# MediaChunks

chunk_text:
uh, Prius SE but uh, the precondition of it make it quite unlikely but 2221.26s - 2226.26s | yeah, it's still a fun one. So, for the context uh, that application uh, was using 2231.34s - 2236.34s | Laminas PHP library to for everything that is using like emails. Laminas is doing a lot of 2240.08s - 2245.94s | checks and transformation to be sure that the email is valid and things like that. There's 2245.98s - 2252.16s | like a lot of different label uh, libraries there. And on the application we're testing uh, 2252.16s - 2257.16s | we have uh, control over a from header that will be uh, used for sending some emails. So, 2261.50s - 2266.50s | that from header will be passed uh, over the fifth argument of mail for those who know uh, 2268.60s - 2275.08s | mail function uh, of a fifth argument that is like arguments that will be passed to the 2275.12s - 2280.12s | send mail uh, binary. So, if that fifth argument is uh, completely controlled by an attacker, 2282.50s - 2287.50s | you can have like argument injection to the send mail binary. There are like known exploit to 2289.10s - 2294.10s | that uh, but it definitely depends on the MTA that is used. So, uh, every MTA is shipped with 2297.84s - 2302.84s | different send mail binaries. So, for this uh, talk, we will consider uh, send mail MTA 2305.48s - 2311.46s | here. That's like a first priority condition. Why send mail? Because I'm cheating. That's my 2311.46s - 2316.46s | bug. I decide whatever is the condition. So, that's what uh, I want to be. So, uh, the 2322.94s - 2327.94s | problem is Laminas validating email address. We can't like put anything that is not a valid 2328.38s - 2333.38s | email address. Uh, Laminas is supporting uh, cutted string uh, format. So, uh, double quotes 2337.12s - 2342.12s | and pretty much anything. Uh, dot atom format that's like the standard uh, email format. Uh, 2343.96s - 2348.96s | for that they are using super big regex. Uh, that was super hard to read. And yeah, the thing 2349.70s - 2354.70s | is uh, they are also using uh, escape shell lag uh, on the email before being used on the uh, 2362.34s - 2367.34s | mail function. But uh, PHP


chunk_text:
to 2289.10s - 2294.10s | that uh, but it definitely depends on the MTA that is used. So, uh, every MTA is shipped with 2297.84s - 2302.84s | different send mail binaries. So, for this uh, talk, we will consider uh, send mail MTA 2305.48s - 2311.46s | here. That's like a first priority condition. Why send mail? Because I'm cheating. That's my 2311.46s - 2316.46s | bug. I decide whatever is the condition. So, that's what uh, I want to be. So, uh, the 2322.94s - 2327.94s | problem is Laminas validating email address. We can't like put anything that is not a valid 2328.38s - 2333.38s | email address. Uh, Laminas is supporting uh, cutted string uh, format. So, uh, double quotes 2337.12s - 2342.12s | and pretty much anything. Uh, dot atom format that's like the standard uh, email format. Uh, 2343.96s - 2348.96s | for that they are using super big regex. Uh, that was super hard to read. And yeah, the thing 2349.70s - 2354.70s | is uh, they are also using uh, escape shell lag uh, on the email before being used on the uh, 2362.34s - 2367.34s | mail function. But uh, PHP is automatically applies escape shell command to the entire 2370.74s - 2377.26s | command uh, when calling mail uh, that will apply escape shell command to send mail. Uh, 2377.32s - 2382.32s | double escape means uh, no escape at all. Means argument injection, thanks PHP. So, I 2386.64s - 2392.48s | know the problem is uh, Laminas also application I don't know is uh, lower casing 2392.48s - 2397.48s | email and every exploit for uh, send mail are generally using uh, the C and the X 2401.18s - 2406.18s | uppercase arguments with very long pass. And the other problem is we are limited to 2408.96s - 2415.50s | 64 characters for the local path and definitely if you need like long pass uh, for two 2415.50s - 2420.50s | arguments that's definitely not cool because we are like limited in size. Painful, I was like a 2422.88s - 2427.88s | bit in despair I was pretty sure that won't be exploitable at all but yeah, I still decided to 2431.12s - 2436.12s | make like both of testing. I was pretty much like that after a few years. But at some point 2439.46s - 2444.46s | I


chunk_text:
is automatically applies escape shell command to the entire 2370.74s - 2377.26s | command uh, when calling mail uh, that will apply escape shell command to send mail. Uh, 2377.32s - 2382.32s | double escape means uh, no escape at all. Means argument injection, thanks PHP. So, I 2386.64s - 2392.48s | know the problem is uh, Laminas also application I don't know is uh, lower casing 2392.48s - 2397.48s | email and every exploit for uh, send mail are generally using uh, the C and the X 2401.18s - 2406.18s | uppercase arguments with very long pass. And the other problem is we are limited to 2408.96s - 2415.50s | 64 characters for the local path and definitely if you need like long pass uh, for two 2415.50s - 2420.50s | arguments that's definitely not cool because we are like limited in size. Painful, I was like a 2422.88s - 2427.88s | bit in despair I was pretty sure that won't be exploitable at all but yeah, I still decided to 2431.12s - 2436.12s | make like both of testing. I was pretty much like that after a few years. But at some point 2439.46s - 2444.46s | I saw that uh, there was like a stranger if my email contains uh, uh, right angle brackets. 2447.60s - 2454.30s | So, if I put XSX uh, right angle bracket at black dot east I received by the app invalid 2454.30s - 2459.32s | domain black dot east right bracket. I was like such, such strange that's definitely not 2459.32s - 2464.32s | the domain I put in my mail. So, I decided to debug the behavior so Laminas uh, did uh, the 2464.98s - 2469.98s | validation of the email. Laminas and the app uh, were crafting a full email with headers and 2473.82s - 2478.82s | the body and put the email in the from uh, header. Then uh, Laminas passed the generated 2481.60s - 2486.60s | email. Then the app is extracting the sender again from it. Validates that it's still a 2487.42s - 2492.42s | valid email. So, painful process. So, I was like okay but that doesn't explain the error. So, 2498.14s - 2503.14s | that's a traditional from header so it's just uh, double quotes your name, double quotes and in 2505.38s - 2510.38s | brackets uh, the full email. But when I tried


chunk_text:
saw that uh, there was like a stranger if my email contains uh, uh, right angle brackets. 2447.60s - 2454.30s | So, if I put XSX uh, right angle bracket at black dot east I received by the app invalid 2454.30s - 2459.32s | domain black dot east right bracket. I was like such, such strange that's definitely not 2459.32s - 2464.32s | the domain I put in my mail. So, I decided to debug the behavior so Laminas uh, did uh, the 2464.98s - 2469.98s | validation of the email. Laminas and the app uh, were crafting a full email with headers and 2473.82s - 2478.82s | the body and put the email in the from uh, header. Then uh, Laminas passed the generated 2481.60s - 2486.60s | email. Then the app is extracting the sender again from it. Validates that it's still a 2487.42s - 2492.42s | valid email. So, painful process. So, I was like okay but that doesn't explain the error. So, 2498.14s - 2503.14s | that's a traditional from header so it's just uh, double quotes your name, double quotes and in 2505.38s - 2510.38s | brackets uh, the full email. But when I tried to inject XXX right brackets at black dot east 2511.00s - 2516.00s | that was like the from that was generated. So, we have like an injection in the email 2518.74s - 2523.74s | part but that's quite useless in my opinion. Uh, there was like no CRLF, there was like 2527.08s - 2532.08s | protection and mechanism to prevent that. So, I was like okay that's definitely useless. 2533.76s - 2538.76s | But I decided to like investigate because that's quite a dirty thing still. So, yeah. 2541.20s - 2546.20s | I read uh, a lot of RFC, a lot of documentation and I saw there's like something called uh, 2549.14s - 2554.14s | my man coded words. So, uh, that's described by the uh, the RFC 2047. That's for using 2558.22s - 2563.22s | special characters in uh, email headers and body. That's a format so uh, it was seen uh, 2563.94s - 2568.94s | integration point, cassettes, encoding and then you can use like uh, little characters using 2573.48s - 2578.48s | their hexadecimal code uh, with uh, equal thing. So, in that case I'd like generate AAA. 2582.78s - 2587.78s | So, all the characters that


chunk_text:
to inject XXX right brackets at black dot east 2511.00s - 2516.00s | that was like the from that was generated. So, we have like an injection in the email 2518.74s - 2523.74s | part but that's quite useless in my opinion. Uh, there was like no CRLF, there was like 2527.08s - 2532.08s | protection and mechanism to prevent that. So, I was like okay that's definitely useless. 2533.76s - 2538.76s | But I decided to like investigate because that's quite a dirty thing still. So, yeah. 2541.20s - 2546.20s | I read uh, a lot of RFC, a lot of documentation and I saw there's like something called uh, 2549.14s - 2554.14s | my man coded words. So, uh, that's described by the uh, the RFC 2047. That's for using 2558.22s - 2563.22s | special characters in uh, email headers and body. That's a format so uh, it was seen uh, 2563.94s - 2568.94s | integration point, cassettes, encoding and then you can use like uh, little characters using 2573.48s - 2578.48s | their hexadecimal code uh, with uh, equal thing. So, in that case I'd like generate AAA. 2582.78s - 2587.78s | So, all the characters that is used uh, in the MIME uncoded words notation are also valid 2588.66s - 2593.66s | characters in an email address. At least uh, in the double uh, double code encoded 2596.60s - 2601.60s | formats. So, I was like maybe I can inject MIME uncoded words in my uh, sender email. 2605.54s - 2610.54s | So, uh, that will be put in the mail headers and when extracted back by Laminas, it will like 2610.88s - 2615.88s | pass the MIME uncoded words and generate an email that will maybe contain uh, some uh, 2618.98s - 2623.98s | parameter injection to send mail. So, uh, I needed uh, some spaces to like inject another 2628.16s - 2633.16s | argument to send mail. Uh, but uh, equal 20 is forbidden by the specification of the RFC but I 2633.96s - 2638.96s | found that uh, underscore is defined as a space by the RFC. So, we can uh, just input uh, 2643.40s - 2648.40s | spaces by using an underscore. Don't ask me why, there's probably a reason for that. So, as we 2651.08s - 2656.08s | saw uh, the send mail uh, send mail payload is always uh, needing


chunk_text:
is used uh, in the MIME uncoded words notation are also valid 2588.66s - 2593.66s | characters in an email address. At least uh, in the double uh, double code encoded 2596.60s - 2601.60s | formats. So, I was like maybe I can inject MIME uncoded words in my uh, sender email. 2605.54s - 2610.54s | So, uh, that will be put in the mail headers and when extracted back by Laminas, it will like 2610.88s - 2615.88s | pass the MIME uncoded words and generate an email that will maybe contain uh, some uh, 2618.98s - 2623.98s | parameter injection to send mail. So, uh, I needed uh, some spaces to like inject another 2628.16s - 2633.16s | argument to send mail. Uh, but uh, equal 20 is forbidden by the specification of the RFC but I 2633.96s - 2638.96s | found that uh, underscore is defined as a space by the RFC. So, we can uh, just input uh, 2643.40s - 2648.40s | spaces by using an underscore. Don't ask me why, there's probably a reason for that. So, as we 2651.08s - 2656.08s | saw uh, the send mail uh, send mail payload is always uh, needing to point to a local 2657.08s - 2662.08s | configuration file. So, we need to have uh, a control of a malicious local file. 2665.92s - 2672.06s | Fortunately for us, the CMS have uh, a NOS file upload so we can upload files there. The 2672.06s - 2677.46s | problem is uh, the upload folder contains underscore but underscore are replaced by 2677.46s - 2682.46s | spaces but we can replace uh, underscore by uh, equal five F characters. So, that's a 2683.28s - 2688.28s | problem but not so much. The problem is uh, we need a lot of replacement character and the 2692.96s - 2699.20s | size limitation is still 64 characters and the mime encoded words uh, increase the size of a 2699.20s - 2704.20s | string by quite a lot. So, let's consider that uh, a web root is uh, slash app. That's 2704.28s - 2709.28s | short, that's definitely what I need. So, I'm still uh, cheating again. So, uh, that's 2715.02s - 2721.60s | another preconditions. The first one is you need send mail to be used and you need uh, a 2721.60s - 2726.60s | short uh, web root. So, yeah, that's


chunk_text:
to point to a local 2657.08s - 2662.08s | configuration file. So, we need to have uh, a control of a malicious local file. 2665.92s - 2672.06s | Fortunately for us, the CMS have uh, a NOS file upload so we can upload files there. The 2672.06s - 2677.46s | problem is uh, the upload folder contains underscore but underscore are replaced by 2677.46s - 2682.46s | spaces but we can replace uh, underscore by uh, equal five F characters. So, that's a 2683.28s - 2688.28s | problem but not so much. The problem is uh, we need a lot of replacement character and the 2692.96s - 2699.20s | size limitation is still 64 characters and the mime encoded words uh, increase the size of a 2699.20s - 2704.20s | string by quite a lot. So, let's consider that uh, a web root is uh, slash app. That's 2704.28s - 2709.28s | short, that's definitely what I need. So, I'm still uh, cheating again. So, uh, that's 2715.02s - 2721.60s | another preconditions. The first one is you need send mail to be used and you need uh, a 2721.60s - 2726.60s | short uh, web root. So, yeah, that's quite some strong precondition. So, I knew that send 2727.34s - 2732.34s | mail payload are using uh, the C and the X uh, arguments. That's definitely too long for us. 2738.12s - 2743.12s | So, I was like, okay, uh, the C arguments is uh, loading arbitrary config file. Maybe 2745.56s - 2750.86s | that's enough to SE, maybe we don't need the uh, X arguments. So, I decided to focus on 2750.86s - 2757.60s | that and see what is possible to uh, send mail config file. So, in the config file you have 2757.60s - 2763.10s | like the path to the dead letter file. So, the dead letter is like where it, with, it will 2763.10s - 2768.12s | log uh, like incidents in sending emails. So, maybe we can like uh, pat uh, a file that will 2771.92s - 2776.92s | be in the web roots and have maybe a file write but we don't control anything in the mail. And 2777.32s - 2782.32s | there is also uh, uh, bound second recipient in that config file that will be included in the 2786.66s - 2792.14s | dead letter because that will like, you have


chunk_text:
quite some strong precondition. So, I knew that send 2727.34s - 2732.34s | mail payload are using uh, the C and the X uh, arguments. That's definitely too long for us. 2738.12s - 2743.12s | So, I was like, okay, uh, the C arguments is uh, loading arbitrary config file. Maybe 2745.56s - 2750.86s | that's enough to SE, maybe we don't need the uh, X arguments. So, I decided to focus on 2750.86s - 2757.60s | that and see what is possible to uh, send mail config file. So, in the config file you have 2757.60s - 2763.10s | like the path to the dead letter file. So, the dead letter is like where it, with, it will 2763.10s - 2768.12s | log uh, like incidents in sending emails. So, maybe we can like uh, pat uh, a file that will 2771.92s - 2776.92s | be in the web roots and have maybe a file write but we don't control anything in the mail. And 2777.32s - 2782.32s | there is also uh, uh, bound second recipient in that config file that will be included in the 2786.66s - 2792.14s | dead letter because that will like, you have an email that is failed but then it will try to 2792.14s - 2797.74s | send to that second recipient and it will write that in the dead letter file. So, maybe we can 2797.74s - 2802.74s | have arbitrary file writes or at least uh, partial arbitrary file write but that's PHP so if 2803.74s - 2808.74s | I have just uh, a partial file write that would be enough to get a valid PHP file. So, I just 2815.02s - 2820.02s | sent uh, a default send mail MTA config and uh, the two uh, option uh, to get arbitrary file 2823.82s - 2828.50s | write and that's, that was sufficient. So, then I'm sending the mail to not existent at 2828.52s - 2835.24s | localhost so it fails. So, that will bounce. So, that uh, the, the, the config that I was 2835.24s - 2841.97s | using. So, I decided to have a look at the MyMainCoded world and trying to like reduce the 2844.43s - 2849.45s | size of it. Uh, I was able to win some size like you can just empty the car set. There is no 2852.05s - 2857.05s | need of uh,


chunk_text:
an email that is failed but then it will try to 2792.14s - 2797.74s | send to that second recipient and it will write that in the dead letter file. So, maybe we can 2797.74s - 2802.74s | have arbitrary file writes or at least uh, partial arbitrary file write but that's PHP so if 2803.74s - 2808.74s | I have just uh, a partial file write that would be enough to get a valid PHP file. So, I just 2815.02s - 2820.02s | sent uh, a default send mail MTA config and uh, the two uh, option uh, to get arbitrary file 2823.82s - 2828.50s | write and that's, that was sufficient. So, then I'm sending the mail to not existent at 2828.52s - 2835.24s | localhost so it fails. So, that will bounce. So, that uh, the, the, the config that I was 2835.24s - 2841.97s | using. So, I decided to have a look at the MyMainCoded world and trying to like reduce the 2844.43s - 2849.45s | size of it. Uh, I was able to win some size like you can just empty the car set. There is no 2852.05s - 2857.05s | need of uh, filling it. Uh, don't uh, we get, we need double cuts on the payload because uh, 2857.41s - 2862.41s | the email need to be, need to be valid and you need to use a double cutted uh, format. Don't 2866.09s - 2872.13s | ask me why but we need, we needed to end it with uh, two double cuts. I have no idea that's 2872.13s - 2878.79s | magic. I didn't investigate it that. So, we can definitely use the uppercase later now 2878.79s - 2883.79s | because we have the MyMainCoded worlds. Uh, so, 64 cars is still too short but uh, we 2887.17s - 2892.17s | with the precondition of having a short web route and everything that just enter exactly uh, 2895.55s - 2900.55s | the, the 64 characters. So, it uh, uppercase and the final payload was just that. Don't ask 2905.79s - 2910.79s | me why is that some magic. Uh, definitely some magic payload. I have now a t-shirt but it's 2910.81s - 2915.81s | my, in my hotel room with a payload printed on it. Uh, yeah, that's quite a universal 2918.71s - 2923.71s | payload and it is to create RCE


chunk_text:
filling it. Uh, don't uh, we get, we need double cuts on the payload because uh, 2857.41s - 2862.41s | the email need to be, need to be valid and you need to use a double cutted uh, format. Don't 2866.09s - 2872.13s | ask me why but we need, we needed to end it with uh, two double cuts. I have no idea that's 2872.13s - 2878.79s | magic. I didn't investigate it that. So, we can definitely use the uppercase later now 2878.79s - 2883.79s | because we have the MyMainCoded worlds. Uh, so, 64 cars is still too short but uh, we 2887.17s - 2892.17s | with the precondition of having a short web route and everything that just enter exactly uh, 2895.55s - 2900.55s | the, the 64 characters. So, it uh, uppercase and the final payload was just that. Don't ask 2905.79s - 2910.79s | me why is that some magic. Uh, definitely some magic payload. I have now a t-shirt but it's 2910.81s - 2915.81s | my, in my hotel room with a payload printed on it. Uh, yeah, that's quite a universal 2918.71s - 2923.71s | payload and it is to create RCE on that app in very specific conditions. So, yeah, that was 2926.35s - 2933.13s | just uh, settings uh, file re-uploaded in the send mail command injecting a new uh, config 2933.13s - 2938.13s | file for send mail. Get arbitrary write some PHP in the web app. Get RCE. Uh, yeah, that's 2940.83s - 2945.83s | works only on send mail MTA. Web route being short so I cheated a bit. But, yeah, you need 2948.43s - 2953.11s | some high end stuff to exploit that. So, definitely not uh, not really exported in the 2953.11s - 2958.11s | right but still was quite fun technically. So, let's go for a demo. The last one. Once 2963.87s - 2973.86s | again, the crossing shop. I'm just uploading uh, the send mail MTA default config file 2974.26s - 2979.26s | with just like or do 2 config keys. Yeah, doing the upload manually. Sorry, it takes a bit of 2987.48s - 2999.61s | time. So, yeah, you can see that I'm putting the dead letter in the slash app slash back 2999.61s - 3004.61s | dot dot PHP with a double bounce address containing the payload. So, yeah, now the


chunk_text:
on that app in very specific conditions. So, yeah, that was 2926.35s - 2933.13s | just uh, settings uh, file re-uploaded in the send mail command injecting a new uh, config 2933.13s - 2938.13s | file for send mail. Get arbitrary write some PHP in the web app. Get RCE. Uh, yeah, that's 2940.83s - 2945.83s | works only on send mail MTA. Web route being short so I cheated a bit. But, yeah, you need 2948.43s - 2953.11s | some high end stuff to exploit that. So, definitely not uh, not really exported in the 2953.11s - 2958.11s | right but still was quite fun technically. So, let's go for a demo. The last one. Once 2963.87s - 2973.86s | again, the crossing shop. I'm just uploading uh, the send mail MTA default config file 2974.26s - 2979.26s | with just like or do 2 config keys. Yeah, doing the upload manually. Sorry, it takes a bit of 2987.48s - 2999.61s | time. So, yeah, you can see that I'm putting the dead letter in the slash app slash back 2999.61s - 3004.61s | dot dot PHP with a double bounce address containing the payload. So, yeah, now the config 3007.53s - 3012.53s | file is uploaded. We can just run the payload in the from uh, uh, uh, uh, uh, uh, uh, 3013.69s - 3018.69s | in the from email. That's exactly the payload from the, the slides. We're sending that to uh, a 3022.13s - 3027.23s | local host address that doesn't exist so that should draw, draw an error. We see that the page 3027.23s - 3032.25s | is completed bank because that's generated an error. So, now we can go to uh, the slash back 3034.41s - 3039.41s | dot dot PHP. We can see the dead letter there and I did add some back dot there and we get 3040.33s - 3045.33s | arbitrary PHP uh, execution. So, definitely quite cool. So, that was paid 5,000 uh, dollars 3053.71s - 3058.71s | despite the fact that this was uh, hardly exploitable. Uh, made me cry a bit. I spent a lot 3061.89s - 3066.89s | of time on it. So, I hope your brain fried exactly uh, like me. And that's my end word. 3069.79s - 3074.17s | So, uh, thanks for having listened to the end. I hope you had fun. I hope


chunk_text:
config 3007.53s - 3012.53s | file is uploaded. We can just run the payload in the from uh, uh, uh, uh, uh, uh, uh, 3013.69s - 3018.69s | in the from email. That's exactly the payload from the, the slides. We're sending that to uh, a 3022.13s - 3027.23s | local host address that doesn't exist so that should draw, draw an error. We see that the page 3027.23s - 3032.25s | is completed bank because that's generated an error. So, now we can go to uh, the slash back 3034.41s - 3039.41s | dot dot PHP. We can see the dead letter there and I did add some back dot there and we get 3040.33s - 3045.33s | arbitrary PHP uh, execution. So, definitely quite cool. So, that was paid 5,000 uh, dollars 3053.71s - 3058.71s | despite the fact that this was uh, hardly exploitable. Uh, made me cry a bit. I spent a lot 3061.89s - 3066.89s | of time on it. So, I hope your brain fried exactly uh, like me. And that's my end word. 3069.79s - 3074.17s | So, uh, thanks for having listened to the end. I hope you had fun. I hope you learned some 3074.17s - 3079.17s | things and also I will maybe soon open a blog uh, a blog with a lot of my bugs. There's like 3082.71s - 3087.71s | hundred of them. So, yeah, follow me on Twitter if you want some news and thank you.


chunk_text:
you learned some 3074.17s - 3079.17s | things and also I will maybe soon open a blog uh, a blog with a lot of my bugs. There's like 3082.71s - 3087.71s | hundred of them. So, yeah, follow me on Twitter if you want some news and thank you.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=JL7a_oLoXHY", "title": "DEF CON 32 - Exploiting Bluetooth from your car to the bank account - Vladyslav Zubkov, Martin Str", "description": "Over the past decade, infotainment systems experienced a growth in functionality, broader adoption and central incorporation into the vehicle architecture. Due to the ever-growing role of wireless protocols such as Bluetooth and a known lack of patches alongside the difficulty of patch installation, this poses a new attack surface and a genuine threat to the users. At the same time, the tools and methodologies required for testing are scattered across the Internet, absent and need a rigorous setup.\n\nIn this talk, we share a comprehensive framework BlueToolkit to test and replay Bluetooth Classic vulnerabilities. We provide practical information and tips. Additionally, we release new exploits and a privilege escalation attack vector.\n\nWe show how we used the toolkit to find 64 new vulnerabilities in 22 modern cars and the Garmin Flight Stream flight management system used in several aircraft types.\n\nOur work equips Bluetooth hackers with necessary information on novel implementation-specific vulnerabilities that could be used to steal information from target cars, establish MitM position or escalate privileges to hijack victims\u2019 accounts stealthily.\n\nWe believe our research will be beneficial in finding new vulnerabilities and making Bluetooth research more accessible and reproducible.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2899, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.40s - 5.52s | This text was transcribed using whisper model: large-v2 All right. Yeah, the problem of the end of the day apparently the good stuff is empty 7.12s - 9.12s | But it's all right 9.80s - 14.48s | Hello, welcome to our talk exploiting Bluetooth from your card to the bank account 15.64s - 22.22s | To get this out of the way first the main speaker sadly cannot be here tonight. He didn't receive a visa in time 22.72s - 28.32s | We still don't have to do without him, but the second part of the video with all the technical details 29.32s - 31.58s | Of the talk will be given by a video 32.00s - 35.04s | So if you have questions at the end afterwards 35.04s - 39.28s | I'll do my best to answer an online or offline or connect you with blood 39.92s - 43.20s | Who's the main wizard behind this talk really? 46.36s - 55.89s | To prove this I'll let the flood introduce himself and I


chunk_text:
finding new vulnerabilities and making Bluetooth research more accessible and reproducible.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2899, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.40s - 5.52s | This text was transcribed using whisper model: large-v2 All right. Yeah, the problem of the end of the day apparently the good stuff is empty 7.12s - 9.12s | But it's all right 9.80s - 14.48s | Hello, welcome to our talk exploiting Bluetooth from your card to the bank account 15.64s - 22.22s | To get this out of the way first the main speaker sadly cannot be here tonight. He didn't receive a visa in time 22.72s - 28.32s | We still don't have to do without him, but the second part of the video with all the technical details 29.32s - 31.58s | Of the talk will be given by a video 32.00s - 35.04s | So if you have questions at the end afterwards 35.04s - 39.28s | I'll do my best to answer an online or offline or connect you with blood 39.92s - 43.20s | Who's the main wizard behind this talk really? 46.36s - 55.89s | To prove this I'll let the flood introduce himself and I hope this works 55.89s - 86.53s | Do we have sound do we have any sound otherwise I can introduce him but 137.12s - 271.20s | See you recording, my name is Vladislav, but some of you might know me as wise and sweets 271.20s - 276.52s | I'm a bug bounty hunter and primarily focus on web mobile and infrastructure when it comes to pen testing 276.52s - 282.32s | I also focus on quarter views and development of the tools and frameworks. I'm currently open to the new opportunities 282.32s - 284.80s | So feel free to reach out. I also have additional 285.68s - 291.88s | certifications awards and masters, but the most important fact is that I have never attacked booties or cars before and 292.40s - 297.24s | I apply some of the book bounty hunting techniques to it and got some interesting results for you 297.72s - 305.83s | All right. Yeah, sorry for this. Apparently this was the first talk today with audio 306.39s - 311.08s | So let's move on 312.24s - 314.60s | After blood introduced himself, who am I? 315.08s - 321.24s | My name is Martin. I'm a security


chunk_text:
hope this works 55.89s - 86.53s | Do we have sound do we have any sound otherwise I can introduce him but 137.12s - 271.20s | See you recording, my name is Vladislav, but some of you might know me as wise and sweets 271.20s - 276.52s | I'm a bug bounty hunter and primarily focus on web mobile and infrastructure when it comes to pen testing 276.52s - 282.32s | I also focus on quarter views and development of the tools and frameworks. I'm currently open to the new opportunities 282.32s - 284.80s | So feel free to reach out. I also have additional 285.68s - 291.88s | certifications awards and masters, but the most important fact is that I have never attacked booties or cars before and 292.40s - 297.24s | I apply some of the book bounty hunting techniques to it and got some interesting results for you 297.72s - 305.83s | All right. Yeah, sorry for this. Apparently this was the first talk today with audio 306.39s - 311.08s | So let's move on 312.24s - 314.60s | After blood introduced himself, who am I? 315.08s - 321.24s | My name is Martin. I'm a security researcher and a scientist at Swiss cyber defense campus, which is the 322.04s - 324.52s | procurement agency of the Swiss military 325.12s - 327.12s | Have a background in wireless security 327.44s - 333.36s | Been publishing and all the major academic system security conference and I've been leading 333.92s - 340.12s | Research efforts not just on cars, but on all of all sorts of transportation security 341.00s - 347.80s | At our campus that includes aviation, so I've just done a talk at the aerospace village 348.72s - 352.88s | So you can always check that out, but also space cars and trains. I 353.60s - 356.08s | Have never looked at Bluetooth before this work 356.60s - 362.64s | But we've done work on cars so you can also check out broken wire that fail where we've hacked 363.24s - 365.24s | electric charging processes 365.56s - 369.45s | so let me first introduce you to the 370.33s - 371.89s | Motivation for this research 371.89s - 379.01s | One of our main jobs at the campus is to support procurement for the Swiss military and for the federal government 379.13s - 385.01s | So we


chunk_text:
researcher and a scientist at Swiss cyber defense campus, which is the 322.04s - 324.52s | procurement agency of the Swiss military 325.12s - 327.12s | Have a background in wireless security 327.44s - 333.36s | Been publishing and all the major academic system security conference and I've been leading 333.92s - 340.12s | Research efforts not just on cars, but on all of all sorts of transportation security 341.00s - 347.80s | At our campus that includes aviation, so I've just done a talk at the aerospace village 348.72s - 352.88s | So you can always check that out, but also space cars and trains. I 353.60s - 356.08s | Have never looked at Bluetooth before this work 356.60s - 362.64s | But we've done work on cars so you can also check out broken wire that fail where we've hacked 363.24s - 365.24s | electric charging processes 365.56s - 369.45s | so let me first introduce you to the 370.33s - 371.89s | Motivation for this research 371.89s - 379.01s | One of our main jobs at the campus is to support procurement for the Swiss military and for the federal government 379.13s - 385.01s | So we want to really make sure that the government and the military buy secure systems 385.65s - 392.57s | As you can imagine the DoD buys quite a lot of IT systems, but also other systems such as cars 393.57s - 399.49s | If you buy that in high volume you have quite decent negotiation leverage with manufacturers 400.17s - 405.25s | In general public procurement if you don't know it's done with tenders. You can basically 405.89s - 409.93s | Broadly divide it into a pretender stage then the actual tender 410.57s - 418.53s | Contract and the time after actually having procured the systems and even received and deployed the systems 419.49s - 424.69s | Doing simple pen testing after you have bought these things 425.21s - 427.17s | That's often too late for us 427.17s - 434.41s | The leverage you have in negotiations. It's partly gone and the systems. They're already in operation 434.41s - 440.09s | I mean at that point you run insecure systems, so that's not ideal 440.65s - 444.49s | Something else we do is we do a lot of research on standards 445.81s - 447.81s | that works 447.97s - 454.61s |


chunk_text:
want to really make sure that the government and the military buy secure systems 385.65s - 392.57s | As you can imagine the DoD buys quite a lot of IT systems, but also other systems such as cars 393.57s - 399.49s | If you buy that in high volume you have quite decent negotiation leverage with manufacturers 400.17s - 405.25s | In general public procurement if you don't know it's done with tenders. You can basically 405.89s - 409.93s | Broadly divide it into a pretender stage then the actual tender 410.57s - 418.53s | Contract and the time after actually having procured the systems and even received and deployed the systems 419.49s - 424.69s | Doing simple pen testing after you have bought these things 425.21s - 427.17s | That's often too late for us 427.17s - 434.41s | The leverage you have in negotiations. It's partly gone and the systems. They're already in operation 434.41s - 440.09s | I mean at that point you run insecure systems, so that's not ideal 440.65s - 444.49s | Something else we do is we do a lot of research on standards 445.81s - 447.81s | that works 447.97s - 454.61s | If you look at aviation for example you find a lot of flaws and in principle you can 455.61s - 461.49s | Try to change that in the long run the problem is most of these areas have very long life cycles 461.53s - 466.77s | So even if you find and demonstrate major flaws and protocols and technologies being used there 467.29s - 473.73s | It will take decades until that is being changed in practice so again not too helpful 474.57s - 476.57s | for our case here 476.93s - 482.77s | So what do we want to concretely do here to to support our procurement 484.45s - 488.65s | We want to do concrete vulnerability research as early as possible 489.41s - 493.25s | We want to really help shape the security requirements doing 493.89s - 498.81s | Doing the process and in the final tenders to do that we work with the manufacturers 498.81s - 504.37s | But we also use support from academia in Switzerland and outside to bring everyone together 504.77s - 511.57s | To make the systems more secure and not just do this for us, but for everyone so concretely if we


chunk_text:
If you look at aviation for example you find a lot of flaws and in principle you can 455.61s - 461.49s | Try to change that in the long run the problem is most of these areas have very long life cycles 461.53s - 466.77s | So even if you find and demonstrate major flaws and protocols and technologies being used there 467.29s - 473.73s | It will take decades until that is being changed in practice so again not too helpful 474.57s - 476.57s | for our case here 476.93s - 482.77s | So what do we want to concretely do here to to support our procurement 484.45s - 488.65s | We want to do concrete vulnerability research as early as possible 489.41s - 493.25s | We want to really help shape the security requirements doing 493.89s - 498.81s | Doing the process and in the final tenders to do that we work with the manufacturers 498.81s - 504.37s | But we also use support from academia in Switzerland and outside to bring everyone together 504.77s - 511.57s | To make the systems more secure and not just do this for us, but for everyone so concretely if we do research 511.57s - 516.17s | We follow a responsible disclosure process where the manufacturers if you find anything 516.97s - 521.01s | We publish at conferences also come to hacker cons now 521.45s - 525.41s | And we also release our code wherever possible just as in this case 527.46s - 533.14s | that brings me then to today's concrete case study vehicles and the army and Bluetooth as 534.14s - 541.54s | Alluded earlier the DoD buys a lot of vehicles not just these that you can see here probably the ones you think of first 543.94s - 550.10s | Luckily these don't have Bluetooth or at least I think I mean I haven't checked all of them 550.10s - 555.42s | You don't really know that might exist these days as well, but in general they don't 557.14s - 559.14s | But honestly 559.30s - 565.94s | Boringly by far the most vehicles being procured by our DoD are box standard 566.14s - 568.38s | run-of-the-mill civilian cars and 568.90s - 576.62s | They all have Bluetooth you basically cannot buy a car without it even if you want it so even we can't get that without


chunk_text:
do research 511.57s - 516.17s | We follow a responsible disclosure process where the manufacturers if you find anything 516.97s - 521.01s | We publish at conferences also come to hacker cons now 521.45s - 525.41s | And we also release our code wherever possible just as in this case 527.46s - 533.14s | that brings me then to today's concrete case study vehicles and the army and Bluetooth as 534.14s - 541.54s | Alluded earlier the DoD buys a lot of vehicles not just these that you can see here probably the ones you think of first 543.94s - 550.10s | Luckily these don't have Bluetooth or at least I think I mean I haven't checked all of them 550.10s - 555.42s | You don't really know that might exist these days as well, but in general they don't 557.14s - 559.14s | But honestly 559.30s - 565.94s | Boringly by far the most vehicles being procured by our DoD are box standard 566.14s - 568.38s | run-of-the-mill civilian cars and 568.90s - 576.62s | They all have Bluetooth you basically cannot buy a car without it even if you want it so even we can't get that without 578.14s - 581.30s | That brings me of the scope of this research now 582.30s - 589.38s | Bluetooth of course is not the only interface you find in the car cars are super complex systems 590.58s - 592.58s | when doing accounts 593.58s - 597.34s | We found at least 19 interfaces in modern cars 597.86s - 604.62s | From wired or we deport to the key fob if there's an issue with any of these interfaces we use systems 605.26s - 610.78s | The only way and the only way traditionally for a manufacturer to do anything and to deal with it 611.30s - 615.38s | In that car and that model is to do a recall and recalls 616.10s - 619.26s | typically for safety problems, they're expensive and 620.26s - 626.46s | Rarely done really just for very important safety problem for security 627.34s - 628.82s | reasons 628.82s - 630.82s | This rarely happens to be honest 631.50s - 635.50s | So that leaves us with a very complex attack surface 636.26s - 644.34s | Much of which actually has been discussed at Defqon also at the car hacking village. They specialize in that of


chunk_text:
578.14s - 581.30s | That brings me of the scope of this research now 582.30s - 589.38s | Bluetooth of course is not the only interface you find in the car cars are super complex systems 590.58s - 592.58s | when doing accounts 593.58s - 597.34s | We found at least 19 interfaces in modern cars 597.86s - 604.62s | From wired or we deport to the key fob if there's an issue with any of these interfaces we use systems 605.26s - 610.78s | The only way and the only way traditionally for a manufacturer to do anything and to deal with it 611.30s - 615.38s | In that car and that model is to do a recall and recalls 616.10s - 619.26s | typically for safety problems, they're expensive and 620.26s - 626.46s | Rarely done really just for very important safety problem for security 627.34s - 628.82s | reasons 628.82s - 630.82s | This rarely happens to be honest 631.50s - 635.50s | So that leaves us with a very complex attack surface 636.26s - 644.34s | Much of which actually has been discussed at Defqon also at the car hacking village. They specialize in that of course, but 645.42s - 652.30s | Just an illustration here. Don't have to check all of this, but it's a very big complex surf cars 652.62s - 654.62s | Attack surface you have in modern cars 656.46s - 659.94s | So why are we looking now specifically at Bluetooth? Well? 660.86s - 662.54s | most importantly 662.54s - 664.54s | nobody had done it yet, so 664.94s - 668.46s | There's a lot of Bluetooth research of course, but nobody has really checked 669.34s - 676.58s | on a large scale all the exploits that exist in Bluetooth with a reasonable amount of cars 677.18s - 680.86s | So that sort of Bluetooth security cars hasn't been addressed 681.62s - 685.94s | That felt to us like an oversight not not just from the procurement perspective 685.94s - 693.66s | But over 1 billion cars have Bluetooth and as mentioned you can't do anything about that if you buy a new car 694.02s - 699.38s | that overall makes the research very impactful not just for us, but really for anyone with a car and 700.86s - 702.86s | We're very happy also with the outcomes 703.66s - 705.66s |


chunk_text:
course, but 645.42s - 652.30s | Just an illustration here. Don't have to check all of this, but it's a very big complex surf cars 652.62s - 654.62s | Attack surface you have in modern cars 656.46s - 659.94s | So why are we looking now specifically at Bluetooth? Well? 660.86s - 662.54s | most importantly 662.54s - 664.54s | nobody had done it yet, so 664.94s - 668.46s | There's a lot of Bluetooth research of course, but nobody has really checked 669.34s - 676.58s | on a large scale all the exploits that exist in Bluetooth with a reasonable amount of cars 677.18s - 680.86s | So that sort of Bluetooth security cars hasn't been addressed 681.62s - 685.94s | That felt to us like an oversight not not just from the procurement perspective 685.94s - 693.66s | But over 1 billion cars have Bluetooth and as mentioned you can't do anything about that if you buy a new car 694.02s - 699.38s | that overall makes the research very impactful not just for us, but really for anyone with a car and 700.86s - 702.86s | We're very happy also with the outcomes 703.66s - 705.66s | That we had from this research 705.74s - 710.54s | which was led by by Vlad who will now present the technical details and 711.46s - 716.82s | I will come back afterwards for any questions or any information 729.32s - 733.60s | Bluetooth is a short-range wireless communication standard and it is not a specific protocol 733.60s - 739.84s | But multiple different protocols that work on top of each other and that are maintained by different entities. Due to this complexity 739.84s - 746.16s | There are different errors and misunderstandings that arise and these are the primary source of the vulnerabilities that we keep finding 746.28s - 751.44s | We're only going to talk about the Bluetooth classic here. We are not going to talk about the Bluetooth technology at all 751.60s - 757.76s | So what you have to remember about the Bluetooth is that it is a transport plus additional functionality on top of it 757.76s - 761.44s | And when I refer to the functionality I refer to the Bluetooth profiles 761.64s - 768.36s | That allow you to make calls, stream audio, share context messages and even have the whole internet stack on


chunk_text:
That we had from this research 705.74s - 710.54s | which was led by by Vlad who will now present the technical details and 711.46s - 716.82s | I will come back afterwards for any questions or any information 729.32s - 733.60s | Bluetooth is a short-range wireless communication standard and it is not a specific protocol 733.60s - 739.84s | But multiple different protocols that work on top of each other and that are maintained by different entities. Due to this complexity 739.84s - 746.16s | There are different errors and misunderstandings that arise and these are the primary source of the vulnerabilities that we keep finding 746.28s - 751.44s | We're only going to talk about the Bluetooth classic here. We are not going to talk about the Bluetooth technology at all 751.60s - 757.76s | So what you have to remember about the Bluetooth is that it is a transport plus additional functionality on top of it 757.76s - 761.44s | And when I refer to the functionality I refer to the Bluetooth profiles 761.64s - 768.36s | That allow you to make calls, stream audio, share context messages and even have the whole internet stack on top of the Bluetooth 768.72s - 773.52s | So Bluetooth is rich in the functionality and we have to secure it and for that we have pairing 773.68s - 779.32s | When it comes to pairing it depends on the capabilities of the device and the security options 779.44s - 785.28s | So when it comes to the capabilities themselves, they depend on the input and output capabilities of the device 785.40s - 789.28s | So if the device has both of them, then we call such device display 789.28s - 789.68s | Yes, no 789.68s - 795.52s | If the device has only output capabilities, then we call such device display only. When it comes to the 795.92s - 797.92s | devices that only has input capabilities 797.92s - 803.84s | We call such devices keyword-only devices and when the device doesn't have any of the capabilities 803.92s - 807.72s | So we call such devices no-input, no-output capability device 808.28s - 813.36s | We can also summarize the security model of the Bluetooth as everything or nothing as pass-pairing 813.48s - 815.48s | We can access almost all 815.80s - 821.48s | Functionality that is available to us


chunk_text:
top of the Bluetooth 768.72s - 773.52s | So Bluetooth is rich in the functionality and we have to secure it and for that we have pairing 773.68s - 779.32s | When it comes to pairing it depends on the capabilities of the device and the security options 779.44s - 785.28s | So when it comes to the capabilities themselves, they depend on the input and output capabilities of the device 785.40s - 789.28s | So if the device has both of them, then we call such device display 789.28s - 789.68s | Yes, no 789.68s - 795.52s | If the device has only output capabilities, then we call such device display only. When it comes to the 795.92s - 797.92s | devices that only has input capabilities 797.92s - 803.84s | We call such devices keyword-only devices and when the device doesn't have any of the capabilities 803.92s - 807.72s | So we call such devices no-input, no-output capability device 808.28s - 813.36s | We can also summarize the security model of the Bluetooth as everything or nothing as pass-pairing 813.48s - 815.48s | We can access almost all 815.80s - 821.48s | Functionality that is available to us on the target device without any further authorization in most of the cases 822.08s - 828.32s | That's why we have to be sure and confident in the pairing process and for that we have different pairing modes 828.72s - 832.04s | So when the one of the devices doesn't have doesn't support 832.72s - 834.72s | security options then 834.76s - 840.08s | for example, it doesn't have simple security pairing or and secure connections then 841.08s - 843.12s | Legacy pairing is used and from its name 843.12s - 847.60s | You can ensure that it's legacy and ideally shouldn't be used at all. To give you some reasons 847.60s - 850.36s | it's vulnerable to the non-pairing text attacks and also 851.32s - 853.32s | the 853.76s - 859.32s | The link, the security of the link depends on the four-digit pin which you can easily boot for us 859.64s - 862.68s | So then when it comes to devices that 863.36s - 869.52s | Doesn't have input capabilities. If one of the devices doesn't have input capabilities, then just work-pairing mode is used 870.28s - 876.44s | and for this pairing mode, there are no guarantees


chunk_text:
on the target device without any further authorization in most of the cases 822.08s - 828.32s | That's why we have to be sure and confident in the pairing process and for that we have different pairing modes 828.72s - 832.04s | So when the one of the devices doesn't have doesn't support 832.72s - 834.72s | security options then 834.76s - 840.08s | for example, it doesn't have simple security pairing or and secure connections then 841.08s - 843.12s | Legacy pairing is used and from its name 843.12s - 847.60s | You can ensure that it's legacy and ideally shouldn't be used at all. To give you some reasons 847.60s - 850.36s | it's vulnerable to the non-pairing text attacks and also 851.32s - 853.32s | the 853.76s - 859.32s | The link, the security of the link depends on the four-digit pin which you can easily boot for us 859.64s - 862.68s | So then when it comes to devices that 863.36s - 869.52s | Doesn't have input capabilities. If one of the devices doesn't have input capabilities, then just work-pairing mode is used 870.28s - 876.44s | and for this pairing mode, there are no guarantees that you're actually pairing with the device that you want to pair with and 877.28s - 883.40s | That's why it is intrinsically vulnerable to the middle attacks. When it comes to the pass-key entry 883.40s - 889.56s | It was recently discovered that it's vulnerable to the message confusion when the middle attack which is not 890.08s - 892.08s | Remediated yet in the latest 892.32s - 895.12s | Bluetooth version might be there for a few years at least 895.80s - 898.56s | So it leaves us with only one pairing mode 898.56s - 904.80s | Which is actually secure and this is an American version. It is executed only for the devices that have this way 904.80s - 908.60s | There's no capabilities and they both want to pair with each other 909.60s - 916.88s | then when it comes to when we are pass-pairing most of the firmwares or all of the firmwares do not differentiate between the 917.16s - 921.72s | pairing modes used so whether or not you use the secure pairing mode or not and 922.76s - 924.44s | that means that 924.44s - 928.60s | Legacy pairing is the same as an


chunk_text:
that you're actually pairing with the device that you want to pair with and 877.28s - 883.40s | That's why it is intrinsically vulnerable to the middle attacks. When it comes to the pass-key entry 883.40s - 889.56s | It was recently discovered that it's vulnerable to the message confusion when the middle attack which is not 890.08s - 892.08s | Remediated yet in the latest 892.32s - 895.12s | Bluetooth version might be there for a few years at least 895.80s - 898.56s | So it leaves us with only one pairing mode 898.56s - 904.80s | Which is actually secure and this is an American version. It is executed only for the devices that have this way 904.80s - 908.60s | There's no capabilities and they both want to pair with each other 909.60s - 916.88s | then when it comes to when we are pass-pairing most of the firmwares or all of the firmwares do not differentiate between the 917.16s - 921.72s | pairing modes used so whether or not you use the secure pairing mode or not and 922.76s - 924.44s | that means that 924.44s - 928.60s | Legacy pairing is the same as an American version at least in the eyes of the firmware 929.16s - 934.88s | So Bluetooth has been there for more than 23 years and we have found that there are more than 108 different attacks 934.96s - 938.44s | from the Bluetooth standards themselves as of March 2024 938.72s - 945.48s | also, SANS provided statistics that there are approximately 650 different CVEs related to the Bluetooth devices as of 945.84s - 950.60s | 2022 and even more right now. So for the presentation 950.64s - 956.08s | We are going to differentiate between four different categories of the exploits 956.12s - 962.88s | So when I refer to the critical exploits, I refer to the remote code execution, memory leakage, information leakage, but 963.48s - 964.64s | then 964.64s - 968.88s | In the middle, the nano-source categories are actually self-explanatory while 970.72s - 972.72s | while the chaining category 973.44s - 974.84s | describes 974.84s - 979.48s | not specifically vulnerabilities or exploits, but rather weaknesses that 980.28s - 982.28s | one can use to 983.32s - 987.00s | to make the attacks possible or they actually allow 988.00s - 991.08s | or make some of the


chunk_text:
American version at least in the eyes of the firmware 929.16s - 934.88s | So Bluetooth has been there for more than 23 years and we have found that there are more than 108 different attacks 934.96s - 938.44s | from the Bluetooth standards themselves as of March 2024 938.72s - 945.48s | also, SANS provided statistics that there are approximately 650 different CVEs related to the Bluetooth devices as of 945.84s - 950.60s | 2022 and even more right now. So for the presentation 950.64s - 956.08s | We are going to differentiate between four different categories of the exploits 956.12s - 962.88s | So when I refer to the critical exploits, I refer to the remote code execution, memory leakage, information leakage, but 963.48s - 964.64s | then 964.64s - 968.88s | In the middle, the nano-source categories are actually self-explanatory while 970.72s - 972.72s | while the chaining category 973.44s - 974.84s | describes 974.84s - 979.48s | not specifically vulnerabilities or exploits, but rather weaknesses that 980.28s - 982.28s | one can use to 983.32s - 987.00s | to make the attacks possible or they actually allow 988.00s - 991.08s | or make some of the attacks to be executed easily 991.80s - 993.80s | We actually tried 993.88s - 995.88s | even though there are 996.12s - 998.84s | sorry, even though these have been there for 999.64s - 1001.64s | 22 years and been subject to the 1002.04s - 1005.76s | extensive security research, there are still charges involved into testing it 1005.92s - 1011.04s | So it's like the common database of Bluetooth vulnerabilities, it's like the framework for testing it and 1012.84s - 1019.68s | In general the attacks are being shared, but the proof-of-concepts are not and if they are shared, they are generally shared on the 1020.56s - 1022.56s | sites that are not 1022.56s - 1024.36s | quite well indexed 1024.36s - 1029.12s | So it's quite challenging to find such proof-of-concept and if you find the proof-of-concept 1029.12s - 1032.40s | there is also, there is a high chance that the 1032.96s - 1039.04s | proof-of-concept will be based on the old hardware that you can't buy anymore and this also applies to the recently 1039.68s - 1041.60s | recently publicized 1041.60s - 1046.24s | exploits, for example, it's hard-to-mainstream. When it comes to testing, there are intrinsic


chunk_text:
attacks to be executed easily 991.80s - 993.80s | We actually tried 993.88s - 995.88s | even though there are 996.12s - 998.84s | sorry, even though these have been there for 999.64s - 1001.64s | 22 years and been subject to the 1002.04s - 1005.76s | extensive security research, there are still charges involved into testing it 1005.92s - 1011.04s | So it's like the common database of Bluetooth vulnerabilities, it's like the framework for testing it and 1012.84s - 1019.68s | In general the attacks are being shared, but the proof-of-concepts are not and if they are shared, they are generally shared on the 1020.56s - 1022.56s | sites that are not 1022.56s - 1024.36s | quite well indexed 1024.36s - 1029.12s | So it's quite challenging to find such proof-of-concept and if you find the proof-of-concept 1029.12s - 1032.40s | there is also, there is a high chance that the 1032.96s - 1039.04s | proof-of-concept will be based on the old hardware that you can't buy anymore and this also applies to the recently 1039.68s - 1041.60s | recently publicized 1041.60s - 1046.24s | exploits, for example, it's hard-to-mainstream. When it comes to testing, there are intrinsic 1046.80s - 1052.56s | false positives and false negatives when you test in the black box fashion for the nano-source based attacks 1053.36s - 1055.36s | and then it's a bit tricky to 1056.88s - 1061.84s | It's a bit tricky to automate the nano-source attacks in some cases, especially for some of the devices 1062.40s - 1064.40s | because 1064.40s - 1066.88s | the nano-source attacks are quite powerful in these 1067.44s - 1069.20s | cases and 1069.20s - 1071.20s | it requires rebooting the device 1071.76s - 1073.76s | but it's quite difficult to do, for example 1075.44s - 1082.00s | In case of the cars, in some cases it requires to wait for 10, 20 or 30 minutes. So it's a bit tricky 1083.04s - 1087.52s | we try to solve some of these problems and that's why we come up and 1088.48s - 1094.64s | open-source the framework for vulnerability testing framework for Blizzard Classic. I can access and redevelop 44 different exploits 1095.12s - 1096.88s | also, the main goal is 1096.88s - 1098.88s | reproducibility of the 1099.20s - 1105.12s | past and future research. There is also a balance between automation, semi-automation and


chunk_text:
1046.80s - 1052.56s | false positives and false negatives when you test in the black box fashion for the nano-source based attacks 1053.36s - 1055.36s | and then it's a bit tricky to 1056.88s - 1061.84s | It's a bit tricky to automate the nano-source attacks in some cases, especially for some of the devices 1062.40s - 1064.40s | because 1064.40s - 1066.88s | the nano-source attacks are quite powerful in these 1067.44s - 1069.20s | cases and 1069.20s - 1071.20s | it requires rebooting the device 1071.76s - 1073.76s | but it's quite difficult to do, for example 1075.44s - 1082.00s | In case of the cars, in some cases it requires to wait for 10, 20 or 30 minutes. So it's a bit tricky 1083.04s - 1087.52s | we try to solve some of these problems and that's why we come up and 1088.48s - 1094.64s | open-source the framework for vulnerability testing framework for Blizzard Classic. I can access and redevelop 44 different exploits 1095.12s - 1096.88s | also, the main goal is 1096.88s - 1098.88s | reproducibility of the 1099.20s - 1105.12s | past and future research. There is also a balance between automation, semi-automation and manual tests. So 1106.08s - 1108.64s | even though the attacker side is automated, the 1110.08s - 1112.56s | victim side is not, it's infeasible to do so 1112.64s - 1117.28s | So you still have to do some of the manual actions, for example on the infotainment screen 1117.76s - 1120.96s | I also evaluated half of the exploits on the non-vulnerable devices 1121.28s - 1128.88s | while for the other half I ensured that the exploits write to some of the payloads, but as there were no vulnerable devices for them 1129.84s - 1137.12s | we used them as is, but still these exploits found the real vulnerabilities in the cars, so 1138.40s - 1140.40s | I'm quite confident in them 1140.56s - 1143.04s | The talk itself works pretty straightforward, the 1143.92s - 1146.72s | test executes the command, then the engine loads the 1147.26s - 1148.48s | predefined 1148.48s - 1156.24s | exploit profile, then checks for the variability and availability of the target device without requiring any interactions from the tester, then executes the 1156.54s - 1162.00s | exploit and after that, depending on the exploit type, it either compares the value 1162.56s - 1167.68s


chunk_text:
manual tests. So 1106.08s - 1108.64s | even though the attacker side is automated, the 1110.08s - 1112.56s | victim side is not, it's infeasible to do so 1112.64s - 1117.28s | So you still have to do some of the manual actions, for example on the infotainment screen 1117.76s - 1120.96s | I also evaluated half of the exploits on the non-vulnerable devices 1121.28s - 1128.88s | while for the other half I ensured that the exploits write to some of the payloads, but as there were no vulnerable devices for them 1129.84s - 1137.12s | we used them as is, but still these exploits found the real vulnerabilities in the cars, so 1138.40s - 1140.40s | I'm quite confident in them 1140.56s - 1143.04s | The talk itself works pretty straightforward, the 1143.92s - 1146.72s | test executes the command, then the engine loads the 1147.26s - 1148.48s | predefined 1148.48s - 1156.24s | exploit profile, then checks for the variability and availability of the target device without requiring any interactions from the tester, then executes the 1156.54s - 1162.00s | exploit and after that, depending on the exploit type, it either compares the value 1162.56s - 1167.68s | or it checks the variability and availability of the target device once again. After that 1168.24s - 1170.24s | the toolkit reports back to the tester 1170.96s - 1172.96s | So I used this 1172.96s - 1178.24s | toolkit to attack different cars and decided it was pretty minimalistic, a computer-based laptop, or 1178.64s - 1181.20s | we could have used the virtual machine, USB cables, 1182.80s - 1185.68s | development board and Nexus 5 phone for 1186.72s - 1193.36s | denial-of-service attacks and internal war attacks, then I spent approximately one to three hours per car 1193.68s - 1197.68s | There's different issues arose and for some of the cars, especially the 1198.72s - 1200.72s | internal combustion cars, you have to 1202.16s - 1206.72s | test them outside as they require the engine to be started to access the infotainment system 1207.20s - 1209.44s | and because of that you have to test them outside 1210.64s - 1215.60s | If you can connect to the infotainment system and observe the logs, please do that as it would help to 1216.16s - 1219.70s | remediate some of the false positives and false negatives 1220.58s - 1226.52s | So


chunk_text:
| or it checks the variability and availability of the target device once again. After that 1168.24s - 1170.24s | the toolkit reports back to the tester 1170.96s - 1172.96s | So I used this 1172.96s - 1178.24s | toolkit to attack different cars and decided it was pretty minimalistic, a computer-based laptop, or 1178.64s - 1181.20s | we could have used the virtual machine, USB cables, 1182.80s - 1185.68s | development board and Nexus 5 phone for 1186.72s - 1193.36s | denial-of-service attacks and internal war attacks, then I spent approximately one to three hours per car 1193.68s - 1197.68s | There's different issues arose and for some of the cars, especially the 1198.72s - 1200.72s | internal combustion cars, you have to 1202.16s - 1206.72s | test them outside as they require the engine to be started to access the infotainment system 1207.20s - 1209.44s | and because of that you have to test them outside 1210.64s - 1215.60s | If you can connect to the infotainment system and observe the logs, please do that as it would help to 1216.16s - 1219.70s | remediate some of the false positives and false negatives 1220.58s - 1226.52s | So all of the cars were provided by SAP Defense Campus Army Logistics and some were provided by friends and acquaintances 1227.14s - 1229.38s | In total we had 22 cars, only 1230.50s - 1236.58s | four were partially tested. You might think that the sample size is quite small, but it is the biggest out there 1237.54s - 1238.58s | and 1238.58s - 1241.06s | we tried to focus on different categories of the cars 1242.50s - 1243.92s | of the cars 1243.92s - 1250.40s | monetary-wise and also focusing on the top manufacturers, so that we would have a notion 1250.80s - 1255.12s | of the state-of-the-art blitzer security in the automotive industry 1255.84s - 1262.08s | And finally, all the blitzer tests are non-invasive, so we didn't have any problems with the 1262.64s - 1264.64s | cars afterwards 1264.72s - 1270.90s | I spent approximately 40 hours throughout a few weeks and found 73 different vulnerabilities 1271.62s - 1276.26s | Some issues were not reportable because they are inherent issues and 1277.22s - 1279.88s | that's why I was able to report only 64 vulnerabilities 1280.74s - 1288.10s | All the vulnerabilities that were reported were reported responsibly


chunk_text:
all of the cars were provided by SAP Defense Campus Army Logistics and some were provided by friends and acquaintances 1227.14s - 1229.38s | In total we had 22 cars, only 1230.50s - 1236.58s | four were partially tested. You might think that the sample size is quite small, but it is the biggest out there 1237.54s - 1238.58s | and 1238.58s - 1241.06s | we tried to focus on different categories of the cars 1242.50s - 1243.92s | of the cars 1243.92s - 1250.40s | monetary-wise and also focusing on the top manufacturers, so that we would have a notion 1250.80s - 1255.12s | of the state-of-the-art blitzer security in the automotive industry 1255.84s - 1262.08s | And finally, all the blitzer tests are non-invasive, so we didn't have any problems with the 1262.64s - 1264.64s | cars afterwards 1264.72s - 1270.90s | I spent approximately 40 hours throughout a few weeks and found 73 different vulnerabilities 1271.62s - 1276.26s | Some issues were not reportable because they are inherent issues and 1277.22s - 1279.88s | that's why I was able to report only 64 vulnerabilities 1280.74s - 1288.10s | All the vulnerabilities that were reported were reported responsibly and all manufacturers and vendors had time to fix them 1288.58s - 1291.38s | But you already guessed that not all of them did that 1291.94s - 1297.30s | But we still are releasing as there have been more time. They had a lot of time to do so 1298.10s - 1300.10s | so 1300.10s - 1307.46s | Generally, the first thing that I wanted to share is that the cars are generally lagging in adoption of the newest blitzer standards 1307.70s - 1311.86s | so for example, you wanted to buy a 2023 car, you would expect that the 1312.50s - 1319.08s | Hardware used in it would be rather recent. But in fact, what you get is the blitzer's version from 2014 1319.62s - 1321.94s | And the difference is nine years in this case 1322.42s - 1326.10s | And on average it's seven years and mean is also seven years 1326.74s - 1332.66s | So in the time frame of nine years, there have been a lot of research done into the business 1333.06s - 1339.06s | So there are more than 10 different attacks on the car specification itself, which also affects your 1339.62s - 1340.90s


chunk_text:
and all manufacturers and vendors had time to fix them 1288.58s - 1291.38s | But you already guessed that not all of them did that 1291.94s - 1297.30s | But we still are releasing as there have been more time. They had a lot of time to do so 1298.10s - 1300.10s | so 1300.10s - 1307.46s | Generally, the first thing that I wanted to share is that the cars are generally lagging in adoption of the newest blitzer standards 1307.70s - 1311.86s | so for example, you wanted to buy a 2023 car, you would expect that the 1312.50s - 1319.08s | Hardware used in it would be rather recent. But in fact, what you get is the blitzer's version from 2014 1319.62s - 1321.94s | And the difference is nine years in this case 1322.42s - 1326.10s | And on average it's seven years and mean is also seven years 1326.74s - 1332.66s | So in the time frame of nine years, there have been a lot of research done into the business 1333.06s - 1339.06s | So there are more than 10 different attacks on the car specification itself, which also affects your 1339.62s - 1340.90s | business version 1340.90s - 1342.90s | and that's why you have to 1343.14s - 1347.94s | You're in risk. You're in risk because there are existing vulnerabilities that could be 1349.30s - 1350.88s | could be 1350.88s - 1352.66s | exploited in your car 1352.66s - 1357.14s | First you might think that you can remediate them with the firmware update. Here's the first problem 1357.86s - 1363.94s | most of the cars still don't provide the firmware updates and the second problem is that you cannot remediate the 1365.86s - 1372.02s | Force specification attacks with the firmware updates as they generally require the fixing the standards first 1372.34s - 1379.46s | The standards level first then a few years would pass as the new hardware will be developed and be available on the market 1379.86s - 1381.86s | after that you'll be able to 1382.18s - 1383.46s | actually 1383.46s - 1386.66s | swap the hardware in your car for the newest 1387.06s - 1392.42s | But no one is going to do that for you and manufacturers most likely won't be doing that and it is required 1392.82s - 1398.98s | Because you can change the


chunk_text:
| business version 1340.90s - 1342.90s | and that's why you have to 1343.14s - 1347.94s | You're in risk. You're in risk because there are existing vulnerabilities that could be 1349.30s - 1350.88s | could be 1350.88s - 1352.66s | exploited in your car 1352.66s - 1357.14s | First you might think that you can remediate them with the firmware update. Here's the first problem 1357.86s - 1363.94s | most of the cars still don't provide the firmware updates and the second problem is that you cannot remediate the 1365.86s - 1372.02s | Force specification attacks with the firmware updates as they generally require the fixing the standards first 1372.34s - 1379.46s | The standards level first then a few years would pass as the new hardware will be developed and be available on the market 1379.86s - 1381.86s | after that you'll be able to 1382.18s - 1383.46s | actually 1383.46s - 1386.66s | swap the hardware in your car for the newest 1387.06s - 1392.42s | But no one is going to do that for you and manufacturers most likely won't be doing that and it is required 1392.82s - 1398.98s | Because you can change the blitzer's version only by swapping the hardware. You cannot do that in the firmware 1400.02s - 1402.12s | So we've been testing for the known vulnerabilities 1402.66s - 1404.66s | And we actually expected that 1405.22s - 1407.22s | we won't find 1407.22s - 1413.40s | Non-vulnerabilities in the cars produced in 2022 and 23. That was that were our expectations 1413.94s - 1415.94s | But in fact, we still 1416.02s - 1422.36s | We still found a lot of cars that had them and for example Tesla cars. They had a specific man-in-the-middle 1423.36s - 1426.66s | Vulnerability that also should in theory exist in other models 1427.54s - 1429.54s | You can check it for yourself 1429.54s - 1434.68s | but the most interesting view is actually on the average number of vulnerabilities found per car and manufacturer 1435.40s - 1436.28s | as 1436.28s - 1437.80s | you can you can 1437.80s - 1442.30s | See here the differences between between them and also the similarities 1442.84s - 1447.96s | So when it comes to the critical vulnerabilities, there were only three manufacturers that had them 1449.22s - 1451.22s | Renault and Volkswagen 1451.80s - 1456.28s | So


chunk_text:
blitzer's version only by swapping the hardware. You cannot do that in the firmware 1400.02s - 1402.12s | So we've been testing for the known vulnerabilities 1402.66s - 1404.66s | And we actually expected that 1405.22s - 1407.22s | we won't find 1407.22s - 1413.40s | Non-vulnerabilities in the cars produced in 2022 and 23. That was that were our expectations 1413.94s - 1415.94s | But in fact, we still 1416.02s - 1422.36s | We still found a lot of cars that had them and for example Tesla cars. They had a specific man-in-the-middle 1423.36s - 1426.66s | Vulnerability that also should in theory exist in other models 1427.54s - 1429.54s | You can check it for yourself 1429.54s - 1434.68s | but the most interesting view is actually on the average number of vulnerabilities found per car and manufacturer 1435.40s - 1436.28s | as 1436.28s - 1437.80s | you can you can 1437.80s - 1442.30s | See here the differences between between them and also the similarities 1442.84s - 1447.96s | So when it comes to the critical vulnerabilities, there were only three manufacturers that had them 1449.22s - 1451.22s | Renault and Volkswagen 1451.80s - 1456.28s | So these vulnerabilities were rather old and they could have been fixed with the firmware update 1456.36s - 1459.96s | But there were no firmware updates for these vulnerabilities for these cars 1460.84s - 1464.60s | Then the when it comes to the denial of service and man-in-the-middle attacks 1465.48s - 1467.48s | you have to notice that 1468.20s - 1475.56s | If one of the manufacturer doesn't have man-in-the-middle attacks, they would generally have denial of service attacks or vice versa 1475.96s - 1476.92s | so 1476.92s - 1479.88s | These types are omnipresent and they can be swapped 1479.96s - 1484.12s | So they both of them can be used to establish the man-in-the-middle position 1484.20s - 1490.68s | So you can use both denial of service attacks and man-in-the-middle attacks to aid you in establishing the man-in-the-middle position 1491.24s - 1495.80s | So this knowledge would be very helpful in the future. So try to remember it 1496.52s - 1502.04s | And as we've been talking for an hour vulnerabilities, you already guessed that we found some new ones 1502.84s - 1505.56s | especially some new attacks actually 1506.36s - 1509.40s | So the first attack is the


chunk_text:
these vulnerabilities were rather old and they could have been fixed with the firmware update 1456.36s - 1459.96s | But there were no firmware updates for these vulnerabilities for these cars 1460.84s - 1464.60s | Then the when it comes to the denial of service and man-in-the-middle attacks 1465.48s - 1467.48s | you have to notice that 1468.20s - 1475.56s | If one of the manufacturer doesn't have man-in-the-middle attacks, they would generally have denial of service attacks or vice versa 1475.96s - 1476.92s | so 1476.92s - 1479.88s | These types are omnipresent and they can be swapped 1479.96s - 1484.12s | So they both of them can be used to establish the man-in-the-middle position 1484.20s - 1490.68s | So you can use both denial of service attacks and man-in-the-middle attacks to aid you in establishing the man-in-the-middle position 1491.24s - 1495.80s | So this knowledge would be very helpful in the future. So try to remember it 1496.52s - 1502.04s | And as we've been talking for an hour vulnerabilities, you already guessed that we found some new ones 1502.84s - 1505.56s | especially some new attacks actually 1506.36s - 1509.40s | So the first attack is the contact distractor attack here 1509.56s - 1511.56s | The victim 1511.62s - 1517.80s | Establishes the bluetooth connection with the car then shares the contacts via phonebook exit profile and leaves the car 1518.20s - 1521.32s | without impairing the phone for example, which is by 1523.40s - 1528.12s | For example by switching off the bluetooth or just walking away then we will be able to 1529.56s - 1535.08s | spoof the MAC address to the MAC address of the victim establish the bluetooth connection and extract the contacts 1535.48s - 1537.48s | But it would have been an ideal case 1537.64s - 1545.24s | But unfortunately, we cannot do that because both the attacker and the car execute run the phonebook exit profile client 1546.44s - 1548.84s | client service and only the servicers can 1549.56s - 1553.72s | Serve the contacts. So this specific attack applies in the car sharing context 1554.36s - 1557.80s | And due to that fact, we have to get into the car 1558.28s - 1560.12s | We do not need to start the car 1560.12s - 1564.68s | We just need to access the infotainment system and it is accessible without the


chunk_text:
contact distractor attack here 1509.56s - 1511.56s | The victim 1511.62s - 1517.80s | Establishes the bluetooth connection with the car then shares the contacts via phonebook exit profile and leaves the car 1518.20s - 1521.32s | without impairing the phone for example, which is by 1523.40s - 1528.12s | For example by switching off the bluetooth or just walking away then we will be able to 1529.56s - 1535.08s | spoof the MAC address to the MAC address of the victim establish the bluetooth connection and extract the contacts 1535.48s - 1537.48s | But it would have been an ideal case 1537.64s - 1545.24s | But unfortunately, we cannot do that because both the attacker and the car execute run the phonebook exit profile client 1546.44s - 1548.84s | client service and only the servicers can 1549.56s - 1553.72s | Serve the contacts. So this specific attack applies in the car sharing context 1554.36s - 1557.80s | And due to that fact, we have to get into the car 1558.28s - 1560.12s | We do not need to start the car 1560.12s - 1564.68s | We just need to access the infotainment system and it is accessible without the starting the engine 1565.16s - 1567.80s | So we would be able to we would have to 1568.36s - 1574.60s | Search for the password number on the infotainment screen then and if the car is vulnerable, it would show us the contacts 1575.80s - 1578.28s | So here you can see that we connect it to the Renault car 1578.52s - 1581.48s | We do not have any contacts on the left 1581.72s - 1587.40s | But when we switch to the dial pad and search for the part of the number then the contacts are shown to us 1588.36s - 1593.64s | The second attack is very similar to the no-input no-output mini-middle attack with some caveats that 1594.20s - 1598.52s | that apply to the automotive industry 1599.32s - 1600.28s | so 1600.28s - 1602.28s | some of the cars actually deny 1602.42s - 1607.08s | connections or pairing to be initiated from the no-input no-output capability devices 1607.72s - 1609.72s | but there are also the cars that 1610.04s - 1612.36s | allow the connection to be initiated from the 1613.32s - 1615.32s | user smartphone and also from the car 1615.48s - 1616.44s | So


chunk_text:
starting the engine 1565.16s - 1567.80s | So we would be able to we would have to 1568.36s - 1574.60s | Search for the password number on the infotainment screen then and if the car is vulnerable, it would show us the contacts 1575.80s - 1578.28s | So here you can see that we connect it to the Renault car 1578.52s - 1581.48s | We do not have any contacts on the left 1581.72s - 1587.40s | But when we switch to the dial pad and search for the part of the number then the contacts are shown to us 1588.36s - 1593.64s | The second attack is very similar to the no-input no-output mini-middle attack with some caveats that 1594.20s - 1598.52s | that apply to the automotive industry 1599.32s - 1600.28s | so 1600.28s - 1602.28s | some of the cars actually deny 1602.42s - 1607.08s | connections or pairing to be initiated from the no-input no-output capability devices 1607.72s - 1609.72s | but there are also the cars that 1610.04s - 1612.36s | allow the connection to be initiated from the 1613.32s - 1615.32s | user smartphone and also from the car 1615.48s - 1616.44s | So 1616.44s - 1618.04s | in case the 1618.04s - 1619.88s | Connection is being initiated from the car 1619.88s - 1625.48s | There are some cars that actually forget that they deny access to the no-input no-output capability devices 1625.80s - 1629.08s | and thus it might be possible to get the connections from the car to the 1629.88s - 1630.92s | attacker 1630.92s - 1635.48s | For example by self-determining or pre-committing or using the other 1636.36s - 1639.48s | other techniques so that we might be able to 1640.28s - 1642.28s | get the middle position 1642.60s - 1644.04s | So the third 1644.04s - 1647.88s | Attack is actually the attack on the numerical person man-in-the-middle 1648.20s - 1651.64s | This is insecure numerical person man-in-the-middle attack in this case 1652.60s - 1653.96s | the it is 1653.96s - 1655.96s | mutation specific attack so 1656.92s - 1658.92s | In this case the car is either 1659.40s - 1665.32s | either has the design problem or they have a state problem in case of the state we'd have to 1666.04s - 1668.04s | Check the connection 1668.12s - 1674.20s | With different capabilities while for the design


chunk_text:
1616.44s - 1618.04s | in case the 1618.04s - 1619.88s | Connection is being initiated from the car 1619.88s - 1625.48s | There are some cars that actually forget that they deny access to the no-input no-output capability devices 1625.80s - 1629.08s | and thus it might be possible to get the connections from the car to the 1629.88s - 1630.92s | attacker 1630.92s - 1635.48s | For example by self-determining or pre-committing or using the other 1636.36s - 1639.48s | other techniques so that we might be able to 1640.28s - 1642.28s | get the middle position 1642.60s - 1644.04s | So the third 1644.04s - 1647.88s | Attack is actually the attack on the numerical person man-in-the-middle 1648.20s - 1651.64s | This is insecure numerical person man-in-the-middle attack in this case 1652.60s - 1653.96s | the it is 1653.96s - 1655.96s | mutation specific attack so 1656.92s - 1658.92s | In this case the car is either 1659.40s - 1665.32s | either has the design problem or they have a state problem in case of the state we'd have to 1666.04s - 1668.04s | Check the connection 1668.12s - 1674.20s | With different capabilities while for the design we'd have to just observe the pairing process 1674.60s - 1678.44s | so in case the car is vulnerable, it wouldn't need any confirmation of the 1679.00s - 1683.88s | Pairing on the infotainment screen or it show no-input no-output like confirmation without 1684.28s - 1687.96s | Showing the pairing number or it will show you static number across different 1688.52s - 1690.36s | pairing attempts 1690.36s - 1693.40s | So due to this fact we have all the pieces to 1693.88s - 1697.64s | Establish the man-in-the-middle position or just the connection to the car 1698.76s - 1702.44s | So to give you some of the examples in case of the other cars 1702.68s - 1708.60s | they show you the pairing number they show you the button to cancel the connection the pairing or the connection and 1709.24s - 1713.32s | but they show you the button to accept the pairing and this is 1714.12s - 1717.56s | a problem because the call logic is on the attacker side 1717.96s - 1721.40s | In case of the other cars they show you no-input no-output like confirmation window 1721.40s - 1725.80s | They don't show you the pairing number


chunk_text:
we'd have to just observe the pairing process 1674.60s - 1678.44s | so in case the car is vulnerable, it wouldn't need any confirmation of the 1679.00s - 1683.88s | Pairing on the infotainment screen or it show no-input no-output like confirmation without 1684.28s - 1687.96s | Showing the pairing number or it will show you static number across different 1688.52s - 1690.36s | pairing attempts 1690.36s - 1693.40s | So due to this fact we have all the pieces to 1693.88s - 1697.64s | Establish the man-in-the-middle position or just the connection to the car 1698.76s - 1702.44s | So to give you some of the examples in case of the other cars 1702.68s - 1708.60s | they show you the pairing number they show you the button to cancel the connection the pairing or the connection and 1709.24s - 1713.32s | but they show you the button to accept the pairing and this is 1714.12s - 1717.56s | a problem because the call logic is on the attacker side 1717.96s - 1721.40s | In case of the other cars they show you no-input no-output like confirmation window 1721.40s - 1725.80s | They don't show you the pairing number and if you click accept the pairing would be done 1726.52s - 1728.36s | after that, they will show you the 1728.36s - 1733.16s | Window with the pairing number and the button to cancel pairing so unpair 1733.80s - 1735.80s | but in this case, there are two 1736.28s - 1740.44s | Two possibilities. So in case of the first one the if the user 1741.00s - 1743.96s | Clicks yes or pair on their phone. Yes, then 1745.40s - 1751.24s | On their phone first then we'll be able to we might be able to get the man-in-the-middle position 1751.56s - 1757.96s | If they don't then they might spot the attack and then and ask them to have five to ten seconds to execute it 1758.44s - 1763.56s | When it comes to the BMW cars, they had a state problem. Some of them still might have 1764.76s - 1771.24s | But it should be fixed in the newer versions in the newer former versions. So in this case you can force the 1773.88s - 1774.76s | You can 1774.76s - 1776.92s | force the state problem by using 1777.72s - 1784.76s | The capabilities other than


chunk_text:
and if you click accept the pairing would be done 1726.52s - 1728.36s | after that, they will show you the 1728.36s - 1733.16s | Window with the pairing number and the button to cancel pairing so unpair 1733.80s - 1735.80s | but in this case, there are two 1736.28s - 1740.44s | Two possibilities. So in case of the first one the if the user 1741.00s - 1743.96s | Clicks yes or pair on their phone. Yes, then 1745.40s - 1751.24s | On their phone first then we'll be able to we might be able to get the man-in-the-middle position 1751.56s - 1757.96s | If they don't then they might spot the attack and then and ask them to have five to ten seconds to execute it 1758.44s - 1763.56s | When it comes to the BMW cars, they had a state problem. Some of them still might have 1764.76s - 1771.24s | But it should be fixed in the newer versions in the newer former versions. So in this case you can force the 1773.88s - 1774.76s | You can 1774.76s - 1776.92s | force the state problem by using 1777.72s - 1784.76s | The capabilities other than display yes no and it will show you the specific number that you get you see in the screen 1785.96s - 1791.56s | After that, you'll be able to establish the man-in-the-middle position or just the connection to the user or to the car 1791.96s - 1798.68s | In case of the Renault cars, they didn't give you give the user any control whatsoever. So anyone could connect to it 1799.48s - 1803.42s | So you've seen that I found many different vulnerabilities in the car specifically 1803.96s - 1805.96s | primarily denial of service attacks and 1806.60s - 1811.48s | Man-in-the-middle attacks, but you still might have a question. What can we do with them? 1812.04s - 1814.44s | And this is what we are going to explore now 1815.00s - 1820.04s | So first thing we can we have to establish the man-in-the-middle position and for that we have three different options 1820.36s - 1827.16s | First one is to do selective jamming in case of this active jamming is relatively difficult to do but it's still possible 1827.48s - 1829.48s | so in this case, we would have to 1829.72s - 1835.88s | To spoof the MAC


chunk_text:
display yes no and it will show you the specific number that you get you see in the screen 1785.96s - 1791.56s | After that, you'll be able to establish the man-in-the-middle position or just the connection to the user or to the car 1791.96s - 1798.68s | In case of the Renault cars, they didn't give you give the user any control whatsoever. So anyone could connect to it 1799.48s - 1803.42s | So you've seen that I found many different vulnerabilities in the car specifically 1803.96s - 1805.96s | primarily denial of service attacks and 1806.60s - 1811.48s | Man-in-the-middle attacks, but you still might have a question. What can we do with them? 1812.04s - 1814.44s | And this is what we are going to explore now 1815.00s - 1820.04s | So first thing we can we have to establish the man-in-the-middle position and for that we have three different options 1820.36s - 1827.16s | First one is to do selective jamming in case of this active jamming is relatively difficult to do but it's still possible 1827.48s - 1829.48s | so in this case, we would have to 1829.72s - 1835.88s | To spoof the MAC address of the car and then selectively jam it after that we might be able to get the 1837.32s - 1841.40s | Connection the request or pairing request from the user or do it vice versa 1842.12s - 1845.00s | The second option is to use denial of service attacks and deny 1846.76s - 1854.28s | Resource to the car and then spoof the MAC address again and get the connection from the user or vice versa 1855.00s - 1857.96s | The third option is actually to work with different MAC addresses 1858.04s - 1863.48s | but the same names as those the car and the user would expect so in this case if we connect to the 1863.88s - 1865.88s | car, we would have the 1866.12s - 1871.08s | name of a user and if we connect to the user we would have the name of the car so that 1872.12s - 1874.60s | The user would be lured into pairing 1875.72s - 1879.40s | you might actually have a question or a problem with discovering the 1879.88s - 1881.08s | um 1881.08s - 1887.88s | MAC addresses you might think it is difficult, but in fact, it's


chunk_text:
address of the car and then selectively jam it after that we might be able to get the 1837.32s - 1841.40s | Connection the request or pairing request from the user or do it vice versa 1842.12s - 1845.00s | The second option is to use denial of service attacks and deny 1846.76s - 1854.28s | Resource to the car and then spoof the MAC address again and get the connection from the user or vice versa 1855.00s - 1857.96s | The third option is actually to work with different MAC addresses 1858.04s - 1863.48s | but the same names as those the car and the user would expect so in this case if we connect to the 1863.88s - 1865.88s | car, we would have the 1866.12s - 1871.08s | name of a user and if we connect to the user we would have the name of the car so that 1872.12s - 1874.60s | The user would be lured into pairing 1875.72s - 1879.40s | you might actually have a question or a problem with discovering the 1879.88s - 1881.08s | um 1881.08s - 1887.88s | MAC addresses you might think it is difficult, but in fact, it's rather easy and became easy as of recently 1888.12s - 1892.76s | so for example, you have at least two options. The first option is to simply listen for the 1894.36s - 1897.00s | For the MAC addresses for discoverable MAC addresses with your 1897.56s - 1901.72s | Laptop hardware you would be able to find only discoverable MAC addresses 1901.96s - 1908.84s | So the sample size won't be big but it might be enough for the attacks and the second 1909.40s - 1915.96s | Option is to use BlueSquid's attack to actually get the MAC address almost all MAC addresses are in the BlueSquid's classic space 1916.36s - 1922.04s | With the help of EuroSRP and Ubuntu, so it's approximately two thousand dollars worth of the equipment 1922.84s - 1924.84s | so with that you'll be able to 1925.16s - 1929.72s | discover the MAC addresses that are in non-discoverable mode for 1930.60s - 1932.92s | Almost all the attacks that we are going to show you 1933.56s - 1935.56s | so then 1935.56s - 1937.16s | with this specific 1937.16s - 1941.80s | Part you'll be able to get your first click or the first seamless click


chunk_text:
rather easy and became easy as of recently 1888.12s - 1892.76s | so for example, you have at least two options. The first option is to simply listen for the 1894.36s - 1897.00s | For the MAC addresses for discoverable MAC addresses with your 1897.56s - 1901.72s | Laptop hardware you would be able to find only discoverable MAC addresses 1901.96s - 1908.84s | So the sample size won't be big but it might be enough for the attacks and the second 1909.40s - 1915.96s | Option is to use BlueSquid's attack to actually get the MAC address almost all MAC addresses are in the BlueSquid's classic space 1916.36s - 1922.04s | With the help of EuroSRP and Ubuntu, so it's approximately two thousand dollars worth of the equipment 1922.84s - 1924.84s | so with that you'll be able to 1925.16s - 1929.72s | discover the MAC addresses that are in non-discoverable mode for 1930.60s - 1932.92s | Almost all the attacks that we are going to show you 1933.56s - 1935.56s | so then 1935.56s - 1937.16s | with this specific 1937.16s - 1941.80s | Part you'll be able to get your first click or the first seamless click and 1942.92s - 1944.92s | After that, you might have a question 1945.16s - 1947.88s | What can we do with the menu middle position? 1948.04s - 1953.24s | So in this case, we would have to escape the Bluetooth sandbox because we're in so to say 1953.64s - 1955.64s | Bluetooth sandbox says we cannot 1955.86s - 1957.64s | execute the code 1957.64s - 1964.04s | We cannot execute arbitrary code on this other device and because of that we'd have to switch to the phones 1964.68s - 1967.48s | Rather than and look for the functionality that we can exploit 1967.80s - 1973.32s | So in this case generally phones have the phone functionality. They allow you to make calls play 1974.20s - 1979.72s | music or stream audio without any authorization while when it comes to sharing contacts and messages 1980.04s - 1983.96s | They require the authorization in some cases. Then they also allow you to 1985.24s - 1991.16s | Emulate the SIM card of the victim or user and get access to the SMS messages and phone calls 1992.20s - 1993.80s | while this 1993.88s - 1995.48s | might seem 1995.48s - 1999.24s | Very


chunk_text:
and 1942.92s - 1944.92s | After that, you might have a question 1945.16s - 1947.88s | What can we do with the menu middle position? 1948.04s - 1953.24s | So in this case, we would have to escape the Bluetooth sandbox because we're in so to say 1953.64s - 1955.64s | Bluetooth sandbox says we cannot 1955.86s - 1957.64s | execute the code 1957.64s - 1964.04s | We cannot execute arbitrary code on this other device and because of that we'd have to switch to the phones 1964.68s - 1967.48s | Rather than and look for the functionality that we can exploit 1967.80s - 1973.32s | So in this case generally phones have the phone functionality. They allow you to make calls play 1974.20s - 1979.72s | music or stream audio without any authorization while when it comes to sharing contacts and messages 1980.04s - 1983.96s | They require the authorization in some cases. Then they also allow you to 1985.24s - 1991.16s | Emulate the SIM card of the victim or user and get access to the SMS messages and phone calls 1992.20s - 1993.80s | while this 1993.88s - 1995.48s | might seem 1995.48s - 1999.24s | Very interesting the specific semi-access profile. This is actually 1999.78s - 2004.04s | Deprecated and it's only available on the android devices and has a lot of warnings 2004.68s - 2006.28s | it's not like 2006.28s - 2009.72s | Users users would not dismiss the warnings, but still 2010.36s - 2014.28s | It's only available on the android device. And in fact, the most interesting ones 2014.84s - 2019.48s | Is the message access profile which allows you to extract different messages 2019.48s - 2025.98s | For example SMS messages and emails in case of the emails. It's only available according to the specification 2026.52s - 2031.48s | I haven't been able to find any implementation that actually worked with the emails 2031.96s - 2032.84s | so 2032.84s - 2037.24s | You might you might find that might not i'm not sure in case of the emails 2037.24s - 2039.80s | but what I know for the fact is that you can 2040.28s - 2046.60s | Extract the SMS messages that were ever delivered to the phone and also you can send the SMS messages 2047.08s - 2050.28s | So additionally the user experience is very helpful as 2051.40s - 2055.96s


chunk_text:
interesting the specific semi-access profile. This is actually 1999.78s - 2004.04s | Deprecated and it's only available on the android devices and has a lot of warnings 2004.68s - 2006.28s | it's not like 2006.28s - 2009.72s | Users users would not dismiss the warnings, but still 2010.36s - 2014.28s | It's only available on the android device. And in fact, the most interesting ones 2014.84s - 2019.48s | Is the message access profile which allows you to extract different messages 2019.48s - 2025.98s | For example SMS messages and emails in case of the emails. It's only available according to the specification 2026.52s - 2031.48s | I haven't been able to find any implementation that actually worked with the emails 2031.96s - 2032.84s | so 2032.84s - 2037.24s | You might you might find that might not i'm not sure in case of the emails 2037.24s - 2039.80s | but what I know for the fact is that you can 2040.28s - 2046.60s | Extract the SMS messages that were ever delivered to the phone and also you can send the SMS messages 2047.08s - 2050.28s | So additionally the user experience is very helpful as 2051.40s - 2055.96s | on the iOS devices this specific functionality is called notifications file on the 2056.68s - 2063.00s | Android devices. It's called messages. So there is no mention mentioning of SMS messages at all 2064.20s - 2067.26s | So we come to the generic attack that you can execute 2067.72s - 2071.74s | And the first thing that you need is the man in the position which requires 2072.30s - 2076.78s | Which required one click from the user and then you will be able to ask for the messenger exit profile 2077.58s - 2081.26s | Access we should require another click from the user once granted 2081.66s - 2086.78s | You would be able to instruct the user's phone to send the SMS message or call a specific number that you control 2087.02s - 2091.90s | So that you will be able to link the phone number to yourself and then use it 2092.86s - 2094.86s | in the open source intelligence for 2095.08s - 2097.42s | automatic flow so that you will be able to discover the 2098.38s - 2102.46s | Login names or email addresses or just use the phone number 2103.42s - 2105.42s | directly on


chunk_text:
| on the iOS devices this specific functionality is called notifications file on the 2056.68s - 2063.00s | Android devices. It's called messages. So there is no mention mentioning of SMS messages at all 2064.20s - 2067.26s | So we come to the generic attack that you can execute 2067.72s - 2071.74s | And the first thing that you need is the man in the position which requires 2072.30s - 2076.78s | Which required one click from the user and then you will be able to ask for the messenger exit profile 2077.58s - 2081.26s | Access we should require another click from the user once granted 2081.66s - 2086.78s | You would be able to instruct the user's phone to send the SMS message or call a specific number that you control 2087.02s - 2091.90s | So that you will be able to link the phone number to yourself and then use it 2092.86s - 2094.86s | in the open source intelligence for 2095.08s - 2097.42s | automatic flow so that you will be able to discover the 2098.38s - 2102.46s | Login names or email addresses or just use the phone number 2103.42s - 2105.42s | directly on the services 2105.58s - 2107.58s | of interest and then 2108.06s - 2113.66s | Trigger the SMS based OTP for the accounts that are associated with the victim's phone number 2114.22s - 2117.74s | Then the OTP would be delivered to the victim's phone which we can 2118.22s - 2125.18s | Always retrieve as we have the messenger profile access and then relay back to the backend and hijack the accounts 2125.98s - 2130.38s | If this sounds all quite complicated and unlikely to you, I actually have some good news 2130.70s - 2135.10s | So first we do not need to have the manual position at all. We just need the 2135.72s - 2137.42s | connection to the phone 2137.42s - 2144.62s | secondly, we can link the phone numbers while accessing the metadata of the SMS messages that were previously delivered and 2145.10s - 2149.10s | I guess almost all of us have some SMS messages that were delivered to the 2149.98s - 2151.98s | phone numbers that we use 2152.06s - 2158.62s | Then we can also look for the content into the contents of the SMS messages and look for the emails and the login names


chunk_text:
the services 2105.58s - 2107.58s | of interest and then 2108.06s - 2113.66s | Trigger the SMS based OTP for the accounts that are associated with the victim's phone number 2114.22s - 2117.74s | Then the OTP would be delivered to the victim's phone which we can 2118.22s - 2125.18s | Always retrieve as we have the messenger profile access and then relay back to the backend and hijack the accounts 2125.98s - 2130.38s | If this sounds all quite complicated and unlikely to you, I actually have some good news 2130.70s - 2135.10s | So first we do not need to have the manual position at all. We just need the 2135.72s - 2137.42s | connection to the phone 2137.42s - 2144.62s | secondly, we can link the phone numbers while accessing the metadata of the SMS messages that were previously delivered and 2145.10s - 2149.10s | I guess almost all of us have some SMS messages that were delivered to the 2149.98s - 2151.98s | phone numbers that we use 2152.06s - 2158.62s | Then we can also look for the content into the contents of the SMS messages and look for the emails and the login names 2158.94s - 2164.86s | or alternatively, we could use the phone number in the or the data that we found in the 2165.50s - 2169.82s | open source intelligence for then finally, we do not need to have the 2170.46s - 2173.44s | We do not need to ask for the messenger profile authorization 2174.14s - 2181.74s | For some of the phones, especially 2022 and older phones, but also this applies to the latest phones as well 2182.14s - 2186.46s | So this is a one-to-two-click generic cloud takeover attack 2188.14s - 2191.34s | With this attack we can bypass MFA we can 2193.26s - 2198.78s | We can hijack accounts for the service that primarily rely on the SMS-based OTPs, for example meta services 2199.42s - 2202.06s | and but the most interesting services that we 2202.78s - 2204.30s | want to hijack or 2204.30s - 2211.44s | Potential perpetrators we want to hijack are the ones that for which we can trigger the SMS-based OTP by knowing some information 2211.76s - 2213.44s | in most of the cases, it's 2213.44s - 2215.44s | knowing the email address or the 2216.08s - 2217.28s | login name 2217.28s -


chunk_text:
2158.94s - 2164.86s | or alternatively, we could use the phone number in the or the data that we found in the 2165.50s - 2169.82s | open source intelligence for then finally, we do not need to have the 2170.46s - 2173.44s | We do not need to ask for the messenger profile authorization 2174.14s - 2181.74s | For some of the phones, especially 2022 and older phones, but also this applies to the latest phones as well 2182.14s - 2186.46s | So this is a one-to-two-click generic cloud takeover attack 2188.14s - 2191.34s | With this attack we can bypass MFA we can 2193.26s - 2198.78s | We can hijack accounts for the service that primarily rely on the SMS-based OTPs, for example meta services 2199.42s - 2202.06s | and but the most interesting services that we 2202.78s - 2204.30s | want to hijack or 2204.30s - 2211.44s | Potential perpetrators we want to hijack are the ones that for which we can trigger the SMS-based OTP by knowing some information 2211.76s - 2213.44s | in most of the cases, it's 2213.44s - 2215.44s | knowing the email address or the 2216.08s - 2217.28s | login name 2217.28s - 2220.64s | so by knowing this information you would be able to 2221.20s - 2225.52s | Trigger the SMS-based OTP and to know this get to know this information 2225.60s - 2232.32s | You can use the open source intelligence form then you'll be able to hijack paypal coinbase google account in cases the 2232.96s - 2236.48s | User is not logged in into the google account on the android phone 2237.12s - 2241.92s | Then you would be also able to for example hijack the apps to control the vehicles 2243.28s - 2245.84s | But for some of these services, it's rather difficult to do 2246.24s - 2253.12s | So in case of the apple id you have to resort to phishing only as the victim is constantly notified and it's infeasible to you 2253.84s - 2259.20s | The recovery in the timely fashion then when it comes to the google account if the user is logged in 2260.96s - 2264.56s | On the android device then we would have to know the 2264.96s - 2267.92s | Browser type and operating system type 2268.64s - 2271.04s | Type so that we can forge it and as we'll be 2271.60s


chunk_text:
2220.64s | so by knowing this information you would be able to 2221.20s - 2225.52s | Trigger the SMS-based OTP and to know this get to know this information 2225.60s - 2232.32s | You can use the open source intelligence form then you'll be able to hijack paypal coinbase google account in cases the 2232.96s - 2236.48s | User is not logged in into the google account on the android phone 2237.12s - 2241.92s | Then you would be also able to for example hijack the apps to control the vehicles 2243.28s - 2245.84s | But for some of these services, it's rather difficult to do 2246.24s - 2253.12s | So in case of the apple id you have to resort to phishing only as the victim is constantly notified and it's infeasible to you 2253.84s - 2259.20s | The recovery in the timely fashion then when it comes to the google account if the user is logged in 2260.96s - 2264.56s | On the android device then we would have to know the 2264.96s - 2267.92s | Browser type and operating system type 2268.64s - 2271.04s | Type so that we can forge it and as we'll be 2271.60s - 2278.40s | Close to the victim and have similar IP and location we'll be able to bypass all the checks done by google and hijack the account 2278.96s - 2280.64s | To give you some examples 2280.64s - 2286.32s | We would first start with the android phone in this case. This is a samsung s23 for which I did the attack 2286.80s - 2291.94s | So almost all of the android phones are actually always bearable and discoverable 2292.34s - 2293.22s | um 2293.22s - 2295.86s | So you can execute the attack at any time you want 2296.42s - 2301.38s | And once we try to connect and pair the we can force the notebook 2302.58s - 2307.38s | confirmation window that wouldn't show any pairing numbers to compare and thus the user would be 2309.22s - 2315.46s | See only the specific device wants to pair with them and the buttons to pair or cancel 2315.94s - 2317.94s | so in this case, it's 2317.94s - 2322.26s | The art of choosing the names to lure the victim into pairing or 2323.94s - 2330.34s | For that we can use we can do the targeted attacks


chunk_text:
- 2278.40s | Close to the victim and have similar IP and location we'll be able to bypass all the checks done by google and hijack the account 2278.96s - 2280.64s | To give you some examples 2280.64s - 2286.32s | We would first start with the android phone in this case. This is a samsung s23 for which I did the attack 2286.80s - 2291.94s | So almost all of the android phones are actually always bearable and discoverable 2292.34s - 2293.22s | um 2293.22s - 2295.86s | So you can execute the attack at any time you want 2296.42s - 2301.38s | And once we try to connect and pair the we can force the notebook 2302.58s - 2307.38s | confirmation window that wouldn't show any pairing numbers to compare and thus the user would be 2309.22s - 2315.46s | See only the specific device wants to pair with them and the buttons to pair or cancel 2315.94s - 2317.94s | so in this case, it's 2317.94s - 2322.26s | The art of choosing the names to lure the victim into pairing or 2323.94s - 2330.34s | For that we can use we can do the targeted attacks to observe the victim or just use the most common ones 2330.90s - 2335.86s | And try to pair randomly after that we can ask for the master extra profile 2336.90s - 2341.72s | Access and in most of the cases, it is a typical workflow for the carsons 2342.26s - 2347.62s | Smart smart watches and speakers. So if you forge the name for these devices, you would be 2348.66s - 2350.66s | more likely to get the 2351.22s - 2355.46s | Message access if the victim is more or less cautious 2356.10s - 2357.30s | but 2357.30s - 2359.70s | I guess most of the users are not 2360.26s - 2362.50s | so they would probably run the 2363.46s - 2366.66s | Access once granted you'll be able to execute the attack 2366.66s - 2370.58s | So get the phone number first the sms based otp on this specific site 2370.90s - 2376.50s | Then extract the otp enter the otp change the password and log out the user from all of the sessions 2377.22s - 2384.42s | For the samsung account and I was able to log out the user from their old phone and completely hijack


chunk_text:
to observe the victim or just use the most common ones 2330.90s - 2335.86s | And try to pair randomly after that we can ask for the master extra profile 2336.90s - 2341.72s | Access and in most of the cases, it is a typical workflow for the carsons 2342.26s - 2347.62s | Smart smart watches and speakers. So if you forge the name for these devices, you would be 2348.66s - 2350.66s | more likely to get the 2351.22s - 2355.46s | Message access if the victim is more or less cautious 2356.10s - 2357.30s | but 2357.30s - 2359.70s | I guess most of the users are not 2360.26s - 2362.50s | so they would probably run the 2363.46s - 2366.66s | Access once granted you'll be able to execute the attack 2366.66s - 2370.58s | So get the phone number first the sms based otp on this specific site 2370.90s - 2376.50s | Then extract the otp enter the otp change the password and log out the user from all of the sessions 2377.22s - 2384.42s | For the samsung account and I was able to log out the user from their old phone and completely hijack the samsung account 2385.62s - 2392.58s | So this is a two-click generic attack and also who was working on the patch show hardening for the android devices 2392.90s - 2394.90s | while samsung patched this 2395.70s - 2400.10s | Their part in the samsung account service in june 24 2400.90s - 2404.36s | They actually said that they fixed the vulnerability in november 2023 2405.22s - 2410.02s | But I reported in may 2024 and it was exploitable at that time 2410.66s - 2412.66s | but who knows 2412.98s - 2419.86s | When it comes to exploiting ios devices, you can actually exploit map the same way on the ios devices as 2420.34s - 2426.74s | On the android devices as on each new pairing request or in each new repairing pairing 2427.54s - 2431.70s | The user would need to explicitly allow notifications by going to the 2432.42s - 2434.42s | settings menu for this specific 2434.98s - 2442.82s | Bluetooth device and then toggling the button to allow the notifications. It's quite infeasible when we do the attack that way but 2444.18s - 2449.64s | What if we can renegotiate the connection for an already connected device


chunk_text:
the samsung account 2385.62s - 2392.58s | So this is a two-click generic attack and also who was working on the patch show hardening for the android devices 2392.90s - 2394.90s | while samsung patched this 2395.70s - 2400.10s | Their part in the samsung account service in june 24 2400.90s - 2404.36s | They actually said that they fixed the vulnerability in november 2023 2405.22s - 2410.02s | But I reported in may 2024 and it was exploitable at that time 2410.66s - 2412.66s | but who knows 2412.98s - 2419.86s | When it comes to exploiting ios devices, you can actually exploit map the same way on the ios devices as 2420.34s - 2426.74s | On the android devices as on each new pairing request or in each new repairing pairing 2427.54s - 2431.70s | The user would need to explicitly allow notifications by going to the 2432.42s - 2434.42s | settings menu for this specific 2434.98s - 2442.82s | Bluetooth device and then toggling the button to allow the notifications. It's quite infeasible when we do the attack that way but 2444.18s - 2449.64s | What if we can renegotiate the connection for an already connected device that already has the notification permissions? 2449.94s - 2454.52s | You would expect that the notifications would be reset on each pairing which is a requirement 2455.48s - 2457.64s | As per specification but 2459.00s - 2461.80s | ios doesn't follow that so 2462.60s - 2469.48s | You can spoof the mac address for an already connected device that already has access or permissions and try to repair 2470.04s - 2472.04s | in this case 2472.20s - 2473.32s | it's 2473.32s - 2479.16s | Here, I wasn't able to enforce the non-bit notebook like confirmation window that wouldn't show the pairing number to compare 2479.64s - 2486.12s | but you might also experiment with that and maybe get the non-bit notebook like confirmation window, but 2487.56s - 2489.80s | It is unfortunately that 2490.52s - 2492.68s | It's not the case as of today 2492.68s - 2499.00s | But what's most interesting is that the ios is also helping us in 2499.64s - 2506.68s | One other way they fetch the name of the previously connected device from the cache and use it in the pairing request 2507.00s - 2513.96s | So if the user had some kind of esoteric


chunk_text:
that already has the notification permissions? 2449.94s - 2454.52s | You would expect that the notifications would be reset on each pairing which is a requirement 2455.48s - 2457.64s | As per specification but 2459.00s - 2461.80s | ios doesn't follow that so 2462.60s - 2469.48s | You can spoof the mac address for an already connected device that already has access or permissions and try to repair 2470.04s - 2472.04s | in this case 2472.20s - 2473.32s | it's 2473.32s - 2479.16s | Here, I wasn't able to enforce the non-bit notebook like confirmation window that wouldn't show the pairing number to compare 2479.64s - 2486.12s | but you might also experiment with that and maybe get the non-bit notebook like confirmation window, but 2487.56s - 2489.80s | It is unfortunately that 2490.52s - 2492.68s | It's not the case as of today 2492.68s - 2499.00s | But what's most interesting is that the ios is also helping us in 2499.64s - 2506.68s | One other way they fetch the name of the previously connected device from the cache and use it in the pairing request 2507.00s - 2513.96s | So if the user had some kind of esoteric name for their device, they would be more inclined into pairing with us 2514.36s - 2519.96s | And once they click pair we have the notifications permissions as the previous device 2520.36s - 2527.16s | Is the previous connection had them so we'll be able to execute the attack in this case, for example hijack the facebook 2527.64s - 2533.80s | But you might actually want to focus not just on the facebook, but also on the apple id itself. So 2534.12s - 2535.48s | um 2535.48s - 2538.60s | recently there was an attack and that involved phishing and 2539.64s - 2544.04s | Seems to have attack and the perpetrators were able to steal twenty two thousand dollars 2544.52s - 2549.64s | From the victim and here we can try to replicate the single attack with the map 2550.76s - 2552.76s | map attack so 2552.76s - 2557.08s | Here we'll be able to inject the sms message as if they came from apple 2557.48s - 2564.84s | And do phishing once the user enters the apple id and the password the sms-based otp or mfe would be 2566.44s - 2568.84s | Would be used and we'll be able


chunk_text:
name for their device, they would be more inclined into pairing with us 2514.36s - 2519.96s | And once they click pair we have the notifications permissions as the previous device 2520.36s - 2527.16s | Is the previous connection had them so we'll be able to execute the attack in this case, for example hijack the facebook 2527.64s - 2533.80s | But you might actually want to focus not just on the facebook, but also on the apple id itself. So 2534.12s - 2535.48s | um 2535.48s - 2538.60s | recently there was an attack and that involved phishing and 2539.64s - 2544.04s | Seems to have attack and the perpetrators were able to steal twenty two thousand dollars 2544.52s - 2549.64s | From the victim and here we can try to replicate the single attack with the map 2550.76s - 2552.76s | map attack so 2552.76s - 2557.08s | Here we'll be able to inject the sms message as if they came from apple 2557.48s - 2564.84s | And do phishing once the user enters the apple id and the password the sms-based otp or mfe would be 2566.44s - 2568.84s | Would be used and we'll be able to steal them 2569.56s - 2573.40s | Steal the sms message value for or otp value 2574.20s - 2576.20s | via the messenger extra profile attack 2576.60s - 2581.40s | So here we just swap the same tool with the messenger extra profile attack 2581.88s - 2587.32s | We we can also focus on other applications like paypal or coinbase or any other of interest 2587.96s - 2591.88s | So you do not have to always focus on the apple id 2592.76s - 2594.76s | but 2595.08s - 2597.08s | The most actually interesting 2597.56s - 2599.00s | worrying or 2599.00s - 2601.96s | best part or worst part of this talk is that 2602.84s - 2608.92s | This specific vulnerability is not fixed as of the latest ios version and it's not going to be fixed 2609.64s - 2616.76s | The apple said that the users are safe because they are showing the parent prompt, but I seem to see that 2618.04s - 2619.32s | They generally 2619.32s - 2625.72s | Violated the business verification and that's why their users are one click away from their accounts being stolen 2626.12s - 2632.68s | But of course it's up to


chunk_text:
to steal them 2569.56s - 2573.40s | Steal the sms message value for or otp value 2574.20s - 2576.20s | via the messenger extra profile attack 2576.60s - 2581.40s | So here we just swap the same tool with the messenger extra profile attack 2581.88s - 2587.32s | We we can also focus on other applications like paypal or coinbase or any other of interest 2587.96s - 2591.88s | So you do not have to always focus on the apple id 2592.76s - 2594.76s | but 2595.08s - 2597.08s | The most actually interesting 2597.56s - 2599.00s | worrying or 2599.00s - 2601.96s | best part or worst part of this talk is that 2602.84s - 2608.92s | This specific vulnerability is not fixed as of the latest ios version and it's not going to be fixed 2609.64s - 2616.76s | The apple said that the users are safe because they are showing the parent prompt, but I seem to see that 2618.04s - 2619.32s | They generally 2619.32s - 2625.72s | Violated the business verification and that's why their users are one click away from their accounts being stolen 2626.12s - 2632.68s | But of course it's up to you to judge and decide whether this is a specific vulnerability that should be fixed or not 2633.32s - 2637.74s | But I personally hope that apple would eventually fix it and accredit accordingly 2638.70s - 2640.38s | For the attack itself 2640.38s - 2648.14s | I'm releasing a tool that affects more than 50 percent of the smartphone market worldwide more likely to affect the whole market 2648.78s - 2652.94s | And this specific tool would allow you to retrieve and send sms messages as well 2653.02s - 2658.38s | So look for the emails and phone numbers on the device and it would be possible to 2659.02s - 2663.74s | Connect the tool to the infrastructure. This would actually do the recovery process 2664.70s - 2667.26s | so here we come to the kit hacker base and 2667.74s - 2669.74s | the first thing that I want to mention is that 2670.94s - 2675.44s | Even the newest cars are generally shipped with the protocol. It's just vulnerabilities 2676.46s - 2679.18s | and it's not really easy to fix this because 2679.74s - 2684.08s | The design of the car is locked in just several years before it's


chunk_text:
you to judge and decide whether this is a specific vulnerability that should be fixed or not 2633.32s - 2637.74s | But I personally hope that apple would eventually fix it and accredit accordingly 2638.70s - 2640.38s | For the attack itself 2640.38s - 2648.14s | I'm releasing a tool that affects more than 50 percent of the smartphone market worldwide more likely to affect the whole market 2648.78s - 2652.94s | And this specific tool would allow you to retrieve and send sms messages as well 2653.02s - 2658.38s | So look for the emails and phone numbers on the device and it would be possible to 2659.02s - 2663.74s | Connect the tool to the infrastructure. This would actually do the recovery process 2664.70s - 2667.26s | so here we come to the kit hacker base and 2667.74s - 2669.74s | the first thing that I want to mention is that 2670.94s - 2675.44s | Even the newest cars are generally shipped with the protocol. It's just vulnerabilities 2676.46s - 2679.18s | and it's not really easy to fix this because 2679.74s - 2684.08s | The design of the car is locked in just several years before it's manufactured 2684.92s - 2689.66s | Manufactured and it's not possible to change the business version or hardware in it 2690.30s - 2696.22s | So it's quite difficult to do so and we have to live with the anticipation of some kind of 2696.84s - 2700.78s | Protocol obligations vulnerabilities in the cars and knowing that 2701.42s - 2705.42s | Then when it comes to pairing pairing security or in the security environment 2705.74s - 2709.82s | It's extremely important as it's the only safeguard against the many middle attacks 2710.30s - 2712.30s | but what you have to remember is that 2713.26s - 2719.42s | Forcing repairing is possible and it might be malicious. So we have to watch out for that as well 2720.30s - 2722.30s | then when it comes to the 2722.46s - 2726.38s | SMS based OTP services or the services that rely only on 2727.02s - 2734.86s | SMS based OTPs. It might be rather risky for the end users and that's why maybe it would be best to consider other 2735.74s - 2737.74s | OTPs 2738.62s - 2741.34s | OTP sources, so for example 2742.14s - 2747.82s | Email based OTPs and in that


chunk_text:
manufactured 2684.92s - 2689.66s | Manufactured and it's not possible to change the business version or hardware in it 2690.30s - 2696.22s | So it's quite difficult to do so and we have to live with the anticipation of some kind of 2696.84s - 2700.78s | Protocol obligations vulnerabilities in the cars and knowing that 2701.42s - 2705.42s | Then when it comes to pairing pairing security or in the security environment 2705.74s - 2709.82s | It's extremely important as it's the only safeguard against the many middle attacks 2710.30s - 2712.30s | but what you have to remember is that 2713.26s - 2719.42s | Forcing repairing is possible and it might be malicious. So we have to watch out for that as well 2720.30s - 2722.30s | then when it comes to the 2722.46s - 2726.38s | SMS based OTP services or the services that rely only on 2727.02s - 2734.86s | SMS based OTPs. It might be rather risky for the end users and that's why maybe it would be best to consider other 2735.74s - 2737.74s | OTPs 2738.62s - 2741.34s | OTP sources, so for example 2742.14s - 2747.82s | Email based OTPs and in that case it might add additional safeguards to the users 2748.46s - 2753.66s | So thanks for listening now I hand over to Martin and maybe see you next year 2758.59s - 2765.79s | All right, thanks for staying with us there's just two points left for me at the very end 2767.71s - 2769.71s | Let me find the right slides 2774.09s - 2785.37s | No, that's not it 2785.37s - 2797.96s | Be quicker that way 2797.96s - 2804.14s | So yeah, sorry, we've seen that much of bluetooth is fundamentally insecure both for standards and implementations 2804.92s - 2807.56s | The toolkit have the link on the last slide as well 2808.60s - 2812.20s | It's online for you to check your cars your bluetooth 2812.82s - 2814.84s | products any of them 2814.84s - 2817.64s | And of course, we're not liable for anything you do with it 2819.88s - 2827.16s | But we focus on bluetooth and cars and just very last thing of course you can check anything and 2827.96s - 2831.64s | We took it to one of the domains. We're very familiar with which is aviation 2832.04s - 2836.04s | We tried it


chunk_text:
case it might add additional safeguards to the users 2748.46s - 2753.66s | So thanks for listening now I hand over to Martin and maybe see you next year 2758.59s - 2765.79s | All right, thanks for staying with us there's just two points left for me at the very end 2767.71s - 2769.71s | Let me find the right slides 2774.09s - 2785.37s | No, that's not it 2785.37s - 2797.96s | Be quicker that way 2797.96s - 2804.14s | So yeah, sorry, we've seen that much of bluetooth is fundamentally insecure both for standards and implementations 2804.92s - 2807.56s | The toolkit have the link on the last slide as well 2808.60s - 2812.20s | It's online for you to check your cars your bluetooth 2812.82s - 2814.84s | products any of them 2814.84s - 2817.64s | And of course, we're not liable for anything you do with it 2819.88s - 2827.16s | But we focus on bluetooth and cars and just very last thing of course you can check anything and 2827.96s - 2831.64s | We took it to one of the domains. We're very familiar with which is aviation 2832.04s - 2836.04s | We tried it out on our own lab of certified real aircraft hardware 2836.60s - 2843.64s | Which also has bluetooth to connect so-called electronic flight bags, which is just an ipad really with flight computers 2844.60s - 2846.36s | and 2846.36s - 2847.64s | the thing is 2847.64s - 2852.60s | These bluetooth versions are so old. Most of these exploits don't work there because 2853.72s - 2859.56s | honestly, you can establish the man in the middle position anyway, because the encryption is just so 2860.12s - 2863.24s | Weak or trivial so we haven't explored this further 2863.88s - 2865.32s | but it should be 2865.32s - 2869.40s | Very easy to also do this on at least these specific 2870.52s - 2872.52s | flight management systems 2873.16s - 2875.88s | For that, thank you for listening and also 2876.52s - 2881.16s | Putting up with a video talk. I hope that can make it in person next time 2882.12s - 2888.84s | This is the qr code to the github repository where you can find all the information also this disclosure results 2889.56s - 2891.56s | Any questions i'm available? 2892.36s - 2896.70s | And vlad is also very


chunk_text:
out on our own lab of certified real aircraft hardware 2836.60s - 2843.64s | Which also has bluetooth to connect so-called electronic flight bags, which is just an ipad really with flight computers 2844.60s - 2846.36s | and 2846.36s - 2847.64s | the thing is 2847.64s - 2852.60s | These bluetooth versions are so old. Most of these exploits don't work there because 2853.72s - 2859.56s | honestly, you can establish the man in the middle position anyway, because the encryption is just so 2860.12s - 2863.24s | Weak or trivial so we haven't explored this further 2863.88s - 2865.32s | but it should be 2865.32s - 2869.40s | Very easy to also do this on at least these specific 2870.52s - 2872.52s | flight management systems 2873.16s - 2875.88s | For that, thank you for listening and also 2876.52s - 2881.16s | Putting up with a video talk. I hope that can make it in person next time 2882.12s - 2888.84s | This is the qr code to the github repository where you can find all the information also this disclosure results 2889.56s - 2891.56s | Any questions i'm available? 2892.36s - 2896.70s | And vlad is also very happy if you contact him online. Thank you very much


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=9IN1Aj56hYA", "title": "DEF CON 32 - Hunters and Gatherers A Deep Dive into the World of Bug Bounties - Panel", "description": "Join us for an insightful panel discussion where we bring together seasoned Bug Bounty Program Managers and adept bug bounty hunters. This panel aims to address pressing questions and share diverse perspectives on the evolving landscape of bug bounties. We will dive into the challenges faced by both hunters and managers, discuss strategies to enhance the impact of submissions, and explore the future of bug bounties in the face of emerging technologies, evolving trends, and threats. We will also highlight the importance of bug bounties in the current cybersecurity landscape and share the top elements that contribute to a successful bug bounty program. Lastly, we will provide recommendations for organizations looking to mature their bug bounty programs but are hesitant about expanding. This panel promises to be a valuable opportunity for learning, sharing, and networking for anyone involved or interested in the world of bug bounties.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 3397, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 4.16s | This text was transcribed using whisper model: large-v2 Uh, thank you for joining us here today. Uh, we are going to do intros in a second, but 4.16s - 8.46s | overall, we're looking to give you some insight into the bug bounty world from three very 8.46s - 12.70s | different perspectives on this, everywhere from running program management, running the 12.70s - 17.42s | policy village here as well, or at least, uh, being very important regarding it, uh, all 17.42s - 22.58s | the way through to black badge winners and everything in between for this. Uh, so to start 22.58s - 28.12s | off, we'll do a few quick intros and then we'll chat through our overall agenda. Yeah. So 28.12s - 32.54s | Katie, you're first up here. Hi everyone. Uh, I'm Katie Noble, uh, otherwise known as 32.54s - 38.68s | lady in, I am the person for the policy village. So come see us in two 37. Um, so my 38.68s - 42.98s | background is actually in behavioral analysis and, uh, I got into tech a couple of years 42.98s - 48.32s | ago cause I was thrust into it by the government. Um, did, uh, worked for the government 48.32s - 53.86s | for many, many years


chunk_text:
Uh, we are going to do intros in a second, but 4.16s - 8.46s | overall, we're looking to give you some insight into the bug bounty world from three very 8.46s - 12.70s | different perspectives on this, everywhere from running program management, running the 12.70s - 17.42s | policy village here as well, or at least, uh, being very important regarding it, uh, all 17.42s - 22.58s | the way through to black badge winners and everything in between for this. Uh, so to start 22.58s - 28.12s | off, we'll do a few quick intros and then we'll chat through our overall agenda. Yeah. So 28.12s - 32.54s | Katie, you're first up here. Hi everyone. Uh, I'm Katie Noble, uh, otherwise known as 32.54s - 38.68s | lady in, I am the person for the policy village. So come see us in two 37. Um, so my 38.68s - 42.98s | background is actually in behavioral analysis and, uh, I got into tech a couple of years 42.98s - 48.32s | ago cause I was thrust into it by the government. Um, did, uh, worked for the government 48.32s - 53.86s | for many, many years and I currently run, um, uh, the product security incident response 53.86s - 57.50s | and bug bounty for a big fortune 50 company, but I'm not going to tell you which, 57.54s - 63.12s | cause I don't represent them right now. Uh, this is not on the slides. Don't worry. Yeah. So, 63.12s - 67.78s | uh, and my claim to fame is that in my career I've coordinated over 20,000 cyber security 67.78s - 78.90s | vulnerabilities. Definitely can't top that. Uh, hi everyone. I'm Jonathan Cusco. Some of 78.90s - 83.60s | you know me as bad idea. Um, I've kind of done both sides of being a full time bug bounty 83.60s - 87.54s | hunter, also managing responsible disclosure programs. And so I've probably got the 87.58s - 91.34s | intermediate experience here of like half her side, half of his side. Um, currently the 91.34s - 94.32s | founder of chaotic good information security. My background is very much that of the 94.32s - 98.22s | offensive security red team or penetration tester fully on the vulnerability front and 98.22s - 102.62s | identifying what's truly vulnerable. How do we really fix it?


chunk_text:
and I currently run, um, uh, the product security incident response 53.86s - 57.50s | and bug bounty for a big fortune 50 company, but I'm not going to tell you which, 57.54s - 63.12s | cause I don't represent them right now. Uh, this is not on the slides. Don't worry. Yeah. So, 63.12s - 67.78s | uh, and my claim to fame is that in my career I've coordinated over 20,000 cyber security 67.78s - 78.90s | vulnerabilities. Definitely can't top that. Uh, hi everyone. I'm Jonathan Cusco. Some of 78.90s - 83.60s | you know me as bad idea. Um, I've kind of done both sides of being a full time bug bounty 83.60s - 87.54s | hunter, also managing responsible disclosure programs. And so I've probably got the 87.58s - 91.34s | intermediate experience here of like half her side, half of his side. Um, currently the 91.34s - 94.32s | founder of chaotic good information security. My background is very much that of the 94.32s - 98.22s | offensive security red team or penetration tester fully on the vulnerability front and 98.22s - 102.62s | identifying what's truly vulnerable. How do we really fix it? And communicating that 102.62s - 106.02s | across aisles, which is obviously sometimes difficult for engineers as they get a little 106.02s - 117.28s | bit more up their craft. Cool. Um, hi, I'm Sam. Uh, I'm a security engineer at Google. Uh, 117.28s - 122.32s | I help run, uh, one of our nine bug bounty programs, um, and our kind of core google.com bug 122.32s - 129.56s | bounty program. Um, I have a couple of Defcon black badges. Uh, yeah, that's my kind of 129.56s - 131.06s | claim to fame. 131.06s - 136.06s | Alright. Hi everybody. I'm a senior security engineer at GitHub. I work on the bug bounty 139.66s - 145.38s | program. I, uh, like to drive fast cars on curvy roads. I like to hit the track a lot, um, 145.38s - 150.28s | when I'm not on the computer and I love building bug bounty programs, both private public 150.28s - 156.12s | from nothing to full scope programs. And, uh, very excited to be here with you. Thank you. 156.12s - 165.12s | And I am Logan. I work with Jeff also at GitHub helping run bug bounty over there


chunk_text:
And communicating that 102.62s - 106.02s | across aisles, which is obviously sometimes difficult for engineers as they get a little 106.02s - 117.28s | bit more up their craft. Cool. Um, hi, I'm Sam. Uh, I'm a security engineer at Google. Uh, 117.28s - 122.32s | I help run, uh, one of our nine bug bounty programs, um, and our kind of core google.com bug 122.32s - 129.56s | bounty program. Um, I have a couple of Defcon black badges. Uh, yeah, that's my kind of 129.56s - 131.06s | claim to fame. 131.06s - 136.06s | Alright. Hi everybody. I'm a senior security engineer at GitHub. I work on the bug bounty 139.66s - 145.38s | program. I, uh, like to drive fast cars on curvy roads. I like to hit the track a lot, um, 145.38s - 150.28s | when I'm not on the computer and I love building bug bounty programs, both private public 150.28s - 156.12s | from nothing to full scope programs. And, uh, very excited to be here with you. Thank you. 156.12s - 165.12s | And I am Logan. I work with Jeff also at GitHub helping run bug bounty over there at great 165.12s - 167.52s | experiences working with everyone on the panel. And I think we're going to give you a 167.52s - 170.56s | wonderful, a wonderful insight into everything going on here today. 171.46s - 179.46s | Alright. So we're going to pose this as sort of, here's a question. We're going to let them 179.46s - 183.84s | talk and Jeff and I are going to be hanging off to the side. So given that we're here to talk 183.84s - 188.00s | about bug bounty, I mean, this seems like the obvious introduction. Uh, so Coast Coast, 188.00s - 192.94s | we'll start with you on this one. What got you into the world of bug bounty originally? 192.94s - 197.04s | So this is going to dial back about 10 or 12 years ago. Um, I started doing responsible 197.06s - 201.16s | disclosure and bug bounty hunting as a very broke college student with over six figures of 201.16s - 206.00s | student loan debt as it often happens here in the United States. I had my first penetration 206.00s - 209.58s | testing job for a company, but the pay wasn't great.


chunk_text:
at great 165.12s - 167.52s | experiences working with everyone on the panel. And I think we're going to give you a 167.52s - 170.56s | wonderful, a wonderful insight into everything going on here today. 171.46s - 179.46s | Alright. So we're going to pose this as sort of, here's a question. We're going to let them 179.46s - 183.84s | talk and Jeff and I are going to be hanging off to the side. So given that we're here to talk 183.84s - 188.00s | about bug bounty, I mean, this seems like the obvious introduction. Uh, so Coast Coast, 188.00s - 192.94s | we'll start with you on this one. What got you into the world of bug bounty originally? 192.94s - 197.04s | So this is going to dial back about 10 or 12 years ago. Um, I started doing responsible 197.06s - 201.16s | disclosure and bug bounty hunting as a very broke college student with over six figures of 201.16s - 206.00s | student loan debt as it often happens here in the United States. I had my first penetration 206.00s - 209.58s | testing job for a company, but the pay wasn't great. I didn't, I wasn't really like the best 209.58s - 213.44s | at my craft. Um, you know, we started off a little bit lower and so I started moonlighting 213.44s - 218.22s | bug bounties. Back at that time there was no hacker one, no bug crowd, no commercialized 218.22s - 223.16s | sort of platform to, um, just bring you into it easily and get you in straight in front of 223.16s - 226.46s | clients. So the thing that I was doing back then was actually looking at a lot of Google 226.52s - 231.82s | acquisitions and the Google acquisitions would allow you to submit a vulnerability only 231.82s - 236.56s | after they had owned it for six months. Um, pretty easy to find a list of acquisitions. Uh, 236.56s - 242.00s | so I would find as many bounties as I could and then I sat on them until the six month part, 242.00s - 246.24s | uh, scripted the submission to happen at 1201 that night. Sorry, I don't think you were there 246.24s - 252.38s | at the time. Um, and that really got me into a lot of it back then,


chunk_text:
I didn't, I wasn't really like the best 209.58s - 213.44s | at my craft. Um, you know, we started off a little bit lower and so I started moonlighting 213.44s - 218.22s | bug bounties. Back at that time there was no hacker one, no bug crowd, no commercialized 218.22s - 223.16s | sort of platform to, um, just bring you into it easily and get you in straight in front of 223.16s - 226.46s | clients. So the thing that I was doing back then was actually looking at a lot of Google 226.52s - 231.82s | acquisitions and the Google acquisitions would allow you to submit a vulnerability only 231.82s - 236.56s | after they had owned it for six months. Um, pretty easy to find a list of acquisitions. Uh, 236.56s - 242.00s | so I would find as many bounties as I could and then I sat on them until the six month part, 242.00s - 246.24s | uh, scripted the submission to happen at 1201 that night. Sorry, I don't think you were there 246.24s - 252.38s | at the time. Um, and that really got me into a lot of it back then, but my motivations were a 252.38s - 256.04s | little bit split between one being like starving student trying to make his name in the 256.06s - 260.16s | world. Um, obviously the financial implications of doing well in the bug bounty world can be 260.16s - 267.18s | quite ludicrous. Uh, so I started doing that, um, while also just using that as a way to get 267.18s - 270.84s | better at being a security engineer, at being a penetration tester. It's a little bit 270.84s - 274.18s | different to take a client scoped engagement versus what's public out there on the real 274.18s - 277.12s | world. So you get various different maturities. You see a lot of different technologies 277.12s - 281.56s | really fast. Um, and I think that really expands your caliber as a bug bounty hunter, uh, 281.56s - 284.62s | just to see how things work, how different people implement the same thing in different 284.64s - 289.02s | ways. And you get a lot of real world wisdom and experience very, very quickly if you do 289.02s - 297.01s | that over and over and over again, day after day.


chunk_text:
but my motivations were a 252.38s - 256.04s | little bit split between one being like starving student trying to make his name in the 256.06s - 260.16s | world. Um, obviously the financial implications of doing well in the bug bounty world can be 260.16s - 267.18s | quite ludicrous. Uh, so I started doing that, um, while also just using that as a way to get 267.18s - 270.84s | better at being a security engineer, at being a penetration tester. It's a little bit 270.84s - 274.18s | different to take a client scoped engagement versus what's public out there on the real 274.18s - 277.12s | world. So you get various different maturities. You see a lot of different technologies 277.12s - 281.56s | really fast. Um, and I think that really expands your caliber as a bug bounty hunter, uh, 281.56s - 284.62s | just to see how things work, how different people implement the same thing in different 284.64s - 289.02s | ways. And you get a lot of real world wisdom and experience very, very quickly if you do 289.02s - 297.01s | that over and over and over again, day after day. Who wants to pick it up from there? Um, so, 297.01s - 303.55s | uh, I got in a little bit of a different way. So one of my, uh, teammates from DEF CON, uh, 303.55s - 306.69s | reached out to me. I was like, Hey, I'm going to this live hacking event, uh, in New York 306.69s - 311.93s | City. You should come down. I was in Boston, so in Boston. And so I went down there and I 311.95s - 318.15s | participated in this live hacking event, only I was using curl. I wasn't using anything else. I 318.15s - 322.79s | was, I knew exactly what everyone else was doing, but I was very, very slow. And so I made it my 322.79s - 329.77s | mission to get faster, but then also to become a better bug bounty hunter. And fast forward a 329.77s - 332.41s | couple of years, I didn't find anything there. Fast forward a couple of years, I actually won 332.41s - 337.57s | one of the events. Um, so that, that was my kind of how I got into this and how I ramped up 337.59s - 345.30s


chunk_text:
Who wants to pick it up from there? Um, so, 297.01s - 303.55s | uh, I got in a little bit of a different way. So one of my, uh, teammates from DEF CON, uh, 303.55s - 306.69s | reached out to me. I was like, Hey, I'm going to this live hacking event, uh, in New York 306.69s - 311.93s | City. You should come down. I was in Boston, so in Boston. And so I went down there and I 311.95s - 318.15s | participated in this live hacking event, only I was using curl. I wasn't using anything else. I 318.15s - 322.79s | was, I knew exactly what everyone else was doing, but I was very, very slow. And so I made it my 322.79s - 329.77s | mission to get faster, but then also to become a better bug bounty hunter. And fast forward a 329.77s - 332.41s | couple of years, I didn't find anything there. Fast forward a couple of years, I actually won 332.41s - 337.57s | one of the events. Um, so that, that was my kind of how I got into this and how I ramped up 337.59s - 345.30s | from there. I guess that's me. Um, so my background, like I said, was government. Um, I 345.30s - 349.54s | spent about 15 years in the US government doing various things. Like I said, my 349.54s - 354.22s | background's in behavioral analysis, so it's all about why people do the things that they do. Um, 354.22s - 359.62s | so I found myself at Homeland Security at the agency currently known as CISA. I was not CISA 359.62s - 365.96s | when I was there. Um, but I was essentially moved into a position where I was acting as an 365.96s - 372.78s | intermediary. So, um, researchers, hackers, come to, can come to the US government, even at 372.78s - 379.18s | that time, and say like, hey, I'm being threatened by X company. Um, and it was my job to go to 379.18s - 384.22s | that company and be like, what are you doing, man? Like, this is not going to work out. Um, and 384.22s - 388.22s | you can threaten that hacker all you want, but I've got a fleet of lawyers, so go ahead and try 388.22s - 394.14s | to


chunk_text:
| from there. I guess that's me. Um, so my background, like I said, was government. Um, I 345.30s - 349.54s | spent about 15 years in the US government doing various things. Like I said, my 349.54s - 354.22s | background's in behavioral analysis, so it's all about why people do the things that they do. Um, 354.22s - 359.62s | so I found myself at Homeland Security at the agency currently known as CISA. I was not CISA 359.62s - 365.96s | when I was there. Um, but I was essentially moved into a position where I was acting as an 365.96s - 372.78s | intermediary. So, um, researchers, hackers, come to, can come to the US government, even at 372.78s - 379.18s | that time, and say like, hey, I'm being threatened by X company. Um, and it was my job to go to 379.18s - 384.22s | that company and be like, what are you doing, man? Like, this is not going to work out. Um, and 384.22s - 388.22s | you can threaten that hacker all you want, but I've got a fleet of lawyers, so go ahead and try 388.22s - 394.14s | to threaten me. Um, and so I acted as an intermediary a lot, um, basically as a, I feel 394.14s - 399.42s | like a camp counselor a lot. Um, which was great, because I could use all of my, uh, all of my, my 399.42s - 406.86s | behavioral analysis background, um, to mediate a lot of, um, fairly high profile, um, uh, 406.86s - 412.46s | vulnerabilities. A lot of the hackers that would come to us were very, very serious about, like, 412.46s - 416.64s | they were looking at airplanes and nuclear power plants and water plants. These are very serious 416.64s - 423.78s | things, um, that needed to be fixed. And so, that was really how I got into it, and then, uh, 423.78s - 429.26s | eventually I moved out of government, um, into the private sector, um, running bug bounty 429.26s - 431.46s | programs in the private sector. 431.46s - 437.50s | So, wonderful. So, moving on, and thank God I have good notes here. Uh, one of the things you 437.50s - 441.44s | had touched on, Sam, is, you know, starting with Curl and, and wanting to be faster and


chunk_text:
threaten me. Um, and so I acted as an intermediary a lot, um, basically as a, I feel 394.14s - 399.42s | like a camp counselor a lot. Um, which was great, because I could use all of my, uh, all of my, my 399.42s - 406.86s | behavioral analysis background, um, to mediate a lot of, um, fairly high profile, um, uh, 406.86s - 412.46s | vulnerabilities. A lot of the hackers that would come to us were very, very serious about, like, 412.46s - 416.64s | they were looking at airplanes and nuclear power plants and water plants. These are very serious 416.64s - 423.78s | things, um, that needed to be fixed. And so, that was really how I got into it, and then, uh, 423.78s - 429.26s | eventually I moved out of government, um, into the private sector, um, running bug bounty 429.26s - 431.46s | programs in the private sector. 431.46s - 437.50s | So, wonderful. So, moving on, and thank God I have good notes here. Uh, one of the things you 437.50s - 441.44s | had touched on, Sam, is, you know, starting with Curl and, and wanting to be faster and working 441.44s - 445.28s | with everybody else. So, as you've gone through this, and I guess starting from the hacker side 445.34s - 449.72s | and, and sort of looking at it from the response side as well, what, what tools, what techniques 449.72s - 453.12s | have you found to be, uh, the most valuable when you're going through and actually doing bug 453.12s - 455.52s | hunting? Without getting too, too in depth, because we are on the clock. 455.52s - 462.06s | Um, yeah. So, for me, it's, it's mostly about, well, what makes you move faster, um, what makes 462.06s - 465.84s | you find things, and more importantly, what makes you reject things that aren't interesting as 465.84s - 470.00s | quick as possible. Um, and the faster you can do that, the more targets you can look at, um, the 470.00s - 474.74s | more successful you'll be. Simultaneously, it's also important to use your tools to find other 474.74s - 480.34s | targets, so, like, look for weird subdomains, look for weird places. Um, maybe pivoting this a 480.34s - 484.98s | little bit on the program side, program management side, like,


chunk_text:
working 441.44s - 445.28s | with everybody else. So, as you've gone through this, and I guess starting from the hacker side 445.34s - 449.72s | and, and sort of looking at it from the response side as well, what, what tools, what techniques 449.72s - 453.12s | have you found to be, uh, the most valuable when you're going through and actually doing bug 453.12s - 455.52s | hunting? Without getting too, too in depth, because we are on the clock. 455.52s - 462.06s | Um, yeah. So, for me, it's, it's mostly about, well, what makes you move faster, um, what makes 462.06s - 465.84s | you find things, and more importantly, what makes you reject things that aren't interesting as 465.84s - 470.00s | quick as possible. Um, and the faster you can do that, the more targets you can look at, um, the 470.00s - 474.74s | more successful you'll be. Simultaneously, it's also important to use your tools to find other 474.74s - 480.34s | targets, so, like, look for weird subdomains, look for weird places. Um, maybe pivoting this a 480.34s - 484.98s | little bit on the program side, program management side, like, using templates to respond to 484.98s - 490.02s | researchers, um, you'll often get the same invalid reports over and over again if you have to 490.02s - 497.02s | write a custom response every time, like, it's just gonna slow you down. Um, yeah. 497.02s - 501.96s | I'll take it from there. Um, so, I think it, first off, it depends on, like, what your particular 501.98s - 504.82s | vertical of security is, because just by saying, like, what kind of pentester are you, it's, like, 504.82s - 508.66s | saying, like, what, what do you do in cyber security, and, you know, there's a million different 508.66s - 512.20s | verticals. Uh, can I, like, quickly ask the room, like, who are all the web application folks 512.20s - 517.20s | here? Some, like, network, infrastructure, endpoint detection, okay, so it's kind of all 522.10s - 525.98s | over the place, and so, like, saying, like, using Burp Suite to go really deep doesn't mean 525.98s - 529.94s | much to someone who isn't an application security person. Um, and if you're someone who's 529.96s - 533.40s | entirely in web application security, you might be


chunk_text:
using templates to respond to 484.98s - 490.02s | researchers, um, you'll often get the same invalid reports over and over again if you have to 490.02s - 497.02s | write a custom response every time, like, it's just gonna slow you down. Um, yeah. 497.02s - 501.96s | I'll take it from there. Um, so, I think it, first off, it depends on, like, what your particular 501.98s - 504.82s | vertical of security is, because just by saying, like, what kind of pentester are you, it's, like, 504.82s - 508.66s | saying, like, what, what do you do in cyber security, and, you know, there's a million different 508.66s - 512.20s | verticals. Uh, can I, like, quickly ask the room, like, who are all the web application folks 512.20s - 517.20s | here? Some, like, network, infrastructure, endpoint detection, okay, so it's kind of all 522.10s - 525.98s | over the place, and so, like, saying, like, using Burp Suite to go really deep doesn't mean 525.98s - 529.94s | much to someone who isn't an application security person. Um, and if you're someone who's 529.96s - 533.40s | entirely in web application security, you might be a little deer in the headlights when you 533.40s - 538.44s | find a command injection, and it's, like, okay, actually, like, pivot off that box. Um, when it 538.44s - 542.00s | comes to the tools that you're using, I think more importantly than just, like, finding the 542.00s - 545.58s | right tool that just helps, you know, find things automatically, you really need to align 545.58s - 549.68s | that with what your particular vertical is and what you understand really well. Um, there's a 549.68s - 554.06s | lot of opportunities to go deep in new areas of security that you might not be the best at. 554.06s - 558.76s | Like, so, for instance, one of my weak points is, like, malware reversal. So, if I find 558.78s - 562.32s | malware on a machine, I'm probably not going to spend 20 hours trying to figure out how to 562.32s - 565.22s | reverse it. I'm going to find one of my friends who's really good at malware stuff and say, 565.22s - 572.06s | hey, we're going to partner on this one so I can go back to what I do best. Um, yeah,


chunk_text:
a little deer in the headlights when you 533.40s - 538.44s | find a command injection, and it's, like, okay, actually, like, pivot off that box. Um, when it 538.44s - 542.00s | comes to the tools that you're using, I think more importantly than just, like, finding the 542.00s - 545.58s | right tool that just helps, you know, find things automatically, you really need to align 545.58s - 549.68s | that with what your particular vertical is and what you understand really well. Um, there's a 549.68s - 554.06s | lot of opportunities to go deep in new areas of security that you might not be the best at. 554.06s - 558.76s | Like, so, for instance, one of my weak points is, like, malware reversal. So, if I find 558.78s - 562.32s | malware on a machine, I'm probably not going to spend 20 hours trying to figure out how to 562.32s - 565.22s | reverse it. I'm going to find one of my friends who's really good at malware stuff and say, 565.22s - 572.06s | hey, we're going to partner on this one so I can go back to what I do best. Um, yeah, a little 572.06s - 577.36s | pivot, held a die on. I'm going to pivot further. Um, so, we're talking about technology 577.36s - 582.00s | tools, but from my perspective, the best tools that we can have are really the behavioral kind 582.00s - 587.10s | of tools, so, like, common sense I think is probably the best tool that I have available. Um, 587.16s - 590.88s | I get a lot of reports from a lot of folks, and some of them are really high quality, really 590.88s - 597.46s | good quality, um, criticality, and some of them are not. Um, and some of them seem like 597.46s - 601.80s | they're social engineering or just not good quality reports until you actually start 601.80s - 606.50s | digging into them. So, like, um, I always, like, make sure my engineers, like, really look at 606.50s - 612.40s | that report because it could at first appearance be, like, incomplete or not, like, not well 612.40s - 616.74s | formed or just garbage, but in reality, some of the very best critical vulnerabilities are in 616.74s - 621.92s | that way. Um, even negative testing results are


chunk_text:
a little 572.06s - 577.36s | pivot, held a die on. I'm going to pivot further. Um, so, we're talking about technology 577.36s - 582.00s | tools, but from my perspective, the best tools that we can have are really the behavioral kind 582.00s - 587.10s | of tools, so, like, common sense I think is probably the best tool that I have available. Um, 587.16s - 590.88s | I get a lot of reports from a lot of folks, and some of them are really high quality, really 590.88s - 597.46s | good quality, um, criticality, and some of them are not. Um, and some of them seem like 597.46s - 601.80s | they're social engineering or just not good quality reports until you actually start 601.80s - 606.50s | digging into them. So, like, um, I always, like, make sure my engineers, like, really look at 606.50s - 612.40s | that report because it could at first appearance be, like, incomplete or not, like, not well 612.40s - 616.74s | formed or just garbage, but in reality, some of the very best critical vulnerabilities are in 616.74s - 621.92s | that way. Um, even negative testing results are very valuable because negative testing 621.92s - 628.16s | tells us where there is something, but it may not be ready yet, and so, common sense to me 628.16s - 631.92s | is really important, and diligence is really important, um, and just being willing to 631.92s - 636.08s | answer questions, like, uh, the thing that drives me crazy is when we get what I refer to as, 636.08s - 641.32s | like, these cookie crumb results where it's, like, somebody will send a report in to us, and 641.32s - 646.18s | it will be, like, pieces, and then we'll say, like, hey, do you have, like, can you give me 646.18s - 649.18s | more information about this proof of concept, and they'll be, like, well, you're the company, 649.18s - 653.68s | you figure it out, and it's, like, well, your report's probably going to go in the garbage 653.68s - 659.10s | because I have 500 other reports, and you're taking time from those other hackers who took 659.10s - 662.48s | the time to put the report together so that I could actually follow it so that I could pay 662.48s - 667.98s |


chunk_text:
very valuable because negative testing 621.92s - 628.16s | tells us where there is something, but it may not be ready yet, and so, common sense to me 628.16s - 631.92s | is really important, and diligence is really important, um, and just being willing to 631.92s - 636.08s | answer questions, like, uh, the thing that drives me crazy is when we get what I refer to as, 636.08s - 641.32s | like, these cookie crumb results where it's, like, somebody will send a report in to us, and 641.32s - 646.18s | it will be, like, pieces, and then we'll say, like, hey, do you have, like, can you give me 646.18s - 649.18s | more information about this proof of concept, and they'll be, like, well, you're the company, 649.18s - 653.68s | you figure it out, and it's, like, well, your report's probably going to go in the garbage 653.68s - 659.10s | because I have 500 other reports, and you're taking time from those other hackers who took 659.10s - 662.48s | the time to put the report together so that I could actually follow it so that I could pay 662.48s - 667.98s | them out quickly, um, but we try to make sure that we are taking as much time as possible, 667.98s - 671.44s | even with those reports, staying calm and going back to the researcher and being, like, hey, 671.44s - 675.68s | look, I know you're frustrated, but, um, I think you have something here, but you need to 675.68s - 681.48s | work with me to help me figure out what is here so that I can get you paid, um, so I would 681.48s - 685.40s | say, like, common sense and due diligence are probably the best tools that I have in my 685.40s - 688.36s | toolbox, um, from running a program side. 688.36s - 693.32s | Real quick, before we move on, I want to make sure that, like, we actually give, like, good 693.32s - 696.52s | answers for that one, too, because, like, what tools do you use if you're actually going to get 696.52s - 700.90s | started? Um, any sort of man-in-the-middle intercepting proxy for your browser is 700.90s - 704.72s | absolutely a must for application security. If you're needing to find new services on 704.72s - 708.22s |


chunk_text:
them out quickly, um, but we try to make sure that we are taking as much time as possible, 667.98s - 671.44s | even with those reports, staying calm and going back to the researcher and being, like, hey, 671.44s - 675.68s | look, I know you're frustrated, but, um, I think you have something here, but you need to 675.68s - 681.48s | work with me to help me figure out what is here so that I can get you paid, um, so I would 681.48s - 685.40s | say, like, common sense and due diligence are probably the best tools that I have in my 685.40s - 688.36s | toolbox, um, from running a program side. 688.36s - 693.32s | Real quick, before we move on, I want to make sure that, like, we actually give, like, good 693.32s - 696.52s | answers for that one, too, because, like, what tools do you use if you're actually going to get 696.52s - 700.90s | started? Um, any sort of man-in-the-middle intercepting proxy for your browser is 700.90s - 704.72s | absolutely a must for application security. If you're needing to find new services on 704.72s - 708.22s | endpoints, it's time to get really familiar with NMAP or NABU, if you're familiar with the 708.22s - 711.68s | Project Discovery Toolkit. Everyone should just download everything that Project Discovery 711.68s - 716.68s | has. It's free, it's open source, it'll really help you just get from recon to vulnerability 716.68s - 720.02s | pretty quickly, and there's some nuance that you can learn there. Um, but you're going to 720.02s - 723.30s | need tools that will help you go deep in an application, you're going to need tools that will 723.30s - 728.18s | help you go wide across several applications, Nuclei is really good for that. Um, their 728.18s - 733.10s | version of NMAP called NABU is also fantastic, and that will get you most of the way there. 733.10s - 737.02s | At that point, I think you'll start having more hosts than you know what to do with, and this 737.02s - 740.32s | is where you have to start determining, like, okay, where do I spend time, what do I put my 740.32s - 743.94s | manual efforts towards, and I think the thing that you want to remember is that you're


chunk_text:
endpoints, it's time to get really familiar with NMAP or NABU, if you're familiar with the 708.22s - 711.68s | Project Discovery Toolkit. Everyone should just download everything that Project Discovery 711.68s - 716.68s | has. It's free, it's open source, it'll really help you just get from recon to vulnerability 716.68s - 720.02s | pretty quickly, and there's some nuance that you can learn there. Um, but you're going to 720.02s - 723.30s | need tools that will help you go deep in an application, you're going to need tools that will 723.30s - 728.18s | help you go wide across several applications, Nuclei is really good for that. Um, their 728.18s - 733.10s | version of NMAP called NABU is also fantastic, and that will get you most of the way there. 733.10s - 737.02s | At that point, I think you'll start having more hosts than you know what to do with, and this 737.02s - 740.32s | is where you have to start determining, like, okay, where do I spend time, what do I put my 740.32s - 743.94s | manual efforts towards, and I think the thing that you want to remember is that you're going to 743.94s - 748.18s | want to use automation to help you find targets to then go in on manually, uh, because at 748.18s - 751.72s | least when it comes to the bug bounty world, it's first and best dressed, and the reason I 751.72s - 754.68s | wanted to talk about that is because exactly what you just said, you might get breadcrumb 754.68s - 758.48s | vulnerabilities, and so let's say myself as the researcher, I found something that's really 758.48s - 762.68s | cool, I'm pretty sure this is going to pay out, I can spend two hours putting together a 762.76s - 766.30s | really good report, but in that two-hour time, someone else could put in a low-quality 766.30s - 769.76s | report, yet they're first and they're going to get paid out, and so there's kind of like a meta 769.76s - 773.10s | to bug bounty hunting where you have to decide, okay, how much information can I give that's 773.10s - 778.60s | relevant, uh, to make this seem valid, and again, if you're competing with other people, I 778.60s - 781.80s | might start thinking, maybe let me submit


chunk_text:
going to 743.94s - 748.18s | want to use automation to help you find targets to then go in on manually, uh, because at 748.18s - 751.72s | least when it comes to the bug bounty world, it's first and best dressed, and the reason I 751.72s - 754.68s | wanted to talk about that is because exactly what you just said, you might get breadcrumb 754.68s - 758.48s | vulnerabilities, and so let's say myself as the researcher, I found something that's really 758.48s - 762.68s | cool, I'm pretty sure this is going to pay out, I can spend two hours putting together a 762.76s - 766.30s | really good report, but in that two-hour time, someone else could put in a low-quality 766.30s - 769.76s | report, yet they're first and they're going to get paid out, and so there's kind of like a meta 769.76s - 773.10s | to bug bounty hunting where you have to decide, okay, how much information can I give that's 773.10s - 778.60s | relevant, uh, to make this seem valid, and again, if you're competing with other people, I 778.60s - 781.80s | might start thinking, maybe let me submit this incomplete, and then go back and edit it 781.80s - 785.76s | later, can we start looking at submission dates, the first one is the only one that matters. Is 785.76s - 789.06s | that the right thing to do? You know, I think we can have a discussion around that, but if 789.06s - 793.40s | there was a meta to bug bounty hunting, that is definitely one part of it. 793.40s - 797.14s | Just to add one thing to that, you'll never be faster, any tool you use will never be faster 797.14s - 802.72s | than mass scan, so mass scan first, and then move on. 802.72s - 808.72s | Awesome. Well, a great segue to that is, for Katie, where do human efforts provide value 808.72s - 813.86s | than, more value than automation efforts, right, so pivoting off of tooling, where are 813.86s - 817.52s | humans the most efficient, the most valuable? 817.52s - 823.48s | Oh, Lord. So, I mean, I see a lot of, I've started to see a lot of AI generated reports come 823.48s - 831.48s | in last year or two, and those are okay. From where


chunk_text:
this incomplete, and then go back and edit it 781.80s - 785.76s | later, can we start looking at submission dates, the first one is the only one that matters. Is 785.76s - 789.06s | that the right thing to do? You know, I think we can have a discussion around that, but if 789.06s - 793.40s | there was a meta to bug bounty hunting, that is definitely one part of it. 793.40s - 797.14s | Just to add one thing to that, you'll never be faster, any tool you use will never be faster 797.14s - 802.72s | than mass scan, so mass scan first, and then move on. 802.72s - 808.72s | Awesome. Well, a great segue to that is, for Katie, where do human efforts provide value 808.72s - 813.86s | than, more value than automation efforts, right, so pivoting off of tooling, where are 813.86s - 817.52s | humans the most efficient, the most valuable? 817.52s - 823.48s | Oh, Lord. So, I mean, I see a lot of, I've started to see a lot of AI generated reports come 823.48s - 831.48s | in last year or two, and those are okay. From where I sit, like, I work mostly hardware 831.48s - 838.48s | firmware and software, I don't work a lot of SAS, so the AI stuff isn't really valuable to us 838.48s - 842.22s | because we're looking at, like, hard core CVEs versus, like, what I would consider to be 842.38s - 850.38s | misconfigurations, so it is a little bit of a different ballgame, but I think it goes back 850.38s - 855.92s | to, like, that negotiation period, right? Like, you can put in an empty, like, not an empty, 855.92s - 860.18s | but a placeholder report, which we can have that conversation about whether you should or 860.18s - 868.18s | not, but there is more to it than just lobbing the report over the wall. You're going to 869.18s - 875.00s | enter a negotiation period, right? You're going to enter a negotiation period with the triager 875.00s - 878.34s | who is receiving your report, you're probably going to enter a negotiation period, at 878.34s - 883.38s | least in hardware and firmware, where you're going to have to work with an engineer or an 883.38s - 887.10s | engineer is going to be


chunk_text:
I sit, like, I work mostly hardware 831.48s - 838.48s | firmware and software, I don't work a lot of SAS, so the AI stuff isn't really valuable to us 838.48s - 842.22s | because we're looking at, like, hard core CVEs versus, like, what I would consider to be 842.38s - 850.38s | misconfigurations, so it is a little bit of a different ballgame, but I think it goes back 850.38s - 855.92s | to, like, that negotiation period, right? Like, you can put in an empty, like, not an empty, 855.92s - 860.18s | but a placeholder report, which we can have that conversation about whether you should or 860.18s - 868.18s | not, but there is more to it than just lobbing the report over the wall. You're going to 869.18s - 875.00s | enter a negotiation period, right? You're going to enter a negotiation period with the triager 875.00s - 878.34s | who is receiving your report, you're probably going to enter a negotiation period, at 878.34s - 883.38s | least in hardware and firmware, where you're going to have to work with an engineer or an 883.38s - 887.10s | engineer is going to be working on the back end without your knowledge, which happens, 887.10s - 890.06s | usually that's what's going on in that quiet period where they don't respond to you for 890.06s - 895.72s | months, but they're working on trying to figure out a mitigation, right? And so that 895.72s - 902.02s | negotiation, any time I walk into a room and it's, I want, if I want anything, even, like, 902.02s - 906.30s | even ordering coffee, like, I want something, that's a negotiation. Congratulations, 906.30s - 911.88s | you've just entered a negotiation. Because, and that's a human to human interaction. So 911.88s - 916.34s | you can lob the report over the wall, but you're probably going to get a better result if 916.34s - 920.26s | you walk into it understanding there's likely a human involved in there and you're about to 920.26s - 926.68s | enter multiple phases of negotiation. So that's my suggestion. 926.68s - 930.60s | One of the areas that I really like for human efforts over automated stuff is, like, 930.60s - 935.42s | let's say a new target comes my way, I immediately skip everything unauthenticated, I skip 935.42s -


chunk_text:
working on the back end without your knowledge, which happens, 887.10s - 890.06s | usually that's what's going on in that quiet period where they don't respond to you for 890.06s - 895.72s | months, but they're working on trying to figure out a mitigation, right? And so that 895.72s - 902.02s | negotiation, any time I walk into a room and it's, I want, if I want anything, even, like, 902.02s - 906.30s | even ordering coffee, like, I want something, that's a negotiation. Congratulations, 906.30s - 911.88s | you've just entered a negotiation. Because, and that's a human to human interaction. So 911.88s - 916.34s | you can lob the report over the wall, but you're probably going to get a better result if 916.34s - 920.26s | you walk into it understanding there's likely a human involved in there and you're about to 920.26s - 926.68s | enter multiple phases of negotiation. So that's my suggestion. 926.68s - 930.60s | One of the areas that I really like for human efforts over automated stuff is, like, 930.60s - 935.42s | let's say a new target comes my way, I immediately skip everything unauthenticated, I skip 935.42s - 938.30s | everything that would be the first one or two clicks away from whatever the main domain page 938.30s - 942.14s | is, I go straight to anything behind credit card functionality, because that is always, I feel 942.14s - 945.34s | like, what people put, like, on the last of their checklist, it's like, okay, I'm enumerating 945.34s - 949.60s | the application, I'm enumerating whatever the target platform may be, and this bit requires a 949.60s - 952.60s | credit card, and it can't just be a gift card, it has to be something valid, or maybe, like, an 952.60s - 956.72s | ACH transfer has to happen overnight for them to confirm a balance, go straight to that, get 956.72s - 962.26s | the clock running on it as soon as possible. Even if you need to go, I mean, I guess, like, 962.26s - 966.90s | this is not financial advice, just in case that matters. Also not a lawyer, this is not legal 966.90s - 971.60s | advice, all of those things. I have created separate accounts that I can use for all of 971.60s - 975.64s | that, where I can add bank


chunk_text:
938.30s | everything that would be the first one or two clicks away from whatever the main domain page 938.30s - 942.14s | is, I go straight to anything behind credit card functionality, because that is always, I feel 942.14s - 945.34s | like, what people put, like, on the last of their checklist, it's like, okay, I'm enumerating 945.34s - 949.60s | the application, I'm enumerating whatever the target platform may be, and this bit requires a 949.60s - 952.60s | credit card, and it can't just be a gift card, it has to be something valid, or maybe, like, an 952.60s - 956.72s | ACH transfer has to happen overnight for them to confirm a balance, go straight to that, get 956.72s - 962.26s | the clock running on it as soon as possible. Even if you need to go, I mean, I guess, like, 962.26s - 966.90s | this is not financial advice, just in case that matters. Also not a lawyer, this is not legal 966.90s - 971.60s | advice, all of those things. I have created separate accounts that I can use for all of 971.60s - 975.64s | that, where I can add bank accounts, where I can add credit cards, it's separated from my 975.64s - 981.14s | personal stuff, and the setup for that is, it's easier than installing the old version of 981.14s - 986.52s | Bloodhound, if that's a bit of a deep cut, but, like, you should do that if you're remotely 986.52s - 991.18s | serious about bug bounty hunting, because that's going to put you ahead of 80, 90 percent of 991.18s - 994.94s | other people who are out there hunting for stuff being on the same login page, especially if 994.94s - 998.94s | it's something where a new target has been exposed to everyone for the first time, and so you 998.94s - 1002.76s | can imagine, like, maybe scope started at midnight, but you're racing with a lot of other 1002.76s - 1005.76s | people around the world, and so you have to get to the functionality that other people are 1005.76s - 1010.68s | likely to test last, if you want to get the low-hanging fruit first. Obviously you can go 1010.68s - 1014.34s | deep, you can look at business logic analysis, wherever that sort of stuff comes in, I love


chunk_text:
accounts, where I can add credit cards, it's separated from my 975.64s - 981.14s | personal stuff, and the setup for that is, it's easier than installing the old version of 981.14s - 986.52s | Bloodhound, if that's a bit of a deep cut, but, like, you should do that if you're remotely 986.52s - 991.18s | serious about bug bounty hunting, because that's going to put you ahead of 80, 90 percent of 991.18s - 994.94s | other people who are out there hunting for stuff being on the same login page, especially if 994.94s - 998.94s | it's something where a new target has been exposed to everyone for the first time, and so you 998.94s - 1002.76s | can imagine, like, maybe scope started at midnight, but you're racing with a lot of other 1002.76s - 1005.76s | people around the world, and so you have to get to the functionality that other people are 1005.76s - 1010.68s | likely to test last, if you want to get the low-hanging fruit first. Obviously you can go 1010.68s - 1014.34s | deep, you can look at business logic analysis, wherever that sort of stuff comes in, I love 1014.34s - 1018.76s | anything with a contact us form, anything that requires extra information to get to deeper 1018.76s - 1022.64s | areas of the application, it's going to take automation even further to get to those areas, 1022.64s - 1026.14s | and that's going to depend on how good whoever's automation is at spidering, which it's 1026.14s - 1029.88s | already not good at maintaining authenticated versus unauthenticated states, as soon as 1029.88s - 1034.54s | something hits, like, a logout feature, or you trigger rate limiting that logs you out, or 1034.54s - 1038.80s | god forbid it's still a web sphere application, those have unique URLs every time you log in 1038.80s - 1042.58s | or out, automation completely fails at those, and so when you start identifying those 1042.58s - 1046.30s | technologies, I mean, I think the spider sense starts kicking in where you're like, okay, 1046.30s - 1050.80s | there's likely not a lot of competition on this one, if I was going to spend eight hours 1050.80s - 1055.30s | somewhere, this might be worth the time, because it's a lot of cost benefit analysis on 1055.30s - 1059.68s | where your


chunk_text:
1014.34s - 1018.76s | anything with a contact us form, anything that requires extra information to get to deeper 1018.76s - 1022.64s | areas of the application, it's going to take automation even further to get to those areas, 1022.64s - 1026.14s | and that's going to depend on how good whoever's automation is at spidering, which it's 1026.14s - 1029.88s | already not good at maintaining authenticated versus unauthenticated states, as soon as 1029.88s - 1034.54s | something hits, like, a logout feature, or you trigger rate limiting that logs you out, or 1034.54s - 1038.80s | god forbid it's still a web sphere application, those have unique URLs every time you log in 1038.80s - 1042.58s | or out, automation completely fails at those, and so when you start identifying those 1042.58s - 1046.30s | technologies, I mean, I think the spider sense starts kicking in where you're like, okay, 1046.30s - 1050.80s | there's likely not a lot of competition on this one, if I was going to spend eight hours 1050.80s - 1055.30s | somewhere, this might be worth the time, because it's a lot of cost benefit analysis on 1055.30s - 1059.68s | where your efforts are going to go, and it really sucks if you spend eight hours working 1059.68s - 1062.44s | on something that you're pretty sure is vulnerable, you don't find anything, and now you 1062.44s - 1066.80s | have a sunken cost fallacy sort of thought of what did I do with my day, which I think 1066.80s - 1069.72s | we're going to get into that later question, so I don't want to go too much on it here, but 1069.72s - 1073.56s | that's where I would spend human efforts over automation ones. 1073.56s - 1080.38s | So just to add to the human effort, so when you're testing web applications and you come 1080.38s - 1084.68s | across, like, a laugh, you'll often, it's an easy way to get yourself banned, especially 1084.68s - 1090.32s | using automation, and so as a human, you have to, you have the ability to infer that 1090.32s - 1094.92s | something is vulnerable without necessarily proving it using, like, a full exploit, that 1094.92s - 1100.00s | would get your IP banned, that would get your account banned. 1100.00s - 1107.44s | When I see a laugh, it doesn't actually,


chunk_text:
efforts are going to go, and it really sucks if you spend eight hours working 1059.68s - 1062.44s | on something that you're pretty sure is vulnerable, you don't find anything, and now you 1062.44s - 1066.80s | have a sunken cost fallacy sort of thought of what did I do with my day, which I think 1066.80s - 1069.72s | we're going to get into that later question, so I don't want to go too much on it here, but 1069.72s - 1073.56s | that's where I would spend human efforts over automation ones. 1073.56s - 1080.38s | So just to add to the human effort, so when you're testing web applications and you come 1080.38s - 1084.68s | across, like, a laugh, you'll often, it's an easy way to get yourself banned, especially 1084.68s - 1090.32s | using automation, and so as a human, you have to, you have the ability to infer that 1090.32s - 1094.92s | something is vulnerable without necessarily proving it using, like, a full exploit, that 1094.92s - 1100.00s | would get your IP banned, that would get your account banned. 1100.00s - 1107.44s | When I see a laugh, it doesn't actually, for some researchers, it can be, like, a showstopper. 1107.44s - 1111.04s | For me, it's a place I'll actually dive in more, because, you know, you find the right 1111.04s - 1114.92s | quote character, that's going to get past the laugh, and it might throw some interesting 1114.92s - 1122.12s | error, you know, yeah, I see that as, like, really a place where humans thrive versus 1122.12s - 1123.12s | AI. 1123.12s - 1129.48s | You know, simultaneously, I'm sure AI will get better, or automation will get better. 1129.48s - 1132.80s | When you find that a laugh has blacklisted you, don't forget about it. 1132.80s - 1136.88s | If Akamai or CloudFlare or something has locked you out, write down that application, go back 1136.88s - 1141.52s | to it later with a different IP, or lock out other IPs as you're scanning for everything, 1141.52s - 1144.04s | because if you end up with a list of things that are behind CloudFlare and things that 1144.04s - 1148.00s | are behind Akamai, guess where you should spend human efforts? 1148.00s - 1149.00s | Exactly all of those. 1149.00s - 1154.84s | This is also,


chunk_text:
for some researchers, it can be, like, a showstopper. 1107.44s - 1111.04s | For me, it's a place I'll actually dive in more, because, you know, you find the right 1111.04s - 1114.92s | quote character, that's going to get past the laugh, and it might throw some interesting 1114.92s - 1122.12s | error, you know, yeah, I see that as, like, really a place where humans thrive versus 1122.12s - 1123.12s | AI. 1123.12s - 1129.48s | You know, simultaneously, I'm sure AI will get better, or automation will get better. 1129.48s - 1132.80s | When you find that a laugh has blacklisted you, don't forget about it. 1132.80s - 1136.88s | If Akamai or CloudFlare or something has locked you out, write down that application, go back 1136.88s - 1141.52s | to it later with a different IP, or lock out other IPs as you're scanning for everything, 1141.52s - 1144.04s | because if you end up with a list of things that are behind CloudFlare and things that 1144.04s - 1148.00s | are behind Akamai, guess where you should spend human efforts? 1148.00s - 1149.00s | Exactly all of those. 1149.00s - 1154.84s | This is also, like, a little bit in the weeds, but if you find yourself getting a laugh block 1154.84s - 1159.96s | coming back from a server that's not Akamai or CloudFlare, that means that you have the 1159.96s - 1164.64s | potential to DOS an application by blocking the frontend service sometimes. 1164.64s - 1165.64s | I don't know. 1165.64s - 1171.07s | It's a fun variant of this. 1171.07s - 1172.07s | Very cool. 1172.07s - 1177.07s | So it's easy to get in really deep and, you know, go into rabbit holes and eventually 1177.07s - 1180.71s | also just get tired of responding to incidents, right? 1180.71s - 1182.03s | How do you find balance? 1182.03s - 1188.31s | What are some potential tips you can offer to folks, you know, who are proactively burning 1188.31s - 1190.39s | out or, you know, how do you approach it? 1190.39s - 1193.47s | I would love for Sam to start with this. 1193.47s - 1194.47s | Sure. 1194.47s - 1199.35s | So on the researcher side, I mean, it's the same as being at DEF CON. 1199.35s - 1200.87s | I'm really excited to be here. 1200.87s - 1201.87s


chunk_text:
like, a little bit in the weeds, but if you find yourself getting a laugh block 1154.84s - 1159.96s | coming back from a server that's not Akamai or CloudFlare, that means that you have the 1159.96s - 1164.64s | potential to DOS an application by blocking the frontend service sometimes. 1164.64s - 1165.64s | I don't know. 1165.64s - 1171.07s | It's a fun variant of this. 1171.07s - 1172.07s | Very cool. 1172.07s - 1177.07s | So it's easy to get in really deep and, you know, go into rabbit holes and eventually 1177.07s - 1180.71s | also just get tired of responding to incidents, right? 1180.71s - 1182.03s | How do you find balance? 1182.03s - 1188.31s | What are some potential tips you can offer to folks, you know, who are proactively burning 1188.31s - 1190.39s | out or, you know, how do you approach it? 1190.39s - 1193.47s | I would love for Sam to start with this. 1193.47s - 1194.47s | Sure. 1194.47s - 1199.35s | So on the researcher side, I mean, it's the same as being at DEF CON. 1199.35s - 1200.87s | I'm really excited to be here. 1200.87s - 1201.87s | I don't want to sleep. 1201.87s - 1202.87s | I don't want to eat. 1202.87s - 1206.95s | I don't want to, well, I should shower. 1206.95s - 1209.59s | It's everyone should shower. 1209.59s - 1210.99s | It's the same thing with bug bounty hunting. 1210.99s - 1215.19s | It can become very addictive and you have to balance it with the rest of your life. 1215.19s - 1220.11s | You know, if you're having a bad week at work, maybe don't do bug bounty at night. 1220.11s - 1225.51s | I think, like, simultaneously on the program side, if you're the only program manager and 1225.51s - 1229.79s | you're getting in 25 reports a day, like, that's not sustainable. 1229.79s - 1234.51s | You know, at least within Google, like, we try and go for, like, no heroes policy. 1234.51s - 1240.87s | We have a roughly once every seven week or so rotation, a little bit less than that now, 1240.87s - 1246.31s | I think, where you're only on call once out of every seven weeks, and that helps keep 1246.31s - 1247.31s | things sane. 1247.31s - 1250.36s | I'm next. 1250.36s -


chunk_text:
| I don't want to sleep. 1201.87s - 1202.87s | I don't want to eat. 1202.87s - 1206.95s | I don't want to, well, I should shower. 1206.95s - 1209.59s | It's everyone should shower. 1209.59s - 1210.99s | It's the same thing with bug bounty hunting. 1210.99s - 1215.19s | It can become very addictive and you have to balance it with the rest of your life. 1215.19s - 1220.11s | You know, if you're having a bad week at work, maybe don't do bug bounty at night. 1220.11s - 1225.51s | I think, like, simultaneously on the program side, if you're the only program manager and 1225.51s - 1229.79s | you're getting in 25 reports a day, like, that's not sustainable. 1229.79s - 1234.51s | You know, at least within Google, like, we try and go for, like, no heroes policy. 1234.51s - 1240.87s | We have a roughly once every seven week or so rotation, a little bit less than that now, 1240.87s - 1246.31s | I think, where you're only on call once out of every seven weeks, and that helps keep 1246.31s - 1247.31s | things sane. 1247.31s - 1250.36s | I'm next. 1250.36s - 1256.00s | So, yeah, I agree, like, everything� every job, everything that you're passionate about, 1256.00s - 1260.68s | you're going to, like, have burnout in from an industry perspective. 1260.68s - 1265.80s | We have a lot of engineers that are sitting, receiving reports, doing triage, doing mitigation, 1265.80s - 1268.60s | doing disclosure planning, and it gets really exhausting. 1268.60s - 1273.08s | I had an engineer tell me the other day, you know, like, I have 75 tickets and I'm not 1273.08s - 1278.96s | even happy when I close a ticket anymore because I know that I still have 74 tickets to close. 1278.96s - 1285.28s | Like, she used to be, like, really excited every time she closed a report, and now not 1285.28s - 1286.28s | so much. 1286.28s - 1287.28s | And, like, that's real. 1287.28s - 1290.76s | I think everyone is undermanned, especially with, like, a lot of the technology layoffs 1290.76s - 1296.28s | that have happened in the last four to five years, like, being smarter about how we do 1296.28s - 1302.00s | things, incorporating tools on how we actually handle vulnerabilities and disclosures I think 1302.00s -


chunk_text:
1256.00s | So, yeah, I agree, like, everything� every job, everything that you're passionate about, 1256.00s - 1260.68s | you're going to, like, have burnout in from an industry perspective. 1260.68s - 1265.80s | We have a lot of engineers that are sitting, receiving reports, doing triage, doing mitigation, 1265.80s - 1268.60s | doing disclosure planning, and it gets really exhausting. 1268.60s - 1273.08s | I had an engineer tell me the other day, you know, like, I have 75 tickets and I'm not 1273.08s - 1278.96s | even happy when I close a ticket anymore because I know that I still have 74 tickets to close. 1278.96s - 1285.28s | Like, she used to be, like, really excited every time she closed a report, and now not 1285.28s - 1286.28s | so much. 1286.28s - 1287.28s | And, like, that's real. 1287.28s - 1290.76s | I think everyone is undermanned, especially with, like, a lot of the technology layoffs 1290.76s - 1296.28s | that have happened in the last four to five years, like, being smarter about how we do 1296.28s - 1302.00s | things, incorporating tools on how we actually handle vulnerabilities and disclosures I think 1302.00s - 1303.00s | is really important. 1303.00s - 1307.04s | Looking for efficiencies and building those efficiencies and automation into systems and 1307.04s - 1309.88s | processes is incredibly important. 1309.88s - 1314.16s | I would rather that� I see it kind of like a doctor's office, right? 1314.16s - 1320.92s | I would rather that my doctors be doing surgery than filling out insurance forms. 1320.92s - 1329.48s | So where you can offload onto, you know, a specific triage team, you should do that. 1329.48s - 1333.36s | So your, you know, mitigation engineers are not doing triage and mitigation. 1333.36s - 1336.80s | So it's about, like, balancing workload, balancing processes, making sure that you're looking 1336.80s - 1339.76s | for automation opportunities. 1339.76s - 1342.16s | And we do a rotation. 1342.16s - 1347.48s | So our engineers will only do tickets for a certain amount of time. 1347.48s - 1350.68s | So it's usually about three months, and then that's it. 1350.68s - 1352.56s | They're not doing tickets again for another three months. 1352.56s - 1354.40s | They move into an entirely different job. 1354.40s - 1358.80s | So maybe today they're doing triage tickets,


chunk_text:
1303.00s | is really important. 1303.00s - 1307.04s | Looking for efficiencies and building those efficiencies and automation into systems and 1307.04s - 1309.88s | processes is incredibly important. 1309.88s - 1314.16s | I would rather that� I see it kind of like a doctor's office, right? 1314.16s - 1320.92s | I would rather that my doctors be doing surgery than filling out insurance forms. 1320.92s - 1329.48s | So where you can offload onto, you know, a specific triage team, you should do that. 1329.48s - 1333.36s | So your, you know, mitigation engineers are not doing triage and mitigation. 1333.36s - 1336.80s | So it's about, like, balancing workload, balancing processes, making sure that you're looking 1336.80s - 1339.76s | for automation opportunities. 1339.76s - 1342.16s | And we do a rotation. 1342.16s - 1347.48s | So our engineers will only do tickets for a certain amount of time. 1347.48s - 1350.68s | So it's usually about three months, and then that's it. 1350.68s - 1352.56s | They're not doing tickets again for another three months. 1352.56s - 1354.40s | They move into an entirely different job. 1354.40s - 1358.80s | So maybe today they're doing triage tickets, and when their three months is up, they're 1358.80s - 1362.98s | doing comms, they're doing disclosures, they're doing something entirely different. 1362.98s - 1366.40s | So that it doesn't matter that she has 74 tickets left. 1366.40s - 1370.24s | That's now somebody else's problem for the next three months. 1370.32s - 1373.32s | So we try to incorporate a rotation. 1373.32s - 1376.32s | And we try to make sure that we're looking for those automation opportunities. 1376.32s - 1379.72s | Technology has evolved and changed so much in the last several years that it's really 1379.72s - 1384.36s | irresponsible if you're not on the industry side looking for ways to make the processes 1384.36s - 1388.60s | better and easier and more efficient for your engineering team. 1388.60s - 1393.08s | That makes things better and more efficient and faster for your bug hunters. 1393.08s - 1396.40s | Faster that triage, the faster they get paid, the happier they are. 1396.40s - 1398.60s | And then everyone is happy. 1398.60s - 1405.58s | So I think it's irresponsible to not be thinking about your team health along with building 1405.58s - 1413.52s | those processes, making


chunk_text:
and when their three months is up, they're 1358.80s - 1362.98s | doing comms, they're doing disclosures, they're doing something entirely different. 1362.98s - 1366.40s | So that it doesn't matter that she has 74 tickets left. 1366.40s - 1370.24s | That's now somebody else's problem for the next three months. 1370.32s - 1373.32s | So we try to incorporate a rotation. 1373.32s - 1376.32s | And we try to make sure that we're looking for those automation opportunities. 1376.32s - 1379.72s | Technology has evolved and changed so much in the last several years that it's really 1379.72s - 1384.36s | irresponsible if you're not on the industry side looking for ways to make the processes 1384.36s - 1388.60s | better and easier and more efficient for your engineering team. 1388.60s - 1393.08s | That makes things better and more efficient and faster for your bug hunters. 1393.08s - 1396.40s | Faster that triage, the faster they get paid, the happier they are. 1396.40s - 1398.60s | And then everyone is happy. 1398.60s - 1405.58s | So I think it's irresponsible to not be thinking about your team health along with building 1405.58s - 1413.52s | those processes, making sure you're efficient, and really just keeping an eye on your people. 1413.52s - 1416.00s | Very well said. 1416.00s - 1417.64s | So this thought kind of just crossed my mind. 1417.64s - 1420.72s | I don't think any of us thought ten years ago that we'd get a dopamine hit from seeing 1420.72s - 1423.76s | an alert box pop up. 1423.76s - 1427.68s | And it feels just like pulling that slot machine, if we're going to make a gambling reference 1427.68s - 1432.80s | because we're in Vegas, and just seeing something pop up. 1432.80s - 1433.80s | Dopamine feels great. 1433.80s - 1437.56s | And so the same thing, any time any scanner comes back as something that's positive and 1437.56s - 1442.24s | then you verify and it's really there, that feeling of, oh, yes, I just got this thing 1442.24s - 1447.08s | is just infectious. 1447.08s - 1450.16s | Just like with anything that you enjoy doing, balance is absolutely key. 1450.16s - 1452.56s | You have to keep a time on that clock. 1452.56s - 1456.68s | Some of us have real addictive personalities and suddenly you find yourself, it's 4


chunk_text:
sure you're efficient, and really just keeping an eye on your people. 1413.52s - 1416.00s | Very well said. 1416.00s - 1417.64s | So this thought kind of just crossed my mind. 1417.64s - 1420.72s | I don't think any of us thought ten years ago that we'd get a dopamine hit from seeing 1420.72s - 1423.76s | an alert box pop up. 1423.76s - 1427.68s | And it feels just like pulling that slot machine, if we're going to make a gambling reference 1427.68s - 1432.80s | because we're in Vegas, and just seeing something pop up. 1432.80s - 1433.80s | Dopamine feels great. 1433.80s - 1437.56s | And so the same thing, any time any scanner comes back as something that's positive and 1437.56s - 1442.24s | then you verify and it's really there, that feeling of, oh, yes, I just got this thing 1442.24s - 1447.08s | is just infectious. 1447.08s - 1450.16s | Just like with anything that you enjoy doing, balance is absolutely key. 1450.16s - 1452.56s | You have to keep a time on that clock. 1452.56s - 1456.68s | Some of us have real addictive personalities and suddenly you find yourself, it's 4 a.m., 1456.68s - 1461.64s | we haven't had dinner, and you've got a lot to do the next day, but we can get real addicted 1461.64s - 1466.44s | to hunting for vulnerabilities in new content, especially if you're going from application 1466.44s - 1469.04s | to application to application, there's always something new. 1469.04s - 1472.88s | There's always something, like some new rabbit hole that's pulling your interest or you're 1472.88s - 1475.92s | working on one application because you've gone through so many, the light bulb pops 1475.92s - 1479.52s | on something that you were touching an hour ago. 1479.52s - 1482.72s | I should probably mention this with the tool bit earlier, but actually the best tool that 1482.72s - 1486.00s | I have is a timer that I have on my desk. 1486.00s - 1487.92s | And I tell myself the 15-minute rule. 1487.92s - 1491.92s | So after I've been working on a particular area of an application or a target for just 1491.92s - 1496.20s | a couple of minutes, if nothing has been immediately apparent that something is there, I start 1496.20s - 1497.20s | the timer. 1497.20s - 1501.16s |


chunk_text:
a.m., 1456.68s - 1461.64s | we haven't had dinner, and you've got a lot to do the next day, but we can get real addicted 1461.64s - 1466.44s | to hunting for vulnerabilities in new content, especially if you're going from application 1466.44s - 1469.04s | to application to application, there's always something new. 1469.04s - 1472.88s | There's always something, like some new rabbit hole that's pulling your interest or you're 1472.88s - 1475.92s | working on one application because you've gone through so many, the light bulb pops 1475.92s - 1479.52s | on something that you were touching an hour ago. 1479.52s - 1482.72s | I should probably mention this with the tool bit earlier, but actually the best tool that 1482.72s - 1486.00s | I have is a timer that I have on my desk. 1486.00s - 1487.92s | And I tell myself the 15-minute rule. 1487.92s - 1491.92s | So after I've been working on a particular area of an application or a target for just 1491.92s - 1496.20s | a couple of minutes, if nothing has been immediately apparent that something is there, I start 1496.20s - 1497.20s | the timer. 1497.20s - 1501.16s | If that 15-minute timer goes off and I've not made any meaningful progress, go to the 1501.16s - 1506.68s | next functionality or consider taking a break and stepping away from the computer. 1506.68s - 1509.68s | That will help you find more vulnerabilities, too, because I can't tell you how many times 1509.68s - 1512.88s | I've been on a page where I was just certain SQL injection is here. 1512.88s - 1515.16s | There's just something I'm just not getting across. 1515.16s - 1516.16s | It's not actually vulnerable. 1516.16s - 1519.04s | And if you would have just gone to the next bit of functionality, there might be RCE there 1519.04s - 1522.68s | or there might be some breadcrumb that's worth chasing down. 1522.68s - 1526.60s | So manage your time effectively, just like anything else, this isn't specific to hacking. 1526.60s - 1531.48s | This is the same advice for anyone who's seeking mental health wellness. 1531.48s - 1535.48s | What we do is very exciting, it's very addicting, and those of us with addictive personalities 1535.48s - 1537.32s | really need to keep a grasp on that. 1537.32s - 1543.32s | Going back to


chunk_text:
If that 15-minute timer goes off and I've not made any meaningful progress, go to the 1501.16s - 1506.68s | next functionality or consider taking a break and stepping away from the computer. 1506.68s - 1509.68s | That will help you find more vulnerabilities, too, because I can't tell you how many times 1509.68s - 1512.88s | I've been on a page where I was just certain SQL injection is here. 1512.88s - 1515.16s | There's just something I'm just not getting across. 1515.16s - 1516.16s | It's not actually vulnerable. 1516.16s - 1519.04s | And if you would have just gone to the next bit of functionality, there might be RCE there 1519.04s - 1522.68s | or there might be some breadcrumb that's worth chasing down. 1522.68s - 1526.60s | So manage your time effectively, just like anything else, this isn't specific to hacking. 1526.60s - 1531.48s | This is the same advice for anyone who's seeking mental health wellness. 1531.48s - 1535.48s | What we do is very exciting, it's very addicting, and those of us with addictive personalities 1535.48s - 1537.32s | really need to keep a grasp on that. 1537.32s - 1543.32s | Going back to the program side for a minute, you also control your own economy. 1543.32s - 1547.84s | If you're getting in a ton of reports, consider lowering payments. 1547.84s - 1552.96s | You'll still probably get a few reports in, but that might dissuade researchers from spending 1552.96s - 1553.96s | as much time on your program. 1553.96s - 1558.48s | Similarly, if you're not getting reports in, then pay more. 1558.48s - 1563.36s | Control that input to some extent, anyways, and that kind of gets more to the business 1563.36s - 1564.36s | side of everything. 1564.36s - 1567.57s | But yeah. 1567.57s - 1568.57s | Very cool. 1568.57s - 1571.65s | So this is one of my personal favorite questions. 1571.65s - 1575.69s | From a hacker view, what makes a product or an application a good target? 1575.69s - 1579.69s | What makes a good candidate for a bug bounty program from the program side as well when 1579.69s - 1581.85s | you're considering spinning up a program? 1581.85s - 1584.45s | But we're going to start with Cusco's for this one. 1584.45s - 1585.45s | Sure. 1585.45s - 1589.25s | So, as much as I hate


chunk_text:
the program side for a minute, you also control your own economy. 1543.32s - 1547.84s | If you're getting in a ton of reports, consider lowering payments. 1547.84s - 1552.96s | You'll still probably get a few reports in, but that might dissuade researchers from spending 1552.96s - 1553.96s | as much time on your program. 1553.96s - 1558.48s | Similarly, if you're not getting reports in, then pay more. 1558.48s - 1563.36s | Control that input to some extent, anyways, and that kind of gets more to the business 1563.36s - 1564.36s | side of everything. 1564.36s - 1567.57s | But yeah. 1567.57s - 1568.57s | Very cool. 1568.57s - 1571.65s | So this is one of my personal favorite questions. 1571.65s - 1575.69s | From a hacker view, what makes a product or an application a good target? 1575.69s - 1579.69s | What makes a good candidate for a bug bounty program from the program side as well when 1579.69s - 1581.85s | you're considering spinning up a program? 1581.85s - 1584.45s | But we're going to start with Cusco's for this one. 1584.45s - 1585.45s | Sure. 1585.45s - 1589.25s | So, as much as I hate to say it, I'm going to say it. 1589.25s - 1593.45s | We've all heard shift left a million times, and anyone working in security has heard this 1593.45s - 1597.29s | sort of thing brought up, and the concept is basically the earlier that we can identify 1597.29s - 1602.17s | bugs and fix them in the development life cycle, the cheaper it will be to remediate. 1602.17s - 1606.17s | Bug bounty programs are as far right as possible as that shift left could be. 1606.17s - 1611.01s | So when we're, as you're running a program, if you're identifying candidates for your 1611.01s - 1615.09s | bug bounty program, it should be something that has already had all the gambits of internal 1615.09s - 1616.57s | due diligence. 1616.57s - 1621.33s | In an ideal world, you have secret scanning hooked into the CICD, you have rule sets for 1621.33s - 1624.29s | insecure functions not being used, you're running some sort of SAS tool, you're running 1624.29s - 1627.37s | some sort of DAS tool, you're running some sort of runtime analysis, and maybe if you're 1627.37s - 1631.41s | lucky you have an internal pen


chunk_text:
to say it, I'm going to say it. 1589.25s - 1593.45s | We've all heard shift left a million times, and anyone working in security has heard this 1593.45s - 1597.29s | sort of thing brought up, and the concept is basically the earlier that we can identify 1597.29s - 1602.17s | bugs and fix them in the development life cycle, the cheaper it will be to remediate. 1602.17s - 1606.17s | Bug bounty programs are as far right as possible as that shift left could be. 1606.17s - 1611.01s | So when we're, as you're running a program, if you're identifying candidates for your 1611.01s - 1615.09s | bug bounty program, it should be something that has already had all the gambits of internal 1615.09s - 1616.57s | due diligence. 1616.57s - 1621.33s | In an ideal world, you have secret scanning hooked into the CICD, you have rule sets for 1621.33s - 1624.29s | insecure functions not being used, you're running some sort of SAS tool, you're running 1624.29s - 1627.37s | some sort of DAS tool, you're running some sort of runtime analysis, and maybe if you're 1627.37s - 1631.41s | lucky you have an internal pen testing team who can give it all once over assessment before 1631.41s - 1635.81s | it actually goes out to production, you know, the real world. 1635.81s - 1640.49s | Obviously that's a lot of resources, not everyone has a 200 person product security team, but 1640.49s - 1644.29s | if you have something that has not gone through all those areas of due diligence and you're 1644.29s - 1648.81s | going straight to making it a valid bug bounty target, that's fine. 1648.81s - 1653.45s | That is just probably the most expensive way to get security improvements made on that 1653.45s - 1655.21s | particular product. 1655.21s - 1661.01s | At the same time, there's usually nothing academic or, you know, not real once it's 1661.01s - 1662.01s | in production. 1662.01s - 1667.81s | These are targeting customers now, actively impacting them, and again, it's not a theoretical 1667.81s - 1671.13s | or academic finding, so usually there's movement to get it pushed out. 1671.13s - 1674.21s | The other thing that I like doing, if I get multiple reports of the same thing, I treat 1674.21s - 1678.37s | that as an increased likelihood of exploitation,


chunk_text:
testing team who can give it all once over assessment before 1631.41s - 1635.81s | it actually goes out to production, you know, the real world. 1635.81s - 1640.49s | Obviously that's a lot of resources, not everyone has a 200 person product security team, but 1640.49s - 1644.29s | if you have something that has not gone through all those areas of due diligence and you're 1644.29s - 1648.81s | going straight to making it a valid bug bounty target, that's fine. 1648.81s - 1653.45s | That is just probably the most expensive way to get security improvements made on that 1653.45s - 1655.21s | particular product. 1655.21s - 1661.01s | At the same time, there's usually nothing academic or, you know, not real once it's 1661.01s - 1662.01s | in production. 1662.01s - 1667.81s | These are targeting customers now, actively impacting them, and again, it's not a theoretical 1667.81s - 1671.13s | or academic finding, so usually there's movement to get it pushed out. 1671.13s - 1674.21s | The other thing that I like doing, if I get multiple reports of the same thing, I treat 1674.21s - 1678.37s | that as an increased likelihood of exploitation, so something, you know, if you get ten different 1678.37s - 1682.41s | people telling you a thing is coming in and it's rated as a medium, well, if ten different 1682.41s - 1684.65s | unique people can find it and they're not sharing that information, maybe that should 1684.65s - 1687.53s | probably be a high and we shouldn't kick that down the can every three months as business 1687.53s - 1688.53s | accepted risk. 1688.53s - 1691.25s | But basically, it's kind of common sense stuff. 1691.25s - 1694.01s | If you go straight to the bug bounty program, that is the most expensive way to identify 1694.01s - 1695.01s | vulnerabilities on it. 1695.01s - 1698.05s | There will probably be real good ones, though. 1698.05s - 1701.17s | It could be more cost effective to do something a little bit more on the shift left sort of 1701.17s - 1703.17s | pipeline, but that's just the reality of it. 1703.17s - 1709.85s | Yeah, just to add to that a little bit, I feel like if you're getting the same critical 1709.85s - 1714.73s | vulnerabilities in every month, then you're just paying that researcher's mortgage.


chunk_text:
so something, you know, if you get ten different 1678.37s - 1682.41s | people telling you a thing is coming in and it's rated as a medium, well, if ten different 1682.41s - 1684.65s | unique people can find it and they're not sharing that information, maybe that should 1684.65s - 1687.53s | probably be a high and we shouldn't kick that down the can every three months as business 1687.53s - 1688.53s | accepted risk. 1688.53s - 1691.25s | But basically, it's kind of common sense stuff. 1691.25s - 1694.01s | If you go straight to the bug bounty program, that is the most expensive way to identify 1694.01s - 1695.01s | vulnerabilities on it. 1695.01s - 1698.05s | There will probably be real good ones, though. 1698.05s - 1701.17s | It could be more cost effective to do something a little bit more on the shift left sort of 1701.17s - 1703.17s | pipeline, but that's just the reality of it. 1703.17s - 1709.85s | Yeah, just to add to that a little bit, I feel like if you're getting the same critical 1709.85s - 1714.73s | vulnerabilities in every month, then you're just paying that researcher's mortgage. 1714.73s - 1719.97s | It's not, like, your role as a bug bounty program manager should be to push the business 1719.97s - 1725.05s | to do more comprehensive fixes for things or to find every variant of this or to introduce 1725.05s - 1729.25s | some additional scanning or something. 1729.25s - 1730.61s | It's on you, the program manager, to make that happen. 1730.61s - 1735.17s | The researcher is just going to keep submitting, you know, they're not interested in the systematic 1735.17s - 1736.17s | fixes. 1738.64s - 1744.64s | Yeah, I mean, like, the shift left thing is, you hear it all the time, but we're kind of 1744.64s - 1746.28s | stuck with the roadmap, right? 1746.28s - 1750.32s | So whatever product is coming on the market, and those products are based on customer-driven 1750.32s - 1751.32s | needs, right? 1751.32s - 1756.24s | So a customer wants this, this product is built, the product goes through testing, it 1756.24s - 1762.44s | gets internal red teams, it gets lots of pen testing and security evaluations and hackathons 1762.44s - 1766.32s | and whatever internally, and then it gets on the market, and


chunk_text:
1714.73s - 1719.97s | It's not, like, your role as a bug bounty program manager should be to push the business 1719.97s - 1725.05s | to do more comprehensive fixes for things or to find every variant of this or to introduce 1725.05s - 1729.25s | some additional scanning or something. 1729.25s - 1730.61s | It's on you, the program manager, to make that happen. 1730.61s - 1735.17s | The researcher is just going to keep submitting, you know, they're not interested in the systematic 1735.17s - 1736.17s | fixes. 1738.64s - 1744.64s | Yeah, I mean, like, the shift left thing is, you hear it all the time, but we're kind of 1744.64s - 1746.28s | stuck with the roadmap, right? 1746.28s - 1750.32s | So whatever product is coming on the market, and those products are based on customer-driven 1750.32s - 1751.32s | needs, right? 1751.32s - 1756.24s | So a customer wants this, this product is built, the product goes through testing, it 1756.24s - 1762.44s | gets internal red teams, it gets lots of pen testing and security evaluations and hackathons 1762.44s - 1766.32s | and whatever internally, and then it gets on the market, and that's where VDP comes 1766.32s - 1770.96s | in place, so vulnerability disclosure, which is not usually paid, so that's your see something, 1770.96s - 1777.72s | say something, and then and only then should it end up in the bug bounty space. 1777.72s - 1782.08s | So bug bounty is true adversary emulation in my mind, and so you're looking at things 1782.08s - 1785.08s | that are actively accessible. 1785.08s - 1791.88s | But there are places where you can insert yourself into that product life cycle before 1791.88s - 1793.82s | it gets on the market. 1793.82s - 1798.82s | If you have a good researcher base that has really qualified and really awesome researchers 1798.82s - 1803.78s | in that space that align with that target or that product, why not consider running 1803.78s - 1808.58s | a private bug bounty event on that product before that product goes on the market? 1808.58s - 1813.06s | You're likely to get really, really good results that way, because usually developers and hackers 1813.06s - 1817.66s | have different mindsets, some are fixers and some are breakers, and if you approach it 1817.66s - 1822.70s | from an


chunk_text:
that's where VDP comes 1766.32s - 1770.96s | in place, so vulnerability disclosure, which is not usually paid, so that's your see something, 1770.96s - 1777.72s | say something, and then and only then should it end up in the bug bounty space. 1777.72s - 1782.08s | So bug bounty is true adversary emulation in my mind, and so you're looking at things 1782.08s - 1785.08s | that are actively accessible. 1785.08s - 1791.88s | But there are places where you can insert yourself into that product life cycle before 1791.88s - 1793.82s | it gets on the market. 1793.82s - 1798.82s | If you have a good researcher base that has really qualified and really awesome researchers 1798.82s - 1803.78s | in that space that align with that target or that product, why not consider running 1803.78s - 1808.58s | a private bug bounty event on that product before that product goes on the market? 1808.58s - 1813.06s | You're likely to get really, really good results that way, because usually developers and hackers 1813.06s - 1817.66s | have different mindsets, some are fixers and some are breakers, and if you approach it 1817.66s - 1822.70s | from an adversary perspective, like most bug hunters do, you're likely to get really good 1822.70s - 1827.62s | results that way, and then putting the bug hunters and the engineers in the same room, 1827.62s - 1830.46s | I've had really good results with that. 1830.46s - 1836.62s | Just sit them next to each other and let them challenge each other works really well. 1836.62s - 1842.02s | So then I can get those products fixed before it ever even goes on the market, and then 1842.02s - 1845.94s | at that point, then it goes through the rest of the process, product gets launched on the 1845.94s - 1850.62s | market, problems have already been fixed, looks good for the company because you don't 1850.62s - 1857.38s | have as many CBEs or negative reports or bad press, then product goes into VDP, and 1857.38s - 1860.46s | then it goes into bug hunting, so bug bounty. 1860.46s - 1867.30s | So I would say there are probably opportunities to insert one's bug bounty program into the 1867.30s - 1874.70s | product life cycle, but when you think about from an industry perspective, there's a reason 1874.70s - 1880.14s


chunk_text:
adversary perspective, like most bug hunters do, you're likely to get really good 1822.70s - 1827.62s | results that way, and then putting the bug hunters and the engineers in the same room, 1827.62s - 1830.46s | I've had really good results with that. 1830.46s - 1836.62s | Just sit them next to each other and let them challenge each other works really well. 1836.62s - 1842.02s | So then I can get those products fixed before it ever even goes on the market, and then 1842.02s - 1845.94s | at that point, then it goes through the rest of the process, product gets launched on the 1845.94s - 1850.62s | market, problems have already been fixed, looks good for the company because you don't 1850.62s - 1857.38s | have as many CBEs or negative reports or bad press, then product goes into VDP, and 1857.38s - 1860.46s | then it goes into bug hunting, so bug bounty. 1860.46s - 1867.30s | So I would say there are probably opportunities to insert one's bug bounty program into the 1867.30s - 1874.70s | product life cycle, but when you think about from an industry perspective, there's a reason 1874.70s - 1880.14s | that you have a bug bounty program, and that reason is so that you can take those vulnerability 1880.14s - 1883.90s | reports that you get, you can analyze them, you can do trend analysis on them, and you 1883.90s - 1889.90s | can force them back into your SDL, so your life cycle. 1889.90s - 1895.78s | You want to not have that same kind of vulnerability pop up over and over again in succession or 1895.78s - 1899.14s | in multiple products that use the same ingredients. 1899.14s - 1907.38s | So if you don't do that part, then the only people who suffer are the product engineers 1907.38s - 1909.78s | who are having to manage the reports on the other end. 1909.78s - 1913.70s | So it's really important to integrate the bug bounty program back into the development 1913.70s - 1914.70s | life cycle. 1914.70s - 1917.18s | There are lots of ways to do that. 1917.18s - 1919.70s | Chargebacks is one of my favorite. 1919.70s - 1924.44s | For every payment that goes out to a bug hunter, you charge back the business unit that owns 1924.44s - 1928.30s | that program.


chunk_text:
| that you have a bug bounty program, and that reason is so that you can take those vulnerability 1880.14s - 1883.90s | reports that you get, you can analyze them, you can do trend analysis on them, and you 1883.90s - 1889.90s | can force them back into your SDL, so your life cycle. 1889.90s - 1895.78s | You want to not have that same kind of vulnerability pop up over and over again in succession or 1895.78s - 1899.14s | in multiple products that use the same ingredients. 1899.14s - 1907.38s | So if you don't do that part, then the only people who suffer are the product engineers 1907.38s - 1909.78s | who are having to manage the reports on the other end. 1909.78s - 1913.70s | So it's really important to integrate the bug bounty program back into the development 1913.70s - 1914.70s | life cycle. 1914.70s - 1917.18s | There are lots of ways to do that. 1917.18s - 1919.70s | Chargebacks is one of my favorite. 1919.70s - 1924.44s | For every payment that goes out to a bug hunter, you charge back the business unit that owns 1924.44s - 1928.30s | that program. 1928.30s - 1932.50s | So they feel the pain, that's the point, right? 1932.50s - 1937.78s | If you don't know me, I've worked in this field for 20-something years. 1937.78s - 1940.42s | I'm all out of carrots. 1940.42s - 1944.58s | I only have sticks left. 1944.58s - 1949.10s | So if the way to feel the pain and to make the change is going to be hitting someone's 1949.10s - 1953.78s | pocketbook because that's what they understand, then that's what I'm going to do. 1953.78s - 1956.58s | So it's all about completing that cycle, right? 1956.58s - 1961.86s | If it gets to the end and you still have reports and those reports are the same reports over 1961.86s - 1968.34s | and over again or the same template, then that template, that researcher is doing the 1968.34s - 1969.82s | same thing over and over again. 1969.82s - 1973.74s | They're finding multiple problems in multiple products, and we're playing whack-a-mole to 1973.74s - 1974.74s | fix it. 1974.74s - 1976.86s | That's not a good way to do it. 1976.86s - 1978.78s | So that needs to go back to the red team.


chunk_text:
1928.30s - 1932.50s | So they feel the pain, that's the point, right? 1932.50s - 1937.78s | If you don't know me, I've worked in this field for 20-something years. 1937.78s - 1940.42s | I'm all out of carrots. 1940.42s - 1944.58s | I only have sticks left. 1944.58s - 1949.10s | So if the way to feel the pain and to make the change is going to be hitting someone's 1949.10s - 1953.78s | pocketbook because that's what they understand, then that's what I'm going to do. 1953.78s - 1956.58s | So it's all about completing that cycle, right? 1956.58s - 1961.86s | If it gets to the end and you still have reports and those reports are the same reports over 1961.86s - 1968.34s | and over again or the same template, then that template, that researcher is doing the 1968.34s - 1969.82s | same thing over and over again. 1969.82s - 1973.74s | They're finding multiple problems in multiple products, and we're playing whack-a-mole to 1973.74s - 1974.74s | fix it. 1974.74s - 1976.86s | That's not a good way to do it. 1976.86s - 1978.78s | So that needs to go back to the red team. 1978.78s - 1982.30s | The red team needs to go and fix all of those problems and all of those products and all 1982.30s - 1985.94s | of those ingredients, and they need to be forced to do that sometimes. 1985.94s - 1991.42s | So it's all about integrating and making sure that you're adequately using incentives both 1991.50s - 1993.90s | on your bug side and on your internal side. 1993.90s - 1998.06s | You know, real quick, you mentioned that there's only pain involved, but I don't think that's 1998.06s - 2002.50s | pain from the bug hunter who is getting, you know, 30 different duplicates sent across 2002.50s - 2008.42s | different targets and fishing for that payout 30X, which sometimes it's valid, sometimes 2008.42s - 2009.42s | it's not. 2009.42s - 2010.42s | What do you think? 2010.42s - 2015.62s | It's pain whenever they've submitted 30 reports of the same they did the same thing 30 times 2015.62s - 2021.06s | and got 30 different issues and then my team got wise to it and went back and did their 2021.74s - 2027.14s | due diligence on all products and then suddenly that pipe is


chunk_text:
1978.78s - 1982.30s | The red team needs to go and fix all of those problems and all of those products and all 1982.30s - 1985.94s | of those ingredients, and they need to be forced to do that sometimes. 1985.94s - 1991.42s | So it's all about integrating and making sure that you're adequately using incentives both 1991.50s - 1993.90s | on your bug side and on your internal side. 1993.90s - 1998.06s | You know, real quick, you mentioned that there's only pain involved, but I don't think that's 1998.06s - 2002.50s | pain from the bug hunter who is getting, you know, 30 different duplicates sent across 2002.50s - 2008.42s | different targets and fishing for that payout 30X, which sometimes it's valid, sometimes 2008.42s - 2009.42s | it's not. 2009.42s - 2010.42s | What do you think? 2010.42s - 2015.62s | It's pain whenever they've submitted 30 reports of the same they did the same thing 30 times 2015.62s - 2021.06s | and got 30 different issues and then my team got wise to it and went back and did their 2021.74s - 2027.14s | due diligence on all products and then suddenly that pipe is just dried up. 2027.14s - 2028.14s | Which is ideal. 2028.14s - 2029.82s | That's what we want. 2029.82s - 2033.78s | So just to bring it back to bug bounty meta, something that I've done before, when I've 2033.78s - 2038.18s | identified that you can find vulnerabilities on, let's say, 30 different products, do I 2038.18s - 2041.30s | submit all 30 or do I submit two? 2041.30s - 2044.82s | And then once those two get paid out, do I submit two more? 2044.82s - 2045.82s | And so... 2045.82s - 2048.90s | No, submit 30, because if you submit... 2048.90s - 2050.18s | I get one payout. 2050.42s - 2051.42s | No, not necessarily. 2051.42s - 2054.86s | It depends on the program. 2054.86s - 2060.98s | But if you submit two and then you wait, you've now given my engineers time to fix the product 2060.98s - 2067.22s | in all the products, which means those 28 you were holding on to are no longer valid. 2067.22s - 2072.46s | So I'm going to jump in for one second, because this is the perfect segue. 2072.46s - 2078.12s | So talking about different ways to


chunk_text:
just dried up. 2027.14s - 2028.14s | Which is ideal. 2028.14s - 2029.82s | That's what we want. 2029.82s - 2033.78s | So just to bring it back to bug bounty meta, something that I've done before, when I've 2033.78s - 2038.18s | identified that you can find vulnerabilities on, let's say, 30 different products, do I 2038.18s - 2041.30s | submit all 30 or do I submit two? 2041.30s - 2044.82s | And then once those two get paid out, do I submit two more? 2044.82s - 2045.82s | And so... 2045.82s - 2048.90s | No, submit 30, because if you submit... 2048.90s - 2050.18s | I get one payout. 2050.42s - 2051.42s | No, not necessarily. 2051.42s - 2054.86s | It depends on the program. 2054.86s - 2060.98s | But if you submit two and then you wait, you've now given my engineers time to fix the product 2060.98s - 2067.22s | in all the products, which means those 28 you were holding on to are no longer valid. 2067.22s - 2072.46s | So I'm going to jump in for one second, because this is the perfect segue. 2072.46s - 2078.12s | So talking about different ways to approach this, from both perspectives, what qualities 2078.12s - 2080.14s | do the best programs for this have? 2080.14s - 2082.12s | How are you doing that sort of dupe detection? 2082.12s - 2085.94s | How are you playing that game and how are you finding the targets that you want? 2085.94s - 2089.34s | And Katie, since I cut you off, you're the first person to take this one. 2089.34s - 2090.34s | Oh, lord. 2090.34s - 2091.34s | Okay. 2091.34s - 2092.34s | What qualities? 2092.34s - 2093.34s | Oh... 2093.34s - 2097.34s | Well, now my train of thought's interrupted. 2097.34s - 2098.34s | Chris goes... 2098.34s - 2099.34s | Help me out. 2099.34s - 2102.22s | Yeah, no problem. 2102.22s - 2106.90s | So I think the general mantra for a program manager is to allocate budget towards the 2106.90s - 2109.72s | areas that you want to reinforce behavior for. 2109.72s - 2114.04s | So that can mean a couple of different things that are situational based on the bugs that 2114.04s - 2115.04s | are coming in. 2115.04s - 2120.28s | So if I'm running a program and one person has submitted, like, a


chunk_text:
approach this, from both perspectives, what qualities 2078.12s - 2080.14s | do the best programs for this have? 2080.14s - 2082.12s | How are you doing that sort of dupe detection? 2082.12s - 2085.94s | How are you playing that game and how are you finding the targets that you want? 2085.94s - 2089.34s | And Katie, since I cut you off, you're the first person to take this one. 2089.34s - 2090.34s | Oh, lord. 2090.34s - 2091.34s | Okay. 2091.34s - 2092.34s | What qualities? 2092.34s - 2093.34s | Oh... 2093.34s - 2097.34s | Well, now my train of thought's interrupted. 2097.34s - 2098.34s | Chris goes... 2098.34s - 2099.34s | Help me out. 2099.34s - 2102.22s | Yeah, no problem. 2102.22s - 2106.90s | So I think the general mantra for a program manager is to allocate budget towards the 2106.90s - 2109.72s | areas that you want to reinforce behavior for. 2109.72s - 2114.04s | So that can mean a couple of different things that are situational based on the bugs that 2114.04s - 2115.04s | are coming in. 2115.04s - 2120.28s | So if I'm running a program and one person has submitted, like, a template of vulnerability. 2120.28s - 2124.78s | Let's say that I own a lot of infrastructure on the internet and they found something that 2124.78s - 2128.32s | applies to a whole lot of those things. 2128.32s - 2133.32s | I would appreciate knowing all of them at once as a bug bounty program manager. 2133.32s - 2138.36s | But I also realize that, hey, this person could have given me one and I may have paid 2138.36s - 2139.82s | them the same. 2139.82s - 2142.46s | And so I think you need to reinforce the behavior that you want to see. 2142.46s - 2147.00s | So if this is a good, high-quality researcher who gives great reports, they respond back 2147.00s - 2152.20s | to you quickly, they're friendly, if you have the budget for it, pay them a multiple for 2152.20s - 2153.20s | what it is. 2153.20s - 2158.08s | Find a way to make whole based on the effort that they put into finding the thing. 2158.08s - 2161.16s | And I think you can often see based on the report comes in, like, did someone run a scanner 2161.16s - 2164.80s | for 30


chunk_text:
template of vulnerability. 2120.28s - 2124.78s | Let's say that I own a lot of infrastructure on the internet and they found something that 2124.78s - 2128.32s | applies to a whole lot of those things. 2128.32s - 2133.32s | I would appreciate knowing all of them at once as a bug bounty program manager. 2133.32s - 2138.36s | But I also realize that, hey, this person could have given me one and I may have paid 2138.36s - 2139.82s | them the same. 2139.82s - 2142.46s | And so I think you need to reinforce the behavior that you want to see. 2142.46s - 2147.00s | So if this is a good, high-quality researcher who gives great reports, they respond back 2147.00s - 2152.20s | to you quickly, they're friendly, if you have the budget for it, pay them a multiple for 2152.20s - 2153.20s | what it is. 2153.20s - 2158.08s | Find a way to make whole based on the effort that they put into finding the thing. 2158.08s - 2161.16s | And I think you can often see based on the report comes in, like, did someone run a scanner 2161.16s - 2164.80s | for 30 minutes and stumble across something that is interesting and something we still 2164.80s - 2169.32s | need to fix or did this require them going down the rabbit hole for two particular weeks 2169.32s - 2173.56s | and then they found something really cool but maybe it's a one-to-many situation. 2173.56s - 2176.84s | And not everyone has an infinite budget, so it's a little sticky there, but they probably 2176.84s - 2184.12s | deserve more than a 1X payout, is it 2X, 4X, 8X, 20X, you know, half of what they submitted. 2184.12s - 2188.16s | I think it's more important that you're fair and that good faith behavior goes both ways, 2188.16s - 2191.36s | both as the researcher who's submitting the bug and saying, hey, I found a thing, I would 2191.36s - 2194.80s | like something for what has been done, especially if you're going to make a code fix change 2194.80s - 2195.80s | for any of that. 2195.80s - 2199.36s | I think that's the general mantra, if you submit a bug, they make some change, it's 2199.36s - 2203.76s | in scope, you should pay out, hill to die on. 2203.76s - 2206.44s


chunk_text:
minutes and stumble across something that is interesting and something we still 2164.80s - 2169.32s | need to fix or did this require them going down the rabbit hole for two particular weeks 2169.32s - 2173.56s | and then they found something really cool but maybe it's a one-to-many situation. 2173.56s - 2176.84s | And not everyone has an infinite budget, so it's a little sticky there, but they probably 2176.84s - 2184.12s | deserve more than a 1X payout, is it 2X, 4X, 8X, 20X, you know, half of what they submitted. 2184.12s - 2188.16s | I think it's more important that you're fair and that good faith behavior goes both ways, 2188.16s - 2191.36s | both as the researcher who's submitting the bug and saying, hey, I found a thing, I would 2191.36s - 2194.80s | like something for what has been done, especially if you're going to make a code fix change 2194.80s - 2195.80s | for any of that. 2195.80s - 2199.36s | I think that's the general mantra, if you submit a bug, they make some change, it's 2199.36s - 2203.76s | in scope, you should pay out, hill to die on. 2203.76s - 2206.44s | But from the program manager's standpoint, it's going to depend on your budget. 2206.44s - 2210.36s | You can't also just, like, bleed everything instantly because of this one thing that came 2210.36s - 2213.48s | by because you might have a couple more quarters or the rest of the year to get through. 2213.48s - 2217.12s | So you have to also, like, be the king that's managing your resources effectively as well 2217.12s - 2219.20s | for your kingdom that is this bug bounty program. 2220.20s - 2222.20s | How's that for seeding it and starting it off? 2222.20s - 2223.20s | I appreciate that. 2223.20s - 2224.20s | Yeah. 2224.20s - 2228.48s | So, I mean, the best programs that I've seen are programs that are responsive, that have 2228.48s - 2232.52s | interesting targets, that triage quickly, pay people quickly. 2232.52s - 2238.04s | I've seen a lot of programs that don't really, they're kind of just templated, right? 2238.04s - 2243.16s | They just took some, I don't mean to bash the platforms, but, like, they just did what 2243.16s - 2248.44s | the platform said and followed that box, but they never really,


chunk_text:
| But from the program manager's standpoint, it's going to depend on your budget. 2206.44s - 2210.36s | You can't also just, like, bleed everything instantly because of this one thing that came 2210.36s - 2213.48s | by because you might have a couple more quarters or the rest of the year to get through. 2213.48s - 2217.12s | So you have to also, like, be the king that's managing your resources effectively as well 2217.12s - 2219.20s | for your kingdom that is this bug bounty program. 2220.20s - 2222.20s | How's that for seeding it and starting it off? 2222.20s - 2223.20s | I appreciate that. 2223.20s - 2224.20s | Yeah. 2224.20s - 2228.48s | So, I mean, the best programs that I've seen are programs that are responsive, that have 2228.48s - 2232.52s | interesting targets, that triage quickly, pay people quickly. 2232.52s - 2238.04s | I've seen a lot of programs that don't really, they're kind of just templated, right? 2238.04s - 2243.16s | They just took some, I don't mean to bash the platforms, but, like, they just did what 2243.16s - 2248.44s | the platform said and followed that box, but they never really, like, thought about what 2248.44s - 2253.12s | is my product and then what is the skill set that's needed in order to hack my product 2253.12s - 2257.36s | and then how do I efficiently incentivize those skill sets, right? 2257.36s - 2259.76s | So, like, I think there is something to the human element. 2259.76s - 2262.08s | There's multiple kinds of researchers out there. 2262.08s - 2264.96s | You have your traditional bug hunters that are motivated by the cash payout. 2264.96s - 2270.76s | They're going to be happy to lob a report over the fence, and as long as they get paid, 2270.76s - 2271.76s | they don't care. 2271.76s - 2274.92s | They're not going to bother you about, like, disclosure windows or anything else. 2274.92s - 2279.12s | Then you have recognition seekers, and I don't mean that negatively, but I mean people 2279.12s - 2282.36s | who are, like, typically we see this in academics, right? 2282.36s - 2285.64s | Academics often can't accept a bounty anyway, so they don't care. 2285.64s - 2288.20s | They care about, can I talk about this at a conference? 2288.20s - 2290.60s | Am I


chunk_text:
like, thought about what 2248.44s - 2253.12s | is my product and then what is the skill set that's needed in order to hack my product 2253.12s - 2257.36s | and then how do I efficiently incentivize those skill sets, right? 2257.36s - 2259.76s | So, like, I think there is something to the human element. 2259.76s - 2262.08s | There's multiple kinds of researchers out there. 2262.08s - 2264.96s | You have your traditional bug hunters that are motivated by the cash payout. 2264.96s - 2270.76s | They're going to be happy to lob a report over the fence, and as long as they get paid, 2270.76s - 2271.76s | they don't care. 2271.76s - 2274.92s | They're not going to bother you about, like, disclosure windows or anything else. 2274.92s - 2279.12s | Then you have recognition seekers, and I don't mean that negatively, but I mean people 2279.12s - 2282.36s | who are, like, typically we see this in academics, right? 2282.36s - 2285.64s | Academics often can't accept a bounty anyway, so they don't care. 2285.64s - 2288.20s | They care about, can I talk about this at a conference? 2288.20s - 2290.60s | Am I going to get my name next to a CBE for this? 2290.60s - 2298.12s | They are looking for that, how do I make sure that I'm able to build my resume, build my 2298.12s - 2300.60s | street cred based on my research, right? 2300.60s - 2304.24s | So your academics are going to be, or your recognition seekers are going to be different 2304.24s - 2305.24s | than your bug hunters. 2305.24s - 2307.20s | They're going to be motivated by different things. 2307.20s - 2311.56s | You have, like, friendly helpers, as we call them, so that's, like, government agencies 2311.56s - 2313.12s | or sometimes other companies. 2313.12s - 2320.60s | So sometimes my technology is similar to my competitor's technology, and if I get a report 2320.60s - 2325.80s | that I know that impacts my competitor, I tell them. 2325.80s - 2330.80s | We have a number, we call the bat line, and we say, hey, other company, this impacts me 2330.80s - 2333.56s | and it probably impacts you too, and they do the same. 2333.56s - 2336.24s | So those are kind of, like, friendly helpers, right? 2336.24s - 2341.48s | So


chunk_text:
going to get my name next to a CBE for this? 2290.60s - 2298.12s | They are looking for that, how do I make sure that I'm able to build my resume, build my 2298.12s - 2300.60s | street cred based on my research, right? 2300.60s - 2304.24s | So your academics are going to be, or your recognition seekers are going to be different 2304.24s - 2305.24s | than your bug hunters. 2305.24s - 2307.20s | They're going to be motivated by different things. 2307.20s - 2311.56s | You have, like, friendly helpers, as we call them, so that's, like, government agencies 2311.56s - 2313.12s | or sometimes other companies. 2313.12s - 2320.60s | So sometimes my technology is similar to my competitor's technology, and if I get a report 2320.60s - 2325.80s | that I know that impacts my competitor, I tell them. 2325.80s - 2330.80s | We have a number, we call the bat line, and we say, hey, other company, this impacts me 2330.80s - 2333.56s | and it probably impacts you too, and they do the same. 2333.56s - 2336.24s | So those are kind of, like, friendly helpers, right? 2336.24s - 2341.48s | So each one of those different kinds of motivations often requires a different kind of incentive. 2341.48s - 2345.88s | So there's different things that you can do as a program to incentivize the skill set 2345.88s - 2348.16s | that you want and the results that you want. 2348.16s - 2349.80s | Payouts is one of them. 2349.80s - 2356.16s | The other things that you can do are things like, we call it CPEs for CBEs, right? 2356.16s - 2358.36s | So continuing education credits, right? 2358.36s - 2360.80s | Like a lot of people have certifications. 2360.80s - 2366.60s | And if you find a CBE, it's very easy for me as a bug bounty manager to literally write 2366.60s - 2371.44s | out a certificate for that bug hunter, and they can take that back to whoever owns their, 2371.44s - 2376.56s | you know, whether it's EC Council or ISACA or whoever owns that certification, and they 2376.56s - 2379.92s | can get continuing education credits for the work that they do. 2379.92s - 2384.88s | That's going to motivate some people more than a payout will. 2384.88s - 2387.76s | Working with researchers to make


chunk_text:
each one of those different kinds of motivations often requires a different kind of incentive. 2341.48s - 2345.88s | So there's different things that you can do as a program to incentivize the skill set 2345.88s - 2348.16s | that you want and the results that you want. 2348.16s - 2349.80s | Payouts is one of them. 2349.80s - 2356.16s | The other things that you can do are things like, we call it CPEs for CBEs, right? 2356.16s - 2358.36s | So continuing education credits, right? 2358.36s - 2360.80s | Like a lot of people have certifications. 2360.80s - 2366.60s | And if you find a CBE, it's very easy for me as a bug bounty manager to literally write 2366.60s - 2371.44s | out a certificate for that bug hunter, and they can take that back to whoever owns their, 2371.44s - 2376.56s | you know, whether it's EC Council or ISACA or whoever owns that certification, and they 2376.56s - 2379.92s | can get continuing education credits for the work that they do. 2379.92s - 2384.88s | That's going to motivate some people more than a payout will. 2384.88s - 2387.76s | Working with researchers to make sure that their timelines are met so they can talk at 2387.76s - 2392.48s | a conference, or working with them to help improve their overall talk at a conference, 2392.48s - 2398.30s | or working with them to help them improve their paper that's going to get published. 2398.30s - 2403.44s | Those things are specific incentives that you can do to make sure that you're getting 2403.44s - 2405.48s | the quality results. 2405.48s - 2408.92s | So I think that the best bug bounty programs are responsive. 2408.92s - 2413.40s | They're responsive to the needs of the product, and they're responsive to the needs of the 2413.40s - 2417.44s | researchers or the constituents that they want to get those results from. 2417.44s - 2422.48s | It's all about figuring out what that balance is. 2422.48s - 2426.04s | Just to use, like, some concrete examples, maybe, like, as a program manager, like, do 2426.04s - 2429.60s | you know who your top bug bounty hunters are? 2429.60s - 2431.24s | Like what motivates them? 2431.24s - 2432.24s | Why are they there? 2432.24s - 2438.16s | And then similarly, as a program manager, like, do


chunk_text:
sure that their timelines are met so they can talk at 2387.76s - 2392.48s | a conference, or working with them to help improve their overall talk at a conference, 2392.48s - 2398.30s | or working with them to help them improve their paper that's going to get published. 2398.30s - 2403.44s | Those things are specific incentives that you can do to make sure that you're getting 2403.44s - 2405.48s | the quality results. 2405.48s - 2408.92s | So I think that the best bug bounty programs are responsive. 2408.92s - 2413.40s | They're responsive to the needs of the product, and they're responsive to the needs of the 2413.40s - 2417.44s | researchers or the constituents that they want to get those results from. 2417.44s - 2422.48s | It's all about figuring out what that balance is. 2422.48s - 2426.04s | Just to use, like, some concrete examples, maybe, like, as a program manager, like, do 2426.04s - 2429.60s | you know who your top bug bounty hunters are? 2429.60s - 2431.24s | Like what motivates them? 2431.24s - 2432.24s | Why are they there? 2432.24s - 2438.16s | And then similarly, as a program manager, like, do you know what matters to the business? 2438.16s - 2447.00s | Like, going beyond CV or CVSS score, sorry, like, what is a crit, you know, to your business? 2447.00s - 2451.31s | And it's not always RCE, necessarily. 2451.31s - 2453.91s | Yeah, bonuses are delightful, too. 2453.91s - 2458.47s | Just because, like, sometimes you get locked in this, like, legal world where there's a 2458.47s - 2463.03s | definition of the word bounty, and you can have a bounty schedule, but your legal won't 2463.03s - 2468.07s | let you change from what that bounty definition is, because it's tied to a specific thing 2468.07s - 2471.15s | and it's tied to, like, what is the definition of vulnerability? 2471.15s - 2477.35s | So you can be creative sometimes with payouts on things, like, if you change, kind of change 2477.35s - 2483.23s | the definition and say this may not be a traditional vulnerability, which equals a CVE, which equals 2483.23s - 2488.83s | this payout based on criticality, which is our process, you can sometimes say, like, 2488.83s - 2493.75s | based on budget, will my company take action based on this report? 2493.75s -


chunk_text:
you know what matters to the business? 2438.16s - 2447.00s | Like, going beyond CV or CVSS score, sorry, like, what is a crit, you know, to your business? 2447.00s - 2451.31s | And it's not always RCE, necessarily. 2451.31s - 2453.91s | Yeah, bonuses are delightful, too. 2453.91s - 2458.47s | Just because, like, sometimes you get locked in this, like, legal world where there's a 2458.47s - 2463.03s | definition of the word bounty, and you can have a bounty schedule, but your legal won't 2463.03s - 2468.07s | let you change from what that bounty definition is, because it's tied to a specific thing 2468.07s - 2471.15s | and it's tied to, like, what is the definition of vulnerability? 2471.15s - 2477.35s | So you can be creative sometimes with payouts on things, like, if you change, kind of change 2477.35s - 2483.23s | the definition and say this may not be a traditional vulnerability, which equals a CVE, which equals 2483.23s - 2488.83s | this payout based on criticality, which is our process, you can sometimes say, like, 2488.83s - 2493.75s | based on budget, will my company take action based on this report? 2493.75s - 2494.75s | Right? 2494.75s - 2495.75s | That's a guiding principle. 2495.75s - 2499.51s | You can say, if my company will take action based on this report, then this report has 2499.51s - 2505.11s | value to me, and then I have a set bonus scale, like, to what level will my company take action 2505.11s - 2506.11s | on this report? 2506.11s - 2510.79s | Will my company put out a document change and suddenly change the way that the security 2510.79s - 2512.23s | guidance is applied? 2512.23s - 2516.79s | Well, that might be worth a certain amount of money, and that's a bonus payment I can 2516.79s - 2521.85s | pay to that researcher, because I appreciate their, I appreciate the work that they put 2521.85s - 2528.37s | into finding that issue, security issue, and sending it to me, and so now I can fix 2528.37s - 2532.89s | something that I didn't know was a problem, even if it's not a traditional patch. 2532.89s - 2538.93s | So I think you should be creative in the ways that you think about what is a security harm 2538.93s - 2544.33s | versus a vulnerability,


chunk_text:
2494.75s | Right? 2494.75s - 2495.75s | That's a guiding principle. 2495.75s - 2499.51s | You can say, if my company will take action based on this report, then this report has 2499.51s - 2505.11s | value to me, and then I have a set bonus scale, like, to what level will my company take action 2505.11s - 2506.11s | on this report? 2506.11s - 2510.79s | Will my company put out a document change and suddenly change the way that the security 2510.79s - 2512.23s | guidance is applied? 2512.23s - 2516.79s | Well, that might be worth a certain amount of money, and that's a bonus payment I can 2516.79s - 2521.85s | pay to that researcher, because I appreciate their, I appreciate the work that they put 2521.85s - 2528.37s | into finding that issue, security issue, and sending it to me, and so now I can fix 2528.37s - 2532.89s | something that I didn't know was a problem, even if it's not a traditional patch. 2532.89s - 2538.93s | So I think you should be creative in the ways that you think about what is a security harm 2538.93s - 2544.33s | versus a vulnerability, and how do we reward positive behavior? 2544.33s - 2545.33s | Swag motivates. 2545.33s - 2546.33s | It helps. 2546.33s - 2547.33s | All right. 2547.33s - 2549.80s | Thank you. 2550.08s - 2551.08s | Thank you. 2551.08s - 2555.96s | So hopping on, sort of touching back on something Kuskos had mentioned earlier, and something 2555.96s - 2560.12s | we've had a few talks on at DEF CON and AppSec Village and whatnot in the past, and yes, 2560.12s - 2562.52s | we did skip a question. 2562.52s - 2566.52s | What are your thoughts on bounty farming, and if you had to put a specific definition 2566.52s - 2572.44s | or your spin on bounty farming, what would you qualify it as? 2572.44s - 2574.16s | And Kuskos, this one's you to start. 2574.16s - 2575.16s | All right. 2575.16s - 2579.08s | So does anyone here not know what bounty farming is, just looking at the terminology? 2579.08s - 2580.08s | Okay. 2580.08s - 2584.28s | So let's say that you have a platform that is vulnerable to a particular thing, and that 2584.28s - 2588.20s | platform is like a business-to-business sort of thing, so they


chunk_text:
and how do we reward positive behavior? 2544.33s - 2545.33s | Swag motivates. 2545.33s - 2546.33s | It helps. 2546.33s - 2547.33s | All right. 2547.33s - 2549.80s | Thank you. 2550.08s - 2551.08s | Thank you. 2551.08s - 2555.96s | So hopping on, sort of touching back on something Kuskos had mentioned earlier, and something 2555.96s - 2560.12s | we've had a few talks on at DEF CON and AppSec Village and whatnot in the past, and yes, 2560.12s - 2562.52s | we did skip a question. 2562.52s - 2566.52s | What are your thoughts on bounty farming, and if you had to put a specific definition 2566.52s - 2572.44s | or your spin on bounty farming, what would you qualify it as? 2572.44s - 2574.16s | And Kuskos, this one's you to start. 2574.16s - 2575.16s | All right. 2575.16s - 2579.08s | So does anyone here not know what bounty farming is, just looking at the terminology? 2579.08s - 2580.08s | Okay. 2580.08s - 2584.28s | So let's say that you have a platform that is vulnerable to a particular thing, and that 2584.28s - 2588.20s | platform is like a business-to-business sort of thing, so they themselves have customers 2588.20s - 2592.84s | who are using that platform, those customers roll it out for their clients to use. 2592.84s - 2597.84s | And so if the vulnerability exists in the platform, should I be reporting that vulnerability 2597.84s - 2600.76s | to the main parent company, or to all the child companies who are running it who may 2600.76s - 2602.72s | have their own security teams? 2602.72s - 2607.00s | And so when that happens, you end up in this situation, and so again, one to many. 2607.00s - 2611.36s | And so who is responsible for paying that bounty? 2611.36s - 2615.42s | My personal thought is that the most, at least when we're talking about the fundamentals 2615.42s - 2619.34s | of what happened, you've identified a risk, you've reported the risk, and does the entity 2619.34s - 2622.00s | that you're reporting to agree that it is a risk? 2622.00s - 2623.00s | Sometimes there's semantics involved. 2623.00s - 2626.26s | You know, we try to do what we can with prioritization and threat levels, and just something to convey 2626.26s - 2629.44s | across the aisle of if something is bad,


chunk_text:
themselves have customers 2588.20s - 2592.84s | who are using that platform, those customers roll it out for their clients to use. 2592.84s - 2597.84s | And so if the vulnerability exists in the platform, should I be reporting that vulnerability 2597.84s - 2600.76s | to the main parent company, or to all the child companies who are running it who may 2600.76s - 2602.72s | have their own security teams? 2602.72s - 2607.00s | And so when that happens, you end up in this situation, and so again, one to many. 2607.00s - 2611.36s | And so who is responsible for paying that bounty? 2611.36s - 2615.42s | My personal thought is that the most, at least when we're talking about the fundamentals 2615.42s - 2619.34s | of what happened, you've identified a risk, you've reported the risk, and does the entity 2619.34s - 2622.00s | that you're reporting to agree that it is a risk? 2622.00s - 2623.00s | Sometimes there's semantics involved. 2623.00s - 2626.26s | You know, we try to do what we can with prioritization and threat levels, and just something to convey 2626.26s - 2629.44s | across the aisle of if something is bad, how bad is it? 2629.44s - 2635.24s | And obviously the game in this is we want to explain the situation in such a way to 2635.24s - 2638.72s | where the damages are material, and we can remediate it. 2638.72s - 2643.84s | If that company pushes a line of code or changes configuration in response to what you've provided, 2643.84s - 2648.24s | I think that most people will agree that that person has earned a reward, whatever the reward 2648.24s - 2649.24s | may be. 2649.24s - 2651.20s | You know, if they have a budget, spend the budget towards it. 2651.20s - 2654.60s | If they don't have a budget, at the very least some swag of some sort, or, you know, I've 2654.60s - 2658.40s | done vulnerabilities, or I've reported vulnerabilities in place just so that I could be on, like, 2658.40s - 2660.44s | a thank you page on their website. 2660.44s - 2664.64s | Building the CD is material, too, for you. 2664.64s - 2668.64s | Everyone should pay, and it's unfortunate when there becomes conflict there between 2668.64s - 2673.52s | who it is, especially when you have platforms who often


chunk_text:
how bad is it? 2629.44s - 2635.24s | And obviously the game in this is we want to explain the situation in such a way to 2635.24s - 2638.72s | where the damages are material, and we can remediate it. 2638.72s - 2643.84s | If that company pushes a line of code or changes configuration in response to what you've provided, 2643.84s - 2648.24s | I think that most people will agree that that person has earned a reward, whatever the reward 2648.24s - 2649.24s | may be. 2649.24s - 2651.20s | You know, if they have a budget, spend the budget towards it. 2651.20s - 2654.60s | If they don't have a budget, at the very least some swag of some sort, or, you know, I've 2654.60s - 2658.40s | done vulnerabilities, or I've reported vulnerabilities in place just so that I could be on, like, 2658.40s - 2660.44s | a thank you page on their website. 2660.44s - 2664.64s | Building the CD is material, too, for you. 2664.64s - 2668.64s | Everyone should pay, and it's unfortunate when there becomes conflict there between 2668.64s - 2673.52s | who it is, especially when you have platforms who often shift something out in a secure 2673.52s - 2677.92s | by default way, or at least they've done their best attempt at secure by default. 2677.92s - 2681.96s | The customer of that particular platform gets it, and they change settings so that their 2681.96s - 2683.52s | users can log into it easier. 2683.52s - 2689.24s | A great example is lack of 2FA, and I don't want to name any particular platforms. 2689.24s - 2690.24s | Just think. 2690.24s - 2691.24s | There's a lot of them. 2691.60s - 2695.88s | Let's say that it shifts with 2FA enabled, and a strong password complexity. 2695.88s - 2699.92s | That gets to the client who's buying that particular platform, and let's say that that 2699.92s - 2702.12s | client has a non-technical user base. 2702.12s - 2706.20s | Those user base don't want to use 2FA, or they don't want to use password managers for 2706.20s - 2709.28s | high-entropy passwords, and so now you end up with a situation where you can have eight 2709.28s - 2714.08s | lowercase characters as an extreme for a password, and some bug bounty hunter is saying, hey, 2714.08s - 2718.44s |


chunk_text:
shift something out in a secure 2673.52s - 2677.92s | by default way, or at least they've done their best attempt at secure by default. 2677.92s - 2681.96s | The customer of that particular platform gets it, and they change settings so that their 2681.96s - 2683.52s | users can log into it easier. 2683.52s - 2689.24s | A great example is lack of 2FA, and I don't want to name any particular platforms. 2689.24s - 2690.24s | Just think. 2690.24s - 2691.24s | There's a lot of them. 2691.60s - 2695.88s | Let's say that it shifts with 2FA enabled, and a strong password complexity. 2695.88s - 2699.92s | That gets to the client who's buying that particular platform, and let's say that that 2699.92s - 2702.12s | client has a non-technical user base. 2702.12s - 2706.20s | Those user base don't want to use 2FA, or they don't want to use password managers for 2706.20s - 2709.28s | high-entropy passwords, and so now you end up with a situation where you can have eight 2709.28s - 2714.08s | lowercase characters as an extreme for a password, and some bug bounty hunter is saying, hey, 2714.08s - 2718.44s | there's low password entropy here on this particular authentication mechanism. 2718.48s - 2721.92s | If that particular instance is vulnerable, the main parent company for it shipped it 2721.92s - 2728.56s | out by secure by default, they could have many child companies that are all doing this, 2728.56s - 2731.48s | and so there is a vulnerability there, but is it really? 2731.48s - 2735.64s | We get to the semantics argument, and when you find that situation, and I've found that 2735.64s - 2738.76s | situation, when I'm typing up the report, I almost have to ask myself how much do I 2738.76s - 2744.56s | want to spend in my time and effort arguing that it is something that should be changed, 2744.56s - 2749.04s | especially if that particular business is doing it such that they can have customers 2749.04s - 2751.12s | that use their platform a little bit more. 2751.12s - 2753.60s | So there's a lot of nuance there. 2753.60s - 2757.80s | I think that it goes back fundamentally to being accepting of people who are going to 2757.80s - 2760.52s | bring risk to you, and then figuring out what you


chunk_text:
there's low password entropy here on this particular authentication mechanism. 2718.48s - 2721.92s | If that particular instance is vulnerable, the main parent company for it shipped it 2721.92s - 2728.56s | out by secure by default, they could have many child companies that are all doing this, 2728.56s - 2731.48s | and so there is a vulnerability there, but is it really? 2731.48s - 2735.64s | We get to the semantics argument, and when you find that situation, and I've found that 2735.64s - 2738.76s | situation, when I'm typing up the report, I almost have to ask myself how much do I 2738.76s - 2744.56s | want to spend in my time and effort arguing that it is something that should be changed, 2744.56s - 2749.04s | especially if that particular business is doing it such that they can have customers 2749.04s - 2751.12s | that use their platform a little bit more. 2751.12s - 2753.60s | So there's a lot of nuance there. 2753.60s - 2757.80s | I think that it goes back fundamentally to being accepting of people who are going to 2757.80s - 2760.52s | bring risk to you, and then figuring out what you can do about it. 2760.52s - 2765.08s | If there has to be some sort of, like, discussion between that particular client and the parent 2765.08s - 2768.08s | company on who's going to pay out for it, unfortunately it needs to be had, and not 2768.08s - 2769.72s | everyone has those dialogues for it. 2769.72s - 2773.28s | I mean, you know, at best sometimes you have, like, customer service rep from node one talking 2773.28s - 2775.92s | to customer service rep from node two. 2775.92s - 2779.36s | Maybe one of them only has access to the security company, and there's just so much red tape 2779.36s - 2782.12s | in the way that you're not going to get a practical solution in any meaningful amount 2782.12s - 2783.12s | of time. 2783.12s - 2786.04s | So what ends up happening is that that bounty researcher is frustrated. 2786.04s - 2788.64s | They feel like they've spent a whole lot of effort on something, or maybe they haven't, 2788.64s - 2792.28s | but they still typed up the report and brought something to your attention. 2792.28s - 2797.26s | I don't think we have anyone who


chunk_text:
can do about it. 2760.52s - 2765.08s | If there has to be some sort of, like, discussion between that particular client and the parent 2765.08s - 2768.08s | company on who's going to pay out for it, unfortunately it needs to be had, and not 2768.08s - 2769.72s | everyone has those dialogues for it. 2769.72s - 2773.28s | I mean, you know, at best sometimes you have, like, customer service rep from node one talking 2773.28s - 2775.92s | to customer service rep from node two. 2775.92s - 2779.36s | Maybe one of them only has access to the security company, and there's just so much red tape 2779.36s - 2782.12s | in the way that you're not going to get a practical solution in any meaningful amount 2782.12s - 2783.12s | of time. 2783.12s - 2786.04s | So what ends up happening is that that bounty researcher is frustrated. 2786.04s - 2788.64s | They feel like they've spent a whole lot of effort on something, or maybe they haven't, 2788.64s - 2792.28s | but they still typed up the report and brought something to your attention. 2792.28s - 2797.26s | I don't think we have anyone who really says that, or I haven't seen, like, a thing was 2797.26s - 2801.68s | shipped to us in this secure by default way, and then we've changed it, and we're not going 2801.68s - 2804.28s | to you because it's part of how our business operates. 2804.28s - 2805.28s | I've seen that. 2805.28s - 2806.28s | Have you? 2806.28s - 2807.28s | Yeah. 2807.28s - 2811.68s | Because, and so I sit on the CVE board, just for full disclosure there. 2811.68s - 2818.38s | So I've been a CVE board member for 10 years, and when we get into, like, traditional definition 2818.38s - 2822.68s | of what is a vulnerability, what you're describing is a misconfiguration and not a vulnerability. 2822.68s - 2827.88s | And so some companies will say that's a misconfiguration and not a vulnerability, because it was, the 2827.88s - 2832.04s | device is operating as intended. 2832.04s - 2834.52s | It's a shit secure practice, like, security practice. 2834.52s - 2840.36s | Like, it's not a good practice, but it was set up that way to be that way because the 2840.36s - 2845.32s | customer wanted it that way, and that's


chunk_text:
really says that, or I haven't seen, like, a thing was 2797.26s - 2801.68s | shipped to us in this secure by default way, and then we've changed it, and we're not going 2801.68s - 2804.28s | to you because it's part of how our business operates. 2804.28s - 2805.28s | I've seen that. 2805.28s - 2806.28s | Have you? 2806.28s - 2807.28s | Yeah. 2807.28s - 2811.68s | Because, and so I sit on the CVE board, just for full disclosure there. 2811.68s - 2818.38s | So I've been a CVE board member for 10 years, and when we get into, like, traditional definition 2818.38s - 2822.68s | of what is a vulnerability, what you're describing is a misconfiguration and not a vulnerability. 2822.68s - 2827.88s | And so some companies will say that's a misconfiguration and not a vulnerability, because it was, the 2827.88s - 2832.04s | device is operating as intended. 2832.04s - 2834.52s | It's a shit secure practice, like, security practice. 2834.52s - 2840.36s | Like, it's not a good practice, but it was set up that way to be that way because the 2840.36s - 2845.32s | customer wanted it that way, and that's the implementation of the device, not the device. 2845.32s - 2846.76s | So yeah, I've seen that. 2846.76s - 2847.76s | Okay. 2847.76s - 2852.24s | So let's say it's not a, let's get to something more practical, and like, okay, it's not, 2852.24s - 2853.24s | it's not a misconfiguration. 2853.24s - 2856.64s | The product's been shipped out, people are using it, and let's just say it's like cross-site 2856.64s - 2858.16s | scripting on the login page. 2858.16s - 2861.60s | So you know, improper user name, the user name comes back reflected with whatever input 2861.60s - 2866.28s | the user gave it, and so now every installation of this is vulnerable to this particular thing. 2866.28s - 2868.40s | What's that? 2868.40s - 2869.40s | Still a misconfiguration. 2869.40s - 2870.40s | Still a misconfiguration. 2870.40s - 2871.40s | Okay. 2871.40s - 2876.54s | Well, let's say that... 2876.54s - 2877.54s | Log for chair. 2877.54s - 2880.66s | Apache zero day. 2880.66s - 2882.70s | All of those. 2882.70s - 2885.14s | But something more tangible that affects all the different installations. 2885.26s - 2889.40s | So each one should be racing to fix


chunk_text:
the implementation of the device, not the device. 2845.32s - 2846.76s | So yeah, I've seen that. 2846.76s - 2847.76s | Okay. 2847.76s - 2852.24s | So let's say it's not a, let's get to something more practical, and like, okay, it's not, 2852.24s - 2853.24s | it's not a misconfiguration. 2853.24s - 2856.64s | The product's been shipped out, people are using it, and let's just say it's like cross-site 2856.64s - 2858.16s | scripting on the login page. 2858.16s - 2861.60s | So you know, improper user name, the user name comes back reflected with whatever input 2861.60s - 2866.28s | the user gave it, and so now every installation of this is vulnerable to this particular thing. 2866.28s - 2868.40s | What's that? 2868.40s - 2869.40s | Still a misconfiguration. 2869.40s - 2870.40s | Still a misconfiguration. 2870.40s - 2871.40s | Okay. 2871.40s - 2876.54s | Well, let's say that... 2876.54s - 2877.54s | Log for chair. 2877.54s - 2880.66s | Apache zero day. 2880.66s - 2882.70s | All of those. 2882.70s - 2885.14s | But something more tangible that affects all the different installations. 2885.26s - 2889.40s | So each one should be racing to fix it, but they're likely going to have different security 2889.40s - 2891.26s | maturity mechanisms. 2891.26s - 2894.58s | The fastest way for something like that to get fixed, especially in a zero day situation, 2894.58s - 2898.98s | is if the parent company fixes it at the platform level, and then that is automatically cascading 2898.98s - 2902.02s | down to everyone who has their own installations of it. 2902.02s - 2905.14s | Unless those are too custom, such that it can't accept the update, and I've seen that 2905.14s - 2907.22s | happen before, too. 2907.22s - 2911.26s | In that situation, my personal opinion is that the parent company should pay for it, 2911.26s - 2916.58s | but then again, at that same time, is this a one-to-many payout, or is it a one-to-one? 2916.58s - 2919.98s | Because let's say that you, reporting this vulnerability to the parent company, has fixed 2919.98s - 2923.74s | a thousand different installations, and you wanted to have the argument that this was 2923.74s - 2929.53s | like a thousand SQL injections, or a thousand RCEs. 2929.53s - 2933.99s | So at least my view on this anyways is, like,


chunk_text:
it, but they're likely going to have different security 2889.40s - 2891.26s | maturity mechanisms. 2891.26s - 2894.58s | The fastest way for something like that to get fixed, especially in a zero day situation, 2894.58s - 2898.98s | is if the parent company fixes it at the platform level, and then that is automatically cascading 2898.98s - 2902.02s | down to everyone who has their own installations of it. 2902.02s - 2905.14s | Unless those are too custom, such that it can't accept the update, and I've seen that 2905.14s - 2907.22s | happen before, too. 2907.22s - 2911.26s | In that situation, my personal opinion is that the parent company should pay for it, 2911.26s - 2916.58s | but then again, at that same time, is this a one-to-many payout, or is it a one-to-one? 2916.58s - 2919.98s | Because let's say that you, reporting this vulnerability to the parent company, has fixed 2919.98s - 2923.74s | a thousand different installations, and you wanted to have the argument that this was 2923.74s - 2929.53s | like a thousand SQL injections, or a thousand RCEs. 2929.53s - 2933.99s | So at least my view on this anyways is, like, if you're... 2933.99s - 2934.99s | If you find it... 2934.99s - 2935.99s | Using Apache as an example. 2935.99s - 2939.79s | If you find a zero day on Apache, I want to hear about it, because it impacts my products. 2939.79s - 2944.31s | If you're reporting a one day, as in something that's been... 2944.31s - 2947.83s | A CVE has been issued for it, and a patch has been published, and we have to go pick 2947.83s - 2952.23s | up the patch, it's probably already in our pipeline. 2952.23s - 2958.03s | I like policies where there's a 30-day window, essentially, where the program has a chance 2958.03s - 2963.79s | to fix things, and then you can go and report something after a certain amount of time. 2963.79s - 2969.35s | But for original research, I think part of bug bounty is to incentivize that. 2969.35s - 2971.35s | That's my view, anyways. 2971.35s - 2976.03s | Yeah, I'd say it comes down to how well was your program terms written, right? 2976.03s - 2980.39s | So every company that's running a bug bounty program should take the time to look at their 2980.39s


chunk_text:
if you're... 2933.99s - 2934.99s | If you find it... 2934.99s - 2935.99s | Using Apache as an example. 2935.99s - 2939.79s | If you find a zero day on Apache, I want to hear about it, because it impacts my products. 2939.79s - 2944.31s | If you're reporting a one day, as in something that's been... 2944.31s - 2947.83s | A CVE has been issued for it, and a patch has been published, and we have to go pick 2947.83s - 2952.23s | up the patch, it's probably already in our pipeline. 2952.23s - 2958.03s | I like policies where there's a 30-day window, essentially, where the program has a chance 2958.03s - 2963.79s | to fix things, and then you can go and report something after a certain amount of time. 2963.79s - 2969.35s | But for original research, I think part of bug bounty is to incentivize that. 2969.35s - 2971.35s | That's my view, anyways. 2971.35s - 2976.03s | Yeah, I'd say it comes down to how well was your program terms written, right? 2976.03s - 2980.39s | So every company that's running a bug bounty program should take the time to look at their 2980.39s - 2983.23s | product and look at their bug bounty terms. 2983.23s - 2984.23s | And if you have something... 2984.23s - 2990.47s | I mean, you can eliminate those one-to-one, one-to-many, by simply saying that the vulnerability 2990.47s - 2996.03s | is tied to the vulnerable code, not how many instances of the vulnerable code exist. 2996.03s - 3002.39s | So you root cause it, basically, but you need to make that real clear in your terms well 3002.39s - 3005.99s | before someone comes to you with that problem. 3005.99s - 3010.47s | And that is something that can be thought about real early on. 3010.47s - 3011.55s | It shouldn't be a surprise. 3011.55s - 3016.67s | You shouldn't get a researcher submitting 100 tickets for the same kind of problem, 3016.67s - 3018.59s | that roots down to one. 3018.59s - 3019.59s | Submit all your tickets. 3019.71s - 3020.71s | Don't do it two at a time. 3020.71s - 3025.55s | All you're doing is screwing yourself. 3025.55s - 3026.55s | Because it goes by the day. 3026.55s - 3027.55s | I'm telling you, all you're doing is screwing yourself. 3027.55s - 3030.99s | If


chunk_text:
- 2983.23s | product and look at their bug bounty terms. 2983.23s - 2984.23s | And if you have something... 2984.23s - 2990.47s | I mean, you can eliminate those one-to-one, one-to-many, by simply saying that the vulnerability 2990.47s - 2996.03s | is tied to the vulnerable code, not how many instances of the vulnerable code exist. 2996.03s - 3002.39s | So you root cause it, basically, but you need to make that real clear in your terms well 3002.39s - 3005.99s | before someone comes to you with that problem. 3005.99s - 3010.47s | And that is something that can be thought about real early on. 3010.47s - 3011.55s | It shouldn't be a surprise. 3011.55s - 3016.67s | You shouldn't get a researcher submitting 100 tickets for the same kind of problem, 3016.67s - 3018.59s | that roots down to one. 3018.59s - 3019.59s | Submit all your tickets. 3019.71s - 3020.71s | Don't do it two at a time. 3020.71s - 3025.55s | All you're doing is screwing yourself. 3025.55s - 3026.55s | Because it goes by the day. 3026.55s - 3027.55s | I'm telling you, all you're doing is screwing yourself. 3027.55s - 3030.99s | If you give me 30 tickets, and they're all different, substantially different, I'm going 3030.99s - 3034.79s | to pay each one of those tickets, if you hold them, and then I fix that problem, and I've 3034.79s - 3039.95s | just negated your entire research that you had on 28 other tickets, give them to me now. 3039.95s - 3042.59s | Give me all the tickets. 3042.59s - 3043.59s | But it... 3043.59s - 3044.59s | Yeah. 3044.59s - 3047.95s | I think the program terms are really important, right? 3047.99s - 3051.71s | So, like, thinking through your use cases and thinking through, like, this could happen, 3051.71s - 3055.43s | and I need to be very clear with my researchers before they ever start working on my product 3055.43s - 3058.03s | that these are the terms that are going to get paid out, and I can't be changing the 3058.03s - 3061.23s | game halfway through after they've submitted a report. 3061.23s - 3062.55s | Like, that's not cool. 3062.55s - 3063.55s | That's not kosher. 3063.55s - 3064.55s | You don't do that. 3064.55s - 3065.55s | They submitted the report. 3065.55s - 3067.47s | You


chunk_text:
you give me 30 tickets, and they're all different, substantially different, I'm going 3030.99s - 3034.79s | to pay each one of those tickets, if you hold them, and then I fix that problem, and I've 3034.79s - 3039.95s | just negated your entire research that you had on 28 other tickets, give them to me now. 3039.95s - 3042.59s | Give me all the tickets. 3042.59s - 3043.59s | But it... 3043.59s - 3044.59s | Yeah. 3044.59s - 3047.95s | I think the program terms are really important, right? 3047.99s - 3051.71s | So, like, thinking through your use cases and thinking through, like, this could happen, 3051.71s - 3055.43s | and I need to be very clear with my researchers before they ever start working on my product 3055.43s - 3058.03s | that these are the terms that are going to get paid out, and I can't be changing the 3058.03s - 3061.23s | game halfway through after they've submitted a report. 3061.23s - 3062.55s | Like, that's not cool. 3062.55s - 3063.55s | That's not kosher. 3063.55s - 3064.55s | You don't do that. 3064.55s - 3065.55s | They submitted the report. 3065.55s - 3067.47s | You pay the report under the terms that currently exist. 3067.47s - 3069.91s | You change your terms later, well, then you have a cutoff date. 3069.91s - 3073.63s | You say anything comes past this time is going to be subject to these terms. 3073.63s - 3075.35s | But if you submitted it before, then you fall. 3075.35s - 3077.47s | Like, it's just being fair and being honest and being decent. 3077.99s - 3078.99s | Like, so you build that trust. 3078.99s - 3082.99s | If you don't have that trust, then why would a researcher submit the vulnerability to you 3082.99s - 3085.11s | and not sell it? 3085.11s - 3088.03s | So do the right thing and build trust. 3088.03s - 3091.83s | So again, because the title of this whole panel is the realities of bug bounty life, 3091.83s - 3098.55s | I want to go back to what are the realities, what are my incentives to actually report 3098.55s - 3103.35s | this to the main parent program, which, let's say, okay, they're either going to pay nothing 3103.43s - 3108.03s | or they'll treat it as one valid unique thing and they luck out


chunk_text:
pay the report under the terms that currently exist. 3067.47s - 3069.91s | You change your terms later, well, then you have a cutoff date. 3069.91s - 3073.63s | You say anything comes past this time is going to be subject to these terms. 3073.63s - 3075.35s | But if you submitted it before, then you fall. 3075.35s - 3077.47s | Like, it's just being fair and being honest and being decent. 3077.99s - 3078.99s | Like, so you build that trust. 3078.99s - 3082.99s | If you don't have that trust, then why would a researcher submit the vulnerability to you 3082.99s - 3085.11s | and not sell it? 3085.11s - 3088.03s | So do the right thing and build trust. 3088.03s - 3091.83s | So again, because the title of this whole panel is the realities of bug bounty life, 3091.83s - 3098.55s | I want to go back to what are the realities, what are my incentives to actually report 3098.55s - 3103.35s | this to the main parent program, which, let's say, okay, they're either going to pay nothing 3103.43s - 3108.03s | or they'll treat it as one valid unique thing and they luck out by fixing it and it fixes 3108.03s - 3111.59s | all the other multiple installations that are wrong. 3111.59s - 3112.59s | Or incorrect, rather. 3112.59s - 3113.59s | Not wrong. 3113.59s - 3114.59s | Security is hard to do. 3114.59s - 3119.07s | We want to be very blameless about remediation. 3119.07s - 3123.63s | I can either not get paid or get paid or maybe get paid a multiple if I submit it to the 3123.63s - 3124.91s | parent company. 3124.91s - 3129.91s | If they have a child company who's using that platform and they have a security team, I 3129.91s - 3132.11s | can submit it to them and the exact same thing may happen. 3132.11s - 3133.11s | Read the terms. 3133.11s - 3134.11s | Read the terms. 3134.11s - 3135.11s | And I should read the terms. 3135.11s - 3137.43s | And get as many vulnerabilities as you can. 3137.43s - 3138.43s | Read all the terms. 3138.43s - 3139.43s | I promise. 3139.43s - 3140.67s | I'm getting to this. 3140.67s - 3144.19s | We as bug bounty program managers, we know who's bounty farming. 3144.19s - 3145.19s | We talk to


chunk_text:
by fixing it and it fixes 3108.03s - 3111.59s | all the other multiple installations that are wrong. 3111.59s - 3112.59s | Or incorrect, rather. 3112.59s - 3113.59s | Not wrong. 3113.59s - 3114.59s | Security is hard to do. 3114.59s - 3119.07s | We want to be very blameless about remediation. 3119.07s - 3123.63s | I can either not get paid or get paid or maybe get paid a multiple if I submit it to the 3123.63s - 3124.91s | parent company. 3124.91s - 3129.91s | If they have a child company who's using that platform and they have a security team, I 3129.91s - 3132.11s | can submit it to them and the exact same thing may happen. 3132.11s - 3133.11s | Read the terms. 3133.11s - 3134.11s | Read the terms. 3134.11s - 3135.11s | And I should read the terms. 3135.11s - 3137.43s | And get as many vulnerabilities as you can. 3137.43s - 3138.43s | Read all the terms. 3138.43s - 3139.43s | I promise. 3139.43s - 3140.67s | I'm getting to this. 3140.67s - 3144.19s | We as bug bounty program managers, we know who's bounty farming. 3144.19s - 3145.19s | We talk to each other. 3145.19s - 3146.63s | We're all doing the same thing. 3146.63s - 3150.43s | And if you submit a vulnerability to ten different security programs that is all basically the 3150.43s - 3154.19s | same thing, I'm just going to throw WordPress out there because there's a million WordPress 3154.19s - 3156.19s | installations and nearly every company is using it to some degree. 3156.19s - 3159.27s | If you find a WordPress vulnerability, instead of submitting it to WordPress and instead 3159.27s - 3163.03s | you submit it to a company who's using it, they may pay out. 3163.03s - 3164.03s | This one may pay out. 3164.03s - 3165.03s | This one may pay out. 3165.03s - 3167.23s | And then the next thing you know, we're like, hey, I'm getting all these reports for WordPress. 3167.23s - 3168.75s | Oh, I got that too. 3168.75s - 3172.33s | Oh, this person is bounty farming. 3172.33s - 3174.43s | We understand why it happens. 3174.43s - 3178.35s | But also, I don't think you're going to win any good favors with the people who are inviting 3178.35s - 3181.07s | you to programs who are trying


chunk_text:
each other. 3145.19s - 3146.63s | We're all doing the same thing. 3146.63s - 3150.43s | And if you submit a vulnerability to ten different security programs that is all basically the 3150.43s - 3154.19s | same thing, I'm just going to throw WordPress out there because there's a million WordPress 3154.19s - 3156.19s | installations and nearly every company is using it to some degree. 3156.19s - 3159.27s | If you find a WordPress vulnerability, instead of submitting it to WordPress and instead 3159.27s - 3163.03s | you submit it to a company who's using it, they may pay out. 3163.03s - 3164.03s | This one may pay out. 3164.03s - 3165.03s | This one may pay out. 3165.03s - 3167.23s | And then the next thing you know, we're like, hey, I'm getting all these reports for WordPress. 3167.23s - 3168.75s | Oh, I got that too. 3168.75s - 3172.33s | Oh, this person is bounty farming. 3172.33s - 3174.43s | We understand why it happens. 3174.43s - 3178.35s | But also, I don't think you're going to win any good favors with the people who are inviting 3178.35s - 3181.07s | you to programs who are trying to create good targets for you. 3181.07s - 3185.03s | And so, like, intent really is everything there and it should be both ways. 3185.03s - 3188.47s | Both from the researcher side, it's probably an unethical thing to do, but again, it is 3188.47s - 3189.47s | the reality. 3189.47s - 3190.47s | It probably happens. 3190.47s - 3193.15s | Also, they might be younger in their career and not know there's a parent company doing 3193.15s - 3194.51s | it. 3194.51s - 3198.87s | Maybe they've found some, you know, there's a single sign-on, for instance, and they've 3198.87s - 3203.07s | found an issue with a particular single sign-on instance for one particular product, not knowing 3203.07s - 3205.07s | that, like, it's Okta behind the scenes or something. 3205.07s - 3206.71s | It's not always very apparent. 3206.71s - 3209.47s | It often is, but it doesn't have to be. 3209.47s - 3212.59s | How do they know that that should go to, like, the main SSO provider? 3212.59s - 3216.35s | And so, I think it comes down to giving them an opportunity to kind of just, like, state 3216.35s - 3219.43s | their case,


chunk_text:
to create good targets for you. 3181.07s - 3185.03s | And so, like, intent really is everything there and it should be both ways. 3185.03s - 3188.47s | Both from the researcher side, it's probably an unethical thing to do, but again, it is 3188.47s - 3189.47s | the reality. 3189.47s - 3190.47s | It probably happens. 3190.47s - 3193.15s | Also, they might be younger in their career and not know there's a parent company doing 3193.15s - 3194.51s | it. 3194.51s - 3198.87s | Maybe they've found some, you know, there's a single sign-on, for instance, and they've 3198.87s - 3203.07s | found an issue with a particular single sign-on instance for one particular product, not knowing 3203.07s - 3205.07s | that, like, it's Okta behind the scenes or something. 3205.07s - 3206.71s | It's not always very apparent. 3206.71s - 3209.47s | It often is, but it doesn't have to be. 3209.47s - 3212.59s | How do they know that that should go to, like, the main SSO provider? 3212.59s - 3216.35s | And so, I think it comes down to giving them an opportunity to kind of just, like, state 3216.35s - 3219.43s | their case, and if they've found a multiple thing that applies to many things, that's 3219.43s - 3220.43s | fine. 3220.43s - 3225.19s | Like, I know someone who knows, like, some really cool exploits with headless Chrome 3225.19s - 3226.63s | browsers. 3226.63s - 3230.15s | And so, anywhere where he sees that feature operating in an application, yeah, that should 3230.15s - 3235.67s | be fair game for him to go seek it out, because the configuration of that particular product 3235.67s - 3237.59s | might be different than the product itself. 3237.59s - 3240.71s | Again, it just comes down to intent and good faith, researcher. 3240.71s - 3241.71s | State your case. 3241.71s - 3244.63s | Know, you know you're doing something bad if you're doing it, and the people on the 3244.63s - 3248.47s | receiving end will become wise to it eventually. 3248.47s - 3249.47s | That is the reality of it. 3249.47s - 3250.47s | I'm going to differentiate. 3250.47s - 3254.11s | I know we've got to wrap up, but I'm just going to say real quick, hate the game, not 3254.11s - 3255.11s | the player. 3255.11s - 3256.11s | Yeah. 3256.11s -


chunk_text:
and if they've found a multiple thing that applies to many things, that's 3219.43s - 3220.43s | fine. 3220.43s - 3225.19s | Like, I know someone who knows, like, some really cool exploits with headless Chrome 3225.19s - 3226.63s | browsers. 3226.63s - 3230.15s | And so, anywhere where he sees that feature operating in an application, yeah, that should 3230.15s - 3235.67s | be fair game for him to go seek it out, because the configuration of that particular product 3235.67s - 3237.59s | might be different than the product itself. 3237.59s - 3240.71s | Again, it just comes down to intent and good faith, researcher. 3240.71s - 3241.71s | State your case. 3241.71s - 3244.63s | Know, you know you're doing something bad if you're doing it, and the people on the 3244.63s - 3248.47s | receiving end will become wise to it eventually. 3248.47s - 3249.47s | That is the reality of it. 3249.47s - 3250.47s | I'm going to differentiate. 3250.47s - 3254.11s | I know we've got to wrap up, but I'm just going to say real quick, hate the game, not 3254.11s - 3255.11s | the player. 3255.11s - 3256.11s | Yeah. 3256.11s - 3260.35s | I run a bug bounty program at a company, right? 3260.35s - 3262.31s | Like, we all talk to each other. 3262.31s - 3264.31s | There's a whole big community of bug bounty managers. 3264.31s - 3265.31s | We have honest conversations. 3265.31s - 3268.99s | All of us are part of it. 3268.99s - 3274.91s | But if you find it, submit it, like, if you get paid out twice, you get paid out twice. 3274.91s - 3276.39s | If you get paid out ten times, you get paid out ten times. 3276.39s - 3280.11s | I'm not going to hate somebody because they submitted it to me and then they submitted 3280.11s - 3282.27s | it to a competitor and they submitted it to somebody else. 3282.27s - 3283.27s | Like, okay. 3283.27s - 3285.27s | I'm going to stick in my lane. 3285.27s - 3288.67s | I'm going to pay the stuff that I agreed to have paid to. 3288.67s - 3289.95s | So hate the game. 3289.95s - 3290.95s | Don't hate the player. 3290.95s - 3294.91s | But at the same time, if the company says, sorry, this isn't my product because this


chunk_text:
3260.35s | I run a bug bounty program at a company, right? 3260.35s - 3262.31s | Like, we all talk to each other. 3262.31s - 3264.31s | There's a whole big community of bug bounty managers. 3264.31s - 3265.31s | We have honest conversations. 3265.31s - 3268.99s | All of us are part of it. 3268.99s - 3274.91s | But if you find it, submit it, like, if you get paid out twice, you get paid out twice. 3274.91s - 3276.39s | If you get paid out ten times, you get paid out ten times. 3276.39s - 3280.11s | I'm not going to hate somebody because they submitted it to me and then they submitted 3280.11s - 3282.27s | it to a competitor and they submitted it to somebody else. 3282.27s - 3283.27s | Like, okay. 3283.27s - 3285.27s | I'm going to stick in my lane. 3285.27s - 3288.67s | I'm going to pay the stuff that I agreed to have paid to. 3288.67s - 3289.95s | So hate the game. 3289.95s - 3290.95s | Don't hate the player. 3290.95s - 3294.91s | But at the same time, if the company says, sorry, this isn't my product because this 3294.91s - 3298.63s | is actually this parent company's product, don't fight that. 3299.27s - 3301.11s | Just let it go. 3301.11s - 3304.19s | Because it's not going to be worth anybody's time fighting it and you're just going to 3304.19s - 3305.95s | lose any good will you had. 3305.95s - 3309.07s | I do also think that if that happens, you know, in the interest of trying to create 3309.07s - 3313.83s | a strong community around this and bringing legitimacy to it, that company probably has 3313.83s - 3318.59s | stepped into some era of responsibility for walking that up the chain, seeing if it will 3318.59s - 3320.99s | be valid for that other particular program. 3320.99s - 3322.79s | And bug bounties are not taboo anymore. 3322.79s - 3326.99s | We're ten years into this maturing as its own particular vertical of security. 3327.99s - 3330.99s | If you notice that a company doesn't have a responsible disclosure program, I'm pretty 3330.99s - 3332.83s | sure they're considered less than. 3332.83s - 3336.59s | Now there are very tactful ways for us to have that conversation as part of a maturity 3336.59s - 3342.31s


chunk_text:
3294.91s - 3298.63s | is actually this parent company's product, don't fight that. 3299.27s - 3301.11s | Just let it go. 3301.11s - 3304.19s | Because it's not going to be worth anybody's time fighting it and you're just going to 3304.19s - 3305.95s | lose any good will you had. 3305.95s - 3309.07s | I do also think that if that happens, you know, in the interest of trying to create 3309.07s - 3313.83s | a strong community around this and bringing legitimacy to it, that company probably has 3313.83s - 3318.59s | stepped into some era of responsibility for walking that up the chain, seeing if it will 3318.59s - 3320.99s | be valid for that other particular program. 3320.99s - 3322.79s | And bug bounties are not taboo anymore. 3322.79s - 3326.99s | We're ten years into this maturing as its own particular vertical of security. 3327.99s - 3330.99s | If you notice that a company doesn't have a responsible disclosure program, I'm pretty 3330.99s - 3332.83s | sure they're considered less than. 3332.83s - 3336.59s | Now there are very tactful ways for us to have that conversation as part of a maturity 3336.59s - 3342.31s | effort and growing what you're trying to protect your customers from becoming exploited towards. 3342.31s - 3346.79s | But I do think that that whichever company gets the thing that says, hey, this isn't 3346.79s - 3350.67s | my problem, it's someone else's, would probably be behooved to walk that up the chain and 3350.67s - 3354.67s | see if they can redirect that researcher to a good program. 3354.67s - 3357.43s | The same way that we ask for researchers to be good-faith researchers, I think that 3357.43s - 3358.83s | we should be good-faith program managers. 3358.83s - 3363.03s | Yeah, don't just close the report and be like, not my problem. 3363.03s - 3366.31s | Close the report and tell the researcher, hey, not my problem, I can't fix this, but 3366.31s - 3370.15s | you should go talk to this person at this company because they have a bug bounty program 3370.15s - 3372.95s | and your report is valid for them. 3372.95s - 3377.11s | It takes just a little bit more time to do that, and it's going to probably save the 3377.11s - 3381.51s | relationship between the researcher and the company


chunk_text:
| effort and growing what you're trying to protect your customers from becoming exploited towards. 3342.31s - 3346.79s | But I do think that that whichever company gets the thing that says, hey, this isn't 3346.79s - 3350.67s | my problem, it's someone else's, would probably be behooved to walk that up the chain and 3350.67s - 3354.67s | see if they can redirect that researcher to a good program. 3354.67s - 3357.43s | The same way that we ask for researchers to be good-faith researchers, I think that 3357.43s - 3358.83s | we should be good-faith program managers. 3358.83s - 3363.03s | Yeah, don't just close the report and be like, not my problem. 3363.03s - 3366.31s | Close the report and tell the researcher, hey, not my problem, I can't fix this, but 3366.31s - 3370.15s | you should go talk to this person at this company because they have a bug bounty program 3370.15s - 3372.95s | and your report is valid for them. 3372.95s - 3377.11s | It takes just a little bit more time to do that, and it's going to probably save the 3377.11s - 3381.51s | relationship between the researcher and the company by doing that. 3381.51s - 3382.51s | All right. 3382.55s - 3384.63s | And that is perfect because we're going to end right on time. 3384.63s - 3386.83s | Obviously, we don't have time for Q&A. 3386.83s - 3390.19s | If you do want to chat with any of us, find us out in the hall right afterwards. 3390.19s - 3391.75s | Thank you, and here's how you can get in touch with everybody.


chunk_text:
by doing that. 3381.51s - 3382.51s | All right. 3382.55s - 3384.63s | And that is perfect because we're going to end right on time. 3384.63s - 3386.83s | Obviously, we don't have time for Q&A. 3386.83s - 3390.19s | If you do want to chat with any of us, find us out in the hall right afterwards. 3390.19s - 3391.75s | Thank you, and here's how you can get in touch with everybody.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=DwYkeFatP40", "title": "DEF CON 32 - Eradicating Hepatitis C with BioTerrorism - Mix\u00e6l Swan Laufer", "description": "A quarter million people die from Hepatitis C yearly, and it's getting worse. But for the first time in history there is a cure (not just a treatment) for a virus, and it is for Hepatitis C. Take one 400mg pill of Sofosbuvir every day for twelve weeks, and you will be free of the virus. The catch? Those pills are $1,000 USD apiece because the molecule is the so-called \"Intellectual Property\" of Gilead Pharmaceuticals, and they refuse to share. If you have $84,000 USD, Hep C is not your problem. We have developed a way to make the entire course of treatment for $300 USD. This methodology also applies to other diseases. Like any science, the method of manufacture of drugs can be replicated, and we are going to give you all the necessary tools and show you the process top-to-bottom. Watch it happen live, participate, and learn to do it yourself: Use our digital research assistant to help you navigate the scientific literature, get a chemical synthesis pathway, generate code for the the MicroLab to run, and watch the medicine form in the reaction chamber. Finally, press some tablets. The feds say saving a life this way is BioTerrorism. We say: So Be It.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2831, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 4.84s | This text was transcribed using whisper model: large-v2 All right, and with that, Michael's gonna talk to you about eradicating hepatitis C 4.84s - 5.84s | with bioterrorism. 5.84s - 19.16s | So one more round of applause for Michael. 19.16s - 27.23s | I don't know who needs to hear this, but I'm scared too. 27.23s - 32.91s | All the time of losing the health that I have. 32.91s - 35.47s | I know what it feels like. 35.47s - 41.95s | I know what it feels like to not know what's wrong with your body and to have to go shop 41.95s - 49.31s | for a stranger who has the authority to maybe or maybe not give you what you need. 49.31s - 53.89s | I know what it feels like to know what's wrong with your body and to know what you need and 53.89s - 61.15s | to be told you can't have it because


chunk_text:
form in the reaction chamber. Finally, press some tablets. The feds say saving a life this way is BioTerrorism. We say: So Be It.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2831, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 4.84s | This text was transcribed using whisper model: large-v2 All right, and with that, Michael's gonna talk to you about eradicating hepatitis C 4.84s - 5.84s | with bioterrorism. 5.84s - 19.16s | So one more round of applause for Michael. 19.16s - 27.23s | I don't know who needs to hear this, but I'm scared too. 27.23s - 32.91s | All the time of losing the health that I have. 32.91s - 35.47s | I know what it feels like. 35.47s - 41.95s | I know what it feels like to not know what's wrong with your body and to have to go shop 41.95s - 49.31s | for a stranger who has the authority to maybe or maybe not give you what you need. 49.31s - 53.89s | I know what it feels like to know what's wrong with your body and to know what you need and 53.89s - 61.15s | to be told you can't have it because the infrastructure has failed and it's not available. 61.15s - 64.55s | I know what it feels like to be told that you can't get it because it's not legal in 64.55s - 67.25s | the place where you are. 67.25s - 74.57s | I know what it feels like to be told that you can't have it because the doctor doesn't 74.57s - 77.53s | share your opinion. 77.53s - 84.21s | And perhaps worst of all, I know what it's like to be told you can have it only to realize 84.21s - 89.79s | that you can't afford it. 89.79s - 93.50s | I know this happened to you. 93.50s - 95.74s | It never should have occurred. 95.74s - 98.74s | This is wrong. 98.74s - 105.58s | And I hope to show you all some tools so that it doesn't ever have to happen again. 105.58s - 120.23s | Sorry, there may or may not be some slides, but what you're about to see is a photograph 120.23s - 128.46s | of me, hopefully, but I'll keep talking. 128.46s - 132.84s | The photograph you're about to see, you'll notice I looked different then. 132.84s


chunk_text:
the infrastructure has failed and it's not available. 61.15s - 64.55s | I know what it feels like to be told that you can't get it because it's not legal in 64.55s - 67.25s | the place where you are. 67.25s - 74.57s | I know what it feels like to be told that you can't have it because the doctor doesn't 74.57s - 77.53s | share your opinion. 77.53s - 84.21s | And perhaps worst of all, I know what it's like to be told you can have it only to realize 84.21s - 89.79s | that you can't afford it. 89.79s - 93.50s | I know this happened to you. 93.50s - 95.74s | It never should have occurred. 95.74s - 98.74s | This is wrong. 98.74s - 105.58s | And I hope to show you all some tools so that it doesn't ever have to happen again. 105.58s - 120.23s | Sorry, there may or may not be some slides, but what you're about to see is a photograph 120.23s - 128.46s | of me, hopefully, but I'll keep talking. 128.46s - 132.84s | The photograph you're about to see, you'll notice I looked different then. 132.84s - 135.10s | I had long hair. 135.10s - 138.42s | I was overseas. 138.42s - 144.40s | Three days later, I had no hair anywhere on my body. 144.40s - 149.46s | And three weeks later, I had all new skin. 149.46s - 154.94s | And I decided to be magnanimous and not show you how it came off, but it was rough and 154.94s - 155.94s | it was ugly. 155.94s - 164.97s | Then there's another picture. 164.97s - 167.65s | I'm recovering in a hospital. 167.65s - 171.41s | I have an IV in my hand. 171.41s - 176.06s | A tumor had just been removed from my body. 176.06s - 177.06s | This was the first picture. 177.16s - 179.44s | You guys see it? 179.44s - 184.32s | Here I am three days later. 184.32s - 190.68s | Here I am three weeks later. 190.68s - 192.32s | Here I am in the hospital. 192.32s - 195.88s | Well, somewhere, I'm in the hospital. 195.88s - 201.76s | And they'd removed a tumor from my body that was invisible on the MRI. 201.76s - 209.14s | And the only reason it got removed is


chunk_text:
- 135.10s | I had long hair. 135.10s - 138.42s | I was overseas. 138.42s - 144.40s | Three days later, I had no hair anywhere on my body. 144.40s - 149.46s | And three weeks later, I had all new skin. 149.46s - 154.94s | And I decided to be magnanimous and not show you how it came off, but it was rough and 154.94s - 155.94s | it was ugly. 155.94s - 164.97s | Then there's another picture. 164.97s - 167.65s | I'm recovering in a hospital. 167.65s - 171.41s | I have an IV in my hand. 171.41s - 176.06s | A tumor had just been removed from my body. 176.06s - 177.06s | This was the first picture. 177.16s - 179.44s | You guys see it? 179.44s - 184.32s | Here I am three days later. 184.32s - 190.68s | Here I am three weeks later. 190.68s - 192.32s | Here I am in the hospital. 192.32s - 195.88s | Well, somewhere, I'm in the hospital. 195.88s - 201.76s | And they'd removed a tumor from my body that was invisible on the MRI. 201.76s - 209.14s | And the only reason it got removed is because I insisted on it. 209.14s - 212.90s | There's another picture of me in the hospital. 212.90s - 213.90s | I can see my slides. 213.90s - 214.90s | Sorry, guys. 215.14s - 218.98s | I don't know if it's still getting black screen, but it's all right. 218.98s - 224.36s | There's another picture of me recovering in the same hospital because I had to have another 224.36s - 238.34s | operation also under general anesthesia just to prepare for the other surgery. 238.34s - 251.00s | Now, the important thing to note and what I'm trying to impart here is that most medications 251.16s - 259.16s | you can make a better, cheaper version of yourself at home. 259.16s - 262.88s | Anybody can. 262.88s - 264.48s | It's entirely doable. 264.48s - 271.05s | Now, if the slides won't come up for whatever reason, I'll talk through it. 271.05s - 275.43s | But there are a handful of tools that you need to go through this. 275.43s - 280.07s | The first thing that you need to do is you need some chemistry. 280.07s - 283.83s | Now, most people kind of cower. 283.83s - 284.83s


chunk_text:
because I insisted on it. 209.14s - 212.90s | There's another picture of me in the hospital. 212.90s - 213.90s | I can see my slides. 213.90s - 214.90s | Sorry, guys. 215.14s - 218.98s | I don't know if it's still getting black screen, but it's all right. 218.98s - 224.36s | There's another picture of me recovering in the same hospital because I had to have another 224.36s - 238.34s | operation also under general anesthesia just to prepare for the other surgery. 238.34s - 251.00s | Now, the important thing to note and what I'm trying to impart here is that most medications 251.16s - 259.16s | you can make a better, cheaper version of yourself at home. 259.16s - 262.88s | Anybody can. 262.88s - 264.48s | It's entirely doable. 264.48s - 271.05s | Now, if the slides won't come up for whatever reason, I'll talk through it. 271.05s - 275.43s | But there are a handful of tools that you need to go through this. 275.43s - 280.07s | The first thing that you need to do is you need some chemistry. 280.07s - 283.83s | Now, most people kind of cower. 283.83s - 284.83s | Chemistry seems hard. 285.63s - 286.63s | It's like a specialized thing. 286.63s - 292.75s | Well, sure, if you're doing research chemistry, yeah, that's why there's a PhD in it, of course. 292.75s - 298.23s | But if you just need to operate it, similar to the difference between building a computer 298.23s - 303.47s | and using a computer, it's significantly easier. 303.47s - 309.07s | It says a lot about the state of humanity when we develop all of these things and don't 309.07s - 310.07s | deliver them. 310.07s - 312.39s | Sorry, I just got to bounce back to this slide, too. 312.39s - 314.75s | This is so important. 314.75s - 318.95s | Those research chemists that are doing biochemistry, they're doing medicine, they're doing incredibly 318.95s - 319.95s | important things. 319.95s - 320.95s | It's amazing. 320.95s - 321.95s | It's amazing. 321.95s - 322.95s | It's so sophisticated. 322.95s - 326.71s | And yeah, there's a reason that they get PhDs in it. 326.71s - 335.07s | But if all you're trying to do is pirate something, that's doable and it can be automated. 335.07s - 337.19s | I believe


chunk_text:
| Chemistry seems hard. 285.63s - 286.63s | It's like a specialized thing. 286.63s - 292.75s | Well, sure, if you're doing research chemistry, yeah, that's why there's a PhD in it, of course. 292.75s - 298.23s | But if you just need to operate it, similar to the difference between building a computer 298.23s - 303.47s | and using a computer, it's significantly easier. 303.47s - 309.07s | It says a lot about the state of humanity when we develop all of these things and don't 309.07s - 310.07s | deliver them. 310.07s - 312.39s | Sorry, I just got to bounce back to this slide, too. 312.39s - 314.75s | This is so important. 314.75s - 318.95s | Those research chemists that are doing biochemistry, they're doing medicine, they're doing incredibly 318.95s - 319.95s | important things. 319.95s - 320.95s | It's amazing. 320.95s - 321.95s | It's amazing. 321.95s - 322.95s | It's so sophisticated. 322.95s - 326.71s | And yeah, there's a reason that they get PhDs in it. 326.71s - 335.07s | But if all you're trying to do is pirate something, that's doable and it can be automated. 335.07s - 337.19s | I believe this. 337.19s - 339.91s | That's why I'm here. 339.91s - 343.31s | Hacking is important for the world. 343.31s - 344.43s | It saves lives. 344.43s - 345.79s | All of you know this. 345.79s - 346.99s | You've seen it. 346.99s - 349.15s | This is just a little more direct. 349.15s - 350.75s | It can happen with anything. 350.75s - 355.35s | You take something and you use it for a purpose for which it was not intended so that you 355.35s - 358.53s | are no longer gatekept against access. 358.53s - 366.56s | This is why we do what we do, and I know you all understand this. 366.56s - 368.60s | Knowledge belongs to all of humanity. 368.60s - 371.80s | I believe this with every fiber of my being. 371.80s - 377.92s | There have been moments in history where economics and morality have come to a head, and the 377.92s - 382.04s | economists have said, you can't have that. 382.04s - 383.04s | I'm sorry. 383.04s - 384.04s | It's not moral. 384.04s - 386.76s | It's the way our economy works. 386.76s - 390.96s | And the moralists have


chunk_text:
this. 337.19s - 339.91s | That's why I'm here. 339.91s - 343.31s | Hacking is important for the world. 343.31s - 344.43s | It saves lives. 344.43s - 345.79s | All of you know this. 345.79s - 346.99s | You've seen it. 346.99s - 349.15s | This is just a little more direct. 349.15s - 350.75s | It can happen with anything. 350.75s - 355.35s | You take something and you use it for a purpose for which it was not intended so that you 355.35s - 358.53s | are no longer gatekept against access. 358.53s - 366.56s | This is why we do what we do, and I know you all understand this. 366.56s - 368.60s | Knowledge belongs to all of humanity. 368.60s - 371.80s | I believe this with every fiber of my being. 371.80s - 377.92s | There have been moments in history where economics and morality have come to a head, and the 377.92s - 382.04s | economists have said, you can't have that. 382.04s - 383.04s | I'm sorry. 383.04s - 384.04s | It's not moral. 384.04s - 386.76s | It's the way our economy works. 386.76s - 390.96s | And the moralists have come back and said, that's not good enough. 390.96s - 393.34s | It happened in this country with slavery. 393.34s - 395.52s | People said, people can't be property. 395.52s - 397.12s | That is not acceptable. 397.12s - 401.68s | And the economists said, yes, it's really unfortunate and it's kind of old, but that's 401.68s - 402.92s | how our economy runs. 402.92s - 407.52s | And the moralists came back and said, that's not good enough. 407.52s - 413.88s | And similarly today, people are dying every day because of intellectual property law, 413.88s - 418.24s | making it so that people do not have access to the medicines they need. 418.24s - 421.16s | And the economists say, oh, I know it's an old system. 421.16s - 422.16s | I know it's being abused. 422.16s - 425.84s | It's kind of unfortunate, but there are trillions of dollars circling the world. 425.84s - 429.12s | We can't just pull the rug out from under that. 429.12s - 442.70s | And there are some of us who are saying, that's not good enough. 442.70s - 444.90s | I know you all believe in the right to repair.


chunk_text:
come back and said, that's not good enough. 390.96s - 393.34s | It happened in this country with slavery. 393.34s - 395.52s | People said, people can't be property. 395.52s - 397.12s | That is not acceptable. 397.12s - 401.68s | And the economists said, yes, it's really unfortunate and it's kind of old, but that's 401.68s - 402.92s | how our economy runs. 402.92s - 407.52s | And the moralists came back and said, that's not good enough. 407.52s - 413.88s | And similarly today, people are dying every day because of intellectual property law, 413.88s - 418.24s | making it so that people do not have access to the medicines they need. 418.24s - 421.16s | And the economists say, oh, I know it's an old system. 421.16s - 422.16s | I know it's being abused. 422.16s - 425.84s | It's kind of unfortunate, but there are trillions of dollars circling the world. 425.84s - 429.12s | We can't just pull the rug out from under that. 429.12s - 442.70s | And there are some of us who are saying, that's not good enough. 442.70s - 444.90s | I know you all believe in the right to repair. 444.90s - 446.50s | I do too. 446.50s - 449.18s | I believe in the right to repair for your body. 449.18s - 451.82s | And this is not a new idea. 451.82s - 455.70s | It used to be that everybody was involved in their own health. 455.70s - 461.50s | The notion that you can't manage your own health is fairly new. 461.50s - 463.66s | Gates had been put up saying, you can't do this. 463.66s - 465.88s | You're practicing medicine without a license. 465.88s - 467.38s | You're not allowed. 467.38s - 472.71s | But if you come to the authority, we'll sell it back to you. 472.71s - 474.23s | That's not acceptable. 474.23s - 476.75s | You need to become involved in your own health. 476.75s - 478.91s | You can't just follow doctor's orders. 478.91s - 480.55s | It's not good enough anymore. 480.55s - 483.31s | I don't know if it ever was. 483.31s - 487.43s | We know that this is not an excuse in wartime. 487.43s - 491.27s | Why is it still an excuse when you're dealing with your health? 491.27s - 492.27s | It shouldn't be. 492.27s


chunk_text:
444.90s - 446.50s | I do too. 446.50s - 449.18s | I believe in the right to repair for your body. 449.18s - 451.82s | And this is not a new idea. 451.82s - 455.70s | It used to be that everybody was involved in their own health. 455.70s - 461.50s | The notion that you can't manage your own health is fairly new. 461.50s - 463.66s | Gates had been put up saying, you can't do this. 463.66s - 465.88s | You're practicing medicine without a license. 465.88s - 467.38s | You're not allowed. 467.38s - 472.71s | But if you come to the authority, we'll sell it back to you. 472.71s - 474.23s | That's not acceptable. 474.23s - 476.75s | You need to become involved in your own health. 476.75s - 478.91s | You can't just follow doctor's orders. 478.91s - 480.55s | It's not good enough anymore. 480.55s - 483.31s | I don't know if it ever was. 483.31s - 487.43s | We know that this is not an excuse in wartime. 487.43s - 491.27s | Why is it still an excuse when you're dealing with your health? 491.27s - 492.27s | It shouldn't be. 492.27s - 496.20s | I'm going to say this again. 496.20s - 502.84s | You can make most medicines yourself at home, and you can make them better. 502.84s - 504.40s | I'm not kidding. 504.40s - 507.16s | Better and cheaper. 507.16s - 510.64s | Now, we're going to have to look at how. 510.64s - 513.20s | I want to do a quick poll here. 513.20s - 519.84s | How many people know somebody who owns a cat who is also either immunocompromised or pregnant? 519.84s - 520.84s | Show of hands real quick. 520.84s - 521.84s | Yeah? 521.84s - 522.84s | Okay. 522.84s - 523.84s | A couple. 523.84s - 524.84s | Next. 524.84s - 528.84s | How many people know somebody who has an allergy that sends them into anaphylactic shock? 528.84s - 529.84s | Oh, yeah. 529.84s - 530.84s | Plenty. 530.84s - 531.84s | Okay. 532.84s - 536.84s | How many people know somebody who has hepatitis C? 536.84s - 537.84s | All right. 537.84s - 538.84s | A couple. 538.84s - 539.84s | All right. 539.84s - 540.84s | I'm going to remember you. 540.84s - 549.20s | How many people have a


chunk_text:
- 496.20s | I'm going to say this again. 496.20s - 502.84s | You can make most medicines yourself at home, and you can make them better. 502.84s - 504.40s | I'm not kidding. 504.40s - 507.16s | Better and cheaper. 507.16s - 510.64s | Now, we're going to have to look at how. 510.64s - 513.20s | I want to do a quick poll here. 513.20s - 519.84s | How many people know somebody who owns a cat who is also either immunocompromised or pregnant? 519.84s - 520.84s | Show of hands real quick. 520.84s - 521.84s | Yeah? 521.84s - 522.84s | Okay. 522.84s - 523.84s | A couple. 523.84s - 524.84s | Next. 524.84s - 528.84s | How many people know somebody who has an allergy that sends them into anaphylactic shock? 528.84s - 529.84s | Oh, yeah. 529.84s - 530.84s | Plenty. 530.84s - 531.84s | Okay. 532.84s - 536.84s | How many people know somebody who has hepatitis C? 536.84s - 537.84s | All right. 537.84s - 538.84s | A couple. 538.84s - 539.84s | All right. 539.84s - 540.84s | I'm going to remember you. 540.84s - 549.20s | How many people have a uterus and are child-free by choice? 549.20s - 550.20s | Cool. 550.20s - 551.20s | All right. 551.20s - 557.02s | Fewer than I thought, but all right. 557.02s - 559.02s | Who remembers this guy? 559.02s - 565.02s | This is Martin Shkreli, and what you're seeing right now is him lying to Congress. 565.02s - 571.02s | He was CEO of Turing Pharmaceuticals, and what he was lying about was the pricing structure 571.02s - 576.02s | of daraprim, pyrimethamine, an anti-toxoplasmosis drug. 576.02s - 583.02s | It had been $13.50 a pill, and he changed the price to $750 a pill. 583.02s - 592.82s | If you calculate this out, a full course of treatment is just south of $19,000. 592.82s - 595.82s | This is his phone number. 595.82s - 598.82s | I called him from stage at Hope in 2016. 598.82s - 602.82s | He didn't answer, but he called me back a few hours later. 602.82s - 606.82s | Of course, he got hauled off to prison a while after that. 606.82s - 608.82s | Here's what we did. 608.82s - 609.82s | We took exception to this. 609.82s - 611.82s | We found


chunk_text:
uterus and are child-free by choice? 549.20s - 550.20s | Cool. 550.20s - 551.20s | All right. 551.20s - 557.02s | Fewer than I thought, but all right. 557.02s - 559.02s | Who remembers this guy? 559.02s - 565.02s | This is Martin Shkreli, and what you're seeing right now is him lying to Congress. 565.02s - 571.02s | He was CEO of Turing Pharmaceuticals, and what he was lying about was the pricing structure 571.02s - 576.02s | of daraprim, pyrimethamine, an anti-toxoplasmosis drug. 576.02s - 583.02s | It had been $13.50 a pill, and he changed the price to $750 a pill. 583.02s - 592.82s | If you calculate this out, a full course of treatment is just south of $19,000. 592.82s - 595.82s | This is his phone number. 595.82s - 598.82s | I called him from stage at Hope in 2016. 598.82s - 602.82s | He didn't answer, but he called me back a few hours later. 602.82s - 606.82s | Of course, he got hauled off to prison a while after that. 606.82s - 608.82s | Here's what we did. 608.82s - 609.82s | We took exception to this. 609.82s - 611.82s | We found a new synthesis pathway. 611.82s - 613.82s | It had one step fewer. 613.82s - 614.82s | It was much more efficient. 614.82s - 619.82s | There were greater margins of error, and there was greater purity in yield. 619.82s - 621.82s | So we made some. 621.82s - 627.82s | Here I am at that same conference throwing pills to the audience that cost me a quarter to make each. 627.82s - 631.82s | And you can make these things too. 631.82s - 633.82s | Making pills is easy. 633.82s - 637.82s | If you have active pharmaceutical ingredient, just pack it into caplets. 637.82s - 639.82s | Measure it out. 639.82s - 640.82s | Everybody can do this. 640.82s - 642.82s | It's not difficult. 642.82s - 645.82s | And here's what a course of treatment looks like. 645.82s - 650.82s | Now, it's amazing there was so much outrage around what he did, 650.82s - 654.82s | and yet the pricing structure still has not changed, 654.82s - 658.82s | but you can make a full course of treatment for $80. 658.82s - 669.72s | Now, who said they knew somebody who had a cat and was


chunk_text:
a new synthesis pathway. 611.82s - 613.82s | It had one step fewer. 613.82s - 614.82s | It was much more efficient. 614.82s - 619.82s | There were greater margins of error, and there was greater purity in yield. 619.82s - 621.82s | So we made some. 621.82s - 627.82s | Here I am at that same conference throwing pills to the audience that cost me a quarter to make each. 627.82s - 631.82s | And you can make these things too. 631.82s - 633.82s | Making pills is easy. 633.82s - 637.82s | If you have active pharmaceutical ingredient, just pack it into caplets. 637.82s - 639.82s | Measure it out. 639.82s - 640.82s | Everybody can do this. 640.82s - 642.82s | It's not difficult. 642.82s - 645.82s | And here's what a course of treatment looks like. 645.82s - 650.82s | Now, it's amazing there was so much outrage around what he did, 650.82s - 654.82s | and yet the pricing structure still has not changed, 654.82s - 658.82s | but you can make a full course of treatment for $80. 658.82s - 669.72s | Now, who said they knew somebody who had a cat and was pregnant? 669.72s - 672.35s | You want it? 672.35s - 674.35s | I'll toss it out. 674.35s - 676.35s | Keep that person healthy. 676.35s - 678.35s | Keep that person safe. 678.35s - 682.69s | More to come. 682.69s - 684.69s | This is Heather Bresch. 684.69s - 687.69s | She is, can you guess, lying to Congress. 687.69s - 691.69s | She was CEO of Mylan Pharmaceuticals, 691.69s - 695.69s | and she was lying about the pricing structure of the EpiPen. 695.69s - 698.69s | I know everybody remembers this one. 698.69s - 701.69s | It was $60 for a pair. 701.69s - 708.58s | And then she decided it was going to be $604 for a pair. 708.58s - 714.58s | We presented about this in 2018, and I called her at this number. 714.58s - 715.58s | It might still work. 715.58s - 718.58s | You can try it. 718.58s - 723.39s | She didn't answer. 723.39s - 725.39s | We decided to make our own version. 725.39s - 727.39s | It's not a complicated thing. 727.39s - 730.39s | You take an auto-injector that's designed for needle-phobic diabetics. 730.39s - 737.39s | You put


chunk_text:
pregnant? 669.72s - 672.35s | You want it? 672.35s - 674.35s | I'll toss it out. 674.35s - 676.35s | Keep that person healthy. 676.35s - 678.35s | Keep that person safe. 678.35s - 682.69s | More to come. 682.69s - 684.69s | This is Heather Bresch. 684.69s - 687.69s | She is, can you guess, lying to Congress. 687.69s - 691.69s | She was CEO of Mylan Pharmaceuticals, 691.69s - 695.69s | and she was lying about the pricing structure of the EpiPen. 695.69s - 698.69s | I know everybody remembers this one. 698.69s - 701.69s | It was $60 for a pair. 701.69s - 708.58s | And then she decided it was going to be $604 for a pair. 708.58s - 714.58s | We presented about this in 2018, and I called her at this number. 714.58s - 715.58s | It might still work. 715.58s - 718.58s | You can try it. 718.58s - 723.39s | She didn't answer. 723.39s - 725.39s | We decided to make our own version. 725.39s - 727.39s | It's not a complicated thing. 727.39s - 730.39s | You take an auto-injector that's designed for needle-phobic diabetics. 730.39s - 737.39s | You put in a small syringe, a large needle, and a vial of epinephrine. 737.39s - 739.39s | You can make one, too. 739.39s - 741.39s | This costs $30. 741.39s - 744.39s | Additionally, you can test it to see if it works, 744.39s - 746.39s | and you can reload it for $3. 746.39s - 751.70s | You just need a new needle, a new syringe, and a new hit of Epi. 751.70s - 756.70s | And again, after all of this time, the pricing structure has not shifted. 756.70s - 759.70s | There is no leverage to change these prices. 759.70s - 761.70s | You can make your own. 761.70s - 763.70s | It's not hard. 763.70s - 771.70s | Now, who said they had a friend who had anaphylactic shock? 771.70s - 773.70s | You want it? 773.70s - 776.70s | All right, here, pass it back. 776.70s - 778.70s | Keep that person healthy. 778.70s - 779.70s | Keep that person safe. 779.70s - 780.70s | And make more. 780.70s - 786.61s | It's not hard. 786.61s - 789.61s | And then there was this time that these nine robed creeps 789.61s - 791.61s | decided they


chunk_text:
in a small syringe, a large needle, and a vial of epinephrine. 737.39s - 739.39s | You can make one, too. 739.39s - 741.39s | This costs $30. 741.39s - 744.39s | Additionally, you can test it to see if it works, 744.39s - 746.39s | and you can reload it for $3. 746.39s - 751.70s | You just need a new needle, a new syringe, and a new hit of Epi. 751.70s - 756.70s | And again, after all of this time, the pricing structure has not shifted. 756.70s - 759.70s | There is no leverage to change these prices. 759.70s - 761.70s | You can make your own. 761.70s - 763.70s | It's not hard. 763.70s - 771.70s | Now, who said they had a friend who had anaphylactic shock? 771.70s - 773.70s | You want it? 773.70s - 776.70s | All right, here, pass it back. 776.70s - 778.70s | Keep that person healthy. 778.70s - 779.70s | Keep that person safe. 779.70s - 780.70s | And make more. 780.70s - 786.61s | It's not hard. 786.61s - 789.61s | And then there was this time that these nine robed creeps 789.61s - 791.61s | decided they were going to ruin... 791.61s - 793.61s | Sorry, hang on. 793.61s - 796.61s | And then there was this time that these nine robed creeps 796.61s - 799.61s | decided they were going to just ruin everything for everyone 799.61s - 802.61s | by saying you couldn't have the medicine you wanted 802.61s - 805.61s | if you happened to have a uterus. 805.61s - 808.61s | We thought this wasn't cool either. 808.61s - 810.61s | And at Hope in 2022, 810.61s - 815.61s | we figured out a way to dope business cards with abortion drugs. 815.61s - 819.61s | It's fairly simple, and you can do it too. 819.61s - 821.61s | Here's all you need. 821.61s - 823.61s | You get some active pharmaceutical ingredients, 823.61s - 827.61s | some Everclear, a blender, and a pipette. 827.61s - 830.61s | Then all you do is you put in the Everclear, 830.61s - 832.61s | you put in the powder, you blend it up, 832.61s - 838.61s | and then you take the pipette and you put six dots on a business card. 838.61s - 842.61s | Here I am two years ago at DEF CON


chunk_text:
were going to ruin... 791.61s - 793.61s | Sorry, hang on. 793.61s - 796.61s | And then there was this time that these nine robed creeps 796.61s - 799.61s | decided they were going to just ruin everything for everyone 799.61s - 802.61s | by saying you couldn't have the medicine you wanted 802.61s - 805.61s | if you happened to have a uterus. 805.61s - 808.61s | We thought this wasn't cool either. 808.61s - 810.61s | And at Hope in 2022, 810.61s - 815.61s | we figured out a way to dope business cards with abortion drugs. 815.61s - 819.61s | It's fairly simple, and you can do it too. 819.61s - 821.61s | Here's all you need. 821.61s - 823.61s | You get some active pharmaceutical ingredients, 823.61s - 827.61s | some Everclear, a blender, and a pipette. 827.61s - 830.61s | Then all you do is you put in the Everclear, 830.61s - 832.61s | you put in the powder, you blend it up, 832.61s - 838.61s | and then you take the pipette and you put six dots on a business card. 838.61s - 842.61s | Here I am two years ago at DEF CON at a house not far from here 842.61s - 845.61s | making about 200 on a table. 845.61s - 847.61s | Here's all you do. 847.61s - 849.61s | You lay them out. 849.61s - 854.14s | That top one's special edition. You can't get that anymore. 854.14s - 857.14s | You put six dollops on a card. 857.14s - 860.14s | Those are the three doses that you need to induce an abortion. 860.14s - 862.14s | You let it dry. 862.14s - 865.14s | It curls up like this, and then you put it in a baggie. 865.14s - 867.14s | It is super simple. 867.14s - 871.14s | Here's the entire table, and then you bag them up in the morning. 871.14s - 875.14s | And then maybe you put them places 875.14s - 877.14s | because it's just the size of a card, 877.14s - 884.58s | maybe in the family planning section in a drugstore, 884.58s - 887.58s | or maybe at your local public library. 887.58s - 890.58s | You find an appropriate volume 890.58s - 893.58s | that somebody who might be in need might find, 893.58s - 897.83s | and you just


chunk_text:
at a house not far from here 842.61s - 845.61s | making about 200 on a table. 845.61s - 847.61s | Here's all you do. 847.61s - 849.61s | You lay them out. 849.61s - 854.14s | That top one's special edition. You can't get that anymore. 854.14s - 857.14s | You put six dollops on a card. 857.14s - 860.14s | Those are the three doses that you need to induce an abortion. 860.14s - 862.14s | You let it dry. 862.14s - 865.14s | It curls up like this, and then you put it in a baggie. 865.14s - 867.14s | It is super simple. 867.14s - 871.14s | Here's the entire table, and then you bag them up in the morning. 871.14s - 875.14s | And then maybe you put them places 875.14s - 877.14s | because it's just the size of a card, 877.14s - 884.58s | maybe in the family planning section in a drugstore, 884.58s - 887.58s | or maybe at your local public library. 887.58s - 890.58s | You find an appropriate volume 890.58s - 893.58s | that somebody who might be in need might find, 893.58s - 897.83s | and you just slip it in there. 897.83s - 901.83s | And again, the recipe you just saw is for 100 cards, 901.83s - 905.83s | so maybe you even get really creative 905.83s - 909.83s | and decide that another third place that people go to 909.83s - 913.83s | who might have trouble getting access to these sorts of things. 916.83s - 923.95s | I mean, up to you. 923.95s - 927.95s | The Good Mocker Institute estimates that it's about $500 927.95s - 930.95s | if you want an abortion through traditional channels. 930.95s - 934.95s | If you send away for mifepristone and misoprostol pills, 934.95s - 937.95s | it will cost you about $160. 937.95s - 941.95s | These cards, they cost 89 cents to make, 941.95s - 944.95s | including the printing of the cards and the baggies. 944.95s - 948.95s | You can afford to make these. 948.95s - 951.95s | And despite all the outrage around all of it, 951.95s - 956.95s | this pricing structure and the access hasn't shifted much. 956.95s - 960.95s | Now, for some of you who recognize patterns, 960.95s - 963.95s | we'll anticipate the next question, which is,


chunk_text:
slip it in there. 897.83s - 901.83s | And again, the recipe you just saw is for 100 cards, 901.83s - 905.83s | so maybe you even get really creative 905.83s - 909.83s | and decide that another third place that people go to 909.83s - 913.83s | who might have trouble getting access to these sorts of things. 916.83s - 923.95s | I mean, up to you. 923.95s - 927.95s | The Good Mocker Institute estimates that it's about $500 927.95s - 930.95s | if you want an abortion through traditional channels. 930.95s - 934.95s | If you send away for mifepristone and misoprostol pills, 934.95s - 937.95s | it will cost you about $160. 937.95s - 941.95s | These cards, they cost 89 cents to make, 941.95s - 944.95s | including the printing of the cards and the baggies. 944.95s - 948.95s | You can afford to make these. 948.95s - 951.95s | And despite all the outrage around all of it, 951.95s - 956.95s | this pricing structure and the access hasn't shifted much. 956.95s - 960.95s | Now, for some of you who recognize patterns, 960.95s - 963.95s | we'll anticipate the next question, which is, 963.95s - 967.95s | who would like my business card? 967.95s - 969.95s | Who wants this? 969.95s - 972.95s | I'm not going to make assumptions, but I think you don't have a uterus. 972.95s - 975.95s | Yeah, all right. Here, will you pass that back? 975.95s - 980.97s | And there may or may not be a bunch of these 980.97s - 983.97s | stashed in ladies' rooms around. 983.97s - 989.14s | I don't know who put them there. 989.14s - 992.14s | This is hepatitis C. 992.14s - 994.14s | This is what we're talking about today. 994.14s - 998.14s | This is terrifying, and it's not common knowledge. 998.14s - 1001.14s | It is more virulent than HIV. 1001.14s - 1005.14s | It is more widespread than HIV, and it is more lethal than HIV. 1005.14s - 1008.14s | And it is a very clever virus. 1008.14s - 1011.14s | If you want to get into the molecular biology of it, it's incredible. 1011.14s - 1014.14s | It is awe-inspiring. 1014.14s - 1018.93s | This is Sovaldi, 1018.93s - 1022.93s | also known as sofosbuvir. 1022.93s - 1025.93s | This molecule makes magic happen.


chunk_text:
963.95s - 967.95s | who would like my business card? 967.95s - 969.95s | Who wants this? 969.95s - 972.95s | I'm not going to make assumptions, but I think you don't have a uterus. 972.95s - 975.95s | Yeah, all right. Here, will you pass that back? 975.95s - 980.97s | And there may or may not be a bunch of these 980.97s - 983.97s | stashed in ladies' rooms around. 983.97s - 989.14s | I don't know who put them there. 989.14s - 992.14s | This is hepatitis C. 992.14s - 994.14s | This is what we're talking about today. 994.14s - 998.14s | This is terrifying, and it's not common knowledge. 998.14s - 1001.14s | It is more virulent than HIV. 1001.14s - 1005.14s | It is more widespread than HIV, and it is more lethal than HIV. 1005.14s - 1008.14s | And it is a very clever virus. 1008.14s - 1011.14s | If you want to get into the molecular biology of it, it's incredible. 1011.14s - 1014.14s | It is awe-inspiring. 1014.14s - 1018.93s | This is Sovaldi, 1018.93s - 1022.93s | also known as sofosbuvir. 1022.93s - 1025.93s | This molecule makes magic happen. 1025.93s - 1028.93s | It actually goes in and interdicts 1028.93s - 1031.93s | in the replication process 1031.93s - 1037.26s | when hepatitis C is trying to make more of it. 1037.26s - 1040.26s | Here is the enzyme 1040.26s - 1044.26s | that allows hepatitis C to make more by replicating RNA. 1044.26s - 1047.26s | And here is Sovaldi 1047.26s - 1050.26s | inside of the binding pocket 1050.26s - 1054.26s | doing what one of our chemists 1054.26s - 1061.17s | referred to as fucking shit up. 1061.17s - 1064.17s | This is not just a drug that's helpful. 1064.17s - 1068.17s | This drug will actually eradicate the virus from your body. 1068.17s - 1071.17s | This is the first time this has ever been done. 1071.17s - 1074.17s | If you have a virus, either your body manages it 1074.17s - 1078.17s | or you have to continuously take antivirals for the rest of your life, 1078.17s - 1081.17s | you can actually be hepatitis C-free 1081.17s - 1084.17s | with this drug. 1084.17s - 1087.17s | It's not just a treatment. 1087.17s - 1090.17s | You take one pill a day for 12


chunk_text:
1025.93s - 1028.93s | It actually goes in and interdicts 1028.93s - 1031.93s | in the replication process 1031.93s - 1037.26s | when hepatitis C is trying to make more of it. 1037.26s - 1040.26s | Here is the enzyme 1040.26s - 1044.26s | that allows hepatitis C to make more by replicating RNA. 1044.26s - 1047.26s | And here is Sovaldi 1047.26s - 1050.26s | inside of the binding pocket 1050.26s - 1054.26s | doing what one of our chemists 1054.26s - 1061.17s | referred to as fucking shit up. 1061.17s - 1064.17s | This is not just a drug that's helpful. 1064.17s - 1068.17s | This drug will actually eradicate the virus from your body. 1068.17s - 1071.17s | This is the first time this has ever been done. 1071.17s - 1074.17s | If you have a virus, either your body manages it 1074.17s - 1078.17s | or you have to continuously take antivirals for the rest of your life, 1078.17s - 1081.17s | you can actually be hepatitis C-free 1081.17s - 1084.17s | with this drug. 1084.17s - 1087.17s | It's not just a treatment. 1087.17s - 1090.17s | You take one pill a day for 12 weeks, 1090.17s - 1093.17s | and hepatitis C is gone from your body. 1093.17s - 1096.17s | What is the catch? 1096.17s - 1099.17s | These pills cost $1,000 apiece. 1099.17s - 1102.17s | And for those of you who are good with arithmetic, 1103.17s - 1107.17s | you will notice that this is $84,000 that it costs. 1107.17s - 1111.17s | And it will come as no surprise to the Americans in the audience 1111.17s - 1115.17s | that insurance companies aren't super hot to pay for it. 1115.17s - 1119.99s | Let's look at how shitty hepatitis is. 1119.99s - 1124.62s | This is how it's gone the last few years. 1124.62s - 1127.62s | Two seminal moments I'd like to point out. 1127.62s - 1130.62s | Here's where Sovaldi was invented. 1130.62s - 1134.62s | Now, those of you who are familiar with the American medical system 1134.62s - 1137.62s | and how drugs go will know that it takes a while 1137.62s - 1140.62s | between invention and approval, and indeed it did. 1140.62s - 1143.62s | But here's where it was approved. 1143.62s - 1146.62s | Maybe you noticed something kind of strange about the


chunk_text:
weeks, 1090.17s - 1093.17s | and hepatitis C is gone from your body. 1093.17s - 1096.17s | What is the catch? 1096.17s - 1099.17s | These pills cost $1,000 apiece. 1099.17s - 1102.17s | And for those of you who are good with arithmetic, 1103.17s - 1107.17s | you will notice that this is $84,000 that it costs. 1107.17s - 1111.17s | And it will come as no surprise to the Americans in the audience 1111.17s - 1115.17s | that insurance companies aren't super hot to pay for it. 1115.17s - 1119.99s | Let's look at how shitty hepatitis is. 1119.99s - 1124.62s | This is how it's gone the last few years. 1124.62s - 1127.62s | Two seminal moments I'd like to point out. 1127.62s - 1130.62s | Here's where Sovaldi was invented. 1130.62s - 1134.62s | Now, those of you who are familiar with the American medical system 1134.62s - 1137.62s | and how drugs go will know that it takes a while 1137.62s - 1140.62s | between invention and approval, and indeed it did. 1140.62s - 1143.62s | But here's where it was approved. 1143.62s - 1146.62s | Maybe you noticed something kind of strange about the graph. 1146.62s - 1149.62s | Let's extend the data just a little bit. 1149.62s - 1152.62s | And you'll see, taking it up to the current day, 1152.62s - 1156.62s | it's getting worse, not better. 1156.62s - 1161.35s | That's worth wondering about. 1161.35s - 1165.35s | Now, as some of you know, I'm a mathematician. 1165.35s - 1169.35s | I will not require any of you to do the integral 1169.35s - 1172.35s | to calculate the area under the curve here 1172.35s - 1176.35s | as to how many people died since it was invented. 1176.35s - 1181.76s | It was over 5 million 1181.76s - 1184.76s | between the invention of Sovaldi and today, 1184.76s - 1187.76s | all of which could have been avoided 1187.76s - 1190.76s | if they had merely been given this course of treatment. 1190.76s - 1196.16s | And I take great exception to that. 1196.16s - 1199.16s | Right now, 1199.16s - 1204.16s | almost 1% of the entire world has hepatitis C. 1204.16s - 1207.16s | It's closer to 3 quarters of a percent. 1207.16s - 1211.16s | But look around this room and do a quick back of


chunk_text:
graph. 1146.62s - 1149.62s | Let's extend the data just a little bit. 1149.62s - 1152.62s | And you'll see, taking it up to the current day, 1152.62s - 1156.62s | it's getting worse, not better. 1156.62s - 1161.35s | That's worth wondering about. 1161.35s - 1165.35s | Now, as some of you know, I'm a mathematician. 1165.35s - 1169.35s | I will not require any of you to do the integral 1169.35s - 1172.35s | to calculate the area under the curve here 1172.35s - 1176.35s | as to how many people died since it was invented. 1176.35s - 1181.76s | It was over 5 million 1181.76s - 1184.76s | between the invention of Sovaldi and today, 1184.76s - 1187.76s | all of which could have been avoided 1187.76s - 1190.76s | if they had merely been given this course of treatment. 1190.76s - 1196.16s | And I take great exception to that. 1196.16s - 1199.16s | Right now, 1199.16s - 1204.16s | almost 1% of the entire world has hepatitis C. 1204.16s - 1207.16s | It's closer to 3 quarters of a percent. 1207.16s - 1211.16s | But look around this room and do a quick back of the envelope. 1211.16s - 1215.16s | There are plenty of people right here who have it. 1215.16s - 1218.16s | Plenty unknowingly. 1218.16s - 1224.66s | Again, it is more virulent and more deadly than HIV. 1224.66s - 1229.66s | 1.5 million people will get it this year. 1229.66s - 1233.66s | Some probably, like, you know, later today if they get lucky. 1233.66s - 1236.66s | Hopefully it's fun in the process. 1236.66s - 1241.66s | Over a quarter of a million people will die of hepatitis C this year. 1241.66s - 1243.66s | A quarter of a million. 1243.66s - 1247.66s | And somebody dies every 2 minutes. 1247.66s - 1250.66s | How long have I been up here? 1250.66s - 1253.66s | When I talked about this 5 years ago, it was every 3 minutes. 1253.66s - 1256.66s | So again, not only is it getting worse, 1256.66s - 1259.66s | but it's getting worse faster. 1259.66s - 1263.66s | Now, usually when I start throwing these sorts of numbers out, 1263.66s - 1266.66s | people get a little depressed. 1266.66s - 1269.66s | And they ask, is there no hope? 1269.66s - 1274.94s | And I


chunk_text:
the envelope. 1211.16s - 1215.16s | There are plenty of people right here who have it. 1215.16s - 1218.16s | Plenty unknowingly. 1218.16s - 1224.66s | Again, it is more virulent and more deadly than HIV. 1224.66s - 1229.66s | 1.5 million people will get it this year. 1229.66s - 1233.66s | Some probably, like, you know, later today if they get lucky. 1233.66s - 1236.66s | Hopefully it's fun in the process. 1236.66s - 1241.66s | Over a quarter of a million people will die of hepatitis C this year. 1241.66s - 1243.66s | A quarter of a million. 1243.66s - 1247.66s | And somebody dies every 2 minutes. 1247.66s - 1250.66s | How long have I been up here? 1250.66s - 1253.66s | When I talked about this 5 years ago, it was every 3 minutes. 1253.66s - 1256.66s | So again, not only is it getting worse, 1256.66s - 1259.66s | but it's getting worse faster. 1259.66s - 1263.66s | Now, usually when I start throwing these sorts of numbers out, 1263.66s - 1266.66s | people get a little depressed. 1266.66s - 1269.66s | And they ask, is there no hope? 1269.66s - 1274.94s | And I would like to quote one of my favorite superheroes. 1274.94s - 1278.54s | Oh, I will give you hope. 1278.54s - 1283.11s | And I ask only one thing in return. 1283.11s - 1287.74s | Now, you might not recognize this man, 1287.74s - 1290.74s | but his name is Daniel O'Day. 1290.74s - 1293.74s | Interesting last name to be talking about at a hacker conference. 1293.74s - 1296.74s | You figure somebody is going to fuck with him, right? 1296.74s - 1300.74s | He is, as you might guess, lying to Congress. 1300.74s - 1303.74s | He is CEO of Gilead Pharmaceuticals. 1303.74s - 1307.74s | And he is lying about the pricing structure of Sovaldi, 1307.74s - 1312.74s | which, as mentioned previously, is $1,000 a pill 1313.74s - 1317.74s | and is $84,000 for a full course of treatment. 1317.74s - 1323.74s | Oh man, I had such like a climactic moment that I was building to. 1323.74s - 1327.74s | Like I was so excited for the next thing. 1327.74s - 1330.74s | If I can pull it off, it will be great. 1330.74s - 1332.74s | If not, it's like an NES, right? 1332.74s


chunk_text:
would like to quote one of my favorite superheroes. 1274.94s - 1278.54s | Oh, I will give you hope. 1278.54s - 1283.11s | And I ask only one thing in return. 1283.11s - 1287.74s | Now, you might not recognize this man, 1287.74s - 1290.74s | but his name is Daniel O'Day. 1290.74s - 1293.74s | Interesting last name to be talking about at a hacker conference. 1293.74s - 1296.74s | You figure somebody is going to fuck with him, right? 1296.74s - 1300.74s | He is, as you might guess, lying to Congress. 1300.74s - 1303.74s | He is CEO of Gilead Pharmaceuticals. 1303.74s - 1307.74s | And he is lying about the pricing structure of Sovaldi, 1307.74s - 1312.74s | which, as mentioned previously, is $1,000 a pill 1313.74s - 1317.74s | and is $84,000 for a full course of treatment. 1317.74s - 1323.74s | Oh man, I had such like a climactic moment that I was building to. 1323.74s - 1327.74s | Like I was so excited for the next thing. 1327.74s - 1330.74s | If I can pull it off, it will be great. 1330.74s - 1332.74s | If not, it's like an NES, right? 1332.74s - 1334.74s | Everybody remembers this. It's a perfect trick. 1334.74s - 1336.74s | It should work every time. 1336.74s - 1339.74s | So in the event that this doesn't work, 1339.74s - 1342.74s | I'll go a little further from memory. 1342.74s - 1348.31s | But we need to get back to the how. 1348.31s - 1350.31s | I talked a lot about why. 1350.31s - 1353.31s | But there are tools that we have specifically 1353.31s - 1356.31s | that will help you through the entire process. 1356.31s - 1359.31s | At the top is the automation of the chemistry. 1359.31s - 1361.31s | And we have a tool for that, 1361.31s - 1364.31s | an actual way that you can automate the chemistry. 1364.31s - 1369.31s | Below that, there's a system that will build 1369.31s - 1374.31s | the instruction set that the automation system will run. 1374.31s - 1377.31s | Before that, you actually need to figure out 1377.31s - 1379.31s | how the synthesis is done. 1379.31s - 1382.31s | You need to figure out how to start with some material 1382.31s - 1385.31s | and then work your way to your end product.


chunk_text:
- 1334.74s | Everybody remembers this. It's a perfect trick. 1334.74s - 1336.74s | It should work every time. 1336.74s - 1339.74s | So in the event that this doesn't work, 1339.74s - 1342.74s | I'll go a little further from memory. 1342.74s - 1348.31s | But we need to get back to the how. 1348.31s - 1350.31s | I talked a lot about why. 1350.31s - 1353.31s | But there are tools that we have specifically 1353.31s - 1356.31s | that will help you through the entire process. 1356.31s - 1359.31s | At the top is the automation of the chemistry. 1359.31s - 1361.31s | And we have a tool for that, 1361.31s - 1364.31s | an actual way that you can automate the chemistry. 1364.31s - 1369.31s | Below that, there's a system that will build 1369.31s - 1374.31s | the instruction set that the automation system will run. 1374.31s - 1377.31s | Before that, you actually need to figure out 1377.31s - 1379.31s | how the synthesis is done. 1379.31s - 1382.31s | You need to figure out how to start with some material 1382.31s - 1385.31s | and then work your way to your end product. 1385.31s - 1387.31s | And we have a tool for that as well. 1387.31s - 1389.31s | And of course, somewhere along the line, 1389.31s - 1392.31s | you have to figure out what you want to take for what's wrong. 1392.31s - 1393.31s | I don't see one. 1393.31s - 1399.26s | So the first thing is called the apothecary micro lab. 1399.26s - 1402.26s | And you're going to have to take it on faith, 1402.26s - 1405.67s | but I got beautiful pictures of it. 1405.67s - 1409.67s | There are automated lab reactors that are designed for chemistry. 1409.67s - 1412.67s | The way they work is fairly simple. 1412.67s - 1415.67s | There's a reaction chamber on the inside. 1415.67s - 1419.67s | There's a jacket through which liquid flows 1419.67s - 1423.67s | that allows the reaction chamber 1423.67s - 1425.67s | to maintain a particular temperature. 1425.67s - 1429.67s | There's a little paddle inside that will stir. 1429.67s - 1432.67s | And then there are these little injection systems on the top. 1432.67s - 1436.67s | Now, problem is, many. 1436.67s - 1440.67s | First, they're closed source, 1440.67s - 1442.67s |


chunk_text:
1385.31s - 1387.31s | And we have a tool for that as well. 1387.31s - 1389.31s | And of course, somewhere along the line, 1389.31s - 1392.31s | you have to figure out what you want to take for what's wrong. 1392.31s - 1393.31s | I don't see one. 1393.31s - 1399.26s | So the first thing is called the apothecary micro lab. 1399.26s - 1402.26s | And you're going to have to take it on faith, 1402.26s - 1405.67s | but I got beautiful pictures of it. 1405.67s - 1409.67s | There are automated lab reactors that are designed for chemistry. 1409.67s - 1412.67s | The way they work is fairly simple. 1412.67s - 1415.67s | There's a reaction chamber on the inside. 1415.67s - 1419.67s | There's a jacket through which liquid flows 1419.67s - 1423.67s | that allows the reaction chamber 1423.67s - 1425.67s | to maintain a particular temperature. 1425.67s - 1429.67s | There's a little paddle inside that will stir. 1429.67s - 1432.67s | And then there are these little injection systems on the top. 1432.67s - 1436.67s | Now, problem is, many. 1436.67s - 1440.67s | First, they're closed source, 1440.67s - 1442.67s | and they come with all the attendant problems 1442.67s - 1444.67s | with closed source systems. 1444.67s - 1447.67s | Number two, they're ridiculously expensive. 1447.67s - 1451.67s | If you want the most basic model, it's going to be over $5,000. 1451.67s - 1455.67s | And even if you have $5,000, you can't buy it unless you're a lab. 1455.67s - 1457.67s | Now, of course, there are ways around that, 1457.67s - 1460.67s | but why would you want to pay $5,000 1460.67s - 1464.67s | for something that just stirs, controls temperature, 1464.67s - 1467.67s | and injects reagents at a particular time? 1467.67s - 1471.67s | You think you could probably do that yourself, right? 1471.67s - 1473.67s | Well, I'm a very, very lucky man. 1473.67s - 1475.67s | I get to brag about some wonderful things 1475.67s - 1478.67s | that some brilliant people have managed to build, 1478.67s - 1482.67s | and I get to brag about it unabashedly because I didn't do it. 1482.67s - 1485.67s | But the apothecary micro lab is something we've been working on 1485.67s - 1487.67s | for many years, and we have a new version 1487.67s


chunk_text:
and they come with all the attendant problems 1442.67s - 1444.67s | with closed source systems. 1444.67s - 1447.67s | Number two, they're ridiculously expensive. 1447.67s - 1451.67s | If you want the most basic model, it's going to be over $5,000. 1451.67s - 1455.67s | And even if you have $5,000, you can't buy it unless you're a lab. 1455.67s - 1457.67s | Now, of course, there are ways around that, 1457.67s - 1460.67s | but why would you want to pay $5,000 1460.67s - 1464.67s | for something that just stirs, controls temperature, 1464.67s - 1467.67s | and injects reagents at a particular time? 1467.67s - 1471.67s | You think you could probably do that yourself, right? 1471.67s - 1473.67s | Well, I'm a very, very lucky man. 1473.67s - 1475.67s | I get to brag about some wonderful things 1475.67s - 1478.67s | that some brilliant people have managed to build, 1478.67s - 1482.67s | and I get to brag about it unabashedly because I didn't do it. 1482.67s - 1485.67s | But the apothecary micro lab is something we've been working on 1485.67s - 1487.67s | for many years, and we have a new version 1487.67s - 1490.67s | that I like to call version 6, 1490.67s - 1492.67s | and it does all of these things. 1492.67s - 1496.67s | You have a small mason jar inside of a larger mason jar. 1496.67s - 1500.67s | There's fluid that circulates around that... 1500.67s - 1503.67s | Oh, that doesn't look good. 1503.67s - 1505.67s | All right, moving on. 1505.67s - 1507.67s | There's a fluid that circulates around 1507.67s - 1509.67s | that regulates the temperature. 1509.67s - 1516.92s | You've got a stirring paddle that comes in. 1516.92s - 1519.92s | It's made of Teflon, so it's nonreactive. 1519.92s - 1523.92s | And you've got these tubes that pump things in. 1523.92s - 1525.92s | The design is somewhat complex, 1525.92s - 1527.92s | and one thing that I should mention 1527.92s - 1530.92s | is that tomorrow at 11 a.m. 1530.92s - 1534.92s | in the content creators stage, 1534.92s - 1536.92s | we'll be doing an extended version of this talk. 1536.92s - 1538.92s | It's in number 2. 1538.92s - 1540.92s | And we will be going through, 1540.92s - 1543.92s | and we will be demonstrating the actual tool.


chunk_text:
- 1490.67s | that I like to call version 6, 1490.67s - 1492.67s | and it does all of these things. 1492.67s - 1496.67s | You have a small mason jar inside of a larger mason jar. 1496.67s - 1500.67s | There's fluid that circulates around that... 1500.67s - 1503.67s | Oh, that doesn't look good. 1503.67s - 1505.67s | All right, moving on. 1505.67s - 1507.67s | There's a fluid that circulates around 1507.67s - 1509.67s | that regulates the temperature. 1509.67s - 1516.92s | You've got a stirring paddle that comes in. 1516.92s - 1519.92s | It's made of Teflon, so it's nonreactive. 1519.92s - 1523.92s | And you've got these tubes that pump things in. 1523.92s - 1525.92s | The design is somewhat complex, 1525.92s - 1527.92s | and one thing that I should mention 1527.92s - 1530.92s | is that tomorrow at 11 a.m. 1530.92s - 1534.92s | in the content creators stage, 1534.92s - 1536.92s | we'll be doing an extended version of this talk. 1536.92s - 1538.92s | It's in number 2. 1538.92s - 1540.92s | And we will be going through, 1540.92s - 1543.92s | and we will be demonstrating the actual tool. 1543.92s - 1545.92s | We will be going through, 1545.92s - 1547.92s | you will see it making medicines on stage. 1547.92s - 1550.92s | All of these online systems about which I'm about to speak, 1550.92s - 1552.92s | you'll be able to interact with in real time 1552.92s - 1555.92s | because we were discouraged from having live demos 1555.92s - 1558.92s | on the main stage because, well, you know. 1558.92s - 1568.19s | So you'll also be able to request particular drugs. 1568.19s - 1571.19s | If there's a drug that you'd like to know how to make, 1571.19s - 1574.19s | we'll try and figure out a way on the fly, live. 1574.19s - 1578.66s | So please come on by. It'll be fun. 1578.66s - 1582.66s | So then antecedent to the Microlab itself, 1582.66s - 1585.66s | we have a system called the RecipePress. 1585.66s - 1588.66s | This is a graphical user interface 1588.66s - 1593.66s | that allows you to take a procedure 1593.66s - 1596.66s | for making a chemical reaction happen, 1596.66s - 1599.66s | and you get to then input it, 1599.66s - 1603.66s | and it will


chunk_text:
1543.92s - 1545.92s | We will be going through, 1545.92s - 1547.92s | you will see it making medicines on stage. 1547.92s - 1550.92s | All of these online systems about which I'm about to speak, 1550.92s - 1552.92s | you'll be able to interact with in real time 1552.92s - 1555.92s | because we were discouraged from having live demos 1555.92s - 1558.92s | on the main stage because, well, you know. 1558.92s - 1568.19s | So you'll also be able to request particular drugs. 1568.19s - 1571.19s | If there's a drug that you'd like to know how to make, 1571.19s - 1574.19s | we'll try and figure out a way on the fly, live. 1574.19s - 1578.66s | So please come on by. It'll be fun. 1578.66s - 1582.66s | So then antecedent to the Microlab itself, 1582.66s - 1585.66s | we have a system called the RecipePress. 1585.66s - 1588.66s | This is a graphical user interface 1588.66s - 1593.66s | that allows you to take a procedure 1593.66s - 1596.66s | for making a chemical reaction happen, 1596.66s - 1599.66s | and you get to then input it, 1599.66s - 1603.66s | and it will generate the code so that the system runs it. 1603.66s - 1607.66s | And the brains of it come in a nice pretty box. 1607.66s - 1609.66s | I promise you, it's so gorgeous. 1609.66s - 1611.66s | You'll love it. Come by tomorrow. 1611.66s - 1613.66s | Or just go on our GitHub, 1613.66s - 1615.66s | and you can see wonderful pictures of it 1615.66s - 1617.66s | because it's extremely well documented. 1617.66s - 1619.66s | Again, I work with wonderful people. 1619.66s - 1624.66s | As we say, documentation or it's not a project, right? 1625.66s - 1631.66s | So you can then generate a file that it will run, 1631.66s - 1635.66s | and then beyond that, you can edit it. 1635.66s - 1637.66s | It will talk you through the things 1637.66s - 1641.66s | that are easy for a human but difficult for a machine to do. 1641.66s - 1645.66s | There's a touch screen that talks you through it. 1645.66s - 1647.66s | Then for the machine things, 1647.66s - 1649.66s | where you just need to wait for a long time 1649.66s - 1651.66s | and regulate the temperature and keep


chunk_text:
generate the code so that the system runs it. 1603.66s - 1607.66s | And the brains of it come in a nice pretty box. 1607.66s - 1609.66s | I promise you, it's so gorgeous. 1609.66s - 1611.66s | You'll love it. Come by tomorrow. 1611.66s - 1613.66s | Or just go on our GitHub, 1613.66s - 1615.66s | and you can see wonderful pictures of it 1615.66s - 1617.66s | because it's extremely well documented. 1617.66s - 1619.66s | Again, I work with wonderful people. 1619.66s - 1624.66s | As we say, documentation or it's not a project, right? 1625.66s - 1631.66s | So you can then generate a file that it will run, 1631.66s - 1635.66s | and then beyond that, you can edit it. 1635.66s - 1637.66s | It will talk you through the things 1637.66s - 1641.66s | that are easy for a human but difficult for a machine to do. 1641.66s - 1645.66s | There's a touch screen that talks you through it. 1645.66s - 1647.66s | Then for the machine things, 1647.66s - 1649.66s | where you just need to wait for a long time 1649.66s - 1651.66s | and regulate the temperature and keep stirring, 1651.66s - 1654.66s | or easy for a human to get distracted but great for a machine, 1654.66s - 1657.66s | it will do those for you. 1657.66s - 1660.66s | Before that, you need to figure out, again, the retrosynthesis. 1660.66s - 1665.78s | How do you get from point A to point B? 1665.78s - 1667.78s | A number of years ago, we developed a system 1667.78s - 1669.78s | that we called ChemHactica. 1669.78s - 1671.78s | It's a retrosynthesis module 1671.78s - 1674.78s | where what you can do is literally hop on Wikipedia, 1674.78s - 1676.78s | look for your drug of choice, 1676.78s - 1679.78s | scroll down until you find the SMILES code, 1679.78s - 1682.78s | and hackers out there, if you don't know about this, 1682.78s - 1684.78s | the SMILES codes are super dope. 1684.78s - 1687.78s | Invited by the Blue Obelisk Group, 1687.78s - 1690.78s | an open-source way that you can represent any chemical 1690.78s - 1693.78s | or any chemical reaction with an ASCII string. 1693.78s - 1695.78s | It's super cool. 1695.78s - 1698.78s | You copy that, you paste it into ChemHactica, 1698.78s


chunk_text:
stirring, 1651.66s - 1654.66s | or easy for a human to get distracted but great for a machine, 1654.66s - 1657.66s | it will do those for you. 1657.66s - 1660.66s | Before that, you need to figure out, again, the retrosynthesis. 1660.66s - 1665.78s | How do you get from point A to point B? 1665.78s - 1667.78s | A number of years ago, we developed a system 1667.78s - 1669.78s | that we called ChemHactica. 1669.78s - 1671.78s | It's a retrosynthesis module 1671.78s - 1674.78s | where what you can do is literally hop on Wikipedia, 1674.78s - 1676.78s | look for your drug of choice, 1676.78s - 1679.78s | scroll down until you find the SMILES code, 1679.78s - 1682.78s | and hackers out there, if you don't know about this, 1682.78s - 1684.78s | the SMILES codes are super dope. 1684.78s - 1687.78s | Invited by the Blue Obelisk Group, 1687.78s - 1690.78s | an open-source way that you can represent any chemical 1690.78s - 1693.78s | or any chemical reaction with an ASCII string. 1693.78s - 1695.78s | It's super cool. 1695.78s - 1698.78s | You copy that, you paste it into ChemHactica, 1698.78s - 1700.78s | and you say, how do I make this? 1700.78s - 1703.78s | It will find ways to do it. 1703.78s - 1705.78s | It does this combinatorially 1705.78s - 1709.78s | by looking through all of the chemical literature historically, 1709.78s - 1713.78s | and then it will put the pieces together 1713.78s - 1716.78s | and find reactions that have already been tested 1716.78s - 1718.78s | and connect the dots for you, 1718.78s - 1720.78s | and it'll make it as simple as you want. 1720.78s - 1724.73s | How are you doing? 1724.73s - 1726.73s | Yeah, just a quick question. 1726.73s - 1728.73s | Is that the right one? Oh, no, no. 1728.73s - 1730.73s | No, this is not the right one. I see. 1730.73s - 1732.73s | That was my concern. 1732.73s - 1734.73s | I didn't want to go poking around your workstation. 1734.73s - 1736.73s | Thank you. That's all right. 1736.73s - 1738.73s | Bear with us a moment. 1739.73s - 1743.58s | Boop! All right. 1743.58s - 1745.58s | Let's see. Here we go. 1745.58s - 1751.20s | Maybe. 1751.20s - 1754.20s | Just last week, I


chunk_text:
- 1700.78s | and you say, how do I make this? 1700.78s - 1703.78s | It will find ways to do it. 1703.78s - 1705.78s | It does this combinatorially 1705.78s - 1709.78s | by looking through all of the chemical literature historically, 1709.78s - 1713.78s | and then it will put the pieces together 1713.78s - 1716.78s | and find reactions that have already been tested 1716.78s - 1718.78s | and connect the dots for you, 1718.78s - 1720.78s | and it'll make it as simple as you want. 1720.78s - 1724.73s | How are you doing? 1724.73s - 1726.73s | Yeah, just a quick question. 1726.73s - 1728.73s | Is that the right one? Oh, no, no. 1728.73s - 1730.73s | No, this is not the right one. I see. 1730.73s - 1732.73s | That was my concern. 1732.73s - 1734.73s | I didn't want to go poking around your workstation. 1734.73s - 1736.73s | Thank you. That's all right. 1736.73s - 1738.73s | Bear with us a moment. 1739.73s - 1743.58s | Boop! All right. 1743.58s - 1745.58s | Let's see. Here we go. 1745.58s - 1751.20s | Maybe. 1751.20s - 1754.20s | Just last week, I had a guy interview me 1754.20s - 1756.20s | whose childhood friend... 1756.20s - 1758.20s | Wonderful. 1758.20s - 1760.20s | Thank you. 1760.20s - 1762.20s | Probably. 1762.20s - 1770.06s | All right, cool. 1770.06s - 1772.06s | I'm just going to sort of forward the slides 1772.06s - 1774.06s | until it catches up with me. 1774.06s - 1776.06s | I got interviewed with a guy 1776.06s - 1778.06s | who told me this heartbreaking story 1778.06s - 1780.06s | about his childhood friend 1780.06s - 1782.06s | dying of... 1782.06s - 1784.06s | I believe it was multiple sclerosis 1784.06s - 1786.06s | at 25 1786.06s - 1790.06s | because she had a very rare subtype, 1790.06s - 1793.06s | and the medicine 1793.06s - 1795.06s | for that particular subtype, 1795.06s - 1797.06s | because it was so rare, 1797.06s - 1800.06s | had been given orphan drug status, 1800.06s - 1805.06s | which gave it this extended patent length 1805.06s - 1808.06s | and also allowed for the price point 1808.06s - 1811.06s | to be whatever they wanted, 1811.06s - 1816.06s | and it was priced at $850 a day. 1816.06s - 1818.06s |


chunk_text:
had a guy interview me 1754.20s - 1756.20s | whose childhood friend... 1756.20s - 1758.20s | Wonderful. 1758.20s - 1760.20s | Thank you. 1760.20s - 1762.20s | Probably. 1762.20s - 1770.06s | All right, cool. 1770.06s - 1772.06s | I'm just going to sort of forward the slides 1772.06s - 1774.06s | until it catches up with me. 1774.06s - 1776.06s | I got interviewed with a guy 1776.06s - 1778.06s | who told me this heartbreaking story 1778.06s - 1780.06s | about his childhood friend 1780.06s - 1782.06s | dying of... 1782.06s - 1784.06s | I believe it was multiple sclerosis 1784.06s - 1786.06s | at 25 1786.06s - 1790.06s | because she had a very rare subtype, 1790.06s - 1793.06s | and the medicine 1793.06s - 1795.06s | for that particular subtype, 1795.06s - 1797.06s | because it was so rare, 1797.06s - 1800.06s | had been given orphan drug status, 1800.06s - 1805.06s | which gave it this extended patent length 1805.06s - 1808.06s | and also allowed for the price point 1808.06s - 1811.06s | to be whatever they wanted, 1811.06s - 1816.06s | and it was priced at $850 a day. 1816.06s - 1818.06s | And she died. 1818.06s - 1820.06s | And he and I sat down, 1820.06s - 1822.06s | and I shared my screen with him, 1822.06s - 1824.06s | and we went on Chemhaxica, 1824.06s - 1826.06s | and in a matter of minutes, he and I, 1826.06s - 1828.06s | neither of us chemists, 1828.06s - 1831.06s | figured out a way to manufacture it for $20 a day. 1831.06s - 1833.06s | It's that powerful of a tool. 1833.06s - 1835.06s | Now, that's not to say, of course, 1835.06s - 1837.06s | that there isn't some chemistry still to be done. 1837.06s - 1839.06s | You do need to figure some things out. 1839.06s - 1842.06s | But this gets a huge jump on it. 1842.06s - 1846.06s | You could potentially find a synthesis mechanism 1846.06s - 1849.06s | just with this and a good chemist 1849.06s - 1853.06s | rather than having a giant team of them work for months. 1853.06s - 1857.06s | And additionally, this is how we figured out 1857.06s - 1859.06s | how to make Sovaldi. 1859.06s - 1861.06s | Um... 1862.06s - 1864.06s | I kind of, it's tempting to skip


chunk_text:
And she died. 1818.06s - 1820.06s | And he and I sat down, 1820.06s - 1822.06s | and I shared my screen with him, 1822.06s - 1824.06s | and we went on Chemhaxica, 1824.06s - 1826.06s | and in a matter of minutes, he and I, 1826.06s - 1828.06s | neither of us chemists, 1828.06s - 1831.06s | figured out a way to manufacture it for $20 a day. 1831.06s - 1833.06s | It's that powerful of a tool. 1833.06s - 1835.06s | Now, that's not to say, of course, 1835.06s - 1837.06s | that there isn't some chemistry still to be done. 1837.06s - 1839.06s | You do need to figure some things out. 1839.06s - 1842.06s | But this gets a huge jump on it. 1842.06s - 1846.06s | You could potentially find a synthesis mechanism 1846.06s - 1849.06s | just with this and a good chemist 1849.06s - 1853.06s | rather than having a giant team of them work for months. 1853.06s - 1857.06s | And additionally, this is how we figured out 1857.06s - 1859.06s | how to make Sovaldi. 1859.06s - 1861.06s | Um... 1862.06s - 1864.06s | I kind of, it's tempting to skip ahead, 1864.06s - 1866.06s | but I kind of don't want to touch it. 1866.06s - 1870.06s | So I'll keep talking a little bit 1870.06s - 1873.06s | and see where we are on the clock here. 1873.06s - 1876.06s | Um, how fragile is this? 1876.06s - 1878.06s | Where'd my guy go? 1878.06s - 1880.06s | All right, I'll just keep pressing the button. 1880.06s - 1887.01s | So both of these services are live now. 1887.01s - 1889.01s | The other thing to note about the, uh... 1889.01s - 1891.01s | Is this safe? 1891.01s - 1893.01s | Can I skip down? 1893.01s - 1895.01s | No, no, just hit escape. It's fine. 1895.01s - 1897.01s | And then, uh... 1897.01s - 1899.01s | Oh, and then I can just scroll. 1899.01s - 1902.01s | Thank you for bearing with us through this process. 1902.01s - 1904.01s | I appreciate you all. 1904.01s - 1906.01s | Oh, right, I was about to do a thing. 1906.01s - 1908.01s | Okay, cool. 1908.01s - 1910.01s | So here we go. 1910.01s - 1912.01s | Yeah, I guess I kind of gave it away, didn't I? 1912.01s -


chunk_text:
ahead, 1864.06s - 1866.06s | but I kind of don't want to touch it. 1866.06s - 1870.06s | So I'll keep talking a little bit 1870.06s - 1873.06s | and see where we are on the clock here. 1873.06s - 1876.06s | Um, how fragile is this? 1876.06s - 1878.06s | Where'd my guy go? 1878.06s - 1880.06s | All right, I'll just keep pressing the button. 1880.06s - 1887.01s | So both of these services are live now. 1887.01s - 1889.01s | The other thing to note about the, uh... 1889.01s - 1891.01s | Is this safe? 1891.01s - 1893.01s | Can I skip down? 1893.01s - 1895.01s | No, no, just hit escape. It's fine. 1895.01s - 1897.01s | And then, uh... 1897.01s - 1899.01s | Oh, and then I can just scroll. 1899.01s - 1902.01s | Thank you for bearing with us through this process. 1902.01s - 1904.01s | I appreciate you all. 1904.01s - 1906.01s | Oh, right, I was about to do a thing. 1906.01s - 1908.01s | Okay, cool. 1908.01s - 1910.01s | So here we go. 1910.01s - 1912.01s | Yeah, I guess I kind of gave it away, didn't I? 1912.01s - 1914.01s | All right, but here we go. 1914.01s - 1916.01s | All right, here's Daniel O'Day. 1916.01s - 1920.01s | Ha! Lying to Congress about Sovaldi. 1920.01s - 1923.01s | And I think I have time 1923.01s - 1926.01s | to take exception to his pricing structure. 1926.01s - 1928.01s | And my hacker friends, 1928.01s - 1931.01s | I have a question for you. 1931.01s - 1933.01s | Should I call him? 1933.01s - 1938.34s | All right, now don't everybody call him at once. 1938.34s - 1940.34s | He'll jam the line. 1940.34s - 1942.34s | Uh, we'll see, uh... 1942.34s - 1944.34s | We'll see what he has to say. 1944.34s - 1946.34s | All right, Danny boy. 1946.34s - 1948.34s | Pipes are calling. 1948.34s - 1950.34s | Four Thieves Vinegar is calling. 1950.34s - 1952.34s | And we're not pleased with what you've done. 1952.34s - 1959.34s | So here we go, 415-533-3976. 1959.34s - 1961.34s | Call him afterwards if he doesn't answer, okay? 1961.34s - 1968.14s | Let's give this a try. 1968.14s - 1974.52s | Can you hear this? Can you hear this? 1974.52s - 1976.52s | Hi there, Daniel O'Day,


chunk_text:
1914.01s | All right, but here we go. 1914.01s - 1916.01s | All right, here's Daniel O'Day. 1916.01s - 1920.01s | Ha! Lying to Congress about Sovaldi. 1920.01s - 1923.01s | And I think I have time 1923.01s - 1926.01s | to take exception to his pricing structure. 1926.01s - 1928.01s | And my hacker friends, 1928.01s - 1931.01s | I have a question for you. 1931.01s - 1933.01s | Should I call him? 1933.01s - 1938.34s | All right, now don't everybody call him at once. 1938.34s - 1940.34s | He'll jam the line. 1940.34s - 1942.34s | Uh, we'll see, uh... 1942.34s - 1944.34s | We'll see what he has to say. 1944.34s - 1946.34s | All right, Danny boy. 1946.34s - 1948.34s | Pipes are calling. 1948.34s - 1950.34s | Four Thieves Vinegar is calling. 1950.34s - 1952.34s | And we're not pleased with what you've done. 1952.34s - 1959.34s | So here we go, 415-533-3976. 1959.34s - 1961.34s | Call him afterwards if he doesn't answer, okay? 1961.34s - 1968.14s | Let's give this a try. 1968.14s - 1974.52s | Can you hear this? Can you hear this? 1974.52s - 1976.52s | Hi there, Daniel O'Day, please. 1976.52s - 1978.52s | Uh, who's calling? 1978.52s - 1980.52s | Uh, this is Dr. Michael Laufer. 1980.52s - 1985.15s | Dr. Michael Laufer from the Four Thieves Vinegar collection, please. 1985.15s - 1989.10s | Sorry, I can't understand what you're saying. 1989.10s - 1991.10s | I'm sorry, the connection's bad. 1991.10s - 1994.10s | Dr. Michael Laufer, I'm calling from Four Thieves. 1994.10s - 1996.10s | He's expecting my call. 1997.10s - 1999.10s | He's expecting your call? 1999.10s - 2001.10s | Uh, yeah. 2001.10s - 2004.38s | Hold on a second. 2004.38s - 2005.38s | Thank you so much. 2005.38s - 2010.50s | Yep, I'm still here. 2010.50s - 2020.69s | Hold on. 2020.69s - 2021.69s | I still can't understand who you are. 2021.69s - 2023.69s | I'm sorry, can you say that again? 2023.69s - 2025.69s | Yeah, Dr. Michael Laufer from the Four Thieves Vinegar collective. 2025.69s - 2027.69s | I'm calling from Las Vegas. 2027.69s - 2032.43s | Okay, your call. 2032.43s - 2034.43s | Uh, well, can you put me on with him anyway? 2034.43s - 2039.73s | Hi there, it's Dr. Michael Laufer. 2039.73s - 2041.73s | I'm calling from the


chunk_text:
please. 1976.52s - 1978.52s | Uh, who's calling? 1978.52s - 1980.52s | Uh, this is Dr. Michael Laufer. 1980.52s - 1985.15s | Dr. Michael Laufer from the Four Thieves Vinegar collection, please. 1985.15s - 1989.10s | Sorry, I can't understand what you're saying. 1989.10s - 1991.10s | I'm sorry, the connection's bad. 1991.10s - 1994.10s | Dr. Michael Laufer, I'm calling from Four Thieves. 1994.10s - 1996.10s | He's expecting my call. 1997.10s - 1999.10s | He's expecting your call? 1999.10s - 2001.10s | Uh, yeah. 2001.10s - 2004.38s | Hold on a second. 2004.38s - 2005.38s | Thank you so much. 2005.38s - 2010.50s | Yep, I'm still here. 2010.50s - 2020.69s | Hold on. 2020.69s - 2021.69s | I still can't understand who you are. 2021.69s - 2023.69s | I'm sorry, can you say that again? 2023.69s - 2025.69s | Yeah, Dr. Michael Laufer from the Four Thieves Vinegar collective. 2025.69s - 2027.69s | I'm calling from Las Vegas. 2027.69s - 2032.43s | Okay, your call. 2032.43s - 2034.43s | Uh, well, can you put me on with him anyway? 2034.43s - 2039.73s | Hi there, it's Dr. Michael Laufer. 2039.73s - 2041.73s | I'm calling from the Four Thieves Vinegar collective. 2041.73s - 2046.93s | I remember, but please don't call it again. 2047.93s - 2049.93s | Well, you sure you don't want to chat? 2051.93s - 2057.06s | Hello? 2057.06s - 2062.96s | Well, I tried. 2062.96s - 2064.96s | I was going to invite him down and everything. 2064.96s - 2070.20s | All right, moving on. 2070.20s - 2074.20s | How do you do DIY pharmaceuticals, even if you don't have help? 2074.20s - 2077.20s | Again, you have to automate the chemistry. 2077.20s - 2079.20s | You have to deal with the reaction. 2079.20s - 2085.20s | And, oh, I'm, I'm, I'm cutting down on time. 2085.20s - 2090.20s | So here, again, some of this stuff that I talked about, again, tomorrow at 11 a.m., 2090.20s - 2094.20s | Creator Stage 2, you can come by and you can get all the detail on this. 2094.20s - 2096.20s | I'm going to skip down again. 2096.20s - 2101.20s | And, uh, but you'll see, again, if you look in the, like, side column here, 2101.20s - 2104.20s | you can see all of these really beautiful pictures of things. 2104.20s - 2107.20s |


chunk_text:
Four Thieves Vinegar collective. 2041.73s - 2046.93s | I remember, but please don't call it again. 2047.93s - 2049.93s | Well, you sure you don't want to chat? 2051.93s - 2057.06s | Hello? 2057.06s - 2062.96s | Well, I tried. 2062.96s - 2064.96s | I was going to invite him down and everything. 2064.96s - 2070.20s | All right, moving on. 2070.20s - 2074.20s | How do you do DIY pharmaceuticals, even if you don't have help? 2074.20s - 2077.20s | Again, you have to automate the chemistry. 2077.20s - 2079.20s | You have to deal with the reaction. 2079.20s - 2085.20s | And, oh, I'm, I'm, I'm cutting down on time. 2085.20s - 2090.20s | So here, again, some of this stuff that I talked about, again, tomorrow at 11 a.m., 2090.20s - 2094.20s | Creator Stage 2, you can come by and you can get all the detail on this. 2094.20s - 2096.20s | I'm going to skip down again. 2096.20s - 2101.20s | And, uh, but you'll see, again, if you look in the, like, side column here, 2101.20s - 2104.20s | you can see all of these really beautiful pictures of things. 2104.20s - 2107.20s | But I'll show you just one little bit here. 2107.20s - 2110.20s | Uh, I'm going to have to sort of jump back and forth. 2110.20s - 2114.20s | But here's the, uh, here's the micro lab in all its glory. 2114.20s - 2117.20s | And it's actually doing chemistry here. 2117.20s - 2119.20s | Uh, this isn't going to work. 2119.20s - 2122.20s | It was, uh, this was so slick when I put it together. 2122.20s - 2123.20s | I apologize. 2123.20s - 2126.20s | But here at the end, I'll show you this little bit. 2126.20s - 2130.20s | You have your active pharmaceutical ingredient in the solution in this smaller jar. 2130.20s - 2136.20s | And all you're going to do in the last step of most chemistry is just pour it through a coffee filter. 2136.20s - 2138.20s | It's as simple as that. 2138.20s - 2141.20s | And once you do, then you're going to sit there and you're going to let it drip. 2142.20s - 2146.20s | And all of the impurities flow out and your active pharmaceutical ingredient is left. 2146.20s - 2149.20s | And you just dry out the coffee filter.


chunk_text:
But I'll show you just one little bit here. 2107.20s - 2110.20s | Uh, I'm going to have to sort of jump back and forth. 2110.20s - 2114.20s | But here's the, uh, here's the micro lab in all its glory. 2114.20s - 2117.20s | And it's actually doing chemistry here. 2117.20s - 2119.20s | Uh, this isn't going to work. 2119.20s - 2122.20s | It was, uh, this was so slick when I put it together. 2122.20s - 2123.20s | I apologize. 2123.20s - 2126.20s | But here at the end, I'll show you this little bit. 2126.20s - 2130.20s | You have your active pharmaceutical ingredient in the solution in this smaller jar. 2130.20s - 2136.20s | And all you're going to do in the last step of most chemistry is just pour it through a coffee filter. 2136.20s - 2138.20s | It's as simple as that. 2138.20s - 2141.20s | And once you do, then you're going to sit there and you're going to let it drip. 2142.20s - 2146.20s | And all of the impurities flow out and your active pharmaceutical ingredient is left. 2146.20s - 2149.20s | And you just dry out the coffee filter. 2149.20s - 2153.92s | And there's your drug. 2153.92s - 2158.92s | Again, come by tomorrow and you'll see this all happen in real time. 2158.92s - 2160.92s | Um, I already talked through these systems. 2160.92s - 2165.92s | But, again, these are online services that we have, which we will show. 2165.92s - 2168.92s | Uh, the Recipe Press is a brilliant piece of work. 2168.92s - 2170.92s | Uh, Chemhactica is a brilliant piece of work. 2170.92s - 2173.92s | But let me just talk about Sovaldi specifically. 2173.92s - 2175.92s | Here it is rendered in two dimensions. 2175.92s - 2177.92s | I'm sure you've seen this. 2177.92s - 2179.92s | For those of you who are chemistry phobic, do not let this bother you. 2179.92s - 2181.92s | I promise this is simple. 2181.92s - 2184.92s | Our chemists are brilliant and did the hard work. 2184.92s - 2186.92s | Here's what the reaction looks like. 2186.92s - 2189.92s | And the amazing part of this is that it is only one step. 2189.92s - 2191.92s | So, pay attention. 2191.92s - 2193.92s | This will be very quick. 2193.92s - 2194.92s | It will


chunk_text:
2149.20s - 2153.92s | And there's your drug. 2153.92s - 2158.92s | Again, come by tomorrow and you'll see this all happen in real time. 2158.92s - 2160.92s | Um, I already talked through these systems. 2160.92s - 2165.92s | But, again, these are online services that we have, which we will show. 2165.92s - 2168.92s | Uh, the Recipe Press is a brilliant piece of work. 2168.92s - 2170.92s | Uh, Chemhactica is a brilliant piece of work. 2170.92s - 2173.92s | But let me just talk about Sovaldi specifically. 2173.92s - 2175.92s | Here it is rendered in two dimensions. 2175.92s - 2177.92s | I'm sure you've seen this. 2177.92s - 2179.92s | For those of you who are chemistry phobic, do not let this bother you. 2179.92s - 2181.92s | I promise this is simple. 2181.92s - 2184.92s | Our chemists are brilliant and did the hard work. 2184.92s - 2186.92s | Here's what the reaction looks like. 2186.92s - 2189.92s | And the amazing part of this is that it is only one step. 2189.92s - 2191.92s | So, pay attention. 2191.92s - 2193.92s | This will be very quick. 2193.92s - 2194.92s | It will only take a moment. 2194.92s - 2196.92s | Here's what you have. 2196.92s - 2200.92s | On the right, you will see this ring with fluorines. 2200.92s - 2204.92s | The fluorines and the oxygen will break off like this. 2204.92s - 2208.92s | And you get that little extra stick that wants to connect to an oxygen. 2208.92s - 2210.92s | And there's that lonely little oxygen on the other side. 2210.92s - 2213.92s | And they're going to make friends. 2213.92s - 2217.92s | And they do it like this. 2217.92s - 2219.92s | And for those of you with good short-term memories, 2219.92s - 2223.92s | you will see that this is indeed the molecule that we were trying to get at the beginning. 2223.92s - 2225.92s | A single step. 2225.92s - 2227.92s | And you can get this drug. 2227.92s - 2229.92s | You want to see it in three dimensions? 2229.92s - 2231.92s | Here you go. 2231.92s - 2232.92s | Again. 2232.92s - 2234.92s | The fluorines are the green. 2234.92s - 2236.92s | The oxygens are the red. 2236.92s - 2238.92s | You're going to see this piece break off. 2238.92s -


chunk_text:
only take a moment. 2194.92s - 2196.92s | Here's what you have. 2196.92s - 2200.92s | On the right, you will see this ring with fluorines. 2200.92s - 2204.92s | The fluorines and the oxygen will break off like this. 2204.92s - 2208.92s | And you get that little extra stick that wants to connect to an oxygen. 2208.92s - 2210.92s | And there's that lonely little oxygen on the other side. 2210.92s - 2213.92s | And they're going to make friends. 2213.92s - 2217.92s | And they do it like this. 2217.92s - 2219.92s | And for those of you with good short-term memories, 2219.92s - 2223.92s | you will see that this is indeed the molecule that we were trying to get at the beginning. 2223.92s - 2225.92s | A single step. 2225.92s - 2227.92s | And you can get this drug. 2227.92s - 2229.92s | You want to see it in three dimensions? 2229.92s - 2231.92s | Here you go. 2231.92s - 2232.92s | Again. 2232.92s - 2234.92s | The fluorines are the green. 2234.92s - 2236.92s | The oxygens are the red. 2236.92s - 2238.92s | You're going to see this piece break off. 2238.92s - 2241.92s | And you're going to see this extra little stick. 2241.92s - 2244.92s | And it wants to come around in a little smooch. 2244.92s - 2246.92s | And there is Sovaldi. 2246.92s - 2251.92s | Now, eventually, you're going to have to make bills. 2251.92s - 2255.92s | They just passed a law that makes owning a pill press a felony. 2255.92s - 2257.92s | Hilarious. 2257.92s - 2261.92s | Because all you need is something that will press something. 2261.92s - 2263.92s | I've had people tell me that reloading devices can do this. 2263.92s - 2266.92s | A simple Arbor press will do it too. 2266.92s - 2268.92s | Say you want a pill mold? 2268.92s - 2270.92s | You can print one out of resin. 2270.92s - 2273.92s | Then you take your active pharmaceutical ingredient. 2273.92s - 2275.92s | You tap it in. 2275.92s - 2277.92s | You fill it up. 2277.92s - 2279.92s | You put the plunger in. 2279.92s - 2281.92s | You press it down. 2281.92s - 2285.23s | And then you spray it with glitter. 2285.23s - 2287.23s | Why do you spray it with glitter? 2287.23s - 2290.23s |


chunk_text:
2241.92s | And you're going to see this extra little stick. 2241.92s - 2244.92s | And it wants to come around in a little smooch. 2244.92s - 2246.92s | And there is Sovaldi. 2246.92s - 2251.92s | Now, eventually, you're going to have to make bills. 2251.92s - 2255.92s | They just passed a law that makes owning a pill press a felony. 2255.92s - 2257.92s | Hilarious. 2257.92s - 2261.92s | Because all you need is something that will press something. 2261.92s - 2263.92s | I've had people tell me that reloading devices can do this. 2263.92s - 2266.92s | A simple Arbor press will do it too. 2266.92s - 2268.92s | Say you want a pill mold? 2268.92s - 2270.92s | You can print one out of resin. 2270.92s - 2273.92s | Then you take your active pharmaceutical ingredient. 2273.92s - 2275.92s | You tap it in. 2275.92s - 2277.92s | You fill it up. 2277.92s - 2279.92s | You put the plunger in. 2279.92s - 2281.92s | You press it down. 2281.92s - 2285.23s | And then you spray it with glitter. 2285.23s - 2287.23s | Why do you spray it with glitter? 2287.23s - 2290.23s | Well, to put it in the words of one of our chemists, 2290.23s - 2294.23s | if it doesn't sparkle, it's not my revolution. 2294.23s - 2308.53s | I know I've put this figure up many times. 2308.53s - 2311.53s | But it still horrifies me. 2311.53s - 2314.53s | No matter how many times I see it. 2314.53s - 2317.53s | This is a commercial Sovaldi pill. 2317.53s - 2322.26s | This is a $1,000 bill. 2322.26s - 2324.26s | Now, they're in circulation. 2324.26s - 2326.26s | Not much. 2326.26s - 2328.26s | But they're around. 2328.26s - 2330.26s | You can find them. 2330.26s - 2336.03s | They're mostly collector's items. 2336.03s - 2338.03s | But you can get them. 2338.03s - 2340.03s | Grover Cleveland, everybody. 2340.03s - 2342.03s | $1,000. 2342.03s - 2344.03s | How ridiculous is this? 2344.03s - 2349.03s | Now, contrastingly, here's our little pill that we made for $3.50 worth of materials. 2349.03s - 2352.03s | So here's a question. 2352.03s - 2354.03s | Which would you pick? 2354.03s - 2358.28s | Now, I happen to have one of these pills. 2358.28s - 2361.91s | What would you pick? 2361.91s -


chunk_text:
Well, to put it in the words of one of our chemists, 2290.23s - 2294.23s | if it doesn't sparkle, it's not my revolution. 2294.23s - 2308.53s | I know I've put this figure up many times. 2308.53s - 2311.53s | But it still horrifies me. 2311.53s - 2314.53s | No matter how many times I see it. 2314.53s - 2317.53s | This is a commercial Sovaldi pill. 2317.53s - 2322.26s | This is a $1,000 bill. 2322.26s - 2324.26s | Now, they're in circulation. 2324.26s - 2326.26s | Not much. 2326.26s - 2328.26s | But they're around. 2328.26s - 2330.26s | You can find them. 2330.26s - 2336.03s | They're mostly collector's items. 2336.03s - 2338.03s | But you can get them. 2338.03s - 2340.03s | Grover Cleveland, everybody. 2340.03s - 2342.03s | $1,000. 2342.03s - 2344.03s | How ridiculous is this? 2344.03s - 2349.03s | Now, contrastingly, here's our little pill that we made for $3.50 worth of materials. 2349.03s - 2352.03s | So here's a question. 2352.03s - 2354.03s | Which would you pick? 2354.03s - 2358.28s | Now, I happen to have one of these pills. 2358.28s - 2361.91s | What would you pick? 2361.91s - 2365.29s | The bill or the pill? 2365.29s - 2369.70s | So who would take this collector's item? 2369.70s - 2371.70s | Yeah? 2371.70s - 2375.81s | All right, come up. 2375.81s - 2379.81s | Now, these are actually worth more than $1,000 because they're so rare. 2379.81s - 2383.50s | There you go. 2383.50s - 2385.50s | Yours to keep. 2385.50s - 2387.50s | Joke's on you, though. 2387.50s - 2389.50s | It's counterfeit. 2389.50s - 2394.26s | So you're actually in violation of a whole bunch of laws right now because you took that from me. 2394.26s - 2396.26s | But realistically, this is not counterfeit. 2396.26s - 2398.26s | It's pirated. 2398.26s - 2400.26s | There's a difference. 2400.26s - 2402.26s | This doesn't try to look like something it's not. 2402.26s - 2408.26s | This does the exact same thing as the thing that it's trying to be. 2408.26s - 2410.26s | And it doesn't have to try. 2410.26s - 2423.26s | This is both chemically and isomorphically identical to anything that you would get in a pharmacy if you had the money. 2423.26s - 2427.26s | Now, I get this question a lot. 2427.26s -


chunk_text:
2365.29s | The bill or the pill? 2365.29s - 2369.70s | So who would take this collector's item? 2369.70s - 2371.70s | Yeah? 2371.70s - 2375.81s | All right, come up. 2375.81s - 2379.81s | Now, these are actually worth more than $1,000 because they're so rare. 2379.81s - 2383.50s | There you go. 2383.50s - 2385.50s | Yours to keep. 2385.50s - 2387.50s | Joke's on you, though. 2387.50s - 2389.50s | It's counterfeit. 2389.50s - 2394.26s | So you're actually in violation of a whole bunch of laws right now because you took that from me. 2394.26s - 2396.26s | But realistically, this is not counterfeit. 2396.26s - 2398.26s | It's pirated. 2398.26s - 2400.26s | There's a difference. 2400.26s - 2402.26s | This doesn't try to look like something it's not. 2402.26s - 2408.26s | This does the exact same thing as the thing that it's trying to be. 2408.26s - 2410.26s | And it doesn't have to try. 2410.26s - 2423.26s | This is both chemically and isomorphically identical to anything that you would get in a pharmacy if you had the money. 2423.26s - 2427.26s | Now, I get this question a lot. 2427.26s - 2432.26s | Now, of course, the point of all of this is that you don't have to test it. 2432.26s - 2437.26s | The systems are designed so that all of the care and attention you can get on the front end. 2437.26s - 2439.26s | And then you don't have to. 2439.26s - 2442.26s | But we did anyway. 2442.26s - 2452.26s | Anybody out there who knows how to read a high-performance liquid chromatography readout will see that this is fucking amazing. 2452.26s - 2454.26s | That spike is perfect. 2454.26s - 2456.26s | There's only one thing in there. 2456.26s - 2460.26s | For those of you who don't read these, here's something a little more quantitative. 2460.26s - 2464.93s | And I will draw your attention to this number. 2464.93s - 2466.93s | That's the purity. 2466.93s - 2480.65s | Before you get too impressed, allow me to say, if you were to buy Sovaldi in the raw from a chemical supplier, you only get 98%. 2480.65s - 2490.65s | And again, for those of you who are astute with numbers, you will notice this is an order of magnitude more pure than what you would


chunk_text:
2432.26s | Now, of course, the point of all of this is that you don't have to test it. 2432.26s - 2437.26s | The systems are designed so that all of the care and attention you can get on the front end. 2437.26s - 2439.26s | And then you don't have to. 2439.26s - 2442.26s | But we did anyway. 2442.26s - 2452.26s | Anybody out there who knows how to read a high-performance liquid chromatography readout will see that this is fucking amazing. 2452.26s - 2454.26s | That spike is perfect. 2454.26s - 2456.26s | There's only one thing in there. 2456.26s - 2460.26s | For those of you who don't read these, here's something a little more quantitative. 2460.26s - 2464.93s | And I will draw your attention to this number. 2464.93s - 2466.93s | That's the purity. 2466.93s - 2480.65s | Before you get too impressed, allow me to say, if you were to buy Sovaldi in the raw from a chemical supplier, you only get 98%. 2480.65s - 2490.65s | And again, for those of you who are astute with numbers, you will notice this is an order of magnitude more pure than what you would get if you bought it. 2490.65s - 2495.15s | Where'd my goon go? I need another shot. 2495.15s - 2497.15s | Thank you, sir. 2497.15s - 2500.98s | Watch this. 2500.98s - 2514.19s | My team's watching, and they're all freaking out right now because I didn't tell them I was going to do this. 2514.19s - 2519.46s | And I don't even have the hepatitis that I know of. 2519.46s - 2522.46s | All right. Let's keep going. 2522.46s - 2524.46s | I have five minutes. 2524.46s - 2526.46s | Want to quote some other superheroes? 2526.46s - 2528.46s | You'll notice this. 2528.46s - 2536.25s | Now, this is the fourth time I'm mentioning this. 2536.25s - 2546.25s | And I mention this because this entire course of treatment can be made for $300 in raw materials. 2546.25s - 2551.25s | And I happen to have it right here. 2551.25s - 2556.25s | Now, who said they had a friend who was infected with hepatitis? 2556.25s - 2558.25s | There were a couple people. 2558.25s - 2562.10s | Right here? 2562.10s - 2568.62s | You. Come up here. 2568.62s - 2570.62s | Keep your friend healthy. Keep them


chunk_text:
get if you bought it. 2490.65s - 2495.15s | Where'd my goon go? I need another shot. 2495.15s - 2497.15s | Thank you, sir. 2497.15s - 2500.98s | Watch this. 2500.98s - 2514.19s | My team's watching, and they're all freaking out right now because I didn't tell them I was going to do this. 2514.19s - 2519.46s | And I don't even have the hepatitis that I know of. 2519.46s - 2522.46s | All right. Let's keep going. 2522.46s - 2524.46s | I have five minutes. 2524.46s - 2526.46s | Want to quote some other superheroes? 2526.46s - 2528.46s | You'll notice this. 2528.46s - 2536.25s | Now, this is the fourth time I'm mentioning this. 2536.25s - 2546.25s | And I mention this because this entire course of treatment can be made for $300 in raw materials. 2546.25s - 2551.25s | And I happen to have it right here. 2551.25s - 2556.25s | Now, who said they had a friend who was infected with hepatitis? 2556.25s - 2558.25s | There were a couple people. 2558.25s - 2562.10s | Right here? 2562.10s - 2568.62s | You. Come up here. 2568.62s - 2570.62s | Keep your friend healthy. Keep them safe. 2570.62s - 2574.60s | Thank you so much. 2574.60s - 2582.14s | We should be doing this every day. 2582.14s - 2588.58s | I get this question a lot. 2588.58s - 2593.82s | I'm going to move on now. 2593.82s - 2599.82s | Again, if you don't differentiate between morality and legality, one of us is in the wrong conference. 2599.82s - 2601.82s | Again, none of our work scales up. 2601.82s - 2604.82s | This is worth noting because those of you who are like, wow, he does stuff super cheap. 2604.82s - 2606.82s | Maybe I could start a business. 2606.82s - 2608.82s | I mean, go nuts, right? 2608.82s - 2610.82s | But you're going to be wasting it. 2610.82s - 2612.82s | Talk to a chemical engineer. 2612.82s - 2614.82s | Scaling chemistry is very difficult. 2614.82s - 2616.82s | When you do it on a small scale, it's much easier. 2616.82s - 2618.82s | And additionally, some people are like, oh, that's super exciting. 2618.82s - 2620.82s | How do I get one? 2620.82s - 2622.82s | You make it. 2622.82s - 2624.82s | We don't sell anything. 2624.82s - 2626.82s | We don't


chunk_text:
safe. 2570.62s - 2574.60s | Thank you so much. 2574.60s - 2582.14s | We should be doing this every day. 2582.14s - 2588.58s | I get this question a lot. 2588.58s - 2593.82s | I'm going to move on now. 2593.82s - 2599.82s | Again, if you don't differentiate between morality and legality, one of us is in the wrong conference. 2599.82s - 2601.82s | Again, none of our work scales up. 2601.82s - 2604.82s | This is worth noting because those of you who are like, wow, he does stuff super cheap. 2604.82s - 2606.82s | Maybe I could start a business. 2606.82s - 2608.82s | I mean, go nuts, right? 2608.82s - 2610.82s | But you're going to be wasting it. 2610.82s - 2612.82s | Talk to a chemical engineer. 2612.82s - 2614.82s | Scaling chemistry is very difficult. 2614.82s - 2616.82s | When you do it on a small scale, it's much easier. 2616.82s - 2618.82s | And additionally, some people are like, oh, that's super exciting. 2618.82s - 2620.82s | How do I get one? 2620.82s - 2622.82s | You make it. 2622.82s - 2624.82s | We don't sell anything. 2624.82s - 2626.82s | We don't even sell merch. 2626.82s - 2633.74s | We have a merch page on our website showing you how you can make your own. 2633.74s - 2635.74s | You've all seen this stamp. 2635.74s - 2637.74s | This is when an authority figure tells you you're allowed. 2637.74s - 2639.74s | Now, some people decided this might look cute. 2639.74s - 2643.74s | But you will never see this on anything ever. 2643.74s - 2649.74s | Because we are not an authority figure, and we are not telling you what to think or what to do. 2649.74s - 2661.74s | The only thing that the Four Thieves Vinegar Collective will ever approve is you making your own decisions about your own health. 2661.74s - 2663.74s | And that we've already approved. 2663.74s - 2665.74s | So, go on and do the thing. 2665.74s - 2672.96s | I'm running low on time. 2672.96s - 2680.96s | So I'm going to skip this slide, but we have some more deep ideological ideas that I would rant about if I had more on the clock. 2680.96s - 2688.13s | Again, come to the Biohacking Village tomorrow. 2688.13s - 2691.38s | You'll be able to


chunk_text:
even sell merch. 2626.82s - 2633.74s | We have a merch page on our website showing you how you can make your own. 2633.74s - 2635.74s | You've all seen this stamp. 2635.74s - 2637.74s | This is when an authority figure tells you you're allowed. 2637.74s - 2639.74s | Now, some people decided this might look cute. 2639.74s - 2643.74s | But you will never see this on anything ever. 2643.74s - 2649.74s | Because we are not an authority figure, and we are not telling you what to think or what to do. 2649.74s - 2661.74s | The only thing that the Four Thieves Vinegar Collective will ever approve is you making your own decisions about your own health. 2661.74s - 2663.74s | And that we've already approved. 2663.74s - 2665.74s | So, go on and do the thing. 2665.74s - 2672.96s | I'm running low on time. 2672.96s - 2680.96s | So I'm going to skip this slide, but we have some more deep ideological ideas that I would rant about if I had more on the clock. 2680.96s - 2688.13s | Again, come to the Biohacking Village tomorrow. 2688.13s - 2691.38s | You'll be able to see everything. 2691.38s - 2693.38s | This is an American phrase, isn't it? 2693.38s - 2697.38s | I'm going to add another one from the same genre. 2697.38s - 2704.88s | And with this, I would like to address the feds out there. 2704.88s - 2708.88s | And some of the execs from pharmacy. 2708.88s - 2710.88s | I've spotted some of you during the day. 2710.88s - 2712.88s | And I'd like to say the following. 2712.88s - 2716.88s | I would rather be singing your praises. 2716.88s - 2722.88s | I would like it much better if you did your work properly. 2722.88s - 2726.88s | So that our work became obsolete and we could go do something else. 2726.88s - 2736.88s | But until you do, if you would like to stop me, you will have to send assassins. 2736.88s - 2756.88s | Because, so long as you stand between people and the medicines they need, due to your greed, or your ignorance, or your cowardice, I will fight you until I curse you with my dying breath. 2756.88s - 2760.88s | And when you kill me, it won't matter much. 2760.88s - 2762.88s | I'm just


chunk_text:
see everything. 2691.38s - 2693.38s | This is an American phrase, isn't it? 2693.38s - 2697.38s | I'm going to add another one from the same genre. 2697.38s - 2704.88s | And with this, I would like to address the feds out there. 2704.88s - 2708.88s | And some of the execs from pharmacy. 2708.88s - 2710.88s | I've spotted some of you during the day. 2710.88s - 2712.88s | And I'd like to say the following. 2712.88s - 2716.88s | I would rather be singing your praises. 2716.88s - 2722.88s | I would like it much better if you did your work properly. 2722.88s - 2726.88s | So that our work became obsolete and we could go do something else. 2726.88s - 2736.88s | But until you do, if you would like to stop me, you will have to send assassins. 2736.88s - 2756.88s | Because, so long as you stand between people and the medicines they need, due to your greed, or your ignorance, or your cowardice, I will fight you until I curse you with my dying breath. 2756.88s - 2760.88s | And when you kill me, it won't matter much. 2760.88s - 2762.88s | I'm just another human. 2762.88s - 2768.88s | Like the thousands who die from your inaction every day. 2768.88s - 2772.88s | And the other members of Four Thieves will step in to continue the work. 2772.88s - 2780.88s | And the future members of Four Thieves that are probably sitting right next to you now will come to join them. 2780.88s - 2782.88s | And the ones far away we haven't even met yet. 2782.88s - 2787.88s | Because we are fighting for nothing less than our lives. 2787.88s - 2796.06s | Help is not on the way. 2796.06s - 2798.06s | I will say this last. 2798.06s - 2802.06s | My fellow hackers, come join us. 2802.06s - 2806.06s | And we have one last tool that everyone can use. 2806.06s - 2809.06s | And you don't need to read anything about it. 2809.06s - 2813.06s | And you don't need to build anything. 2813.06s - 2824.06s | The next time a medical officer says you can't have what you need, look them in the eye and say, if you will not help me, I will make this myself. 2824.06s - 2826.06s | Because that's the truth. 2826.06s - 2828.06s


chunk_text:
another human. 2762.88s - 2768.88s | Like the thousands who die from your inaction every day. 2768.88s - 2772.88s | And the other members of Four Thieves will step in to continue the work. 2772.88s - 2780.88s | And the future members of Four Thieves that are probably sitting right next to you now will come to join them. 2780.88s - 2782.88s | And the ones far away we haven't even met yet. 2782.88s - 2787.88s | Because we are fighting for nothing less than our lives. 2787.88s - 2796.06s | Help is not on the way. 2796.06s - 2798.06s | I will say this last. 2798.06s - 2802.06s | My fellow hackers, come join us. 2802.06s - 2806.06s | And we have one last tool that everyone can use. 2806.06s - 2809.06s | And you don't need to read anything about it. 2809.06s - 2813.06s | And you don't need to build anything. 2813.06s - 2824.06s | The next time a medical officer says you can't have what you need, look them in the eye and say, if you will not help me, I will make this myself. 2824.06s - 2826.06s | Because that's the truth. 2826.06s - 2828.06s | You can. 2828.06s - 2830.06s | Thank you so much.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=BIjgd2mOEks", "title": "DEF CON 32 - Human Dignity in AI and Tech Policy - Jan Trzaskowski", "description": "Social media have been a decade-long dress rehearsal in online manipulation. AI can create information, make predictions and take decisions that will affect human behaviour, including our behaviours as citizens, workers and consumers. Safeguards are needed, since generative AI will only exacerbate the personal, social and societal harms already caused by data-driven business models.\n\nWe examine the centrality of human dignity in tech law and policy and how our mindsets and legal frameworks must be informed by psychological, technological and societal perspectives. Based on insights from market dynamics, marketing techniques, design strategies, and human frailties we demonstrate how information asymmetries have reduced individual agency and the ability to create transparency.\n\nHuman dignity is a core value in liberal democracies that must also be reflected in tech policy. Protections are required when businesses interfere with our rights to freedom, property, privacy and non-discrimination. With the digitalisation of the human experience, users have become programmable objects. We cannot rely on regulation alone and need to discuss how we can act to reclaim our dignity.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2263, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 4.00s | This text was transcribed using whisper model: large-v2 Thank you so much for sharing your attention with me today. 4.00s - 8.00s | The technology is not really working, but I'll explain what's on the slides, 8.00s - 11.00s | and you can download them if they don't get up here. 11.00s - 15.00s | So, I'm a law professor at Copenhagen Business School and Aalborg University, 15.00s - 20.00s | and I'm here to talk about hacking human behavior. 20.00s - 27.00s | I will talk about big tech arrogance, human ignorance, 27.00s - 32.00s | what human dignity can be used for, what to do about it, 32.00s - 34.00s | so that's what I'm going to talk about. 34.00s - 37.00s | Everything is based on the book you can see on the screen there. 37.00s - 43.00s | It's an orange book. I'll leave a copy at the Policy Village for you to see. 43.00s - 47.00s | So, the good thing is it's available online, and you can find the link on the slides 47.00s - 50.00s | whenever you get there. 50.00s - 55.00s | Okay, so you're there, so


