - 211.21s |  so that when the door is closed,
211.21s - 214.09s |  that the dead latch is actuated.
214.09s - 217.05s |  What that means is that also, if you push the door,
217.05s - 219.97s |  for example, it will still be actuated.
219.97s - 224.01s |  The door cannot warp, et cetera, et cetera.
224.01s - 255.12s |  So there are a couple of different ways.
255.12s - 258.92s |  OK, so we're trying our best to get the AV working.
258.92s - 262.00s |  But again, the DEF CON Wi-Fi is our best friend
262.00s - 263.76s |  in the whole wide world.
263.76s - 265.88s |  So Terry was about to talk about dead latches.
266.64s - 268.72s |  So I'll talk about that until we can figure out
268.72s - 269.76s |  how to get this to load.
269.76s - 272.96s |  Can you come back?
272.96s - 275.20s |  Yeah, so basically, go back.
275.20s - 283.85s |  Please go back.
283.85s - 285.17s |  Thanks, guys, for being patient.
285.17s - 288.29s |  So a dead latch is essentially a security mechanism
288.29s - 291.77s |  that is built into that door closing
291.77s - 294.89s |  hardware that allows you to stop people
294.89s - 296.49s |  from using this exploit.
296.49s - 298.77s |  So for those familiar with Bypass 101,
298.77s - 301.03s |  what we call latch slipping or latch shoving,
301.03s - 302.33s |  it seems a little bit too easy.
302.33s - 304.01s |  And it's because it is.
304.01s - 306.17s |  It has this security mechanism that prevents you
306.17s - 308.29s |  from being able to do this.
308.29s - 311.89s |  But a lot of the installers of doors and other things
311.89s - 314.13s |  in a facility doesn't really think about that.
314.13s - 315.97s |  They don't care about the security.
315.97s - 318.17s |  They don't know what these features do.
318.17s - 321.21s |  All in all, it means that people aren't
321.21s - 323.93s |  keeping that security mindset in place
323.93s - 325.81s |  while they're doing their installations.
325.81s - 328.29s |  And that leads to a lot of vulnerabilities.
328.29s - 331.59s |  So I'm sure you guys have seen the retrofits for this before.
331.59s - 333.57s |  If you've ever walked along a long hallway
333.61s - 338.57s |  and you've seen doors with a big metal plate over that latch,
338.57s - 340.61s |  usually what this is is a retrofit.
340.61s - 344.45s |  So they found that that dead latch isn't working properly.
344.45s - 345.93s |  And so instead of fixing the door,
345.93s - 348.01s |  instead of installing it properly,
348.01s - 350.25s |  they're just putting this panel over it and going,
350.25s - 351.25s |  OK, that's good enough.
351.25s - 352.93s |  Now they can't latch slip the door.
352.93s - 355.05s |  However, these can still be bypassed.
355.05s - 359.21s |  For example, with this little latch cover, what people can do
359.21s - 360.77s |  is take a little bit of piano wire,
360.77s - 362.45s |  stick it behind the latch, and open it
362.45s - 365.61s |  pretty much the exact same way without much more trouble.
365.61s - 366.73s |  Do we have it?
366.73s - 369.66s |  Yay!
369.66s - 376.24s |  So if you could full screen that.
376.24s - 382.96s |  How many hackers does it take to play a PowerPoint presentation?
382.96s - 384.76s |  Oh, OK, there we go.
384.76s - 388.22s |  Do we have the slideshow?
388.22s - 396.02s |  You're fine.
396.02s - 397.90s |  We're going to give this a second to load.
397.90s - 399.22s |  And hopefully this video loads.
399.22s - 405.42s |  That'll give us a little demo of how the dead latch works.
405.42s - 406.58s |  There it is.
406.58s - 409.02s |  OK, so like I was mentioning, so there's the latch.
409.02s - 410.58s |  And that little half moon shape there
410.58s - 411.98s |  is what's called the dead latch.
411.98s - 413.46s |  And when it's pushed into the door,
413.46s - 415.74s |  it actually prevents the latch from being
415.74s - 421.08s |  able to be pushed in, thus stopping that exploit.
421.08s - 424.04s |  So obviously, the easiest way to prevent people
424.04s - 427.32s |  from using this exploit is just to install your door properly
427.32s - 429.80s |  and make sure that the dead latch is actually being pushed
429.80s - 432.24s |  in when that door is closed.
432.24s - 433.88s |  I already talked about this retrofit,
433.88s - 435.72s |  so we're just going to skip over that.
435.72s - 437.60s |  And again, it can be bypassed.
437.60s - 439.72s |  In fact, usually on red team engagements,
439.72s - 441.52s |  I'm looking out for these kinds of covers,
441.52s - 447.46s |  because it means that that latch is vulnerable to an attack.
447.46s - 450.06s |  Next, I'm going to be talking about handle-targeted bypass.
450.06s - 453.06s |  So this usually mimics a person on the other side of the door
453.06s - 454.86s |  exiting from the other side and can
454.86s - 457.96s |  be used on lever handles and doorknobs and crash bars.
457.96s - 460.54s |  The easiest way to prevent this, I'm going to have to go fast.
460.54s - 461.46s |  I'm running out of time.
461.46s - 462.62s |  So the easiest way to prevent this
462.62s - 465.46s |  is to have a properly sized door that fits into the door frame
465.46s - 467.62s |  and doesn't leave gap enough for tools
467.62s - 470.18s |  to fit in, around, or under.
470.18s - 472.30s |  In addition to that, certain types of lever handles
472.30s - 476.70s |  will make it more difficult to use the under-the-door tool.
476.70s - 479.18s |  A retrofit like this can help reduce the amount of gap
479.18s - 480.94s |  underneath your door and make sure people
480.94s - 482.56s |  can't fit tools underneath.
482.56s - 484.18s |  You've probably seen things like this,
484.18s - 488.02s |  which isn't intended to better secure your facility
488.02s - 490.66s |  for weatherproofing, but it can make using those kinds of tools
490.66s - 492.54s |  more difficult. In addition to that,
492.54s - 495.34s |  windows next to your door or alongside your door
495.34s - 496.98s |  can make it easier to use these tools.
496.98s - 500.54s |  So cover them up or don't have them at all if not necessary.
500.54s - 502.58s |  Mag locks can also provide additional security,
502.58s - 507.05s |  but again, these can also be bypassed.
507.05s - 508.01s |  So you have deadbolts.
508.01s - 511.45s |  This is a deadbolt. They're different from dead latches
511.45s - 514.97s |  and have a thumb turn on the other side.
514.97s - 518.01s |  The best way of remediating this is
518.01s - 520.37s |  to have a double-sided deadbolt. Basically,
520.37s - 522.41s |  you don't have that thumb turn on the other side.
522.41s - 525.81s |  This prevents you from using JTools to bypass it.
525.81s - 528.37s |  If you don't know what JTool is, you can look in our village.
528.37s - 531.09s |  Yeah, and basically, the thing is, in exchange for security,
531.09s - 532.61s |  you are losing a bit of convenience,
532.61s - 534.05s |  but sometimes in certain facilities,
534.05s - 536.97s |  it is worth that exchange.
536.97s - 539.01s |  For push bars, the main thing is don't have holes
539.01s - 540.65s |  or gaps in your door if possible.
540.65s - 542.65s |  Use a push bar with dead latches
542.65s - 546.21s |  to prevent latch-targeted attacks.
546.21s - 548.73s |  There are also retrofits, which you'll see in a bit.
548.73s - 554.08s |  We also have a video.
554.08s - 556.32s |  We had a video. It's no longer there.
556.32s - 557.64s |  We were on a red team engagement.
557.64s - 561.48s |  Basically, someone was able to reach their hand around
561.48s - 563.44s |  and push on the push bar from the other side.
563.44s - 565.68s |  If you want to see it, you can come by after.
565.68s - 567.76s |  I'll show you the video on my phone.
567.76s - 569.52s |  Oh, yeah, you can see the retrofit here.
569.52s - 573.88s |  They can be bypassed, but it makes it a lot harder.
573.88s - 576.60s |  You can also use bar guards, again,
576.60s - 578.24s |  to further prevent bypasses.
578.24s - 580.24s |  Again, it is possible, but, yeah.
580.24s - 581.96s |  Okay, cool. Next is removing the hinges.
581.96s - 584.64s |  So, usually, you can take out those little hinge pins
584.64s - 586.60s |  and pull the door off of the frame.
586.60s - 588.08s |  There are special security hinges,
588.08s - 590.28s |  such as these ones called set-screw hinges
590.28s - 594.08s |  and stud-pit hinges that allow you to lock that door,
594.08s - 595.64s |  and even if the hinge pin is taken out,
595.64s - 598.56s |  you can't actually remove the door from the frame.
598.56s - 599.88s |  Button-push combination locks.
599.88s - 601.08s |  So, these are simplex locks.
601.08s - 602.88s |  They use the default combination from the factory,
602.88s - 605.00s |  two and four at the same time, and then the number three.
605.00s - 607.00s |  Change your default combinations.
607.00s - 608.24s |  Other combination locks, as well,
608.24s - 609.88s |  you can easily find these defaults online.
609.88s - 612.80s |  Change your combination!
612.80s - 614.72s |  Enter phones. Okay, so, I'm sure you've seen these before.
614.72s - 615.48s |  These are enter phones.
615.48s - 617.80s |  They're used to let people into apartments in high-rises.
617.80s - 619.48s |  You can call up using that enter phone,
619.48s - 621.12s |  and the resident can push a button on their phone
621.12s - 622.92s |  and allow you access.
622.92s - 625.36s |  There's a master code that comes from the factory
625.36s - 627.24s |  that allows the owner of the building
627.24s - 628.28s |  and the owner of the enter phone
628.28s - 630.28s |  to add entry codes and add residents.
630.28s - 631.84s |  You can find these online from manufacturers.
631.84s - 634.24s |  So, change your combination!
634.24s - 636.00s |  Further to that, these enter phones are key-to-like,
636.00s - 638.56s |  and with these keys, you're actually able to open
638.56s - 640.20s |  all enter phones by that same brand
640.20s - 642.24s |  and get at the electronics.
642.24s - 643.32s |  Guess how you can fix this?
643.32s - 644.44s |  You can change your lock.
644.44s - 646.96s |  Wow, they don't have to be the default.
646.96s - 647.80s |  There's also these.
647.80s - 649.92s |  These are security bars and enter phone covers,
649.92s - 651.24s |  and they can be used to prevent people
651.24s - 652.88s |  from being able to force it open,
652.88s - 655.00s |  or even if they have a key for the enter phone,
655.00s - 658.40s |  from opening it and getting at those circuitries inside.
658.40s - 660.44s |  You have requests to exit sensors.
660.44s - 662.12s |  They're set up so that you can unlock
662.12s - 665.40s |  when you're coming in from the inside of the building.
665.40s - 668.24s |  So, most of them rely on passive infrared.
668.24s - 670.12s |  If someone can trick the sensor
670.12s - 672.32s |  into thinking there's someone inside and exit the building,
672.32s - 673.44s |  they'll allow them access.
673.44s - 677.00s |  What you have is you have sensors
677.20s - 679.12s |  that use both PR and radar
679.12s - 680.88s |  to detect if someone is coming in.
680.88s - 683.20s |  There used to be a company called Interlogix,
683.20s - 685.16s |  which made a REC sensor.
685.16s - 686.12s |  They no longer exist.
686.12s - 688.48s |  There are other companies in the market,
688.48s - 692.00s |  but they're many thousands of dollars, but they do exist.
693.36s - 697.12s |  For remediation, REC sensors are generally more convenient.
697.12s - 698.28s |  They are less secure.
698.28s - 701.60s |  For more secure areas, there are these REC buttons
701.60s - 702.76s |  that you can use.
702.76s - 704.24s |  Make sure to put them away from the door
704.24s - 706.64s |  so people can't use any sort of wire
706.64s - 709.28s |  to push it from the outside.
709.28s - 711.40s |  As well as that, tap in, tap out, of course,
711.40s - 714.20s |  is the most secure way to let people in and out of spaces.
714.20s - 715.60s |  But again, you're trading that convenience
715.60s - 717.36s |  in for that security.
717.36s - 719.04s |  Elevators, so you see elevators.
719.04s - 719.88s |  Two minutes, okay.
719.88s - 721.56s |  We have elevators everywhere in modern buildings.
721.56s - 723.88s |  There's a lot of bypasses that you can get around them.
723.88s - 726.28s |  A lot of elevator locks can be changed out
726.28s - 728.00s |  and don't have to be the default.
728.00s - 729.72s |  This is not true for fire recall switches.
729.72s - 732.16s |  Do not touch your fire recall key switches.
732.16s - 733.76s |  But generally, the best way to prevent people
733.76s - 735.56s |  from hacking your elevator to get into a space
735.56s - 737.92s |  is don't rely on elevator floor lockouts for security.
737.92s - 740.04s |  It's way better to have a little hallway
740.04s - 742.44s |  and then have additional locked doors past that elevator
742.44s - 744.40s |  in order to prevent people from gaining access
744.40s - 745.64s |  when they're not supposed to.
745.64s - 748.00s |  Other remediation, so it's really important
748.00s - 751.12s |  to foster a proper security culture within your company.
751.12s - 752.68s |  Things like tailgating and other methods
752.68s - 754.56s |  of social engineering are often the easiest way
754.56s - 756.32s |  to get into a secure space.
756.32s - 757.74s |  Employees that disallow tailgating
757.74s - 759.40s |  or see people that they don't recognize and say,
759.40s - 760.24s |  hey, who are you?
760.24s - 761.06s |  Do you work here?
761.06s - 761.90s |  Can you prove it?
761.90s - 763.12s |  Can help stop bad actors.
763.12s - 765.52s |  In addition to that, alarms and sensors are very important.
765.52s - 767.28s |  So they can be used in combination with retrofits
767.28s - 768.96s |  to prevent bypasses and catch people
768.96s - 770.56s |  that are in the middle of using bypasses.
770.56s - 772.28s |  These are imperfect and can be bypassed,
772.28s - 773.88s |  but the main thing is without sensors,
773.88s - 775.12s |  without cameras, without detection,
775.12s - 778.08s |  anyone can get in with sufficient force and time.
778.08s - 779.00s |  Like I mentioned, cameras,
779.00s - 780.80s |  they are part of a complete security plan.
780.80s - 782.40s |  They can deter, enable response,
782.40s - 784.94s |  and minimize risk of insurance claims refusal.
784.94s - 786.44s |  Last of all, timing analysis.
786.44s - 789.12s |  So this is a service that I do work in.
789.12s - 791.24s |  And in combination with your alarms, sensors, cameras,
791.24s - 792.68s |  everything, and your response time
792.68s - 794.36s |  has to all be taken into consideration
794.36s - 796.80s |  in order to get to the bad actor
796.80s - 799.72s |  before they're able to do any harm to your company.
799.72s - 801.20s |  Okay, we've reached the end for the questions.
801.20s - 802.08s |  I'm so sorry, guys.
802.08s - 805.72s |  You're gonna have to play this video at like 0.5 speed.
805.72s - 807.10s |  If you guys have any questions,
807.10s - 809.12s |  you can come by The Village and come talk to me and Terry.
809.12s - 810.76s |  I'm very sorry for the technical difficulties,
810.76s - 812.08s |  but I hope you guys enjoyed it regardless.
812.08s - 812.92s |  Thank you!


url: https://www.youtube.com/watch?v=MrNmdtkH3YY
title: DEF CON 32 - From Easy Wins to Epic Challenges: Bounty Hunter Edition - Daniel Blaklis Le Gall
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=MrNmdtkH3YY",
  "title": "DEF CON 32 - From Easy Wins to Epic Challenges: Bounty Hunter Edition - Daniel Blaklis Le Gall",
  "description": "Step into the mind of a bug bounty hunter as I take you on a journey through my own adventures in vulnerability hunting. In this presentation, I\u2019ll share some of the most intriguing bugs I've discovered, from the shockingly/stupidly simple to the mind-bendingly complex.\n\nWe'll start with the surprising simplicity of some bugs, but as the hunt isn\u2019t always so simple, I\u2019ll also reveal some complex bug chains that required advanced knowledge, lot of work and probably some hacker's intuition to know it was worth pushing further.\n\nIf you want to know how a coffee break gave me the opportunity to get infinite money, or how a vulnerable CAPTCHA helped me to break the encryption of a sensitive application - you're in the right place!",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 3095,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 7.52s | This text was transcribed using whisper model: large-v2

 Good morning, everyone. Welcome to talk two in the creator stage four. Apologies to those who are
7.52s - 12.80s |  watching online. We still are having technical difficulties. And so, we only have the slides
13.44s - 17.44s |  on the screen. We are working on it. Hopefully we'll have it for the next talk.
19.52s - 26.48s |  But I would like to introduce Blackis on his talk from easy wins to epic challenges,
27.12s - 30.16s |  the bounty hunter edition. Everyone rolls.
38.02s - 46.10s |  Hey, everyone. So, I present you a bit of my journey in bug bounty. I tried to select
46.98s - 53.30s |  some bugs that were quite surprising. Surprising in the sense of being very easy
53.30s - 62.42s |  or being very difficult. So, I will present a couple of fun bugs. So, a bit about myself. So,
62.42s - 68.82s |  I'm doing bug bounty for seven years now. I did a lot of CTFSO for 15 years or something like that.
69.38s - 74.90s |  And in general, I'm hacking for 18 years now. So, that's quite a long time I'm doing that.
76.02s - 86.98s |  I'm definitely a web application enjoyer. I love PHP. And I love doing review. I'm definitely
86.98s - 92.58s |  not a recon guy. Not doing anything like reconnaissance or something like that. I'm just
92.58s - 101.30s |  going to main apps and break them. Most of the time at least. I really love like complex chain,
102.74s - 109.94s |  complex exploit or things like that. And yeah, in my bug bounty journey, I did something around
109.94s - 116.98s |  like 2 million dollars across all platforms. And I'm also an ambassador for France. So, yeah,
116.98s - 123.78s |  I'm French. That explains my pretty bad English. I'm sorry for that. If something isn't clear,
123.78s - 131.78s |  don't hesitate to come later and just ask me. So, we'll begin with first customer Swisscom.
131.94s - 139.94s |  Swisscom. So, I represent a couple of bug I found on them. Um, Swisscom, uh, is the biggest
139.94s - 145.62s |  provider in Switzerland. They are doing a lot of things. Not only telcos, they are active
145.62s - 153.70s |  pretty much everywhere. Uh, they decided to open a white card bug bounty program in uh, 2016.
153.70s - 161.30s |  That was my first bug bounty experience. I started like end of 2016 on them. And that's a
161.30s - 165.46s |  pretty good team to be honest. Uh, they're pretty fair. They're pretty kind. Good
165.46s - 172.34s |  communication with them. Uh, they have a very big scope like millions of IP addresses. So, it's
172.34s - 179.98s |  pretty cool. And I did something around like 500,000 dollars on them. So, yeah, that's quite
179.98s - 187.48s |  good. Um, definitely the bug bounty, uh, they decided to open, uh, definitely, definitely
187.48s - 195.48s |  improved their security, uh, their security stuff over time. And, yeah, the bugs I'm
195.48s - 203.48s |  presenting now are quite old. Uh, definitely they're like pretty much uh, other stuff now. But
203.48s - 209.92s |  still quite some cool bugs. So, if some people here are interested by uh, their bug bounty
209.92s - 216.44s |  programs, they're outside of any platform, you can just take a peek of the URL. Everything is
216.92s - 224.34s |  uh, explained there. So, let's talk about uh, first target which is Swisscom Cockpit. Uh,
224.34s - 228.84s |  that's a mobile phone manager in Swisscom. That's basically where you can see your
228.84s - 234.62s |  subscription, subscription and where you can just buy some packs for traveling and things
234.62s - 240.46s |  like that. Uh, there is lock in process on it that is quite particular. It's just you uh,
240.46s - 245.70s |  sending your phone number and you receive a SMS token. You need also to fill a capture and
245.70s - 252.66s |  you log in if the card is uh, valid rights. So, it definitely manage uh, some serious uh,
252.66s - 258.64s |  confidential data, a lot of PII payments, things like that. Uh, you can see everything that is
258.64s - 264.64s |  related to Swisscom subscription on there. So, definitely a good target for me. Also, uh, pretty
267.14s - 272.22s |  good stuff for us. There is a staging instance on the internet that is like publicly
272.24s - 277.88s |  available. I was cool as there might be some uh, stuff that is not published on the
277.88s - 282.88s |  production server and things like that. So, let's talk about the first bug. Uh, I saw that on
285.66s - 290.66s |  the staging instance. The SMS token is always 1111. Pretty good. Uh, the problem is the
293.70s - 300.34s |  staging login doesn't work. It uh, it always true, throw some uh, internal server error. So,
300.36s - 307.70s |  I can't log in with it. And I was like, yeah, maybe that's uh, the SMS central repository. It
307.70s - 313.48s |  might be like shared uh, with the production system. So, I just try to log in on the
313.48s - 318.48s |  production system. Then try to log in on the staging system. Then use 1111 on production
321.52s - 326.52s |  system and I was logged in. So, that was a very simple uh, bug but definitely a good impact.
330.36s - 335.36s |  So, let's see a demo. If everything is working well, we should be able to see. Yeah. So, I'm
337.64s - 342.64s |  just entering a phone number. Just trying to sign in. Doing the same on the staging instance
348.81s - 353.81s |  and uh, trying on the prod instance to just input 1111. Filling the captcha. Sign in and I'm
358.26s - 363.26s |  signed in. So, yeah. Pretty easy. Uh, that's not video of the internet. So, let's see a
365.54s - 371.84s |  real system. I will produce everything locally. I will share the demo, uh, the demos videoed
371.84s - 376.84s |  and the instances uh, a bit later after the talk. So, yeah. This was paid $8000 which is
379.62s - 385.48s |  pretty good because that was super easy. But that uh, uh, nice impact for them because I
385.48s - 392.50s |  have like PII of every customer there. Uh, maybe millions of uh, PII there. So, yeah, pretty
392.54s - 397.54s |  good. Uh, second bug. So, as I said, the login process is uh, pretty easy. You just input uh,
403.68s - 410.12s |  your phone number. You submit. Then uh, you receive uh, SMS codes that you need to submit
410.12s - 417.06s |  with uh, captcha. But the process is also setting you uh, three encrypted cookies. The first
417.06s - 423.10s |  one is a cockpit captcha text. Uh, it definitely by the name I guess, it definitely manages
423.10s - 429.64s |  captcha text. Uh, the cockpit MSISDN key that manage the phone numbers that you input at the
429.64s - 436.32s |  first step. And the cockpit SMS token key which I guess is a pin code that was received by
436.32s - 443.32s |  SMS. So, I was like, okay maybe they are using like the same tree, the same key for
443.36s - 448.36s |  encryption. So, I decided to like copy the cockpit SMS token key cookie into the cockpit
450.76s - 455.76s |  captcha text. Reload the page and the pin code is just leaked into the captcha. So, here it is.
458.84s - 465.34s |  That's not very clear because there is some uh, maybe uh, padding issue. But you can see
465.34s - 470.34s |  the, the code there that is 7998. So, that's once again an authentication bypass by
470.70s - 475.70s |  leaking uh, the SMS pin token into the captcha which is like pretty lame but pretty good for me.
481.12s - 486.12s |  So, let's do a small, if I can move that. Here it is. Out of the demo. So, just filling the
486.12s - 491.12s |  phone number again. Trying to see the cookies. Putting the SMS token key into the captcha
504.72s - 509.72s |  text uh, cookie. Just reloading. And we get uh, the pin code into the captcha which is uh,
510.72s - 515.72s |  RK, RRKB5T. That's a pin code I received by SMS. So, I'm once again logged in with that. So,
525.36s - 532.04s |  pretty cool but definitely uh, not as serious as the previous bug but because it was pretty
532.04s - 537.28s |  hard to see, to read the captcha. You can't really automate the attack. So, they decided to
537.30s - 542.30s |  pay 3,000 dollars for that. Once again, it was quite an easy bug. So, I can complain uh, on the
544.98s - 549.98s |  amount. So, I decided it might be the time to stop on cockpits. But no, here is uh, is uh,
552.56s - 557.56s |  self bug. Uh, try to log in. Input your phone number but at the time you receive the SMS pin
559.86s - 564.86s |  code, just cancel and authentication successful. I have no idea why. I, I don't know why
567.36s - 573.64s |  but I suppose they did something bad by patching uh, some of my bugs. Uh, yeah, probably a
573.64s - 579.42s |  fail. So, they decided to pay uh, 8,000 for that because I just cancelled the log in process
579.42s - 584.22s |  and I was logged in. Uh, I suppose you don't expect a demo for that. I mean, that's not
584.22s - 589.22s |  really needed I guess. So, for this time, let's really move on to another target. So, uh,
589.38s - 594.38s |  Swisscom WorkLink uh, is a Swisscom acquisition that was like a company that just bought. Uh,
599.72s - 604.72s |  decided to have a check. They were using uh, completely unknown CMS called weblication.
606.86s - 611.86s |  Something in PHP you know that trigger me always. Uh, so I decided to uh, buy a weblication
612.48s - 617.48s |  license. Uh, so I can grab the code and turn that into like some source code review. Uh,
625.00s - 632.00s |  firstly I saw that the thing is not using SQL at all. Uh, it's only some uh, XML databases
632.00s - 637.00s |  and some uh, file system storage which is quite not so usual. So, firstly I saw that uh,
637.36s - 642.36s |  they have a general pass traversal prevention mechanism and in general uh, they are trying
647.40s - 654.40s |  like to sanitize every uh, every variables that you can input. There is an easy bypass
654.40s - 660.40s |  because they are like uh, trying to remove uh, pass traversal characters and later in the
660.40s - 666.82s |  process they're trying to remove pipes. So, you can just like uh, use uh, dot pipe dot
667.64s - 672.54s |  pipe slash and it will be transformed to pipe uh, to dot dot slash. So, there is like an easy
672.54s - 678.58s |  bypass of the uh, mechanism to prevent pass traversal. So, I decided to have a look for some
678.58s - 685.22s |  pass traversal issues. Uh, I found pretty easily uh, vulnerabilities that allow me to delete
685.22s - 692.22s |  all the files uh, in a directory but uh, it wasn't uh, reachable but because it checked for
692.26s - 698.60s |  specific directory on the app that was never used anywhere so there is no way to create that
698.60s - 703.60s |  uh, directory. But I found uh, an arbitrary directory creation which is generally
707.68s - 713.84s |  something that is quite useless but for that case it was quite useful for me so I created the
713.84s - 718.86s |  directory that was needed uh, to reach the directory empty vulnerability. Uh, so cool. I can
719.20s - 724.20s |  delete files in directories uh, but come on that's not useful. I'm definitely not wanting to
728.34s - 733.34s |  deface a website that's definitely not the goal. So, uh, I did a I I other check and uh, in the
738.32s - 745.32s |  weblication slash grid uh, five directories there is a dot htaccess files that's the only file
745.52s - 752.52s |  there. But in the sub directories there is like all the databases uh, all the XML databases
752.52s - 757.54s |  there. Uh, the only uh, mechanism of protection there is a dot htaccess file so maybe we can
760.84s - 765.84s |  just remove the dot htaccess file so we can access the XML databases then. For some reason I
768.40s - 773.00s |  don't know why but I decided that to uh, name all the XML databases with uh, dot php
774.00s - 779.00s |  extension. That's quite a strange uh, decision but I found that uh, the logs uh, the login
784.38s - 790.38s |  logs uh, that uh, database is containing uh, the session token for all users there so I can
790.38s - 795.38s |  just win it. That's an authentication bypass that's a win. No, it works locally, it doesn't
796.28s - 801.28s |  work remotely. I have like uh, internal server error everywhere so I was quite in
803.82s - 808.82s |  despair, I was crying a bit. Um, so my guess was uh, my uh, so work link was using uh, php
813.90s - 818.90s |  short tags so uh, it clashed with uh, XML open tags so the the system was uh, thinking that
819.90s - 824.90s |  the XML file was some php, it broke because of some syntax error and so just through
830.20s - 835.20s |  internal server error so definitely didn't work. I decided to go and say search uh, other
837.78s - 842.78s |  vulnerabilities. I found a pre-auth sc there but it failed again for the exact same reason so
842.96s - 847.96s |  I cried a bit again. And I found something that was maybe interesting but quite lame, I
852.64s - 857.64s |  didn't see the impact at first. I found an XML injection in the log user database. Uh, so
859.84s - 864.84s |  pretty much the same, it's also uh, php extension uh, in the same directories. So uh, the the
865.84s - 870.84s |  injection is on the user name and that's like the database that contains uh, if a user name is
875.42s - 881.62s |  uh, blocked by the system. So if you're trying to log in uh, with a specific user name more
881.62s - 888.46s |  than 3 times and the login is failed, you're like injected in that uh, specific database. So
888.46s - 893.46s |  there is a XML injection there. Okay, not so useful, I can block up entire users maybe but
895.14s - 902.00s |  yeah, quite lame. So, I did have a check on how uh, the XML database are passed by the
902.00s - 907.02s |  application. Uh, I saw that uh, the developers uh, did that quite well. They decided to add
909.92s - 915.82s |  some layers of protection uh, trying to prevent xinclude by calling dumb document uh,
915.82s - 920.82s |  xinclude function with a false parameter. No luck for them, uh, thanks php. Uh, it enabled
921.58s - 926.58s |  xinclude instead. So, definitely not what they wanted. Uh, so for those that don't know
929.86s - 936.86s |  xinclude is a XML feature that allow to include other XML or even not XML documents into the
936.86s - 943.97s |  current one. So that's like, exactly like php include but for XML. So, trying to put uh, that
944.97s - 949.97s |  user name will definitely uh, add a xinclude directive that will load uh, the login logs
955.33s - 962.21s |  database into the uh, blocked users database. Uh, that's, that's a notation for xinclude
962.21s - 967.21s |  directive. Uh, that's a bit complicated but yeah, definitely the impact there is like we can
968.17s - 973.17s |  just include the entire uh, login logs database into the blocked user database. But, uh yeah,
977.91s - 983.35s |  xinclude is doing their best to like reformat all the file to be a fully valid XML. You can
983.35s - 990.05s |  break, you can't really break uh, the file by using xinclude which is quite good. It's doing
990.05s - 995.99s |  like automatic correction and things like that. But, but no, that's still useless. I mean
996.01s - 1001.01s |  yeah, I can include the database into another but that's quite useless. But, I try to see all
1003.81s - 1010.09s |  the log users feature is working and I found a blind xpass injection so in the user name is
1010.09s - 1015.09s |  you, if you can, if you inject uh, some xpass uh, notation you have uh, an injection there.
1018.07s - 1023.07s |  So, you can definitely extract the entire log, log database and I guess you see uh, what the
1023.23s - 1028.23s |  interest there. We can uh, inject uh, the content of other database uh, in, in the log
1032.37s - 1037.37s |  database and then we can like exfiltrate it. So, the log database uh, yes, I, I, I would
1040.57s - 1045.57s |  say that. But, uh, so we can choose a blind xpass injection, we can exfiltrate session token
1046.09s - 1051.09s |  byte by a byte per bytes. That gave me admin takeover on the application and that time in the
1056.57s - 1061.57s |  admin panel there is like feature to get RC. So, this time is a win. It works remotely. So,
1065.57s - 1071.81s |  the chain was log user with uh, xm injection in the user name with xinclude directive
1071.83s - 1076.83s |  pointing to the xml logs. Exfiltrate it with xpass injection, get admin session, get RC
1081.33s - 1093.34s |  and let, let's go for a demo. So, we can see there on the right that the blog database is
1093.34s - 1100.10s |  empty. Now, we try to log in with x uh, to see that just the blog database is now filled
1102.34s - 1107.34s |  with uh, one and three for the x uh, x uh, user. We now try to inject some xmlogs and
1109.18s - 1117.20s |  xml to see if there is a xm injection there. And yes, it is. There is now a foobar
1117.20s - 1122.20s |  attribute uh, in the, in the block uh, block uh, entry. So, that time we're using the
1125.00s - 1131.42s |  payloads that uh, we saw before with the xinclude directive trying to include uh, the
1131.42s - 1139.39s |  login logs uh, in the, in the blog database. So, yeah, I just saw that the login log
1139.39s - 1144.39s |  contains some uh, session stuff there. So, we make that user with the payload to be
1147.53s - 1155.42s |  blocked. We can see that to xinclude directive is now there in the file of the blocked uh,
1155.42s - 1161.62s |  database. We make uh, another user, another random user to be blocked so the file will be
1161.62s - 1168.24s |  parsed again and this time there is like the entire login log database in that blog
1168.24s - 1173.24s |  database. So, this time it was completely replaced uh, by the, by the original login logs
1175.74s - 1180.74s |  file. So, now we can try to use uh, the xpass injection. So, we are like targeting uh, a log
1182.92s - 1188.42s |  element, trying to infiltrate the session. We're checking, we're checking if it begins by
1188.42s - 1193.42s |  a L. We know it is because we can see that on the right screen. So, if it begins by a L, we
1194.42s - 1199.42s |  should receive that the account is blocked. But if we check uh, if it begin by a X, we
1203.92s - 1209.22s |  receive that no user is found. So, we have an oracle to leak uh, the characters one by one.
1209.22s - 1214.24s |  So, I write a little script and yeah, it definitely leaks the session token character by
1216.80s - 1221.80s |  character. So, yeah, we got it. We got an admin account to that and yet, uh, the
1223.94s - 1227.58s |  admin account is still there. So, we can use it remotely. For that, uh, Swisscom decided to
1227.58s - 1232.58s |  pay me $3,000. So, uh, $2,500 for the bug. Uh, $500 uh, for the um, for uh, bonus for the
1237.66s - 1242.66s |  nice shell and also the editor decided to uh, reward me for with uh, $2,000. They didn't
1246.46s - 1251.20s |  have a bug bounty but they were like impressed by the bug. So, pretty cool for them, for,
1251.22s - 1256.22s |  for them. So, now let's switch to yet another customer. Uh, another Swiss one. Uh, so
1260.10s - 1265.10s |  Swisspost. I'm not sure I need to explain what is Swisspost. Pretty standard, they are like
1267.34s - 1273.74s |  the postal office in Switzerland but they are also a private company uh, doing a lot of
1273.74s - 1280.28s |  different things and they are like involved in a lot of uh, major projects in Switzerland like
1280.30s - 1286.74s |  e-voting. Uh, they decide, they, they are also very active in cyber security. They like about a
1286.74s - 1293.48s |  lot of local uh, cyber security, security companies. So, so they are like very active in the
1293.48s - 1298.48s |  cyber security uh, stuff in Switzerland. They decided to start a bug bounty in 2019 uh,
1300.92s - 1305.92s |  especially for their e-voting platform. Uh, and they decided to add uh, assets uh, over time.
1306.64s - 1311.64s |  So, that's a super fair team, they're pretty good. Pretty much the same as Swisscom to be
1313.98s - 1318.98s |  honest. Uh, we can have a lot of uh, communication with them, they're pretty good. And yeah, if
1321.32s - 1325.76s |  some people are from the voting village uh, go on their bug bounty programs, they are paying
1325.76s - 1330.76s |  like uh, $230K for a very critical bug there. That's definitely a good program. I'm not a
1331.48s - 1336.48s |  crypto guy so I'm not going back. Maybe you are. So, if you want to have a check, uh,
1340.92s - 1345.92s |  everything is described on their VDP page. So, vdp.post.ch. So, uh, for, for the first bug
1351.80s - 1358.54s |  I will talk about their uh, payment system. So, they have like their own payment system uh,
1358.58s - 1364.56s |  completely custom. Uh, everything is quite common. You get some sign requests. Uh, there's a
1364.56s - 1370.46s |  lot of different endpoints for failure and success and uh, also you can stack money on your
1370.46s - 1375.50s |  account, on your postal account. You have a balance system so it's always interesting if we
1375.50s - 1380.50s |  can get like infinite money there. I will switch this back because we have some time issue.
1380.84s - 1385.84s |  Let's go on the second one. So, I did find a lot of uh, stuff there so I was uh, hacking on
1390.64s - 1397.28s |  them and I was trying to manipulate some payment session there. Uh, changing price in a
1397.28s - 1404.06s |  trans- transaction. Uh, a lot of things but uh, a delivery man rang the doorbell in my
1404.06s - 1410.14s |  office so I need to cut the package, sing everything. I decided that was the time for
1410.14s - 1415.14s |  coffee break and then after maybe 10, 15 minutes, I don't know, got back to my chair and I had
1418.58s - 1423.58s |  some money coming from nowhere on my account so I had no idea why. So, I decided to replay
1428.12s - 1434.30s |  everything I did. I was like probably I triggered something and I didn't even know. So, I
1434.32s - 1441.20s |  tried to replay everything. So, that failed. No idea what happened. So, I did to replay
1441.20s - 1447.84s |  everything including the coffee break. That was maybe the main point. So, I did a coffee break
1447.84s - 1452.84s |  with a colleague and there was my account was credited again. So, I was like okay, what the
1457.22s - 1463.76s |  fact? I did, I tested a lot of things and the real explanation is uh, when you run the
1464.48s - 1470.86s |  transaction, after the transaction is timed out. So, you didn't uh, make the payment uh, in
1470.86s - 1477.26s |  the good time frame. It just considered successful. So, probably a bad check of payment
1477.26s - 1482.26s |  states. It default to success instead of defaulting to uh, a failure. So, yeah. Let's go
1485.28s - 1492.46s |  for a demo. So, let's buy a very good croissant because I'm French. Ah, that's not a good
1492.84s - 1500.33s |  demo. That was a croissant, a bigger one. Let's go for it. Just wait. Just go grab a coffee
1505.31s - 1515.75s |  maybe. Are you patient enough? Oh yeah. Uh, joking it will just last. Yeah, success
1518.39s - 1526.54s |  payments just by waiting. I mean, pretty cool. Uh, pretty cool solution to get some money
1526.58s - 1533.58s |  right? So, I was paid uh, $3,000 for that. Uh, that's probably the most I get for like a
1533.58s - 1538.60s |  coffee break or two. Definitely was quite profitable right? So, let's go to another project
1542.60s - 1547.60s |  of them. Uh, they have like a sub-domain uh, using a very, very unknown uh, CMS. So,
1548.44s - 1553.44s |  paper shop that's like a Swiss page PCMS. They also do some manager thing and things like
1556.68s - 1561.68s |  that. I never heard of them. So, I decided once again to buy a license uh, of the CMS so I
1564.82s - 1569.82s |  get access to the code. Once again it's PHP so I'm super interested by that. And I just had a
1570.82s - 1575.82s |  look at the code. Everything was quite, you know, PHP. Uh, so I saw that uh, another main
1581.76s - 1586.76s |  feature uh, that is quite interesting is a restore backup thing. Uh, it's some like custom
1590.64s - 1595.64s |  things. They decided that the delimiter between SQL queries will be that stuff. No idea why.
1595.84s - 1600.84s |  Why don't use like semicolon like everyone do? I don't know. They decided it is. And they also
1605.24s - 1612.18s |  have uh, some features I never, I don't know why because I didn't see any occurrences where
1612.18s - 1617.18s |  they are using that but they do. So, if you use uh, the base64 start and the base64 end tags,
1618.14s - 1623.14s |  that will be replaced by a single coded string of uh, the base64 decoded string that is
1627.14s - 1632.16s |  between the tag. I don't know why. I, I, that's quite a strange feature to be honest. So, uh,
1635.68s - 1642.56s |  the restore backup, uh, the restore uh, feature is using uh, backup from a local file system.
1642.58s - 1648.68s |  Uh, that needs to be generated from the CMS backup feature. So, uh, you can't upload
1648.68s - 1653.70s |  anything or something like that. So, my goal was maybe I can inject SQL queries and backup from
1656.56s - 1661.56s |  the front end. Uh, the method is exploiting the very like strange passing to break SQL
1665.50s - 1670.50s |  contexts. So, my idea is uh, if I use like so specific uh, separate methods, uh, to
1672.58s - 1677.58s |  separate uh, uh, like tags in some data uh, that is stored in the database uh, so uh, that will
1680.12s - 1687.06s |  be stored in the database. Uh, maybe when they will backup and restore again, that will break
1687.06s - 1693.10s |  something if I get some data with those tags. Uh, maybe on my profile, on my, I don't know,
1693.10s - 1700.10s |  username, name, other comments or things like that. The first problem is uh, most fields are
1700.12s - 1705.12s |  sanitized by default. That's like a global sanitize, uh, sanitization that is done on every
1707.88s - 1712.90s |  field. Uh, so no, no new lines, no hash, no special characters in general. Uh, the second
1717.10s - 1722.10s |  problem is that if the restore fail on one SQL query, it's like ending the process and not
1722.98s - 1727.98s |  going further in the file. I mean, for the first problem, the solution is quite easy. Most uh,
1734.52s - 1739.86s |  field are sanitized but not all. They are like exception. One of them are like uh,
1739.86s - 1744.86s |  comments that are put on the other so I can definitely reach that field uh, on the front end.
1745.56s - 1750.56s |  And the second uh, problem, we have like a separator between queries and way to inject single
1754.88s - 1759.88s |  code. So that should be possible uh, to get like a valid file after injecting things. So let's
1764.58s - 1769.58s |  imagine uh, uh, a valid SQL query in the file formats. So we control fully the values of
1769.58s - 1774.58s |  Bemerkugin. I have no idea what it means but that's the name of the database of the uh,
1778.66s - 1785.42s |  table. I have no idea what it is. So we can control that fully and you can see the separator at
1785.42s - 1792.14s |  the end. So we're trying to use their base 64 feature to break from single codes. So we're
1792.14s - 1797.14s |  trying to get something like that. That will be transformed to that. So we inject the
1799.78s - 1804.78s |  single code, a parenthesis, a comment and that is working pretty well to be honest. So then my goal
1809.52s - 1814.52s |  is to inject new queries in the packet file. So this time I'm also adding uh, a separator and a
1818.46s - 1823.46s |  new uh, query with a comment at the end. So after being uh, uh, passed by the restart
1824.46s - 1829.46s |  procedure that will give that. And that's definitely valid. So I was able to uh, just
1833.66s - 1838.66s |  inject uh, an update to uh, an arbitrary table changing arbitrary column there. Pretty good.
1842.80s - 1847.80s |  Um, so the impact is I can run arbitrary queries on the restart process if they take a backup
1848.06s - 1853.06s |  and restart that will run my queries. Pretty good. But uh, the database is obviously that
1860.44s - 1865.44s |  PHP uh, storing some serialized uh, PHP objects because you know, relational databases is
1868.44s - 1873.44s |  done for that, storing full objects. So I found uh, pretty fastly a custom gadget uh, that
1873.80s - 1878.80s |  allow to delete local files. Once again, not the most interesting primitive for us because
1882.88s - 1889.88s |  that's definitely not a goal to delete uh, files on them. But I saw that uh, the admin
1889.88s - 1895.92s |  authentication mechanism is just uh, dot htaccess file so that just a basic authentication
1895.92s - 1900.92s |  system. So if we delete the dot htaccess file, uh, everyone can go to slash admin and uh,
1903.66s - 1909.10s |  admin, just that. There's no authentication besides that. So just like, you need either
1909.10s - 1915.68s |  valid credential or you need to pipe as a dot htaccess. The payload is too big for the screen,
1915.68s - 1922.53s |  I'm sorry. So let's get a demo for this one. Once again, super cross and sharp. So we put
1929.15s - 1938.31s |  the payload uh, in the other commands. You can see the payload there, it's pretty big. It
1938.33s - 1943.33s |  just uh, trying to update the other table and set uh, a big uh, serialized uh, object in the
1945.61s - 1950.61s |  data of the others. So now my user have uh, like another ways uh, or uh, or tags uh, or
1957.65s - 1962.65s |  by basic C for tags. So let's go to an administrator account, let's do a backup. Yeah,
1962.87s - 1971.77s |  that's a fail. Let's go to the backup, let's log in. So let's do a backup and now trying to
1979.92s - 1984.92s |  restore it. Not, not, before restoring it, we can see in the order that uh, we have like
1987.76s - 1993.40s |  old data that is injected uh, in the order. So now trying to restore, that's definitely not
1993.40s - 1998.40s |  the same data. We were able to update the order and add like a serialized object that they
2000.80s - 2006.84s |  have a pass traversal to the htaccess file. So let's go see the order that triggered uh, the
2006.84s - 2011.98s |  serialized objects and now we can go to the admin panel and there is no more authentication
2011.98s - 2016.98s |  on it. So yeah, that definitely deleted uh, the htaccess so everyone is admin which is uh, to
2021.12s - 2026.12s |  be honest a bit uh, frightening because like by exploiting that I gave everyone admin
2026.40s - 2031.40s |  access. Oops. So they pay me uh, six and, six hundred fifty dollars which is quite bad but uh,
2039.18s - 2045.58s |  the real uh, thing is that Swiss Post is not using the backup and restore feature because they
2045.58s - 2050.58s |  have too much data and the official backup feature there is just crashing because there is too
2050.76s - 2055.76s |  much data. You know like, problem of memory issues and things like that. So that's even
2058.66s - 2064.00s |  fair they decided to pay a bounty for that because they are like, no chance they are using
2064.00s - 2070.44s |  the backup and restore features. So yeah, still quite firm. Let's go on another customer, the
2073.18s - 2078.18s |  most known one, Redacted. Uh, I wasn't able to name them so let's consider that Redacted
2082.86s - 2087.86s |  uh, we just put a bit of context. Imagine a PHP CMS, once again PHP, widely used uh, with a
2093.26s - 2100.28s |  lot of complex code, complex features and a little blacklist criticizing the code at every
2100.28s - 2105.28s |  release, every time. So, first bag, there is a new CV there uh, that's a Prius SE to a SSTI
2105.98s - 2110.98s |  in the wild, like used by a straight actor. So the maintainers decided to make an emergency
2119.06s - 2124.06s |  patch. I decided to reverse it, obviously. Uh, so uh, there is like a double level of
2127.40s - 2132.40s |  templating uh, on the app and the patch from uh, the maintainers were just a break replace to
2135.44s - 2140.44s |  uh, remove uh, the tags just after a single evaluation of the templates. Uh, the problem is
2144.18s - 2150.94s |  maybe someone saw that? You saw that, I know. The regex is not matching new lines. Uh, that
2153.92s - 2160.82s |  means that you can just use the original payload but use a new line before the closing tags,
2160.82s - 2165.82s |  you're bypassing that regex and that's like a Prius SE again. That was paid a bounty for
2167.06s - 2172.06s |  uh, $10,000 because you know, Prius SE are always cool. And small bonus, my colleague uh,
2175.30s - 2180.30s |  also found another bypass, you just had to not close the tags. So, that was enough. Uh,
2182.58s - 2187.58s |  templates uh, will contain some tags, ending tags later. So, yeah, that's also bypass it.
2190.78s - 2195.78s |  So, and there's a second bag and I'm sorry this one will be quite complex. Uh, the
2197.66s - 2202.66s |  I will try my best to explain it uh, correctly but yeah, that's a complex one. So, I found a
2205.66s - 2210.66s |  bag uh, that is to be honest barely exportable but it's super fun technically. So, the worst
2215.38s - 2220.38s |  impact uh, to it was uh, Prius SE but uh, the precondition of it make it quite unlikely but
2221.26s - 2226.26s |  yeah, it's still a fun one. So, for the context uh, that application uh, was using
2231.34s - 2236.34s |  Laminas PHP library to for everything that is using like emails. Laminas is doing a lot of
2240.08s - 2245.94s |  checks and transformation to be sure that the email is valid and things like that. There's
2245.98s - 2252.16s |  like a lot of different label uh, libraries there. And on the application we're testing uh,
2252.16s - 2257.16s |  we have uh, control over a from header that will be uh, used for sending some emails. So,
2261.50s - 2266.50s |  that from header will be passed uh, over the fifth argument of mail for those who know uh,
2268.60s - 2275.08s |  mail function uh, of a fifth argument that is like arguments that will be passed to the
2275.12s - 2280.12s |  send mail uh, binary. So, if that fifth argument is uh, completely controlled by an attacker,
2282.50s - 2287.50s |  you can have like argument injection to the send mail binary. There are like known exploit to
2289.10s - 2294.10s |  that uh, but it definitely depends on the MTA that is used. So, uh, every MTA is shipped with
2297.84s - 2302.84s |  different send mail binaries. So, for this uh, talk, we will consider uh, send mail MTA
2305.48s - 2311.46s |  here. That's like a first priority condition. Why send mail? Because I'm cheating. That's my
2311.46s - 2316.46s |  bug. I decide whatever is the condition. So, that's what uh, I want to be. So, uh, the
2322.94s - 2327.94s |  problem is Laminas validating email address. We can't like put anything that is not a valid
2328.38s - 2333.38s |  email address. Uh, Laminas is supporting uh, cutted string uh, format. So, uh, double quotes
2337.12s - 2342.12s |  and pretty much anything. Uh, dot atom format that's like the standard uh, email format. Uh,
2343.96s - 2348.96s |  for that they are using super big regex. Uh, that was super hard to read. And yeah, the thing
2349.70s - 2354.70s |  is uh, they are also using uh, escape shell lag uh, on the email before being used on the uh,
2362.34s - 2367.34s |  mail function. But uh, PHP is automatically applies escape shell command to the entire
2370.74s - 2377.26s |  command uh, when calling mail uh, that will apply escape shell command to send mail. Uh,
2377.32s - 2382.32s |  double escape means uh, no escape at all. Means argument injection, thanks PHP. So, I
2386.64s - 2392.48s |  know the problem is uh, Laminas also application I don't know is uh, lower casing
2392.48s - 2397.48s |  email and every exploit for uh, send mail are generally using uh, the C and the X
2401.18s - 2406.18s |  uppercase arguments with very long pass. And the other problem is we are limited to
2408.96s - 2415.50s |  64 characters for the local path and definitely if you need like long pass uh, for two
2415.50s - 2420.50s |  arguments that's definitely not cool because we are like limited in size. Painful, I was like a
2422.88s - 2427.88s |  bit in despair I was pretty sure that won't be exploitable at all but yeah, I still decided to
2431.12s - 2436.12s |  make like both of testing. I was pretty much like that after a few years. But at some point
2439.46s - 2444.46s |  I saw that uh, there was like a stranger if my email contains uh, uh, right angle brackets.
2447.60s - 2454.30s |  So, if I put XSX uh, right angle bracket at black dot east I received by the app invalid
2454.30s - 2459.32s |  domain black dot east right bracket. I was like such, such strange that's definitely not
2459.32s - 2464.32s |  the domain I put in my mail. So, I decided to debug the behavior so Laminas uh, did uh, the
2464.98s - 2469.98s |  validation of the email. Laminas and the app uh, were crafting a full email with headers and
2473.82s - 2478.82s |  the body and put the email in the from uh, header. Then uh, Laminas passed the generated
2481.60s - 2486.60s |  email. Then the app is extracting the sender again from it. Validates that it's still a
2487.42s - 2492.42s |  valid email. So, painful process. So, I was like okay but that doesn't explain the error. So,
2498.14s - 2503.14s |  that's a traditional from header so it's just uh, double quotes your name, double quotes and in
2505.38s - 2510.38s |  brackets uh, the full email. But when I tried to inject XXX right brackets at black dot east
2511.00s - 2516.00s |  that was like the from that was generated. So, we have like an injection in the email
2518.74s - 2523.74s |  part but that's quite useless in my opinion. Uh, there was like no CRLF, there was like
2527.08s - 2532.08s |  protection and mechanism to prevent that. So, I was like okay that's definitely useless.
2533.76s - 2538.76s |  But I decided to like investigate because that's quite a dirty thing still. So, yeah.
2541.20s - 2546.20s |  I read uh, a lot of RFC, a lot of documentation and I saw there's like something called uh,
2549.14s - 2554.14s |  my man coded words. So, uh, that's described by the uh, the RFC 2047. That's for using
2558.22s - 2563.22s |  special characters in uh, email headers and body. That's a format so uh, it was seen uh,
2563.94s - 2568.94s |  integration point, cassettes, encoding and then you can use like uh, little characters using
2573.48s - 2578.48s |  their hexadecimal code uh, with uh, equal thing. So, in that case I'd like generate AAA.
2582.78s - 2587.78s |  So, all the characters that is used uh, in the MIME uncoded words notation are also valid
2588.66s - 2593.66s |  characters in an email address. At least uh, in the double uh, double code encoded
2596.60s - 2601.60s |  formats. So, I was like maybe I can inject MIME uncoded words in my uh, sender email.
2605.54s - 2610.54s |  So, uh, that will be put in the mail headers and when extracted back by Laminas, it will like
2610.88s - 2615.88s |  pass the MIME uncoded words and generate an email that will maybe contain uh, some uh,
2618.98s - 2623.98s |  parameter injection to send mail. So, uh, I needed uh, some spaces to like inject another
2628.16s - 2633.16s |  argument to send mail. Uh, but uh, equal 20 is forbidden by the specification of the RFC but I
2633.96s - 2638.96s |  found that uh, underscore is defined as a space by the RFC. So, we can uh, just input uh,
2643.40s - 2648.40s |  spaces by using an underscore. Don't ask me why, there's probably a reason for that. So, as we
2651.08s - 2656.08s |  saw uh, the send mail uh, send mail payload is always uh, needing to point to a local
2657.08s - 2662.08s |  configuration file. So, we need to have uh, a control of a malicious local file.
2665.92s - 2672.06s |  Fortunately for us, the CMS have uh, a NOS file upload so we can upload files there. The
2672.06s - 2677.46s |  problem is uh, the upload folder contains underscore but underscore are replaced by
2677.46s - 2682.46s |  spaces but we can replace uh, underscore by uh, equal five F characters. So, that's a
2683.28s - 2688.28s |  problem but not so much. The problem is uh, we need a lot of replacement character and the
2692.96s - 2699.20s |  size limitation is still 64 characters and the mime encoded words uh, increase the size of a
2699.20s - 2704.20s |  string by quite a lot. So, let's consider that uh, a web root is uh, slash app. That's
2704.28s - 2709.28s |  short, that's definitely what I need. So, I'm still uh, cheating again. So, uh, that's
2715.02s - 2721.60s |  another preconditions. The first one is you need send mail to be used and you need uh, a
2721.60s - 2726.60s |  short uh, web root. So, yeah, that's quite some strong precondition. So, I knew that send
2727.34s - 2732.34s |  mail payload are using uh, the C and the X uh, arguments. That's definitely too long for us.
2738.12s - 2743.12s |  So, I was like, okay, uh, the C arguments is uh, loading arbitrary config file. Maybe
2745.56s - 2750.86s |  that's enough to SE, maybe we don't need the uh, X arguments. So, I decided to focus on
2750.86s - 2757.60s |  that and see what is possible to uh, send mail config file. So, in the config file you have
2757.60s - 2763.10s |  like the path to the dead letter file. So, the dead letter is like where it, with, it will
2763.10s - 2768.12s |  log uh, like incidents in sending emails. So, maybe we can like uh, pat uh, a file that will
2771.92s - 2776.92s |  be in the web roots and have maybe a file write but we don't control anything in the mail. And
2777.32s - 2782.32s |  there is also uh, uh, bound second recipient in that config file that will be included in the
2786.66s - 2792.14s |  dead letter because that will like, you have an email that is failed but then it will try to
2792.14s - 2797.74s |  send to that second recipient and it will write that in the dead letter file. So, maybe we can
2797.74s - 2802.74s |  have arbitrary file writes or at least uh, partial arbitrary file write but that's PHP so if
2803.74s - 2808.74s |  I have just uh, a partial file write that would be enough to get a valid PHP file. So, I just
2815.02s - 2820.02s |  sent uh, a default send mail MTA config and uh, the two uh, option uh, to get arbitrary file
2823.82s - 2828.50s |  write and that's, that was sufficient. So, then I'm sending the mail to not existent at
2828.52s - 2835.24s |  localhost so it fails. So, that will bounce. So, that uh, the, the, the config that I was
2835.24s - 2841.97s |  using. So, I decided to have a look at the MyMainCoded world and trying to like reduce the
2844.43s - 2849.45s |  size of it. Uh, I was able to win some size like you can just empty the car set. There is no
2852.05s - 2857.05s |  need of uh, filling it. Uh, don't uh, we get, we need double cuts on the payload because uh,
2857.41s - 2862.41s |  the email need to be, need to be valid and you need to use a double cutted uh, format. Don't
2866.09s - 2872.13s |  ask me why but we need, we needed to end it with uh, two double cuts. I have no idea that's
2872.13s - 2878.79s |  magic. I didn't investigate it that. So, we can definitely use the uppercase later now
2878.79s - 2883.79s |  because we have the MyMainCoded worlds. Uh, so, 64 cars is still too short but uh, we
2887.17s - 2892.17s |  with the precondition of having a short web route and everything that just enter exactly uh,
2895.55s - 2900.55s |  the, the 64 characters. So, it uh, uppercase and the final payload was just that. Don't ask
2905.79s - 2910.79s |  me why is that some magic. Uh, definitely some magic payload. I have now a t-shirt but it's
2910.81s - 2915.81s |  my, in my hotel room with a payload printed on it. Uh, yeah, that's quite a universal
2918.71s - 2923.71s |  payload and it is to create RCE on that app in very specific conditions. So, yeah, that was
2926.35s - 2933.13s |  just uh, settings uh, file re-uploaded in the send mail command injecting a new uh, config
2933.13s - 2938.13s |  file for send mail. Get arbitrary write some PHP in the web app. Get RCE. Uh, yeah, that's
2940.83s - 2945.83s |  works only on send mail MTA. Web route being short so I cheated a bit. But, yeah, you need
2948.43s - 2953.11s |  some high end stuff to exploit that. So, definitely not uh, not really exported in the
2953.11s - 2958.11s |  right but still was quite fun technically. So, let's go for a demo. The last one. Once
2963.87s - 2973.86s |  again, the crossing shop. I'm just uploading uh, the send mail MTA default config file
2974.26s - 2979.26s |  with just like or do 2 config keys. Yeah, doing the upload manually. Sorry, it takes a bit of
2987.48s - 2999.61s |  time. So, yeah, you can see that I'm putting the dead letter in the slash app slash back
2999.61s - 3004.61s |  dot dot PHP with a double bounce address containing the payload. So, yeah, now the config
3007.53s - 3012.53s |  file is uploaded. We can just run the payload in the from uh, uh, uh, uh, uh, uh, uh,
3013.69s - 3018.69s |  in the from email. That's exactly the payload from the, the slides. We're sending that to uh, a
3022.13s - 3027.23s |  local host address that doesn't exist so that should draw, draw an error. We see that the page
3027.23s - 3032.25s |  is completed bank because that's generated an error. So, now we can go to uh, the slash back
3034.41s - 3039.41s |  dot dot PHP. We can see the dead letter there and I did add some back dot there and we get
3040.33s - 3045.33s |  arbitrary PHP uh, execution. So, definitely quite cool. So, that was paid 5,000 uh, dollars
3053.71s - 3058.71s |  despite the fact that this was uh, hardly exploitable. Uh, made me cry a bit. I spent a lot
3061.89s - 3066.89s |  of time on it. So, I hope your brain fried exactly uh, like me. And that's my end word.
3069.79s - 3074.17s |  So, uh, thanks for having listened to the end. I hope you had fun. I hope you learned some
3074.17s - 3079.17s |  things and also I will maybe soon open a blog uh, a blog with a lot of my bugs. There's like
3082.71s - 3087.71s |  hundred of them. So, yeah, follow me on Twitter if you want some news and thank you.


url: https://www.youtube.com/watch?v=JL7a_oLoXHY
title: DEF CON 32 - Exploiting Bluetooth from your car to the bank account - Vladyslav Zubkov, Martin Str
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=JL7a_oLoXHY",
  "title": "DEF CON 32 - Exploiting Bluetooth from your car to the bank account  - Vladyslav Zubkov, Martin Str",
  "description": "Over the past decade, infotainment systems experienced a growth in functionality, broader adoption and central incorporation into the vehicle architecture. Due to the ever-growing role of wireless protocols such as Bluetooth and a known lack of patches alongside the difficulty of patch installation, this poses a new attack surface and a genuine threat to the users. At the same time, the tools and methodologies required for testing are scattered across the Internet, absent and need a rigorous setup.\n\nIn this talk, we share a comprehensive framework BlueToolkit to test and replay Bluetooth Classic vulnerabilities. We provide practical information and tips. Additionally, we release new exploits and a privilege escalation attack vector.\n\nWe show how we used the toolkit to find 64 new vulnerabilities in 22 modern cars and the Garmin Flight Stream flight management system used in several aircraft types.\n\nOur work equips Bluetooth hackers with necessary information on novel implementation-specific vulnerabilities that could be used to steal information from target cars, establish MitM position or escalate privileges to hijack victims\u2019 accounts stealthily.\n\nWe believe our research will be beneficial in finding new vulnerabilities and making Bluetooth research more accessible and reproducible.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 2899,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.40s - 5.52s | This text was transcribed using whisper model: large-v2

 All right. Yeah, the problem of the end of the day apparently the good stuff is empty
7.12s - 9.12s |  But it's all right
9.80s - 14.48s |  Hello, welcome to our talk exploiting Bluetooth from your card to the bank account
15.64s - 22.22s |  To get this out of the way first the main speaker sadly cannot be here tonight. He didn't receive a visa in time
22.72s - 28.32s |  We still don't have to do without him, but the second part of the video with all the technical details
29.32s - 31.58s |  Of the talk will be given by a video
32.00s - 35.04s |  So if you have questions at the end afterwards
35.04s - 39.28s |  I'll do my best to answer an online or offline or connect you with blood
39.92s - 43.20s |  Who's the main wizard behind this talk really?
46.36s - 55.89s |  To prove this I'll let the flood introduce himself and I hope this works
55.89s - 86.53s |  Do we have sound do we have any sound otherwise I can introduce him but
137.12s - 271.20s |  See you recording, my name is Vladislav, but some of you might know me as wise and sweets
271.20s - 276.52s |  I'm a bug bounty hunter and primarily focus on web mobile and infrastructure when it comes to pen testing
276.52s - 282.32s |  I also focus on quarter views and development of the tools and frameworks. I'm currently open to the new opportunities
282.32s - 284.80s |  So feel free to reach out. I also have additional
285.68s - 291.88s |  certifications awards and masters, but the most important fact is that I have never attacked booties or cars before and
292.40s - 297.24s |  I apply some of the book bounty hunting techniques to it and got some interesting results for you
297.72s - 305.83s |  All right. Yeah, sorry for this. Apparently this was the first talk today with audio
306.39s - 311.08s |  So let's move on
312.24s - 314.60s |  After blood introduced himself, who am I?
315.08s - 321.24s |  My name is Martin. I'm a security researcher and a scientist at Swiss cyber defense campus, which is the
322.04s - 324.52s |  procurement agency of the Swiss military
325.12s - 327.12s |  Have a background in wireless security
327.44s - 333.36s |  Been publishing and all the major academic system security conference and I've been leading
333.92s - 340.12s |  Research efforts not just on cars, but on all of all sorts of transportation security
341.00s - 347.80s |  At our campus that includes aviation, so I've just done a talk at the aerospace village
348.72s - 352.88s |  So you can always check that out, but also space cars and trains. I
353.60s - 356.08s |  Have never looked at Bluetooth before this work
356.60s - 362.64s |  But we've done work on cars so you can also check out broken wire that fail where we've hacked
363.24s - 365.24s |  electric charging processes
365.56s - 369.45s |  so let me first introduce you to the
370.33s - 371.89s |  Motivation for this research
371.89s - 379.01s |  One of our main jobs at the campus is to support procurement for the Swiss military and for the federal government
379.13s - 385.01s |  So we want to really make sure that the government and the military buy secure systems
385.65s - 392.57s |  As you can imagine the DoD buys quite a lot of IT systems, but also other systems such as cars
393.57s - 399.49s |  If you buy that in high volume you have quite decent negotiation leverage with manufacturers
400.17s - 405.25s |  In general public procurement if you don't know it's done with tenders. You can basically
405.89s - 409.93s |  Broadly divide it into a pretender stage then the actual tender
410.57s - 418.53s |  Contract and the time after actually having procured the systems and even received and deployed the systems
419.49s - 424.69s |  Doing simple pen testing after you have bought these things
425.21s - 427.17s |  That's often too late for us
427.17s - 434.41s |  The leverage you have in negotiations. It's partly gone and the systems. They're already in operation
434.41s - 440.09s |  I mean at that point you run insecure systems, so that's not ideal
440.65s - 444.49s |  Something else we do is we do a lot of research on standards
445.81s - 447.81s |  that works
447.97s - 454.61s |  If you look at aviation for example you find a lot of flaws and in principle you can
455.61s - 461.49s |  Try to change that in the long run the problem is most of these areas have very long life cycles
461.53s - 466.77s |  So even if you find and demonstrate major flaws and protocols and technologies being used there
467.29s - 473.73s |  It will take decades until that is being changed in practice so again not too helpful
474.57s - 476.57s |  for our case here
476.93s - 482.77s |  So what do we want to concretely do here to to support our procurement
484.45s - 488.65s |  We want to do concrete vulnerability research as early as possible
489.41s - 493.25s |  We want to really help shape the security requirements doing
493.89s - 498.81s |  Doing the process and in the final tenders to do that we work with the manufacturers
498.81s - 504.37s |  But we also use support from academia in Switzerland and outside to bring everyone together
504.77s - 511.57s |  To make the systems more secure and not just do this for us, but for everyone so concretely if we do research
511.57s - 516.17s |  We follow a responsible disclosure process where the manufacturers if you find anything
516.97s - 521.01s |  We publish at conferences also come to hacker cons now
521.45s - 525.41s |  And we also release our code wherever possible just as in this case
527.46s - 533.14s |  that brings me then to today's concrete case study vehicles and the army and Bluetooth as
534.14s - 541.54s |  Alluded earlier the DoD buys a lot of vehicles not just these that you can see here probably the ones you think of first
543.94s - 550.10s |  Luckily these don't have Bluetooth or at least I think I mean I haven't checked all of them
550.10s - 555.42s |  You don't really know that might exist these days as well, but in general they don't
557.14s - 559.14s |  But honestly
559.30s - 565.94s |  Boringly by far the most vehicles being procured by our DoD are box standard
566.14s - 568.38s |  run-of-the-mill civilian cars and
568.90s - 576.62s |  They all have Bluetooth you basically cannot buy a car without it even if you want it so even we can't get that without
578.14s - 581.30s |  That brings me of the scope of this research now
582.30s - 589.38s |  Bluetooth of course is not the only interface you find in the car cars are super complex systems
590.58s - 592.58s |  when doing accounts
593.58s - 597.34s |  We found at least 19 interfaces in modern cars
597.86s - 604.62s |  From wired or we deport to the key fob if there's an issue with any of these interfaces we use systems
605.26s - 610.78s |  The only way and the only way traditionally for a manufacturer to do anything and to deal with it
611.30s - 615.38s |  In that car and that model is to do a recall and recalls
616.10s - 619.26s |  typically for safety problems, they're expensive and
620.26s - 626.46s |  Rarely done really just for very important safety problem for security
627.34s - 628.82s |  reasons
628.82s - 630.82s |  This rarely happens to be honest
631.50s - 635.50s |  So that leaves us with a very complex attack surface
636.26s - 644.34s |  Much of which actually has been discussed at Defqon also at the car hacking village. They specialize in that of course, but
645.42s - 652.30s |  Just an illustration here. Don't have to check all of this, but it's a very big complex surf cars
652.62s - 654.62s |  Attack surface you have in modern cars
656.46s - 659.94s |  So why are we looking now specifically at Bluetooth? Well?
660.86s - 662.54s |  most importantly
662.54s - 664.54s |  nobody had done it yet, so
664.94s - 668.46s |  There's a lot of Bluetooth research of course, but nobody has really checked
669.34s - 676.58s |  on a large scale all the exploits that exist in Bluetooth with a reasonable amount of cars
677.18s - 680.86s |  So that sort of Bluetooth security cars hasn't been addressed
681.62s - 685.94s |  That felt to us like an oversight not not just from the procurement perspective
685.94s - 693.66s |  But over 1 billion cars have Bluetooth and as mentioned you can't do anything about that if you buy a new car
694.02s - 699.38s |  that overall makes the research very impactful not just for us, but really for anyone with a car and
700.86s - 702.86s |  We're very happy also with the outcomes
703.66s - 705.66s |  That we had from this research
705.74s - 710.54s |  which was led by by Vlad who will now present the technical details and
711.46s - 716.82s |  I will come back afterwards for any questions or any information
729.32s - 733.60s |  Bluetooth is a short-range wireless communication standard and it is not a specific protocol
733.60s - 739.84s |  But multiple different protocols that work on top of each other and that are maintained by different entities. Due to this complexity
739.84s - 746.16s |  There are different errors and misunderstandings that arise and these are the primary source of the vulnerabilities that we keep finding
746.28s - 751.44s |  We're only going to talk about the Bluetooth classic here. We are not going to talk about the Bluetooth technology at all
751.60s - 757.76s |  So what you have to remember about the Bluetooth is that it is a transport plus additional functionality on top of it
757.76s - 761.44s |  And when I refer to the functionality I refer to the Bluetooth profiles
761.64s - 768.36s |  That allow you to make calls, stream audio, share context messages and even have the whole internet stack on top of the Bluetooth
768.72s - 773.52s |  So Bluetooth is rich in the functionality and we have to secure it and for that we have pairing
773.68s - 779.32s |  When it comes to pairing it depends on the capabilities of the device and the security options
779.44s - 785.28s |  So when it comes to the capabilities themselves, they depend on the input and output capabilities of the device
785.40s - 789.28s |  So if the device has both of them, then we call such device display
789.28s - 789.68s |  Yes, no
789.68s - 795.52s |  If the device has only output capabilities, then we call such device display only. When it comes to the
795.92s - 797.92s |  devices that only has input capabilities
797.92s - 803.84s |  We call such devices keyword-only devices and when the device doesn't have any of the capabilities
803.92s - 807.72s |  So we call such devices no-input, no-output capability device
808.28s - 813.36s |  We can also summarize the security model of the Bluetooth as everything or nothing as pass-pairing
813.48s - 815.48s |  We can access almost all
815.80s - 821.48s |  Functionality that is available to us on the target device without any further authorization in most of the cases
822.08s - 828.32s |  That's why we have to be sure and confident in the pairing process and for that we have different pairing modes
828.72s - 832.04s |  So when the one of the devices doesn't have doesn't support
832.72s - 834.72s |  security options then
834.76s - 840.08s |  for example, it doesn't have simple security pairing or and secure connections then
841.08s - 843.12s |  Legacy pairing is used and from its name
843.12s - 847.60s |  You can ensure that it's legacy and ideally shouldn't be used at all. To give you some reasons
847.60s - 850.36s |  it's vulnerable to the non-pairing text attacks and also
851.32s - 853.32s |  the
853.76s - 859.32s |  The link, the security of the link depends on the four-digit pin which you can easily boot for us
859.64s - 862.68s |  So then when it comes to devices that
863.36s - 869.52s |  Doesn't have input capabilities. If one of the devices doesn't have input capabilities, then just work-pairing mode is used
870.28s - 876.44s |  and for this pairing mode, there are no guarantees that you're actually pairing with the device that you want to pair with and
877.28s - 883.40s |  That's why it is intrinsically vulnerable to the middle attacks. When it comes to the pass-key entry
883.40s - 889.56s |  It was recently discovered that it's vulnerable to the message confusion when the middle attack which is not
890.08s - 892.08s |  Remediated yet in the latest
892.32s - 895.12s |  Bluetooth version might be there for a few years at least
895.80s - 898.56s |  So it leaves us with only one pairing mode
898.56s - 904.80s |  Which is actually secure and this is an American version. It is executed only for the devices that have this way
904.80s - 908.60s |  There's no capabilities and they both want to pair with each other
909.60s - 916.88s |  then when it comes to when we are pass-pairing most of the firmwares or all of the firmwares do not differentiate between the
917.16s - 921.72s |  pairing modes used so whether or not you use the secure pairing mode or not and
922.76s - 924.44s |  that means that
924.44s - 928.60s |  Legacy pairing is the same as an American version at least in the eyes of the firmware
929.16s - 934.88s |  So Bluetooth has been there for more than 23 years and we have found that there are more than 108 different attacks
934.96s - 938.44s |  from the Bluetooth standards themselves as of March 2024
938.72s - 945.48s |  also, SANS provided statistics that there are approximately 650 different CVEs related to the Bluetooth devices as of
945.84s - 950.60s |  2022 and even more right now. So for the presentation
950.64s - 956.08s |  We are going to differentiate between four different categories of the exploits
956.12s - 962.88s |  So when I refer to the critical exploits, I refer to the remote code execution, memory leakage, information leakage, but
963.48s - 964.64s |  then
964.64s - 968.88s |  In the middle, the nano-source categories are actually self-explanatory while
970.72s - 972.72s |  while the chaining category
973.44s - 974.84s |  describes
974.84s - 979.48s |  not specifically vulnerabilities or exploits, but rather weaknesses that
980.28s - 982.28s |  one can use to
983.32s - 987.00s |  to make the attacks possible or they actually allow
988.00s - 991.08s |  or make some of the attacks to be executed easily
991.80s - 993.80s |  We actually tried
993.88s - 995.88s |  even though there are
996.12s - 998.84s |  sorry, even though these have been there for
999.64s - 1001.64s |  22 years and been subject to the
1002.04s - 1005.76s |  extensive security research, there are still charges involved into testing it
1005.92s - 1011.04s |  So it's like the common database of Bluetooth vulnerabilities, it's like the framework for testing it and
1012.84s - 1019.68s |  In general the attacks are being shared, but the proof-of-concepts are not and if they are shared, they are generally shared on the
1020.56s - 1022.56s |  sites that are not
1022.56s - 1024.36s |  quite well indexed
1024.36s - 1029.12s |  So it's quite challenging to find such proof-of-concept and if you find the proof-of-concept
1029.12s - 1032.40s |  there is also, there is a high chance that the
1032.96s - 1039.04s |  proof-of-concept will be based on the old hardware that you can't buy anymore and this also applies to the recently
1039.68s - 1041.60s |  recently publicized
1041.60s - 1046.24s |  exploits, for example, it's hard-to-mainstream. When it comes to testing, there are intrinsic
1046.80s - 1052.56s |  false positives and false negatives when you test in the black box fashion for the nano-source based attacks
1053.36s - 1055.36s |  and then it's a bit tricky to
1056.88s - 1061.84s |  It's a bit tricky to automate the nano-source attacks in some cases, especially for some of the devices
1062.40s - 1064.40s |  because
1064.40s - 1066.88s |  the nano-source attacks are quite powerful in these
1067.44s - 1069.20s |  cases and
1069.20s - 1071.20s |  it requires rebooting the device
1071.76s - 1073.76s |  but it's quite difficult to do, for example
1075.44s - 1082.00s |  In case of the cars, in some cases it requires to wait for 10, 20 or 30 minutes. So it's a bit tricky
1083.04s - 1087.52s |  we try to solve some of these problems and that's why we come up and
1088.48s - 1094.64s |  open-source the framework for vulnerability testing framework for Blizzard Classic. I can access and redevelop 44 different exploits
1095.12s - 1096.88s |  also, the main goal is
1096.88s - 1098.88s |  reproducibility of the
1099.20s - 1105.12s |  past and future research. There is also a balance between automation, semi-automation and manual tests. So
1106.08s - 1108.64s |  even though the attacker side is automated, the
1110.08s - 1112.56s |  victim side is not, it's infeasible to do so
1112.64s - 1117.28s |  So you still have to do some of the manual actions, for example on the infotainment screen
1117.76s - 1120.96s |  I also evaluated half of the exploits on the non-vulnerable devices
1121.28s - 1128.88s |  while for the other half I ensured that the exploits write to some of the payloads, but as there were no vulnerable devices for them
1129.84s - 1137.12s |  we used them as is, but still these exploits found the real vulnerabilities in the cars, so
1138.40s - 1140.40s |  I'm quite confident in them
1140.56s - 1143.04s |  The talk itself works pretty straightforward, the
1143.92s - 1146.72s |  test executes the command, then the engine loads the
1147.26s - 1148.48s |  predefined
1148.48s - 1156.24s |  exploit profile, then checks for the variability and availability of the target device without requiring any interactions from the tester, then executes the
1156.54s - 1162.00s |  exploit and after that, depending on the exploit type, it either compares the value
1162.56s - 1167.68s |  or it checks the variability and availability of the target device once again. After that
1168.24s - 1170.24s |  the toolkit reports back to the tester
1170.96s - 1172.96s |  So I used this
1172.96s - 1178.24s |  toolkit to attack different cars and decided it was pretty minimalistic, a computer-based laptop, or
1178.64s - 1181.20s |  we could have used the virtual machine, USB cables,
1182.80s - 1185.68s |  development board and Nexus 5 phone for
1186.72s - 1193.36s |  denial-of-service attacks and internal war attacks, then I spent approximately one to three hours per car
1193.68s - 1197.68s |  There's different issues arose and for some of the cars, especially the
1198.72s - 1200.72s |  internal combustion cars, you have to
1202.16s - 1206.72s |  test them outside as they require the engine to be started to access the infotainment system
1207.20s - 1209.44s |  and because of that you have to test them outside
1210.64s - 1215.60s |  If you can connect to the infotainment system and observe the logs, please do that as it would help to
1216.16s - 1219.70s |  remediate some of the false positives and false negatives
1220.58s - 1226.52s |  So all of the cars were provided by SAP Defense Campus Army Logistics and some were provided by friends and acquaintances
1227.14s - 1229.38s |  In total we had 22 cars, only
1230.50s - 1236.58s |  four were partially tested. You might think that the sample size is quite small, but it is the biggest out there
1237.54s - 1238.58s |  and
1238.58s - 1241.06s |  we tried to focus on different categories of the cars
1242.50s - 1243.92s |  of the cars
1243.92s - 1250.40s |  monetary-wise and also focusing on the top manufacturers, so that we would have a notion
1250.80s - 1255.12s |  of the state-of-the-art blitzer security in the automotive industry
1255.84s - 1262.08s |  And finally, all the blitzer tests are non-invasive, so we didn't have any problems with the
1262.64s - 1264.64s |  cars afterwards
1264.72s - 1270.90s |  I spent approximately 40 hours throughout a few weeks and found 73 different vulnerabilities
1271.62s - 1276.26s |  Some issues were not reportable because they are inherent issues and
1277.22s - 1279.88s |  that's why I was able to report only 64 vulnerabilities
1280.74s - 1288.10s |  All the vulnerabilities that were reported were reported responsibly and all manufacturers and vendors had time to fix them
1288.58s - 1291.38s |  But you already guessed that not all of them did that
1291.94s - 1297.30s |  But we still are releasing as there have been more time. They had a lot of time to do so
1298.10s - 1300.10s |  so
1300.10s - 1307.46s |  Generally, the first thing that I wanted to share is that the cars are generally lagging in adoption of the newest blitzer standards
1307.70s - 1311.86s |  so for example, you wanted to buy a 2023 car, you would expect that the
1312.50s - 1319.08s |  Hardware used in it would be rather recent. But in fact, what you get is the blitzer's version from 2014
1319.62s - 1321.94s |  And the difference is nine years in this case
1322.42s - 1326.10s |  And on average it's seven years and mean is also seven years
1326.74s - 1332.66s |  So in the time frame of nine years, there have been a lot of research done into the business
1333.06s - 1339.06s |  So there are more than 10 different attacks on the car specification itself, which also affects your
1339.62s - 1340.90s |  business version
1340.90s - 1342.90s |  and that's why you have to
1343.14s - 1347.94s |  You're in risk. You're in risk because there are existing vulnerabilities that could be
1349.30s - 1350.88s |  could be
1350.88s - 1352.66s |  exploited in your car
1352.66s - 1357.14s |  First you might think that you can remediate them with the firmware update. Here's the first problem
1357.86s - 1363.94s |  most of the cars still don't provide the firmware updates and the second problem is that you cannot remediate the
1365.86s - 1372.02s |  Force specification attacks with the firmware updates as they generally require the fixing the standards first
1372.34s - 1379.46s |  The standards level first then a few years would pass as the new hardware will be developed and be available on the market
1379.86s - 1381.86s |  after that you'll be able to
1382.18s - 1383.46s |  actually
1383.46s - 1386.66s |  swap the hardware in your car for the newest
1387.06s - 1392.42s |  But no one is going to do that for you and manufacturers most likely won't be doing that and it is required
1392.82s - 1398.98s |  Because you can change the blitzer's version only by swapping the hardware. You cannot do that in the firmware
1400.02s - 1402.12s |  So we've been testing for the known vulnerabilities
1402.66s - 1404.66s |  And we actually expected that
1405.22s - 1407.22s |  we won't find
1407.22s - 1413.40s |  Non-vulnerabilities in the cars produced in 2022 and 23. That was that were our expectations
1413.94s - 1415.94s |  But in fact, we still
1416.02s - 1422.36s |  We still found a lot of cars that had them and for example Tesla cars. They had a specific man-in-the-middle
1423.36s - 1426.66s |  Vulnerability that also should in theory exist in other models
1427.54s - 1429.54s |  You can check it for yourself
1429.54s - 1434.68s |  but the most interesting view is actually on the average number of vulnerabilities found per car and manufacturer
1435.40s - 1436.28s |  as
1436.28s - 1437.80s |  you can you can
1437.80s - 1442.30s |  See here the differences between between them and also the similarities
1442.84s - 1447.96s |  So when it comes to the critical vulnerabilities, there were only three manufacturers that had them
1449.22s - 1451.22s |  Renault and Volkswagen
1451.80s - 1456.28s |  So these vulnerabilities were rather old and they could have been fixed with the firmware update
1456.36s - 1459.96s |  But there were no firmware updates for these vulnerabilities for these cars
1460.84s - 1464.60s |  Then the when it comes to the denial of service and man-in-the-middle attacks
1465.48s - 1467.48s |  you have to notice that
1468.20s - 1475.56s |  If one of the manufacturer doesn't have man-in-the-middle attacks, they would generally have denial of service attacks or vice versa
1475.96s - 1476.92s |  so
1476.92s - 1479.88s |  These types are omnipresent and they can be swapped
1479.96s - 1484.12s |  So they both of them can be used to establish the man-in-the-middle position
1484.20s - 1490.68s |  So you can use both denial of service attacks and man-in-the-middle attacks to aid you in establishing the man-in-the-middle position
1491.24s - 1495.80s |  So this knowledge would be very helpful in the future. So try to remember it
1496.52s - 1502.04s |  And as we've been talking for an hour vulnerabilities, you already guessed that we found some new ones
1502.84s - 1505.56s |  especially some new attacks actually
1506.36s - 1509.40s |  So the first attack is the contact distractor attack here
1509.56s - 1511.56s |  The victim
1511.62s - 1517.80s |  Establishes the bluetooth connection with the car then shares the contacts via phonebook exit profile and leaves the car
1518.20s - 1521.32s |  without impairing the phone for example, which is by
1523.40s - 1528.12s |  For example by switching off the bluetooth or just walking away then we will be able to
1529.56s - 1535.08s |  spoof the MAC address to the MAC address of the victim establish the bluetooth connection and extract the contacts
1535.48s - 1537.48s |  But it would have been an ideal case
1537.64s - 1545.24s |  But unfortunately, we cannot do that because both the attacker and the car execute run the phonebook exit profile client
1546.44s - 1548.84s |  client service and only the servicers can
1549.56s - 1553.72s |  Serve the contacts. So this specific attack applies in the car sharing context
1554.36s - 1557.80s |  And due to that fact, we have to get into the car
1558.28s - 1560.12s |  We do not need to start the car
1560.12s - 1564.68s |  We just need to access the infotainment system and it is accessible without the starting the engine
1565.16s - 1567.80s |  So we would be able to we would have to
1568.36s - 1574.60s |  Search for the password number on the infotainment screen then and if the car is vulnerable, it would show us the contacts
1575.80s - 1578.28s |  So here you can see that we connect it to the Renault car
1578.52s - 1581.48s |  We do not have any contacts on the left
1581.72s - 1587.40s |  But when we switch to the dial pad and search for the part of the number then the contacts are shown to us
1588.36s - 1593.64s |  The second attack is very similar to the no-input no-output mini-middle attack with some caveats that
1594.20s - 1598.52s |  that apply to the automotive industry
1599.32s - 1600.28s |  so
1600.28s - 1602.28s |  some of the cars actually deny
1602.42s - 1607.08s |  connections or pairing to be initiated from the no-input no-output capability devices
1607.72s - 1609.72s |  but there are also the cars that
1610.04s - 1612.36s |  allow the connection to be initiated from the
1613.32s - 1615.32s |  user smartphone and also from the car
1615.48s - 1616.44s |  So
1616.44s - 1618.04s |  in case the
1618.04s - 1619.88s |  Connection is being initiated from the car
1619.88s - 1625.48s |  There are some cars that actually forget that they deny access to the no-input no-output capability devices
1625.80s - 1629.08s |  and thus it might be possible to get the connections from the car to the
1629.88s - 1630.92s |  attacker
1630.92s - 1635.48s |  For example by self-determining or pre-committing or using the other
1636.36s - 1639.48s |  other techniques so that we might be able to
1640.28s - 1642.28s |  get the middle position
1642.60s - 1644.04s |  So the third
1644.04s - 1647.88s |  Attack is actually the attack on the numerical person man-in-the-middle
1648.20s - 1651.64s |  This is insecure numerical person man-in-the-middle attack in this case
1652.60s - 1653.96s |  the it is
1653.96s - 1655.96s |  mutation specific attack so
1656.92s - 1658.92s |  In this case the car is either
1659.40s - 1665.32s |  either has the design problem or they have a state problem in case of the state we'd have to
1666.04s - 1668.04s |  Check the connection
1668.12s - 1674.20s |  With different capabilities while for the design we'd have to just observe the pairing process
1674.60s - 1678.44s |  so in case the car is vulnerable, it wouldn't need any confirmation of the
1679.00s - 1683.88s |  Pairing on the infotainment screen or it show no-input no-output like confirmation without
1684.28s - 1687.96s |  Showing the pairing number or it will show you static number across different
1688.52s - 1690.36s |  pairing attempts
1690.36s - 1693.40s |  So due to this fact we have all the pieces to
1693.88s - 1697.64s |  Establish the man-in-the-middle position or just the connection to the car
1698.76s - 1702.44s |  So to give you some of the examples in case of the other cars
1702.68s - 1708.60s |  they show you the pairing number they show you the button to cancel the connection the pairing or the connection and
1709.24s - 1713.32s |  but they show you the button to accept the pairing and this is
1714.12s - 1717.56s |  a problem because the call logic is on the attacker side
1717.96s - 1721.40s |  In case of the other cars they show you no-input no-output like confirmation window
1721.40s - 1725.80s |  They don't show you the pairing number and if you click accept the pairing would be done
1726.52s - 1728.36s |  after that, they will show you the
1728.36s - 1733.16s |  Window with the pairing number and the button to cancel pairing so unpair
1733.80s - 1735.80s |  but in this case, there are two
1736.28s - 1740.44s |  Two possibilities. So in case of the first one the if the user
1741.00s - 1743.96s |  Clicks yes or pair on their phone. Yes, then
1745.40s - 1751.24s |  On their phone first then we'll be able to we might be able to get the man-in-the-middle position
1751.56s - 1757.96s |  If they don't then they might spot the attack and then and ask them to have five to ten seconds to execute it
1758.44s - 1763.56s |  When it comes to the BMW cars, they had a state problem. Some of them still might have
1764.76s - 1771.24s |  But it should be fixed in the newer versions in the newer former versions. So in this case you can force the
1773.88s - 1774.76s |  You can
1774.76s - 1776.92s |  force the state problem by using
1777.72s - 1784.76s |  The capabilities other than display yes no and it will show you the specific number that you get you see in the screen
1785.96s - 1791.56s |  After that, you'll be able to establish the man-in-the-middle position or just the connection to the user or to the car
1791.96s - 1798.68s |  In case of the Renault cars, they didn't give you give the user any control whatsoever. So anyone could connect to it
1799.48s - 1803.42s |  So you've seen that I found many different vulnerabilities in the car specifically
1803.96s - 1805.96s |  primarily denial of service attacks and
1806.60s - 1811.48s |  Man-in-the-middle attacks, but you still might have a question. What can we do with them?
1812.04s - 1814.44s |  And this is what we are going to explore now
1815.00s - 1820.04s |  So first thing we can we have to establish the man-in-the-middle position and for that we have three different options
1820.36s - 1827.16s |  First one is to do selective jamming in case of this active jamming is relatively difficult to do but it's still possible
1827.48s - 1829.48s |  so in this case, we would have to
1829.72s - 1835.88s |  To spoof the MAC address of the car and then selectively jam it after that we might be able to get the
1837.32s - 1841.40s |  Connection the request or pairing request from the user or do it vice versa
1842.12s - 1845.00s |  The second option is to use denial of service attacks and deny
1846.76s - 1854.28s |  Resource to the car and then spoof the MAC address again and get the connection from the user or vice versa
1855.00s - 1857.96s |  The third option is actually to work with different MAC addresses
1858.04s - 1863.48s |  but the same names as those the car and the user would expect so in this case if we connect to the
1863.88s - 1865.88s |  car, we would have the
1866.12s - 1871.08s |  name of a user and if we connect to the user we would have the name of the car so that
1872.12s - 1874.60s |  The user would be lured into pairing
1875.72s - 1879.40s |  you might actually have a question or a problem with discovering the
1879.88s - 1881.08s |  um
1881.08s - 1887.88s |  MAC addresses you might think it is difficult, but in fact, it's rather easy and became easy as of recently
1888.12s - 1892.76s |  so for example, you have at least two options. The first option is to simply listen for the
1894.36s - 1897.00s |  For the MAC addresses for discoverable MAC addresses with your
1897.56s - 1901.72s |  Laptop hardware you would be able to find only discoverable MAC addresses
1901.96s - 1908.84s |  So the sample size won't be big but it might be enough for the attacks and the second
1909.40s - 1915.96s |  Option is to use BlueSquid's attack to actually get the MAC address almost all MAC addresses are in the BlueSquid's classic space
1916.36s - 1922.04s |  With the help of EuroSRP and Ubuntu, so it's approximately two thousand dollars worth of the equipment
1922.84s - 1924.84s |  so with that you'll be able to
1925.16s - 1929.72s |  discover the MAC addresses that are in non-discoverable mode for
1930.60s - 1932.92s |  Almost all the attacks that we are going to show you
1933.56s - 1935.56s |  so then
1935.56s - 1937.16s |  with this specific
1937.16s - 1941.80s |  Part you'll be able to get your first click or the first seamless click and
1942.92s - 1944.92s |  After that, you might have a question
1945.16s - 1947.88s |  What can we do with the menu middle position?
1948.04s - 1953.24s |  So in this case, we would have to escape the Bluetooth sandbox because we're in so to say
1953.64s - 1955.64s |  Bluetooth sandbox says we cannot
1955.86s - 1957.64s |  execute the code
1957.64s - 1964.04s |  We cannot execute arbitrary code on this other device and because of that we'd have to switch to the phones
1964.68s - 1967.48s |  Rather than and look for the functionality that we can exploit
1967.80s - 1973.32s |  So in this case generally phones have the phone functionality. They allow you to make calls play
1974.20s - 1979.72s |  music or stream audio without any authorization while when it comes to sharing contacts and messages
1980.04s - 1983.96s |  They require the authorization in some cases. Then they also allow you to
1985.24s - 1991.16s |  Emulate the SIM card of the victim or user and get access to the SMS messages and phone calls
1992.20s - 1993.80s |  while this
1993.88s - 1995.48s |  might seem
1995.48s - 1999.24s |  Very interesting the specific semi-access profile. This is actually
1999.78s - 2004.04s |  Deprecated and it's only available on the android devices and has a lot of warnings
2004.68s - 2006.28s |  it's not like
2006.28s - 2009.72s |  Users users would not dismiss the warnings, but still
2010.36s - 2014.28s |  It's only available on the android device. And in fact, the most interesting ones
2014.84s - 2019.48s |  Is the message access profile which allows you to extract different messages
2019.48s - 2025.98s |  For example SMS messages and emails in case of the emails. It's only available according to the specification
2026.52s - 2031.48s |  I haven't been able to find any implementation that actually worked with the emails
2031.96s - 2032.84s |  so
2032.84s - 2037.24s |  You might you might find that might not i'm not sure in case of the emails
2037.24s - 2039.80s |  but what I know for the fact is that you can
2040.28s - 2046.60s |  Extract the SMS messages that were ever delivered to the phone and also you can send the SMS messages
2047.08s - 2050.28s |  So additionally the user experience is very helpful as
2051.40s - 2055.96s |  on the iOS devices this specific functionality is called notifications file on the
2056.68s - 2063.00s |  Android devices. It's called messages. So there is no mention mentioning of SMS messages at all
2064.20s - 2067.26s |  So we come to the generic attack that you can execute
2067.72s - 2071.74s |  And the first thing that you need is the man in the position which requires
2072.30s - 2076.78s |  Which required one click from the user and then you will be able to ask for the messenger exit profile
2077.58s - 2081.26s |  Access we should require another click from the user once granted
2081.66s - 2086.78s |  You would be able to instruct the user's phone to send the SMS message or call a specific number that you control
2087.02s - 2091.90s |  So that you will be able to link the phone number to yourself and then use it
2092.86s - 2094.86s |  in the open source intelligence for
2095.08s - 2097.42s |  automatic flow so that you will be able to discover the
2098.38s - 2102.46s |  Login names or email addresses or just use the phone number
2103.42s - 2105.42s |  directly on the services
2105.58s - 2107.58s |  of interest and then
2108.06s - 2113.66s |  Trigger the SMS based OTP for the accounts that are associated with the victim's phone number
2114.22s - 2117.74s |  Then the OTP would be delivered to the victim's phone which we can
2118.22s - 2125.18s |  Always retrieve as we have the messenger profile access and then relay back to the backend and hijack the accounts
2125.98s - 2130.38s |  If this sounds all quite complicated and unlikely to you, I actually have some good news
2130.70s - 2135.10s |  So first we do not need to have the manual position at all. We just need the
2135.72s - 2137.42s |  connection to the phone
2137.42s - 2144.62s |  secondly, we can link the phone numbers while accessing the metadata of the SMS messages that were previously delivered and
2145.10s - 2149.10s |  I guess almost all of us have some SMS messages that were delivered to the
2149.98s - 2151.98s |  phone numbers that we use
2152.06s - 2158.62s |  Then we can also look for the content into the contents of the SMS messages and look for the emails and the login names
2158.94s - 2164.86s |  or alternatively, we could use the phone number in the or the data that we found in the
2165.50s - 2169.82s |  open source intelligence for then finally, we do not need to have the
2170.46s - 2173.44s |  We do not need to ask for the messenger profile authorization
2174.14s - 2181.74s |  For some of the phones, especially 2022 and older phones, but also this applies to the latest phones as well
2182.14s - 2186.46s |  So this is a one-to-two-click generic cloud takeover attack
2188.14s - 2191.34s |  With this attack we can bypass MFA we can
2193.26s - 2198.78s |  We can hijack accounts for the service that primarily rely on the SMS-based OTPs, for example meta services
2199.42s - 2202.06s |  and but the most interesting services that we
2202.78s - 2204.30s |  want to hijack or
2204.30s - 2211.44s |  Potential perpetrators we want to hijack are the ones that for which we can trigger the SMS-based OTP by knowing some information
2211.76s - 2213.44s |  in most of the cases, it's
2213.44s - 2215.44s |  knowing the email address or the
2216.08s - 2217.28s |  login name
2217.28s - 2220.64s |  so by knowing this information you would be able to
2221.20s - 2225.52s |  Trigger the SMS-based OTP and to know this get to know this information
2225.60s - 2232.32s |  You can use the open source intelligence form then you'll be able to hijack paypal coinbase google account in cases the
2232.96s - 2236.48s |  User is not logged in into the google account on the android phone
2237.12s - 2241.92s |  Then you would be also able to for example hijack the apps to control the vehicles
2243.28s - 2245.84s |  But for some of these services, it's rather difficult to do
2246.24s - 2253.12s |  So in case of the apple id you have to resort to phishing only as the victim is constantly notified and it's infeasible to you
2253.84s - 2259.20s |  The recovery in the timely fashion then when it comes to the google account if the user is logged in
2260.96s - 2264.56s |  On the android device then we would have to know the
2264.96s - 2267.92s |  Browser type and operating system type
2268.64s - 2271.04s |  Type so that we can forge it and as we'll be
2271.60s - 2278.40s |  Close to the victim and have similar IP and location we'll be able to bypass all the checks done by google and hijack the account
2278.96s - 2280.64s |  To give you some examples
2280.64s - 2286.32s |  We would first start with the android phone in this case. This is a samsung s23 for which I did the attack
2286.80s - 2291.94s |  So almost all of the android phones are actually always bearable and discoverable
2292.34s - 2293.22s |  um
2293.22s - 2295.86s |  So you can execute the attack at any time you want
2296.42s - 2301.38s |  And once we try to connect and pair the we can force the notebook
2302.58s - 2307.38s |  confirmation window that wouldn't show any pairing numbers to compare and thus the user would be
2309.22s - 2315.46s |  See only the specific device wants to pair with them and the buttons to pair or cancel
2315.94s - 2317.94s |  so in this case, it's
2317.94s - 2322.26s |  The art of choosing the names to lure the victim into pairing or
2323.94s - 2330.34s |  For that we can use we can do the targeted attacks to observe the victim or just use the most common ones
2330.90s - 2335.86s |  And try to pair randomly after that we can ask for the master extra profile
2336.90s - 2341.72s |  Access and in most of the cases, it is a typical workflow for the carsons
2342.26s - 2347.62s |  Smart smart watches and speakers. So if you forge the name for these devices, you would be
2348.66s - 2350.66s |  more likely to get the
2351.22s - 2355.46s |  Message access if the victim is more or less cautious
2356.10s - 2357.30s |  but
2357.30s - 2359.70s |  I guess most of the users are not
2360.26s - 2362.50s |  so they would probably run the
2363.46s - 2366.66s |  Access once granted you'll be able to execute the attack
2366.66s - 2370.58s |  So get the phone number first the sms based otp on this specific site
2370.90s - 2376.50s |  Then extract the otp enter the otp change the password and log out the user from all of the sessions
2377.22s - 2384.42s |  For the samsung account and I was able to log out the user from their old phone and completely hijack the samsung account
2385.62s - 2392.58s |  So this is a two-click generic attack and also who was working on the patch show hardening for the android devices
2392.90s - 2394.90s |  while samsung patched this
2395.70s - 2400.10s |  Their part in the samsung account service in june 24
2400.90s - 2404.36s |  They actually said that they fixed the vulnerability in november 2023
2405.22s - 2410.02s |  But I reported in may 2024 and it was exploitable at that time
2410.66s - 2412.66s |  but who knows
2412.98s - 2419.86s |  When it comes to exploiting ios devices, you can actually exploit map the same way on the ios devices as
2420.34s - 2426.74s |  On the android devices as on each new pairing request or in each new repairing pairing
2427.54s - 2431.70s |  The user would need to explicitly allow notifications by going to the
2432.42s - 2434.42s |  settings menu for this specific
2434.98s - 2442.82s |  Bluetooth device and then toggling the button to allow the notifications. It's quite infeasible when we do the attack that way but
2444.18s - 2449.64s |  What if we can renegotiate the connection for an already connected device that already has the notification permissions?
2449.94s - 2454.52s |  You would expect that the notifications would be reset on each pairing which is a requirement
2455.48s - 2457.64s |  As per specification but
2459.00s - 2461.80s |  ios doesn't follow that so
2462.60s - 2469.48s |  You can spoof the mac address for an already connected device that already has access or permissions and try to repair
2470.04s - 2472.04s |  in this case
2472.20s - 2473.32s |  it's
2473.32s - 2479.16s |  Here, I wasn't able to enforce the non-bit notebook like confirmation window that wouldn't show the pairing number to compare
2479.64s - 2486.12s |  but you might also experiment with that and maybe get the non-bit notebook like confirmation window, but
2487.56s - 2489.80s |  It is unfortunately that
2490.52s - 2492.68s |  It's not the case as of today
2492.68s - 2499.00s |  But what's most interesting is that the ios is also helping us in
2499.64s - 2506.68s |  One other way they fetch the name of the previously connected device from the cache and use it in the pairing request
2507.00s - 2513.96s |  So if the user had some kind of esoteric name for their device, they would be more inclined into pairing with us
2514.36s - 2519.96s |  And once they click pair we have the notifications permissions as the previous device
2520.36s - 2527.16s |  Is the previous connection had them so we'll be able to execute the attack in this case, for example hijack the facebook
2527.64s - 2533.80s |  But you might actually want to focus not just on the facebook, but also on the apple id itself. So
2534.12s - 2535.48s |  um
2535.48s - 2538.60s |  recently there was an attack and that involved phishing and
2539.64s - 2544.04s |  Seems to have attack and the perpetrators were able to steal twenty two thousand dollars
2544.52s - 2549.64s |  From the victim and here we can try to replicate the single attack with the map
2550.76s - 2552.76s |  map attack so
2552.76s - 2557.08s |  Here we'll be able to inject the sms message as if they came from apple
2557.48s - 2564.84s |  And do phishing once the user enters the apple id and the password the sms-based otp or mfe would be
2566.44s - 2568.84s |  Would be used and we'll be able to steal them
2569.56s - 2573.40s |  Steal the sms message value for or otp value
2574.20s - 2576.20s |  via the messenger extra profile attack
2576.60s - 2581.40s |  So here we just swap the same tool with the messenger extra profile attack
2581.88s - 2587.32s |  We we can also focus on other applications like paypal or coinbase or any other of interest
2587.96s - 2591.88s |  So you do not have to always focus on the apple id
2592.76s - 2594.76s |  but
2595.08s - 2597.08s |  The most actually interesting
2597.56s - 2599.00s |  worrying or
2599.00s - 2601.96s |  best part or worst part of this talk is that
2602.84s - 2608.92s |  This specific vulnerability is not fixed as of the latest ios version and it's not going to be fixed
2609.64s - 2616.76s |  The apple said that the users are safe because they are showing the parent prompt, but I seem to see that
2618.04s - 2619.32s |  They generally
2619.32s - 2625.72s |  Violated the business verification and that's why their users are one click away from their accounts being stolen
2626.12s - 2632.68s |  But of course it's up to you to judge and decide whether this is a specific vulnerability that should be fixed or not
2633.32s - 2637.74s |  But I personally hope that apple would eventually fix it and accredit accordingly
2638.70s - 2640.38s |  For the attack itself
2640.38s - 2648.14s |  I'm releasing a tool that affects more than 50 percent of the smartphone market worldwide more likely to affect the whole market
2648.78s - 2652.94s |  And this specific tool would allow you to retrieve and send sms messages as well
2653.02s - 2658.38s |  So look for the emails and phone numbers on the device and it would be possible to
2659.02s - 2663.74s |  Connect the tool to the infrastructure. This would actually do the recovery process
2664.70s - 2667.26s |  so here we come to the kit hacker base and
2667.74s - 2669.74s |  the first thing that I want to mention is that
2670.94s - 2675.44s |  Even the newest cars are generally shipped with the protocol. It's just vulnerabilities
2676.46s - 2679.18s |  and it's not really easy to fix this because
2679.74s - 2684.08s |  The design of the car is locked in just several years before it's manufactured
2684.92s - 2689.66s |  Manufactured and it's not possible to change the business version or hardware in it
2690.30s - 2696.22s |  So it's quite difficult to do so and we have to live with the anticipation of some kind of
2696.84s - 2700.78s |  Protocol obligations vulnerabilities in the cars and knowing that
2701.42s - 2705.42s |  Then when it comes to pairing pairing security or in the security environment
2705.74s - 2709.82s |  It's extremely important as it's the only safeguard against the many middle attacks
2710.30s - 2712.30s |  but what you have to remember is that
2713.26s - 2719.42s |  Forcing repairing is possible and it might be malicious. So we have to watch out for that as well
2720.30s - 2722.30s |  then when it comes to the
2722.46s - 2726.38s |  SMS based OTP services or the services that rely only on
2727.02s - 2734.86s |  SMS based OTPs. It might be rather risky for the end users and that's why maybe it would be best to consider other
2735.74s - 2737.74s |  OTPs
2738.62s - 2741.34s |  OTP sources, so for example
2742.14s - 2747.82s |  Email based OTPs and in that case it might add additional safeguards to the users
2748.46s - 2753.66s |  So thanks for listening now I hand over to Martin and maybe see you next year
2758.59s - 2765.79s |  All right, thanks for staying with us there's just two points left for me at the very end
2767.71s - 2769.71s |  Let me find the right slides
2774.09s - 2785.37s |  No, that's not it
2785.37s - 2797.96s |  Be quicker that way
2797.96s - 2804.14s |  So yeah, sorry, we've seen that much of bluetooth is fundamentally insecure both for standards and implementations
2804.92s - 2807.56s |  The toolkit have the link on the last slide as well
2808.60s - 2812.20s |  It's online for you to check your cars your bluetooth
2812.82s - 2814.84s |  products any of them
2814.84s - 2817.64s |  And of course, we're not liable for anything you do with it
2819.88s - 2827.16s |  But we focus on bluetooth and cars and just very last thing of course you can check anything and
2827.96s - 2831.64s |  We took it to one of the domains. We're very familiar with which is aviation
2832.04s - 2836.04s |  We tried it out on our own lab of certified real aircraft hardware
2836.60s - 2843.64s |  Which also has bluetooth to connect so-called electronic flight bags, which is just an ipad really with flight computers
2844.60s - 2846.36s |  and
2846.36s - 2847.64s |  the thing is
2847.64s - 2852.60s |  These bluetooth versions are so old. Most of these exploits don't work there because
2853.72s - 2859.56s |  honestly, you can establish the man in the middle position anyway, because the encryption is just so
2860.12s - 2863.24s |  Weak or trivial so we haven't explored this further
2863.88s - 2865.32s |  but it should be
2865.32s - 2869.40s |  Very easy to also do this on at least these specific
2870.52s - 2872.52s |  flight management systems
2873.16s - 2875.88s |  For that, thank you for listening and also
2876.52s - 2881.16s |  Putting up with a video talk. I hope that can make it in person next time
2882.12s - 2888.84s |  This is the qr code to the github repository where you can find all the information also this disclosure results
2889.56s - 2891.56s |  Any questions i'm available?
2892.36s - 2896.70s |  And vlad is also very happy if you contact him online. Thank you very much


url: https://www.youtube.com/watch?v=9IN1Aj56hYA
title: DEF CON 32 - Hunters and Gatherers A Deep Dive into the World of Bug Bounties - Panel
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=9IN1Aj56hYA",
  "title": "DEF CON 32 -  Hunters and Gatherers A Deep Dive into the World of Bug Bounties - Panel",
  "description": "Join us for an insightful panel discussion where we bring together seasoned Bug Bounty Program Managers and adept bug bounty hunters. This panel aims to address pressing questions and share diverse perspectives on the evolving landscape of bug bounties. We will dive into the challenges faced by both hunters and managers, discuss strategies to enhance the impact of submissions, and explore the future of bug bounties in the face of emerging technologies, evolving trends, and threats. We will also highlight the importance of bug bounties in the current cybersecurity landscape and share the top elements that contribute to a successful bug bounty program. Lastly, we will provide recommendations for organizations looking to mature their bug bounty programs but are hesitant about expanding. This panel promises to be a valuable opportunity for learning, sharing, and networking for anyone involved or interested in the world of bug bounties.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 3397,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 4.16s | This text was transcribed using whisper model: large-v2

 Uh, thank you for joining us here today. Uh, we are going to do intros in a second, but
4.16s - 8.46s |  overall, we're looking to give you some insight into the bug bounty world from three very
8.46s - 12.70s |  different perspectives on this, everywhere from running program management, running the
12.70s - 17.42s |  policy village here as well, or at least, uh, being very important regarding it, uh, all
17.42s - 22.58s |  the way through to black badge winners and everything in between for this. Uh, so to start
22.58s - 28.12s |  off, we'll do a few quick intros and then we'll chat through our overall agenda. Yeah. So
28.12s - 32.54s |  Katie, you're first up here. Hi everyone. Uh, I'm Katie Noble, uh, otherwise known as
32.54s - 38.68s |  lady in, I am the person for the policy village. So come see us in two 37. Um, so my
38.68s - 42.98s |  background is actually in behavioral analysis and, uh, I got into tech a couple of years
42.98s - 48.32s |  ago cause I was thrust into it by the government. Um, did, uh, worked for the government
48.32s - 53.86s |  for many, many years and I currently run, um, uh, the product security incident response
53.86s - 57.50s |  and bug bounty for a big fortune 50 company, but I'm not going to tell you which,
57.54s - 63.12s |  cause I don't represent them right now. Uh, this is not on the slides. Don't worry. Yeah. So,
63.12s - 67.78s |  uh, and my claim to fame is that in my career I've coordinated over 20,000 cyber security
67.78s - 78.90s |  vulnerabilities. Definitely can't top that. Uh, hi everyone. I'm Jonathan Cusco. Some of
78.90s - 83.60s |  you know me as bad idea. Um, I've kind of done both sides of being a full time bug bounty
83.60s - 87.54s |  hunter, also managing responsible disclosure programs. And so I've probably got the
87.58s - 91.34s |  intermediate experience here of like half her side, half of his side. Um, currently the
91.34s - 94.32s |  founder of chaotic good information security. My background is very much that of the
94.32s - 98.22s |  offensive security red team or penetration tester fully on the vulnerability front and
98.22s - 102.62s |  identifying what's truly vulnerable. How do we really fix it? And communicating that
102.62s - 106.02s |  across aisles, which is obviously sometimes difficult for engineers as they get a little
106.02s - 117.28s |  bit more up their craft. Cool. Um, hi, I'm Sam. Uh, I'm a security engineer at Google. Uh,
117.28s - 122.32s |  I help run, uh, one of our nine bug bounty programs, um, and our kind of core google.com bug
122.32s - 129.56s |  bounty program. Um, I have a couple of Defcon black badges. Uh, yeah, that's my kind of
129.56s - 131.06s |  claim to fame.
131.06s - 136.06s |  Alright. Hi everybody. I'm a senior security engineer at GitHub. I work on the bug bounty
139.66s - 145.38s |  program. I, uh, like to drive fast cars on curvy roads. I like to hit the track a lot, um,
145.38s - 150.28s |  when I'm not on the computer and I love building bug bounty programs, both private public
150.28s - 156.12s |  from nothing to full scope programs. And, uh, very excited to be here with you. Thank you.
156.12s - 165.12s |  And I am Logan. I work with Jeff also at GitHub helping run bug bounty over there at great
165.12s - 167.52s |  experiences working with everyone on the panel. And I think we're going to give you a
167.52s - 170.56s |  wonderful, a wonderful insight into everything going on here today.
171.46s - 179.46s |  Alright. So we're going to pose this as sort of, here's a question. We're going to let them
179.46s - 183.84s |  talk and Jeff and I are going to be hanging off to the side. So given that we're here to talk
183.84s - 188.00s |  about bug bounty, I mean, this seems like the obvious introduction. Uh, so Coast Coast,
188.00s - 192.94s |  we'll start with you on this one. What got you into the world of bug bounty originally?
192.94s - 197.04s |  So this is going to dial back about 10 or 12 years ago. Um, I started doing responsible
197.06s - 201.16s |  disclosure and bug bounty hunting as a very broke college student with over six figures of
201.16s - 206.00s |  student loan debt as it often happens here in the United States. I had my first penetration
206.00s - 209.58s |  testing job for a company, but the pay wasn't great. I didn't, I wasn't really like the best
209.58s - 213.44s |  at my craft. Um, you know, we started off a little bit lower and so I started moonlighting
213.44s - 218.22s |  bug bounties. Back at that time there was no hacker one, no bug crowd, no commercialized
218.22s - 223.16s |  sort of platform to, um, just bring you into it easily and get you in straight in front of
223.16s - 226.46s |  clients. So the thing that I was doing back then was actually looking at a lot of Google
226.52s - 231.82s |  acquisitions and the Google acquisitions would allow you to submit a vulnerability only
231.82s - 236.56s |  after they had owned it for six months. Um, pretty easy to find a list of acquisitions. Uh,
236.56s - 242.00s |  so I would find as many bounties as I could and then I sat on them until the six month part,
242.00s - 246.24s |  uh, scripted the submission to happen at 1201 that night. Sorry, I don't think you were there
246.24s - 252.38s |  at the time. Um, and that really got me into a lot of it back then, but my motivations were a
252.38s - 256.04s |  little bit split between one being like starving student trying to make his name in the
256.06s - 260.16s |  world. Um, obviously the financial implications of doing well in the bug bounty world can be
260.16s - 267.18s |  quite ludicrous. Uh, so I started doing that, um, while also just using that as a way to get
267.18s - 270.84s |  better at being a security engineer, at being a penetration tester. It's a little bit
270.84s - 274.18s |  different to take a client scoped engagement versus what's public out there on the real
274.18s - 277.12s |  world. So you get various different maturities. You see a lot of different technologies
277.12s - 281.56s |  really fast. Um, and I think that really expands your caliber as a bug bounty hunter, uh,
281.56s - 284.62s |  just to see how things work, how different people implement the same thing in different
284.64s - 289.02s |  ways. And you get a lot of real world wisdom and experience very, very quickly if you do
289.02s - 297.01s |  that over and over and over again, day after day. Who wants to pick it up from there? Um, so,
297.01s - 303.55s |  uh, I got in a little bit of a different way. So one of my, uh, teammates from DEF CON, uh,
303.55s - 306.69s |  reached out to me. I was like, Hey, I'm going to this live hacking event, uh, in New York
306.69s - 311.93s |  City. You should come down. I was in Boston, so in Boston. And so I went down there and I
311.95s - 318.15s |  participated in this live hacking event, only I was using curl. I wasn't using anything else. I
318.15s - 322.79s |  was, I knew exactly what everyone else was doing, but I was very, very slow. And so I made it my
322.79s - 329.77s |  mission to get faster, but then also to become a better bug bounty hunter. And fast forward a
329.77s - 332.41s |  couple of years, I didn't find anything there. Fast forward a couple of years, I actually won
332.41s - 337.57s |  one of the events. Um, so that, that was my kind of how I got into this and how I ramped up
337.59s - 345.30s |  from there. I guess that's me. Um, so my background, like I said, was government. Um, I
345.30s - 349.54s |  spent about 15 years in the US government doing various things. Like I said, my
349.54s - 354.22s |  background's in behavioral analysis, so it's all about why people do the things that they do. Um,
354.22s - 359.62s |  so I found myself at Homeland Security at the agency currently known as CISA. I was not CISA
359.62s - 365.96s |  when I was there. Um, but I was essentially moved into a position where I was acting as an
365.96s - 372.78s |  intermediary. So, um, researchers, hackers, come to, can come to the US government, even at
372.78s - 379.18s |  that time, and say like, hey, I'm being threatened by X company. Um, and it was my job to go to
379.18s - 384.22s |  that company and be like, what are you doing, man? Like, this is not going to work out. Um, and
384.22s - 388.22s |  you can threaten that hacker all you want, but I've got a fleet of lawyers, so go ahead and try
388.22s - 394.14s |  to threaten me. Um, and so I acted as an intermediary a lot, um, basically as a, I feel
394.14s - 399.42s |  like a camp counselor a lot. Um, which was great, because I could use all of my, uh, all of my, my
399.42s - 406.86s |  behavioral analysis background, um, to mediate a lot of, um, fairly high profile, um, uh,
406.86s - 412.46s |  vulnerabilities. A lot of the hackers that would come to us were very, very serious about, like,
412.46s - 416.64s |  they were looking at airplanes and nuclear power plants and water plants. These are very serious
416.64s - 423.78s |  things, um, that needed to be fixed. And so, that was really how I got into it, and then, uh,
423.78s - 429.26s |  eventually I moved out of government, um, into the private sector, um, running bug bounty
429.26s - 431.46s |  programs in the private sector.
431.46s - 437.50s |  So, wonderful. So, moving on, and thank God I have good notes here. Uh, one of the things you
437.50s - 441.44s |  had touched on, Sam, is, you know, starting with Curl and, and wanting to be faster and working
441.44s - 445.28s |  with everybody else. So, as you've gone through this, and I guess starting from the hacker side
445.34s - 449.72s |  and, and sort of looking at it from the response side as well, what, what tools, what techniques
449.72s - 453.12s |  have you found to be, uh, the most valuable when you're going through and actually doing bug
453.12s - 455.52s |  hunting? Without getting too, too in depth, because we are on the clock.
455.52s - 462.06s |  Um, yeah. So, for me, it's, it's mostly about, well, what makes you move faster, um, what makes
462.06s - 465.84s |  you find things, and more importantly, what makes you reject things that aren't interesting as
465.84s - 470.00s |  quick as possible. Um, and the faster you can do that, the more targets you can look at, um, the
470.00s - 474.74s |  more successful you'll be. Simultaneously, it's also important to use your tools to find other
474.74s - 480.34s |  targets, so, like, look for weird subdomains, look for weird places. Um, maybe pivoting this a
480.34s - 484.98s |  little bit on the program side, program management side, like, using templates to respond to
484.98s - 490.02s |  researchers, um, you'll often get the same invalid reports over and over again if you have to
490.02s - 497.02s |  write a custom response every time, like, it's just gonna slow you down. Um, yeah.
497.02s - 501.96s |  I'll take it from there. Um, so, I think it, first off, it depends on, like, what your particular
501.98s - 504.82s |  vertical of security is, because just by saying, like, what kind of pentester are you, it's, like,
504.82s - 508.66s |  saying, like, what, what do you do in cyber security, and, you know, there's a million different
508.66s - 512.20s |  verticals. Uh, can I, like, quickly ask the room, like, who are all the web application folks
512.20s - 517.20s |  here? Some, like, network, infrastructure, endpoint detection, okay, so it's kind of all
522.10s - 525.98s |  over the place, and so, like, saying, like, using Burp Suite to go really deep doesn't mean
525.98s - 529.94s |  much to someone who isn't an application security person. Um, and if you're someone who's
529.96s - 533.40s |  entirely in web application security, you might be a little deer in the headlights when you
533.40s - 538.44s |  find a command injection, and it's, like, okay, actually, like, pivot off that box. Um, when it
538.44s - 542.00s |  comes to the tools that you're using, I think more importantly than just, like, finding the
542.00s - 545.58s |  right tool that just helps, you know, find things automatically, you really need to align
545.58s - 549.68s |  that with what your particular vertical is and what you understand really well. Um, there's a
549.68s - 554.06s |  lot of opportunities to go deep in new areas of security that you might not be the best at.
554.06s - 558.76s |  Like, so, for instance, one of my weak points is, like, malware reversal. So, if I find
558.78s - 562.32s |  malware on a machine, I'm probably not going to spend 20 hours trying to figure out how to
562.32s - 565.22s |  reverse it. I'm going to find one of my friends who's really good at malware stuff and say,
565.22s - 572.06s |  hey, we're going to partner on this one so I can go back to what I do best. Um, yeah, a little
572.06s - 577.36s |  pivot, held a die on. I'm going to pivot further. Um, so, we're talking about technology
577.36s - 582.00s |  tools, but from my perspective, the best tools that we can have are really the behavioral kind
582.00s - 587.10s |  of tools, so, like, common sense I think is probably the best tool that I have available. Um,
587.16s - 590.88s |  I get a lot of reports from a lot of folks, and some of them are really high quality, really
590.88s - 597.46s |  good quality, um, criticality, and some of them are not. Um, and some of them seem like
597.46s - 601.80s |  they're social engineering or just not good quality reports until you actually start
601.80s - 606.50s |  digging into them. So, like, um, I always, like, make sure my engineers, like, really look at
606.50s - 612.40s |  that report because it could at first appearance be, like, incomplete or not, like, not well
612.40s - 616.74s |  formed or just garbage, but in reality, some of the very best critical vulnerabilities are in
616.74s - 621.92s |  that way. Um, even negative testing results are very valuable because negative testing
621.92s - 628.16s |  tells us where there is something, but it may not be ready yet, and so, common sense to me
628.16s - 631.92s |  is really important, and diligence is really important, um, and just being willing to
631.92s - 636.08s |  answer questions, like, uh, the thing that drives me crazy is when we get what I refer to as,
636.08s - 641.32s |  like, these cookie crumb results where it's, like, somebody will send a report in to us, and
641.32s - 646.18s |  it will be, like, pieces, and then we'll say, like, hey, do you have, like, can you give me
646.18s - 649.18s |  more information about this proof of concept, and they'll be, like, well, you're the company,
649.18s - 653.68s |  you figure it out, and it's, like, well, your report's probably going to go in the garbage
653.68s - 659.10s |  because I have 500 other reports, and you're taking time from those other hackers who took
659.10s - 662.48s |  the time to put the report together so that I could actually follow it so that I could pay
662.48s - 667.98s |  them out quickly, um, but we try to make sure that we are taking as much time as possible,
667.98s - 671.44s |  even with those reports, staying calm and going back to the researcher and being, like, hey,
671.44s - 675.68s |  look, I know you're frustrated, but, um, I think you have something here, but you need to
675.68s - 681.48s |  work with me to help me figure out what is here so that I can get you paid, um, so I would
681.48s - 685.40s |  say, like, common sense and due diligence are probably the best tools that I have in my
685.40s - 688.36s |  toolbox, um, from running a program side.
688.36s - 693.32s |  Real quick, before we move on, I want to make sure that, like, we actually give, like, good
693.32s - 696.52s |  answers for that one, too, because, like, what tools do you use if you're actually going to get
696.52s - 700.90s |  started? Um, any sort of man-in-the-middle intercepting proxy for your browser is
700.90s - 704.72s |  absolutely a must for application security. If you're needing to find new services on
704.72s - 708.22s |  endpoints, it's time to get really familiar with NMAP or NABU, if you're familiar with the
708.22s - 711.68s |  Project Discovery Toolkit. Everyone should just download everything that Project Discovery
711.68s - 716.68s |  has. It's free, it's open source, it'll really help you just get from recon to vulnerability
716.68s - 720.02s |  pretty quickly, and there's some nuance that you can learn there. Um, but you're going to
720.02s - 723.30s |  need tools that will help you go deep in an application, you're going to need tools that will
723.30s - 728.18s |  help you go wide across several applications, Nuclei is really good for that. Um, their
728.18s - 733.10s |  version of NMAP called NABU is also fantastic, and that will get you most of the way there.
733.10s - 737.02s |  At that point, I think you'll start having more hosts than you know what to do with, and this
737.02s - 740.32s |  is where you have to start determining, like, okay, where do I spend time, what do I put my
740.32s - 743.94s |  manual efforts towards, and I think the thing that you want to remember is that you're going to
743.94s - 748.18s |  want to use automation to help you find targets to then go in on manually, uh, because at
748.18s - 751.72s |  least when it comes to the bug bounty world, it's first and best dressed, and the reason I
751.72s - 754.68s |  wanted to talk about that is because exactly what you just said, you might get breadcrumb
754.68s - 758.48s |  vulnerabilities, and so let's say myself as the researcher, I found something that's really
758.48s - 762.68s |  cool, I'm pretty sure this is going to pay out, I can spend two hours putting together a
762.76s - 766.30s |  really good report, but in that two-hour time, someone else could put in a low-quality
766.30s - 769.76s |  report, yet they're first and they're going to get paid out, and so there's kind of like a meta
769.76s - 773.10s |  to bug bounty hunting where you have to decide, okay, how much information can I give that's
773.10s - 778.60s |  relevant, uh, to make this seem valid, and again, if you're competing with other people, I
778.60s - 781.80s |  might start thinking, maybe let me submit this incomplete, and then go back and edit it
781.80s - 785.76s |  later, can we start looking at submission dates, the first one is the only one that matters. Is
785.76s - 789.06s |  that the right thing to do? You know, I think we can have a discussion around that, but if
789.06s - 793.40s |  there was a meta to bug bounty hunting, that is definitely one part of it.
793.40s - 797.14s |  Just to add one thing to that, you'll never be faster, any tool you use will never be faster
797.14s - 802.72s |  than mass scan, so mass scan first, and then move on.
802.72s - 808.72s |  Awesome. Well, a great segue to that is, for Katie, where do human efforts provide value
808.72s - 813.86s |  than, more value than automation efforts, right, so pivoting off of tooling, where are
813.86s - 817.52s |  humans the most efficient, the most valuable?
817.52s - 823.48s |  Oh, Lord. So, I mean, I see a lot of, I've started to see a lot of AI generated reports come
823.48s - 831.48s |  in last year or two, and those are okay. From where I sit, like, I work mostly hardware
831.48s - 838.48s |  firmware and software, I don't work a lot of SAS, so the AI stuff isn't really valuable to us
838.48s - 842.22s |  because we're looking at, like, hard core CVEs versus, like, what I would consider to be
842.38s - 850.38s |  misconfigurations, so it is a little bit of a different ballgame, but I think it goes back
850.38s - 855.92s |  to, like, that negotiation period, right? Like, you can put in an empty, like, not an empty,
855.92s - 860.18s |  but a placeholder report, which we can have that conversation about whether you should or
860.18s - 868.18s |  not, but there is more to it than just lobbing the report over the wall. You're going to
869.18s - 875.00s |  enter a negotiation period, right? You're going to enter a negotiation period with the triager
875.00s - 878.34s |  who is receiving your report, you're probably going to enter a negotiation period, at
878.34s - 883.38s |  least in hardware and firmware, where you're going to have to work with an engineer or an
883.38s - 887.10s |  engineer is going to be working on the back end without your knowledge, which happens,
887.10s - 890.06s |  usually that's what's going on in that quiet period where they don't respond to you for
890.06s - 895.72s |  months, but they're working on trying to figure out a mitigation, right? And so that
895.72s - 902.02s |  negotiation, any time I walk into a room and it's, I want, if I want anything, even, like,
902.02s - 906.30s |  even ordering coffee, like, I want something, that's a negotiation. Congratulations,
906.30s - 911.88s |  you've just entered a negotiation. Because, and that's a human to human interaction. So
911.88s - 916.34s |  you can lob the report over the wall, but you're probably going to get a better result if
916.34s - 920.26s |  you walk into it understanding there's likely a human involved in there and you're about to
920.26s - 926.68s |  enter multiple phases of negotiation. So that's my suggestion.
926.68s - 930.60s |  One of the areas that I really like for human efforts over automated stuff is, like,
930.60s - 935.42s |  let's say a new target comes my way, I immediately skip everything unauthenticated, I skip
935.42s - 938.30s |  everything that would be the first one or two clicks away from whatever the main domain page
938.30s - 942.14s |  is, I go straight to anything behind credit card functionality, because that is always, I feel
942.14s - 945.34s |  like, what people put, like, on the last of their checklist, it's like, okay, I'm enumerating
945.34s - 949.60s |  the application, I'm enumerating whatever the target platform may be, and this bit requires a
949.60s - 952.60s |  credit card, and it can't just be a gift card, it has to be something valid, or maybe, like, an
952.60s - 956.72s |  ACH transfer has to happen overnight for them to confirm a balance, go straight to that, get
956.72s - 962.26s |  the clock running on it as soon as possible. Even if you need to go, I mean, I guess, like,
962.26s - 966.90s |  this is not financial advice, just in case that matters. Also not a lawyer, this is not legal
966.90s - 971.60s |  advice, all of those things. I have created separate accounts that I can use for all of
971.60s - 975.64s |  that, where I can add bank accounts, where I can add credit cards, it's separated from my
975.64s - 981.14s |  personal stuff, and the setup for that is, it's easier than installing the old version of
981.14s - 986.52s |  Bloodhound, if that's a bit of a deep cut, but, like, you should do that if you're remotely
986.52s - 991.18s |  serious about bug bounty hunting, because that's going to put you ahead of 80, 90 percent of
991.18s - 994.94s |  other people who are out there hunting for stuff being on the same login page, especially if
994.94s - 998.94s |  it's something where a new target has been exposed to everyone for the first time, and so you
998.94s - 1002.76s |  can imagine, like, maybe scope started at midnight, but you're racing with a lot of other
1002.76s - 1005.76s |  people around the world, and so you have to get to the functionality that other people are
1005.76s - 1010.68s |  likely to test last, if you want to get the low-hanging fruit first. Obviously you can go
1010.68s - 1014.34s |  deep, you can look at business logic analysis, wherever that sort of stuff comes in, I love
1014.34s - 1018.76s |  anything with a contact us form, anything that requires extra information to get to deeper
1018.76s - 1022.64s |  areas of the application, it's going to take automation even further to get to those areas,
1022.64s - 1026.14s |  and that's going to depend on how good whoever's automation is at spidering, which it's
1026.14s - 1029.88s |  already not good at maintaining authenticated versus unauthenticated states, as soon as
1029.88s - 1034.54s |  something hits, like, a logout feature, or you trigger rate limiting that logs you out, or
1034.54s - 1038.80s |  god forbid it's still a web sphere application, those have unique URLs every time you log in
1038.80s - 1042.58s |  or out, automation completely fails at those, and so when you start identifying those
1042.58s - 1046.30s |  technologies, I mean, I think the spider sense starts kicking in where you're like, okay,
1046.30s - 1050.80s |  there's likely not a lot of competition on this one, if I was going to spend eight hours
1050.80s - 1055.30s |  somewhere, this might be worth the time, because it's a lot of cost benefit analysis on
1055.30s - 1059.68s |  where your efforts are going to go, and it really sucks if you spend eight hours working
1059.68s - 1062.44s |  on something that you're pretty sure is vulnerable, you don't find anything, and now you
1062.44s - 1066.80s |  have a sunken cost fallacy sort of thought of what did I do with my day, which I think
1066.80s - 1069.72s |  we're going to get into that later question, so I don't want to go too much on it here, but
1069.72s - 1073.56s |  that's where I would spend human efforts over automation ones.
1073.56s - 1080.38s |  So just to add to the human effort, so when you're testing web applications and you come
1080.38s - 1084.68s |  across, like, a laugh, you'll often, it's an easy way to get yourself banned, especially
1084.68s - 1090.32s |  using automation, and so as a human, you have to, you have the ability to infer that
1090.32s - 1094.92s |  something is vulnerable without necessarily proving it using, like, a full exploit, that
1094.92s - 1100.00s |  would get your IP banned, that would get your account banned.
1100.00s - 1107.44s |  When I see a laugh, it doesn't actually, for some researchers, it can be, like, a showstopper.
1107.44s - 1111.04s |  For me, it's a place I'll actually dive in more, because, you know, you find the right
1111.04s - 1114.92s |  quote character, that's going to get past the laugh, and it might throw some interesting
1114.92s - 1122.12s |  error, you know, yeah, I see that as, like, really a place where humans thrive versus
1122.12s - 1123.12s |  AI.
1123.12s - 1129.48s |  You know, simultaneously, I'm sure AI will get better, or automation will get better.
1129.48s - 1132.80s |  When you find that a laugh has blacklisted you, don't forget about it.
1132.80s - 1136.88s |  If Akamai or CloudFlare or something has locked you out, write down that application, go back
1136.88s - 1141.52s |  to it later with a different IP, or lock out other IPs as you're scanning for everything,
1141.52s - 1144.04s |  because if you end up with a list of things that are behind CloudFlare and things that
1144.04s - 1148.00s |  are behind Akamai, guess where you should spend human efforts?
1148.00s - 1149.00s |  Exactly all of those.
1149.00s - 1154.84s |  This is also, like, a little bit in the weeds, but if you find yourself getting a laugh block
1154.84s - 1159.96s |  coming back from a server that's not Akamai or CloudFlare, that means that you have the
1159.96s - 1164.64s |  potential to DOS an application by blocking the frontend service sometimes.
1164.64s - 1165.64s |  I don't know.
1165.64s - 1171.07s |  It's a fun variant of this.
1171.07s - 1172.07s |  Very cool.
1172.07s - 1177.07s |  So it's easy to get in really deep and, you know, go into rabbit holes and eventually
1177.07s - 1180.71s |  also just get tired of responding to incidents, right?
1180.71s - 1182.03s |  How do you find balance?
1182.03s - 1188.31s |  What are some potential tips you can offer to folks, you know, who are proactively burning
1188.31s - 1190.39s |  out or, you know, how do you approach it?
1190.39s - 1193.47s |  I would love for Sam to start with this.
1193.47s - 1194.47s |  Sure.
1194.47s - 1199.35s |  So on the researcher side, I mean, it's the same as being at DEF CON.
1199.35s - 1200.87s |  I'm really excited to be here.
1200.87s - 1201.87s |  I don't want to sleep.
1201.87s - 1202.87s |  I don't want to eat.
1202.87s - 1206.95s |  I don't want to, well, I should shower.
1206.95s - 1209.59s |  It's everyone should shower.
1209.59s - 1210.99s |  It's the same thing with bug bounty hunting.
1210.99s - 1215.19s |  It can become very addictive and you have to balance it with the rest of your life.
1215.19s - 1220.11s |  You know, if you're having a bad week at work, maybe don't do bug bounty at night.
1220.11s - 1225.51s |  I think, like, simultaneously on the program side, if you're the only program manager and
1225.51s - 1229.79s |  you're getting in 25 reports a day, like, that's not sustainable.
1229.79s - 1234.51s |  You know, at least within Google, like, we try and go for, like, no heroes policy.
1234.51s - 1240.87s |  We have a roughly once every seven week or so rotation, a little bit less than that now,
1240.87s - 1246.31s |  I think, where you're only on call once out of every seven weeks, and that helps keep
1246.31s - 1247.31s |  things sane.
1247.31s - 1250.36s |  I'm next.
1250.36s - 1256.00s |  So, yeah, I agree, like, everything� every job, everything that you're passionate about,
1256.00s - 1260.68s |  you're going to, like, have burnout in from an industry perspective.
1260.68s - 1265.80s |  We have a lot of engineers that are sitting, receiving reports, doing triage, doing mitigation,
1265.80s - 1268.60s |  doing disclosure planning, and it gets really exhausting.
1268.60s - 1273.08s |  I had an engineer tell me the other day, you know, like, I have 75 tickets and I'm not
1273.08s - 1278.96s |  even happy when I close a ticket anymore because I know that I still have 74 tickets to close.
1278.96s - 1285.28s |  Like, she used to be, like, really excited every time she closed a report, and now not
1285.28s - 1286.28s |  so much.
1286.28s - 1287.28s |  And, like, that's real.
1287.28s - 1290.76s |  I think everyone is undermanned, especially with, like, a lot of the technology layoffs
1290.76s - 1296.28s |  that have happened in the last four to five years, like, being smarter about how we do
1296.28s - 1302.00s |  things, incorporating tools on how we actually handle vulnerabilities and disclosures I think
1302.00s - 1303.00s |  is really important.
1303.00s - 1307.04s |  Looking for efficiencies and building those efficiencies and automation into systems and
1307.04s - 1309.88s |  processes is incredibly important.
1309.88s - 1314.16s |  I would rather that� I see it kind of like a doctor's office, right?
1314.16s - 1320.92s |  I would rather that my doctors be doing surgery than filling out insurance forms.
1320.92s - 1329.48s |  So where you can offload onto, you know, a specific triage team, you should do that.
1329.48s - 1333.36s |  So your, you know, mitigation engineers are not doing triage and mitigation.
1333.36s - 1336.80s |  So it's about, like, balancing workload, balancing processes, making sure that you're looking
1336.80s - 1339.76s |  for automation opportunities.
1339.76s - 1342.16s |  And we do a rotation.
1342.16s - 1347.48s |  So our engineers will only do tickets for a certain amount of time.
1347.48s - 1350.68s |  So it's usually about three months, and then that's it.
1350.68s - 1352.56s |  They're not doing tickets again for another three months.
1352.56s - 1354.40s |  They move into an entirely different job.
1354.40s - 1358.80s |  So maybe today they're doing triage tickets, and when their three months is up, they're
1358.80s - 1362.98s |  doing comms, they're doing disclosures, they're doing something entirely different.
1362.98s - 1366.40s |  So that it doesn't matter that she has 74 tickets left.
1366.40s - 1370.24s |  That's now somebody else's problem for the next three months.
1370.32s - 1373.32s |  So we try to incorporate a rotation.
1373.32s - 1376.32s |  And we try to make sure that we're looking for those automation opportunities.
1376.32s - 1379.72s |  Technology has evolved and changed so much in the last several years that it's really
1379.72s - 1384.36s |  irresponsible if you're not on the industry side looking for ways to make the processes
1384.36s - 1388.60s |  better and easier and more efficient for your engineering team.
1388.60s - 1393.08s |  That makes things better and more efficient and faster for your bug hunters.
1393.08s - 1396.40s |  Faster that triage, the faster they get paid, the happier they are.
1396.40s - 1398.60s |  And then everyone is happy.
1398.60s - 1405.58s |  So I think it's irresponsible to not be thinking about your team health along with building
1405.58s - 1413.52s |  those processes, making sure you're efficient, and really just keeping an eye on your people.
1413.52s - 1416.00s |  Very well said.
1416.00s - 1417.64s |  So this thought kind of just crossed my mind.
1417.64s - 1420.72s |  I don't think any of us thought ten years ago that we'd get a dopamine hit from seeing
1420.72s - 1423.76s |  an alert box pop up.
1423.76s - 1427.68s |  And it feels just like pulling that slot machine, if we're going to make a gambling reference
1427.68s - 1432.80s |  because we're in Vegas, and just seeing something pop up.
1432.80s - 1433.80s |  Dopamine feels great.
1433.80s - 1437.56s |  And so the same thing, any time any scanner comes back as something that's positive and
1437.56s - 1442.24s |  then you verify and it's really there, that feeling of, oh, yes, I just got this thing
1442.24s - 1447.08s |  is just infectious.
1447.08s - 1450.16s |  Just like with anything that you enjoy doing, balance is absolutely key.
1450.16s - 1452.56s |  You have to keep a time on that clock.
1452.56s - 1456.68s |  Some of us have real addictive personalities and suddenly you find yourself, it's 4 a.m.,
1456.68s - 1461.64s |  we haven't had dinner, and you've got a lot to do the next day, but we can get real addicted
1461.64s - 1466.44s |  to hunting for vulnerabilities in new content, especially if you're going from application
1466.44s - 1469.04s |  to application to application, there's always something new.
1469.04s - 1472.88s |  There's always something, like some new rabbit hole that's pulling your interest or you're
1472.88s - 1475.92s |  working on one application because you've gone through so many, the light bulb pops
1475.92s - 1479.52s |  on something that you were touching an hour ago.
1479.52s - 1482.72s |  I should probably mention this with the tool bit earlier, but actually the best tool that
1482.72s - 1486.00s |  I have is a timer that I have on my desk.
1486.00s - 1487.92s |  And I tell myself the 15-minute rule.
1487.92s - 1491.92s |  So after I've been working on a particular area of an application or a target for just
1491.92s - 1496.20s |  a couple of minutes, if nothing has been immediately apparent that something is there, I start
1496.20s - 1497.20s |  the timer.
1497.20s - 1501.16s |  If that 15-minute timer goes off and I've not made any meaningful progress, go to the
1501.16s - 1506.68s |  next functionality or consider taking a break and stepping away from the computer.
1506.68s - 1509.68s |  That will help you find more vulnerabilities, too, because I can't tell you how many times
1509.68s - 1512.88s |  I've been on a page where I was just certain SQL injection is here.
1512.88s - 1515.16s |  There's just something I'm just not getting across.
1515.16s - 1516.16s |  It's not actually vulnerable.
1516.16s - 1519.04s |  And if you would have just gone to the next bit of functionality, there might be RCE there
1519.04s - 1522.68s |  or there might be some breadcrumb that's worth chasing down.
1522.68s - 1526.60s |  So manage your time effectively, just like anything else, this isn't specific to hacking.
1526.60s - 1531.48s |  This is the same advice for anyone who's seeking mental health wellness.
1531.48s - 1535.48s |  What we do is very exciting, it's very addicting, and those of us with addictive personalities
1535.48s - 1537.32s |  really need to keep a grasp on that.
1537.32s - 1543.32s |  Going back to the program side for a minute, you also control your own economy.
1543.32s - 1547.84s |  If you're getting in a ton of reports, consider lowering payments.
1547.84s - 1552.96s |  You'll still probably get a few reports in, but that might dissuade researchers from spending
1552.96s - 1553.96s |  as much time on your program.
1553.96s - 1558.48s |  Similarly, if you're not getting reports in, then pay more.
1558.48s - 1563.36s |  Control that input to some extent, anyways, and that kind of gets more to the business
1563.36s - 1564.36s |  side of everything.
1564.36s - 1567.57s |  But yeah.
1567.57s - 1568.57s |  Very cool.
1568.57s - 1571.65s |  So this is one of my personal favorite questions.
1571.65s - 1575.69s |  From a hacker view, what makes a product or an application a good target?
1575.69s - 1579.69s |  What makes a good candidate for a bug bounty program from the program side as well when
1579.69s - 1581.85s |  you're considering spinning up a program?
1581.85s - 1584.45s |  But we're going to start with Cusco's for this one.
1584.45s - 1585.45s |  Sure.
1585.45s - 1589.25s |  So, as much as I hate to say it, I'm going to say it.
1589.25s - 1593.45s |  We've all heard shift left a million times, and anyone working in security has heard this
1593.45s - 1597.29s |  sort of thing brought up, and the concept is basically the earlier that we can identify
1597.29s - 1602.17s |  bugs and fix them in the development life cycle, the cheaper it will be to remediate.
1602.17s - 1606.17s |  Bug bounty programs are as far right as possible as that shift left could be.
1606.17s - 1611.01s |  So when we're, as you're running a program, if you're identifying candidates for your
1611.01s - 1615.09s |  bug bounty program, it should be something that has already had all the gambits of internal
1615.09s - 1616.57s |  due diligence.
1616.57s - 1621.33s |  In an ideal world, you have secret scanning hooked into the CICD, you have rule sets for
1621.33s - 1624.29s |  insecure functions not being used, you're running some sort of SAS tool, you're running
1624.29s - 1627.37s |  some sort of DAS tool, you're running some sort of runtime analysis, and maybe if you're
1627.37s - 1631.41s |  lucky you have an internal pen testing team who can give it all once over assessment before
1631.41s - 1635.81s |  it actually goes out to production, you know, the real world.
1635.81s - 1640.49s |  Obviously that's a lot of resources, not everyone has a 200 person product security team, but
1640.49s - 1644.29s |  if you have something that has not gone through all those areas of due diligence and you're
1644.29s - 1648.81s |  going straight to making it a valid bug bounty target, that's fine.
1648.81s - 1653.45s |  That is just probably the most expensive way to get security improvements made on that
1653.45s - 1655.21s |  particular product.
1655.21s - 1661.01s |  At the same time, there's usually nothing academic or, you know, not real once it's
1661.01s - 1662.01s |  in production.
1662.01s - 1667.81s |  These are targeting customers now, actively impacting them, and again, it's not a theoretical
1667.81s - 1671.13s |  or academic finding, so usually there's movement to get it pushed out.
1671.13s - 1674.21s |  The other thing that I like doing, if I get multiple reports of the same thing, I treat
1674.21s - 1678.37s |  that as an increased likelihood of exploitation, so something, you know, if you get ten different
1678.37s - 1682.41s |  people telling you a thing is coming in and it's rated as a medium, well, if ten different
1682.41s - 1684.65s |  unique people can find it and they're not sharing that information, maybe that should
1684.65s - 1687.53s |  probably be a high and we shouldn't kick that down the can every three months as business
1687.53s - 1688.53s |  accepted risk.
1688.53s - 1691.25s |  But basically, it's kind of common sense stuff.
1691.25s - 1694.01s |  If you go straight to the bug bounty program, that is the most expensive way to identify
1694.01s - 1695.01s |  vulnerabilities on it.
1695.01s - 1698.05s |  There will probably be real good ones, though.
1698.05s - 1701.17s |  It could be more cost effective to do something a little bit more on the shift left sort of
1701.17s - 1703.17s |  pipeline, but that's just the reality of it.
1703.17s - 1709.85s |  Yeah, just to add to that a little bit, I feel like if you're getting the same critical
1709.85s - 1714.73s |  vulnerabilities in every month, then you're just paying that researcher's mortgage.
1714.73s - 1719.97s |  It's not, like, your role as a bug bounty program manager should be to push the business
1719.97s - 1725.05s |  to do more comprehensive fixes for things or to find every variant of this or to introduce
1725.05s - 1729.25s |  some additional scanning or something.
1729.25s - 1730.61s |  It's on you, the program manager, to make that happen.
1730.61s - 1735.17s |  The researcher is just going to keep submitting, you know, they're not interested in the systematic
1735.17s - 1736.17s |  fixes.
1738.64s - 1744.64s |  Yeah, I mean, like, the shift left thing is, you hear it all the time, but we're kind of
1744.64s - 1746.28s |  stuck with the roadmap, right?
1746.28s - 1750.32s |  So whatever product is coming on the market, and those products are based on customer-driven
1750.32s - 1751.32s |  needs, right?
1751.32s - 1756.24s |  So a customer wants this, this product is built, the product goes through testing, it
1756.24s - 1762.44s |  gets internal red teams, it gets lots of pen testing and security evaluations and hackathons
1762.44s - 1766.32s |  and whatever internally, and then it gets on the market, and that's where VDP comes
1766.32s - 1770.96s |  in place, so vulnerability disclosure, which is not usually paid, so that's your see something,
1770.96s - 1777.72s |  say something, and then and only then should it end up in the bug bounty space.
1777.72s - 1782.08s |  So bug bounty is true adversary emulation in my mind, and so you're looking at things
1782.08s - 1785.08s |  that are actively accessible.
1785.08s - 1791.88s |  But there are places where you can insert yourself into that product life cycle before
1791.88s - 1793.82s |  it gets on the market.
1793.82s - 1798.82s |  If you have a good researcher base that has really qualified and really awesome researchers
1798.82s - 1803.78s |  in that space that align with that target or that product, why not consider running
1803.78s - 1808.58s |  a private bug bounty event on that product before that product goes on the market?
1808.58s - 1813.06s |  You're likely to get really, really good results that way, because usually developers and hackers
1813.06s - 1817.66s |  have different mindsets, some are fixers and some are breakers, and if you approach it
1817.66s - 1822.70s |  from an adversary perspective, like most bug hunters do, you're likely to get really good
1822.70s - 1827.62s |  results that way, and then putting the bug hunters and the engineers in the same room,
1827.62s - 1830.46s |  I've had really good results with that.
1830.46s - 1836.62s |  Just sit them next to each other and let them challenge each other works really well.
1836.62s - 1842.02s |  So then I can get those products fixed before it ever even goes on the market, and then
1842.02s - 1845.94s |  at that point, then it goes through the rest of the process, product gets launched on the
1845.94s - 1850.62s |  market, problems have already been fixed, looks good for the company because you don't
1850.62s - 1857.38s |  have as many CBEs or negative reports or bad press, then product goes into VDP, and
1857.38s - 1860.46s |  then it goes into bug hunting, so bug bounty.
1860.46s - 1867.30s |  So I would say there are probably opportunities to insert one's bug bounty program into the
1867.30s - 1874.70s |  product life cycle, but when you think about from an industry perspective, there's a reason
1874.70s - 1880.14s |  that you have a bug bounty program, and that reason is so that you can take those vulnerability
1880.14s - 1883.90s |  reports that you get, you can analyze them, you can do trend analysis on them, and you
1883.90s - 1889.90s |  can force them back into your SDL, so your life cycle.
1889.90s - 1895.78s |  You want to not have that same kind of vulnerability pop up over and over again in succession or
1895.78s - 1899.14s |  in multiple products that use the same ingredients.
1899.14s - 1907.38s |  So if you don't do that part, then the only people who suffer are the product engineers
1907.38s - 1909.78s |  who are having to manage the reports on the other end.
1909.78s - 1913.70s |  So it's really important to integrate the bug bounty program back into the development
1913.70s - 1914.70s |  life cycle.
1914.70s - 1917.18s |  There are lots of ways to do that.
1917.18s - 1919.70s |  Chargebacks is one of my favorite.
1919.70s - 1924.44s |  For every payment that goes out to a bug hunter, you charge back the business unit that owns
1924.44s - 1928.30s |  that program.
1928.30s - 1932.50s |  So they feel the pain, that's the point, right?
1932.50s - 1937.78s |  If you don't know me, I've worked in this field for 20-something years.
1937.78s - 1940.42s |  I'm all out of carrots.
1940.42s - 1944.58s |  I only have sticks left.
1944.58s - 1949.10s |  So if the way to feel the pain and to make the change is going to be hitting someone's
1949.10s - 1953.78s |  pocketbook because that's what they understand, then that's what I'm going to do.
1953.78s - 1956.58s |  So it's all about completing that cycle, right?
1956.58s - 1961.86s |  If it gets to the end and you still have reports and those reports are the same reports over
1961.86s - 1968.34s |  and over again or the same template, then that template, that researcher is doing the
1968.34s - 1969.82s |  same thing over and over again.
1969.82s - 1973.74s |  They're finding multiple problems in multiple products, and we're playing whack-a-mole to
1973.74s - 1974.74s |  fix it.
1974.74s - 1976.86s |  That's not a good way to do it.
1976.86s - 1978.78s |  So that needs to go back to the red team.
1978.78s - 1982.30s |  The red team needs to go and fix all of those problems and all of those products and all
1982.30s - 1985.94s |  of those ingredients, and they need to be forced to do that sometimes.
1985.94s - 1991.42s |  So it's all about integrating and making sure that you're adequately using incentives both
1991.50s - 1993.90s |  on your bug side and on your internal side.
1993.90s - 1998.06s |  You know, real quick, you mentioned that there's only pain involved, but I don't think that's
1998.06s - 2002.50s |  pain from the bug hunter who is getting, you know, 30 different duplicates sent across
2002.50s - 2008.42s |  different targets and fishing for that payout 30X, which sometimes it's valid, sometimes
2008.42s - 2009.42s |  it's not.
2009.42s - 2010.42s |  What do you think?
2010.42s - 2015.62s |  It's pain whenever they've submitted 30 reports of the same they did the same thing 30 times
2015.62s - 2021.06s |  and got 30 different issues and then my team got wise to it and went back and did their
2021.74s - 2027.14s |  due diligence on all products and then suddenly that pipe is just dried up.
2027.14s - 2028.14s |  Which is ideal.
2028.14s - 2029.82s |  That's what we want.
2029.82s - 2033.78s |  So just to bring it back to bug bounty meta, something that I've done before, when I've
2033.78s - 2038.18s |  identified that you can find vulnerabilities on, let's say, 30 different products, do I
2038.18s - 2041.30s |  submit all 30 or do I submit two?
2041.30s - 2044.82s |  And then once those two get paid out, do I submit two more?
2044.82s - 2045.82s |  And so...
2045.82s - 2048.90s |  No, submit 30, because if you submit...
2048.90s - 2050.18s |  I get one payout.
2050.42s - 2051.42s |  No, not necessarily.
2051.42s - 2054.86s |  It depends on the program.
2054.86s - 2060.98s |  But if you submit two and then you wait, you've now given my engineers time to fix the product
2060.98s - 2067.22s |  in all the products, which means those 28 you were holding on to are no longer valid.
2067.22s - 2072.46s |  So I'm going to jump in for one second, because this is the perfect segue.
2072.46s - 2078.12s |  So talking about different ways to approach this, from both perspectives, what qualities
2078.12s - 2080.14s |  do the best programs for this have?
2080.14s - 2082.12s |  How are you doing that sort of dupe detection?
2082.12s - 2085.94s |  How are you playing that game and how are you finding the targets that you want?
2085.94s - 2089.34s |  And Katie, since I cut you off, you're the first person to take this one.
2089.34s - 2090.34s |  Oh, lord.
2090.34s - 2091.34s |  Okay.
2091.34s - 2092.34s |  What qualities?
2092.34s - 2093.34s |  Oh...
2093.34s - 2097.34s |  Well, now my train of thought's interrupted.
2097.34s - 2098.34s |  Chris goes...
2098.34s - 2099.34s |  Help me out.
2099.34s - 2102.22s |  Yeah, no problem.
2102.22s - 2106.90s |  So I think the general mantra for a program manager is to allocate budget towards the
2106.90s - 2109.72s |  areas that you want to reinforce behavior for.
2109.72s - 2114.04s |  So that can mean a couple of different things that are situational based on the bugs that
2114.04s - 2115.04s |  are coming in.
2115.04s - 2120.28s |  So if I'm running a program and one person has submitted, like, a template of vulnerability.
2120.28s - 2124.78s |  Let's say that I own a lot of infrastructure on the internet and they found something that
2124.78s - 2128.32s |  applies to a whole lot of those things.
2128.32s - 2133.32s |  I would appreciate knowing all of them at once as a bug bounty program manager.
2133.32s - 2138.36s |  But I also realize that, hey, this person could have given me one and I may have paid
2138.36s - 2139.82s |  them the same.
2139.82s - 2142.46s |  And so I think you need to reinforce the behavior that you want to see.
2142.46s - 2147.00s |  So if this is a good, high-quality researcher who gives great reports, they respond back
2147.00s - 2152.20s |  to you quickly, they're friendly, if you have the budget for it, pay them a multiple for
2152.20s - 2153.20s |  what it is.
2153.20s - 2158.08s |  Find a way to make whole based on the effort that they put into finding the thing.
2158.08s - 2161.16s |  And I think you can often see based on the report comes in, like, did someone run a scanner
2161.16s - 2164.80s |  for 30 minutes and stumble across something that is interesting and something we still
2164.80s - 2169.32s |  need to fix or did this require them going down the rabbit hole for two particular weeks
2169.32s - 2173.56s |  and then they found something really cool but maybe it's a one-to-many situation.
2173.56s - 2176.84s |  And not everyone has an infinite budget, so it's a little sticky there, but they probably
2176.84s - 2184.12s |  deserve more than a 1X payout, is it 2X, 4X, 8X, 20X, you know, half of what they submitted.
2184.12s - 2188.16s |  I think it's more important that you're fair and that good faith behavior goes both ways,
2188.16s - 2191.36s |  both as the researcher who's submitting the bug and saying, hey, I found a thing, I would
2191.36s - 2194.80s |  like something for what has been done, especially if you're going to make a code fix change
2194.80s - 2195.80s |  for any of that.
2195.80s - 2199.36s |  I think that's the general mantra, if you submit a bug, they make some change, it's
2199.36s - 2203.76s |  in scope, you should pay out, hill to die on.
2203.76s - 2206.44s |  But from the program manager's standpoint, it's going to depend on your budget.
2206.44s - 2210.36s |  You can't also just, like, bleed everything instantly because of this one thing that came
2210.36s - 2213.48s |  by because you might have a couple more quarters or the rest of the year to get through.
2213.48s - 2217.12s |  So you have to also, like, be the king that's managing your resources effectively as well
2217.12s - 2219.20s |  for your kingdom that is this bug bounty program.
2220.20s - 2222.20s |  How's that for seeding it and starting it off?
2222.20s - 2223.20s |  I appreciate that.
2223.20s - 2224.20s |  Yeah.
2224.20s - 2228.48s |  So, I mean, the best programs that I've seen are programs that are responsive, that have
2228.48s - 2232.52s |  interesting targets, that triage quickly, pay people quickly.
2232.52s - 2238.04s |  I've seen a lot of programs that don't really, they're kind of just templated, right?
2238.04s - 2243.16s |  They just took some, I don't mean to bash the platforms, but, like, they just did what
2243.16s - 2248.44s |  the platform said and followed that box, but they never really, like, thought about what
2248.44s - 2253.12s |  is my product and then what is the skill set that's needed in order to hack my product
2253.12s - 2257.36s |  and then how do I efficiently incentivize those skill sets, right?
2257.36s - 2259.76s |  So, like, I think there is something to the human element.
2259.76s - 2262.08s |  There's multiple kinds of researchers out there.
2262.08s - 2264.96s |  You have your traditional bug hunters that are motivated by the cash payout.
2264.96s - 2270.76s |  They're going to be happy to lob a report over the fence, and as long as they get paid,
2270.76s - 2271.76s |  they don't care.
2271.76s - 2274.92s |  They're not going to bother you about, like, disclosure windows or anything else.
2274.92s - 2279.12s |  Then you have recognition seekers, and I don't mean that negatively, but I mean people
2279.12s - 2282.36s |  who are, like, typically we see this in academics, right?
2282.36s - 2285.64s |  Academics often can't accept a bounty anyway, so they don't care.
2285.64s - 2288.20s |  They care about, can I talk about this at a conference?
2288.20s - 2290.60s |  Am I going to get my name next to a CBE for this?
2290.60s - 2298.12s |  They are looking for that, how do I make sure that I'm able to build my resume, build my
2298.12s - 2300.60s |  street cred based on my research, right?
2300.60s - 2304.24s |  So your academics are going to be, or your recognition seekers are going to be different
2304.24s - 2305.24s |  than your bug hunters.
2305.24s - 2307.20s |  They're going to be motivated by different things.
2307.20s - 2311.56s |  You have, like, friendly helpers, as we call them, so that's, like, government agencies
2311.56s - 2313.12s |  or sometimes other companies.
2313.12s - 2320.60s |  So sometimes my technology is similar to my competitor's technology, and if I get a report
2320.60s - 2325.80s |  that I know that impacts my competitor, I tell them.
2325.80s - 2330.80s |  We have a number, we call the bat line, and we say, hey, other company, this impacts me
2330.80s - 2333.56s |  and it probably impacts you too, and they do the same.
2333.56s - 2336.24s |  So those are kind of, like, friendly helpers, right?
2336.24s - 2341.48s |  So each one of those different kinds of motivations often requires a different kind of incentive.
2341.48s - 2345.88s |  So there's different things that you can do as a program to incentivize the skill set
2345.88s - 2348.16s |  that you want and the results that you want.
2348.16s - 2349.80s |  Payouts is one of them.
2349.80s - 2356.16s |  The other things that you can do are things like, we call it CPEs for CBEs, right?
2356.16s - 2358.36s |  So continuing education credits, right?
2358.36s - 2360.80s |  Like a lot of people have certifications.
2360.80s - 2366.60s |  And if you find a CBE, it's very easy for me as a bug bounty manager to literally write
2366.60s - 2371.44s |  out a certificate for that bug hunter, and they can take that back to whoever owns their,
2371.44s - 2376.56s |  you know, whether it's EC Council or ISACA or whoever owns that certification, and they
2376.56s - 2379.92s |  can get continuing education credits for the work that they do.
2379.92s - 2384.88s |  That's going to motivate some people more than a payout will.
2384.88s - 2387.76s |  Working with researchers to make sure that their timelines are met so they can talk at
2387.76s - 2392.48s |  a conference, or working with them to help improve their overall talk at a conference,
2392.48s - 2398.30s |  or working with them to help them improve their paper that's going to get published.
2398.30s - 2403.44s |  Those things are specific incentives that you can do to make sure that you're getting
2403.44s - 2405.48s |  the quality results.
2405.48s - 2408.92s |  So I think that the best bug bounty programs are responsive.
2408.92s - 2413.40s |  They're responsive to the needs of the product, and they're responsive to the needs of the
2413.40s - 2417.44s |  researchers or the constituents that they want to get those results from.
2417.44s - 2422.48s |  It's all about figuring out what that balance is.
2422.48s - 2426.04s |  Just to use, like, some concrete examples, maybe, like, as a program manager, like, do
2426.04s - 2429.60s |  you know who your top bug bounty hunters are?
2429.60s - 2431.24s |  Like what motivates them?
2431.24s - 2432.24s |  Why are they there?
2432.24s - 2438.16s |  And then similarly, as a program manager, like, do you know what matters to the business?
2438.16s - 2447.00s |  Like, going beyond CV or CVSS score, sorry, like, what is a crit, you know, to your business?
2447.00s - 2451.31s |  And it's not always RCE, necessarily.
2451.31s - 2453.91s |  Yeah, bonuses are delightful, too.
2453.91s - 2458.47s |  Just because, like, sometimes you get locked in this, like, legal world where there's a
2458.47s - 2463.03s |  definition of the word bounty, and you can have a bounty schedule, but your legal won't
2463.03s - 2468.07s |  let you change from what that bounty definition is, because it's tied to a specific thing
2468.07s - 2471.15s |  and it's tied to, like, what is the definition of vulnerability?
2471.15s - 2477.35s |  So you can be creative sometimes with payouts on things, like, if you change, kind of change
2477.35s - 2483.23s |  the definition and say this may not be a traditional vulnerability, which equals a CVE, which equals
2483.23s - 2488.83s |  this payout based on criticality, which is our process, you can sometimes say, like,
2488.83s - 2493.75s |  based on budget, will my company take action based on this report?
2493.75s - 2494.75s |  Right?
2494.75s - 2495.75s |  That's a guiding principle.
2495.75s - 2499.51s |  You can say, if my company will take action based on this report, then this report has
2499.51s - 2505.11s |  value to me, and then I have a set bonus scale, like, to what level will my company take action
2505.11s - 2506.11s |  on this report?
2506.11s - 2510.79s |  Will my company put out a document change and suddenly change the way that the security
2510.79s - 2512.23s |  guidance is applied?
2512.23s - 2516.79s |  Well, that might be worth a certain amount of money, and that's a bonus payment I can
2516.79s - 2521.85s |  pay to that researcher, because I appreciate their, I appreciate the work that they put
2521.85s - 2528.37s |  into finding that issue, security issue, and sending it to me, and so now I can fix
2528.37s - 2532.89s |  something that I didn't know was a problem, even if it's not a traditional patch.
2532.89s - 2538.93s |  So I think you should be creative in the ways that you think about what is a security harm
2538.93s - 2544.33s |  versus a vulnerability, and how do we reward positive behavior?
2544.33s - 2545.33s |  Swag motivates.
2545.33s - 2546.33s |  It helps.
2546.33s - 2547.33s |  All right.
2547.33s - 2549.80s |  Thank you.
2550.08s - 2551.08s |  Thank you.
2551.08s - 2555.96s |  So hopping on, sort of touching back on something Kuskos had mentioned earlier, and something
2555.96s - 2560.12s |  we've had a few talks on at DEF CON and AppSec Village and whatnot in the past, and yes,
2560.12s - 2562.52s |  we did skip a question.
2562.52s - 2566.52s |  What are your thoughts on bounty farming, and if you had to put a specific definition
2566.52s - 2572.44s |  or your spin on bounty farming, what would you qualify it as?
2572.44s - 2574.16s |  And Kuskos, this one's you to start.
2574.16s - 2575.16s |  All right.
2575.16s - 2579.08s |  So does anyone here not know what bounty farming is, just looking at the terminology?
2579.08s - 2580.08s |  Okay.
2580.08s - 2584.28s |  So let's say that you have a platform that is vulnerable to a particular thing, and that
2584.28s - 2588.20s |  platform is like a business-to-business sort of thing, so they themselves have customers
2588.20s - 2592.84s |  who are using that platform, those customers roll it out for their clients to use.
2592.84s - 2597.84s |  And so if the vulnerability exists in the platform, should I be reporting that vulnerability
2597.84s - 2600.76s |  to the main parent company, or to all the child companies who are running it who may
2600.76s - 2602.72s |  have their own security teams?
2602.72s - 2607.00s |  And so when that happens, you end up in this situation, and so again, one to many.
2607.00s - 2611.36s |  And so who is responsible for paying that bounty?
2611.36s - 2615.42s |  My personal thought is that the most, at least when we're talking about the fundamentals
2615.42s - 2619.34s |  of what happened, you've identified a risk, you've reported the risk, and does the entity
2619.34s - 2622.00s |  that you're reporting to agree that it is a risk?
2622.00s - 2623.00s |  Sometimes there's semantics involved.
2623.00s - 2626.26s |  You know, we try to do what we can with prioritization and threat levels, and just something to convey
2626.26s - 2629.44s |  across the aisle of if something is bad, how bad is it?
2629.44s - 2635.24s |  And obviously the game in this is we want to explain the situation in such a way to
2635.24s - 2638.72s |  where the damages are material, and we can remediate it.
2638.72s - 2643.84s |  If that company pushes a line of code or changes configuration in response to what you've provided,
2643.84s - 2648.24s |  I think that most people will agree that that person has earned a reward, whatever the reward
2648.24s - 2649.24s |  may be.
2649.24s - 2651.20s |  You know, if they have a budget, spend the budget towards it.
2651.20s - 2654.60s |  If they don't have a budget, at the very least some swag of some sort, or, you know, I've
2654.60s - 2658.40s |  done vulnerabilities, or I've reported vulnerabilities in place just so that I could be on, like,
2658.40s - 2660.44s |  a thank you page on their website.
2660.44s - 2664.64s |  Building the CD is material, too, for you.
2664.64s - 2668.64s |  Everyone should pay, and it's unfortunate when there becomes conflict there between
2668.64s - 2673.52s |  who it is, especially when you have platforms who often shift something out in a secure
2673.52s - 2677.92s |  by default way, or at least they've done their best attempt at secure by default.
2677.92s - 2681.96s |  The customer of that particular platform gets it, and they change settings so that their
2681.96s - 2683.52s |  users can log into it easier.
2683.52s - 2689.24s |  A great example is lack of 2FA, and I don't want to name any particular platforms.
2689.24s - 2690.24s |  Just think.
2690.24s - 2691.24s |  There's a lot of them.
2691.60s - 2695.88s |  Let's say that it shifts with 2FA enabled, and a strong password complexity.
2695.88s - 2699.92s |  That gets to the client who's buying that particular platform, and let's say that that
2699.92s - 2702.12s |  client has a non-technical user base.
2702.12s - 2706.20s |  Those user base don't want to use 2FA, or they don't want to use password managers for
2706.20s - 2709.28s |  high-entropy passwords, and so now you end up with a situation where you can have eight
2709.28s - 2714.08s |  lowercase characters as an extreme for a password, and some bug bounty hunter is saying, hey,
2714.08s - 2718.44s |  there's low password entropy here on this particular authentication mechanism.
2718.48s - 2721.92s |  If that particular instance is vulnerable, the main parent company for it shipped it
2721.92s - 2728.56s |  out by secure by default, they could have many child companies that are all doing this,
2728.56s - 2731.48s |  and so there is a vulnerability there, but is it really?
2731.48s - 2735.64s |  We get to the semantics argument, and when you find that situation, and I've found that
2735.64s - 2738.76s |  situation, when I'm typing up the report, I almost have to ask myself how much do I
2738.76s - 2744.56s |  want to spend in my time and effort arguing that it is something that should be changed,
2744.56s - 2749.04s |  especially if that particular business is doing it such that they can have customers
2749.04s - 2751.12s |  that use their platform a little bit more.
2751.12s - 2753.60s |  So there's a lot of nuance there.
2753.60s - 2757.80s |  I think that it goes back fundamentally to being accepting of people who are going to
2757.80s - 2760.52s |  bring risk to you, and then figuring out what you can do about it.
2760.52s - 2765.08s |  If there has to be some sort of, like, discussion between that particular client and the parent
2765.08s - 2768.08s |  company on who's going to pay out for it, unfortunately it needs to be had, and not
2768.08s - 2769.72s |  everyone has those dialogues for it.
2769.72s - 2773.28s |  I mean, you know, at best sometimes you have, like, customer service rep from node one talking
2773.28s - 2775.92s |  to customer service rep from node two.
2775.92s - 2779.36s |  Maybe one of them only has access to the security company, and there's just so much red tape
2779.36s - 2782.12s |  in the way that you're not going to get a practical solution in any meaningful amount
2782.12s - 2783.12s |  of time.
2783.12s - 2786.04s |  So what ends up happening is that that bounty researcher is frustrated.
2786.04s - 2788.64s |  They feel like they've spent a whole lot of effort on something, or maybe they haven't,
2788.64s - 2792.28s |  but they still typed up the report and brought something to your attention.
2792.28s - 2797.26s |  I don't think we have anyone who really says that, or I haven't seen, like, a thing was
2797.26s - 2801.68s |  shipped to us in this secure by default way, and then we've changed it, and we're not going
2801.68s - 2804.28s |  to you because it's part of how our business operates.
2804.28s - 2805.28s |  I've seen that.
2805.28s - 2806.28s |  Have you?
2806.28s - 2807.28s |  Yeah.
2807.28s - 2811.68s |  Because, and so I sit on the CVE board, just for full disclosure there.
2811.68s - 2818.38s |  So I've been a CVE board member for 10 years, and when we get into, like, traditional definition
2818.38s - 2822.68s |  of what is a vulnerability, what you're describing is a misconfiguration and not a vulnerability.
2822.68s - 2827.88s |  And so some companies will say that's a misconfiguration and not a vulnerability, because it was, the
2827.88s - 2832.04s |  device is operating as intended.
2832.04s - 2834.52s |  It's a shit secure practice, like, security practice.
2834.52s - 2840.36s |  Like, it's not a good practice, but it was set up that way to be that way because the
2840.36s - 2845.32s |  customer wanted it that way, and that's the implementation of the device, not the device.
2845.32s - 2846.76s |  So yeah, I've seen that.
2846.76s - 2847.76s |  Okay.
2847.76s - 2852.24s |  So let's say it's not a, let's get to something more practical, and like, okay, it's not,
2852.24s - 2853.24s |  it's not a misconfiguration.
2853.24s - 2856.64s |  The product's been shipped out, people are using it, and let's just say it's like cross-site
2856.64s - 2858.16s |  scripting on the login page.
2858.16s - 2861.60s |  So you know, improper user name, the user name comes back reflected with whatever input
2861.60s - 2866.28s |  the user gave it, and so now every installation of this is vulnerable to this particular thing.
2866.28s - 2868.40s |  What's that?
2868.40s - 2869.40s |  Still a misconfiguration.
2869.40s - 2870.40s |  Still a misconfiguration.
2870.40s - 2871.40s |  Okay.
2871.40s - 2876.54s |  Well, let's say that...
2876.54s - 2877.54s |  Log for chair.
2877.54s - 2880.66s |  Apache zero day.
2880.66s - 2882.70s |  All of those.
2882.70s - 2885.14s |  But something more tangible that affects all the different installations.
2885.26s - 2889.40s |  So each one should be racing to fix it, but they're likely going to have different security
2889.40s - 2891.26s |  maturity mechanisms.
2891.26s - 2894.58s |  The fastest way for something like that to get fixed, especially in a zero day situation,
2894.58s - 2898.98s |  is if the parent company fixes it at the platform level, and then that is automatically cascading
2898.98s - 2902.02s |  down to everyone who has their own installations of it.
2902.02s - 2905.14s |  Unless those are too custom, such that it can't accept the update, and I've seen that
2905.14s - 2907.22s |  happen before, too.
2907.22s - 2911.26s |  In that situation, my personal opinion is that the parent company should pay for it,
2911.26s - 2916.58s |  but then again, at that same time, is this a one-to-many payout, or is it a one-to-one?
2916.58s - 2919.98s |  Because let's say that you, reporting this vulnerability to the parent company, has fixed
2919.98s - 2923.74s |  a thousand different installations, and you wanted to have the argument that this was
2923.74s - 2929.53s |  like a thousand SQL injections, or a thousand RCEs.
2929.53s - 2933.99s |  So at least my view on this anyways is, like, if you're...
2933.99s - 2934.99s |  If you find it...
2934.99s - 2935.99s |  Using Apache as an example.
2935.99s - 2939.79s |  If you find a zero day on Apache, I want to hear about it, because it impacts my products.
2939.79s - 2944.31s |  If you're reporting a one day, as in something that's been...
2944.31s - 2947.83s |  A CVE has been issued for it, and a patch has been published, and we have to go pick
2947.83s - 2952.23s |  up the patch, it's probably already in our pipeline.
2952.23s - 2958.03s |  I like policies where there's a 30-day window, essentially, where the program has a chance
2958.03s - 2963.79s |  to fix things, and then you can go and report something after a certain amount of time.
2963.79s - 2969.35s |  But for original research, I think part of bug bounty is to incentivize that.
2969.35s - 2971.35s |  That's my view, anyways.
2971.35s - 2976.03s |  Yeah, I'd say it comes down to how well was your program terms written, right?
2976.03s - 2980.39s |  So every company that's running a bug bounty program should take the time to look at their
2980.39s - 2983.23s |  product and look at their bug bounty terms.
2983.23s - 2984.23s |  And if you have something...
2984.23s - 2990.47s |  I mean, you can eliminate those one-to-one, one-to-many, by simply saying that the vulnerability
2990.47s - 2996.03s |  is tied to the vulnerable code, not how many instances of the vulnerable code exist.
2996.03s - 3002.39s |  So you root cause it, basically, but you need to make that real clear in your terms well
3002.39s - 3005.99s |  before someone comes to you with that problem.
3005.99s - 3010.47s |  And that is something that can be thought about real early on.
3010.47s - 3011.55s |  It shouldn't be a surprise.
3011.55s - 3016.67s |  You shouldn't get a researcher submitting 100 tickets for the same kind of problem,
3016.67s - 3018.59s |  that roots down to one.
3018.59s - 3019.59s |  Submit all your tickets.
3019.71s - 3020.71s |  Don't do it two at a time.
3020.71s - 3025.55s |  All you're doing is screwing yourself.
3025.55s - 3026.55s |  Because it goes by the day.
3026.55s - 3027.55s |  I'm telling you, all you're doing is screwing yourself.
3027.55s - 3030.99s |  If you give me 30 tickets, and they're all different, substantially different, I'm going
3030.99s - 3034.79s |  to pay each one of those tickets, if you hold them, and then I fix that problem, and I've
3034.79s - 3039.95s |  just negated your entire research that you had on 28 other tickets, give them to me now.
3039.95s - 3042.59s |  Give me all the tickets.
3042.59s - 3043.59s |  But it...
3043.59s - 3044.59s |  Yeah.
3044.59s - 3047.95s |  I think the program terms are really important, right?
3047.99s - 3051.71s |  So, like, thinking through your use cases and thinking through, like, this could happen,
3051.71s - 3055.43s |  and I need to be very clear with my researchers before they ever start working on my product
3055.43s - 3058.03s |  that these are the terms that are going to get paid out, and I can't be changing the
3058.03s - 3061.23s |  game halfway through after they've submitted a report.
3061.23s - 3062.55s |  Like, that's not cool.
3062.55s - 3063.55s |  That's not kosher.
3063.55s - 3064.55s |  You don't do that.
3064.55s - 3065.55s |  They submitted the report.
3065.55s - 3067.47s |  You pay the report under the terms that currently exist.
3067.47s - 3069.91s |  You change your terms later, well, then you have a cutoff date.
3069.91s - 3073.63s |  You say anything comes past this time is going to be subject to these terms.
3073.63s - 3075.35s |  But if you submitted it before, then you fall.
3075.35s - 3077.47s |  Like, it's just being fair and being honest and being decent.
3077.99s - 3078.99s |  Like, so you build that trust.
3078.99s - 3082.99s |  If you don't have that trust, then why would a researcher submit the vulnerability to you
3082.99s - 3085.11s |  and not sell it?
3085.11s - 3088.03s |  So do the right thing and build trust.
3088.03s - 3091.83s |  So again, because the title of this whole panel is the realities of bug bounty life,
3091.83s - 3098.55s |  I want to go back to what are the realities, what are my incentives to actually report
3098.55s - 3103.35s |  this to the main parent program, which, let's say, okay, they're either going to pay nothing
3103.43s - 3108.03s |  or they'll treat it as one valid unique thing and they luck out by fixing it and it fixes
3108.03s - 3111.59s |  all the other multiple installations that are wrong.
3111.59s - 3112.59s |  Or incorrect, rather.
3112.59s - 3113.59s |  Not wrong.
3113.59s - 3114.59s |  Security is hard to do.
3114.59s - 3119.07s |  We want to be very blameless about remediation.
3119.07s - 3123.63s |  I can either not get paid or get paid or maybe get paid a multiple if I submit it to the
3123.63s - 3124.91s |  parent company.
3124.91s - 3129.91s |  If they have a child company who's using that platform and they have a security team, I
3129.91s - 3132.11s |  can submit it to them and the exact same thing may happen.
3132.11s - 3133.11s |  Read the terms.
3133.11s - 3134.11s |  Read the terms.
3134.11s - 3135.11s |  And I should read the terms.
3135.11s - 3137.43s |  And get as many vulnerabilities as you can.
3137.43s - 3138.43s |  Read all the terms.
3138.43s - 3139.43s |  I promise.
3139.43s - 3140.67s |  I'm getting to this.
3140.67s - 3144.19s |  We as bug bounty program managers, we know who's bounty farming.
3144.19s - 3145.19s |  We talk to each other.
3145.19s - 3146.63s |  We're all doing the same thing.
3146.63s - 3150.43s |  And if you submit a vulnerability to ten different security programs that is all basically the
3150.43s - 3154.19s |  same thing, I'm just going to throw WordPress out there because there's a million WordPress
3154.19s - 3156.19s |  installations and nearly every company is using it to some degree.
3156.19s - 3159.27s |  If you find a WordPress vulnerability, instead of submitting it to WordPress and instead
3159.27s - 3163.03s |  you submit it to a company who's using it, they may pay out.
3163.03s - 3164.03s |  This one may pay out.
3164.03s - 3165.03s |  This one may pay out.
3165.03s - 3167.23s |  And then the next thing you know, we're like, hey, I'm getting all these reports for WordPress.
3167.23s - 3168.75s |  Oh, I got that too.
3168.75s - 3172.33s |  Oh, this person is bounty farming.
3172.33s - 3174.43s |  We understand why it happens.
3174.43s - 3178.35s |  But also, I don't think you're going to win any good favors with the people who are inviting
3178.35s - 3181.07s |  you to programs who are trying to create good targets for you.
3181.07s - 3185.03s |  And so, like, intent really is everything there and it should be both ways.
3185.03s - 3188.47s |  Both from the researcher side, it's probably an unethical thing to do, but again, it is
3188.47s - 3189.47s |  the reality.
3189.47s - 3190.47s |  It probably happens.
3190.47s - 3193.15s |  Also, they might be younger in their career and not know there's a parent company doing
3193.15s - 3194.51s |  it.
3194.51s - 3198.87s |  Maybe they've found some, you know, there's a single sign-on, for instance, and they've
3198.87s - 3203.07s |  found an issue with a particular single sign-on instance for one particular product, not knowing
3203.07s - 3205.07s |  that, like, it's Okta behind the scenes or something.
3205.07s - 3206.71s |  It's not always very apparent.
3206.71s - 3209.47s |  It often is, but it doesn't have to be.
3209.47s - 3212.59s |  How do they know that that should go to, like, the main SSO provider?
3212.59s - 3216.35s |  And so, I think it comes down to giving them an opportunity to kind of just, like, state
3216.35s - 3219.43s |  their case, and if they've found a multiple thing that applies to many things, that's
3219.43s - 3220.43s |  fine.
3220.43s - 3225.19s |  Like, I know someone who knows, like, some really cool exploits with headless Chrome
3225.19s - 3226.63s |  browsers.
3226.63s - 3230.15s |  And so, anywhere where he sees that feature operating in an application, yeah, that should
3230.15s - 3235.67s |  be fair game for him to go seek it out, because the configuration of that particular product
3235.67s - 3237.59s |  might be different than the product itself.
3237.59s - 3240.71s |  Again, it just comes down to intent and good faith, researcher.
3240.71s - 3241.71s |  State your case.
3241.71s - 3244.63s |  Know, you know you're doing something bad if you're doing it, and the people on the
3244.63s - 3248.47s |  receiving end will become wise to it eventually.
3248.47s - 3249.47s |  That is the reality of it.
3249.47s - 3250.47s |  I'm going to differentiate.
3250.47s - 3254.11s |  I know we've got to wrap up, but I'm just going to say real quick, hate the game, not
3254.11s - 3255.11s |  the player.
3255.11s - 3256.11s |  Yeah.
3256.11s - 3260.35s |  I run a bug bounty program at a company, right?
3260.35s - 3262.31s |  Like, we all talk to each other.
3262.31s - 3264.31s |  There's a whole big community of bug bounty managers.
3264.31s - 3265.31s |  We have honest conversations.
3265.31s - 3268.99s |  All of us are part of it.
3268.99s - 3274.91s |  But if you find it, submit it, like, if you get paid out twice, you get paid out twice.
3274.91s - 3276.39s |  If you get paid out ten times, you get paid out ten times.
3276.39s - 3280.11s |  I'm not going to hate somebody because they submitted it to me and then they submitted
3280.11s - 3282.27s |  it to a competitor and they submitted it to somebody else.
3282.27s - 3283.27s |  Like, okay.
3283.27s - 3285.27s |  I'm going to stick in my lane.
3285.27s - 3288.67s |  I'm going to pay the stuff that I agreed to have paid to.
3288.67s - 3289.95s |  So hate the game.
3289.95s - 3290.95s |  Don't hate the player.
3290.95s - 3294.91s |  But at the same time, if the company says, sorry, this isn't my product because this
3294.91s - 3298.63s |  is actually this parent company's product, don't fight that.
3299.27s - 3301.11s |  Just let it go.
3301.11s - 3304.19s |  Because it's not going to be worth anybody's time fighting it and you're just going to
3304.19s - 3305.95s |  lose any good will you had.
3305.95s - 3309.07s |  I do also think that if that happens, you know, in the interest of trying to create
3309.07s - 3313.83s |  a strong community around this and bringing legitimacy to it, that company probably has
3313.83s - 3318.59s |  stepped into some era of responsibility for walking that up the chain, seeing if it will
3318.59s - 3320.99s |  be valid for that other particular program.
3320.99s - 3322.79s |  And bug bounties are not taboo anymore.
3322.79s - 3326.99s |  We're ten years into this maturing as its own particular vertical of security.
3327.99s - 3330.99s |  If you notice that a company doesn't have a responsible disclosure program, I'm pretty
3330.99s - 3332.83s |  sure they're considered less than.
3332.83s - 3336.59s |  Now there are very tactful ways for us to have that conversation as part of a maturity
3336.59s - 3342.31s |  effort and growing what you're trying to protect your customers from becoming exploited towards.
3342.31s - 3346.79s |  But I do think that that whichever company gets the thing that says, hey, this isn't
3346.79s - 3350.67s |  my problem, it's someone else's, would probably be behooved to walk that up the chain and
3350.67s - 3354.67s |  see if they can redirect that researcher to a good program.
3354.67s - 3357.43s |  The same way that we ask for researchers to be good-faith researchers, I think that
3357.43s - 3358.83s |  we should be good-faith program managers.
3358.83s - 3363.03s |  Yeah, don't just close the report and be like, not my problem.
3363.03s - 3366.31s |  Close the report and tell the researcher, hey, not my problem, I can't fix this, but
3366.31s - 3370.15s |  you should go talk to this person at this company because they have a bug bounty program
3370.15s - 3372.95s |  and your report is valid for them.
3372.95s - 3377.11s |  It takes just a little bit more time to do that, and it's going to probably save the
3377.11s - 3381.51s |  relationship between the researcher and the company by doing that.
3381.51s - 3382.51s |  All right.
3382.55s - 3384.63s |  And that is perfect because we're going to end right on time.
3384.63s - 3386.83s |  Obviously, we don't have time for Q&A.
3386.83s - 3390.19s |  If you do want to chat with any of us, find us out in the hall right afterwards.
3390.19s - 3391.75s |  Thank you, and here's how you can get in touch with everybody.


