# Media

url: https://www.youtube.com/watch?v=qY0Yb8_R3a0
title: DEF CON 32 - Bypass 101- Bill Graydon
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=qY0Yb8_R3a0",
  "title": "DEF CON 32 - Bypass 101- Bill Graydon",
  "description": "There are loads of ways to get through a door without actually attacking the lock itself, including using the egress hardware, access control hardware, and countless other techniques to gain entry. Learn how to do these attacks in this talk!",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1348,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 3.94s | This text was transcribed using whisper model: large-v2

 Welcome. Can everyone hear me alright? Everyone see the screen except for what is not
3.94s - 10.58s |  loading. So, now is the part of the talk where you wholeheartedly boo the speaker for not
10.58s - 15.78s |  downloading his own slides locally before relying on the Defcon wifi to give the talk. So
15.78s - 22.61s |  let's let's hear it. Big ol' big ol' boo for my lack of preparedness. I fucked it up
22.61s - 27.61s |  already. So, this is actually a little bit appropriate though given a lot of what I'm
27.61s - 33.31s |  going to talk about. Because what you, if you were here for the talk an hour ago when we
33.31s - 37.71s |  with Physical Security Village gave the Bypass 101 talk, we were talking about all the
37.71s - 44.23s |  elite hacks that you can do to hack into physical systems and get them to behave in ways
44.23s - 49.77s |  that they're not supposed to. A lot of what this talk is gonna end up converging on is not
49.77s - 54.37s |  doing advanced elite hacks yourself, but just systems that don't work the way they're
54.37s - 61.71s |  supposed to in the first place. And wifi as we're seeing is one of them. So, we'll we'll get
61.71s - 66.77s |  the vis- visuals that we can and I'll talk you through the rest. But um, every time you
66.77s - 71.81s |  see one of these images that doesn't load, keep in mind that is the exact same failure mode
71.81s - 77.85s |  as a lot of physical security systems that don't operate as intended and that's some of the
77.87s - 84.86s |  things that we're gonna focus on in this talk. So, we're gonna go over a bunch of very high
87.66s - 93.74s |  level of the type of bypasses, type of security that we need to concern about. So, bypass, lock
93.74s - 98.04s |  picking, forcible entry, we'll talk about that a little bit. Alarm and detection and then
98.04s - 102.92s |  surveillance. We'll have to focus on how to bring it up and how to get action. All of this in
102.92s - 109.32s |  the context of an internal employee where your main job description is not auditing the
109.34s - 112.78s |  company's physical security. So, there's a lot of people and we get a lot of questions at the
112.78s - 118.58s |  village about this. People that notice flaws in their employer's physical security wonder how
118.58s - 124.62s |  to bring it up, what's important and so that's what we're gonna talk about here. And I'm gonna
124.62s - 131.06s |  hammer this through throughout the talk. A lot of what is most critical to bring up is stupid
131.06s - 138.11s |  shit. So, let's watch some videos of stupid shit. If we can. Alright, so the door is locked.
138.89s - 143.89s |  Doesn't open. Hit the uh, hit the accessibility button. And it pops right open. So this is a
149.69s - 154.47s |  surprisingly common failure mode. It is a simple misconfiguration in the programming
154.47s - 160.97s |  software or in the wiring. When it's a wiring problem, it is just, it thinks this is the
160.97s - 165.91s |  accessibility button on the inside, the secure side of the door and it causes that system to
165.91s - 172.89s |  unlock the door and cause it to open up. So stupid shit, misconfigurations like that. You
172.89s - 177.89s |  also get stupid shit like this. Lock cage. Reach around. Slam the bar and you're through.
184.82s - 191.06s |  There's a couple reasons that stupid shit like this is so relevant to security in general but
191.06s - 197.16s |  also to internal employees bringing it up. Number one from security in general is a threat
197.16s - 201.70s |  modeling perspective. Hitting the accessibility button, reaching around, that's
201.70s - 206.70s |  something that any idiot can look at and see, this is something that might work and they can
206.70s - 212.74s |  try it. It takes no skill whatsoever. When you're bringing up flaws to particularly your own
212.74s - 218.12s |  employer, the less skill it takes, the better in terms of them understanding the
218.12s - 224.48s |  criticality of that problem. If it's a, an advanced, high skilled, high barrier to entry
224.48s - 229.72s |  attack that you're demonstrating, the more it shows off your skills as an attacker, the less
229.72s - 236.76s |  relevant it is from a threat modeling perspective. And so that is why systems that just plain
236.76s - 241.76s |  old don't work, like wifi sometimes, is, is something that uh, is most relevant for this. So
245.76s - 251.94s |  I'm gonna switch off of the presenter mode here and we'll see what we can see. So latch
251.94s - 257.14s |  targeted bypass is something that we talk about in bypass 101. And the physical security
257.14s - 263.22s |  village right across the hall here, quick show of hands, who has uh, checked us out so far? Lot
263.22s - 266.98s |  of people. For those who haven't, I highly recommend it. Everything I'm gonna talk about in
266.98s - 273.46s |  this talk you can try it for yourself in the village. These latches allow self-closing doors
273.46s - 279.10s |  to self-latch and self-lock afterwards. You can often stick a tool in just like we're showing
279.10s - 285.10s |  in this picture here and retract that latch, pull the door open. So again, really low
285.10s - 291.18s |  skilled, easy to demonstrate, easy to show to someone at your workplace of anyone with a bent
291.18s - 297.02s |  wire can do this and open this locked door. And that's something that really gets, gets
297.02s - 303.92s |  results there. This dead latch is what's meant to prevent that. That little half moon there.
303.92s - 308.56s |  Those half moon designs by the way are terrible because if that dead latch is retracted it
308.56s - 313.00s |  will prevent you from pushing it in. You can try that out in the village. When it falls into
313.00s - 318.00s |  the strike plate hole, that allows you to do that latch targeted bypass. So bypasses that are
320.80s - 327.80s |  easy, quick to demonstrate are by far the best ones to bring up in that context. Lock picking
327.80s - 332.98s |  is somewhat relevant. If you're a skilled enough lock picker, this is something that you can
333.00s - 339.74s |  bring up. If you see a critical installation behind a poorly done lock, that might be
339.74s - 345.98s |  something you want to do. As with all lock picking, ask permission before you attempt to pick
345.98s - 351.06s |  any locks. Right? With, with that stupid shit before we reach around and hit the thing, it's
351.06s - 356.50s |  like, that's something that any idiot can see and do. As soon as you stick a pick into a
356.52s - 361.46s |  keyway, you now run afoul of possibly the law, depending on your jurisdiction, possibly
361.46s - 366.46s |  ethics, and very likely your employer's code of conduct. So ask permission there. But when
369.64s - 374.34s |  you have permission and if you see a lock that you know, I can pick that, that's very easy. It
374.34s - 379.34s |  should not be protecting all of our inventory. Or all of our PII. Or whatever it is that you
379.34s - 383.94s |  have behind that, that lock door, in that lock cabinet, whatever it is. You can either ask
383.96s - 388.72s |  permission and half the time, you don't even need to demonstrate. You can just tell them, I
388.72s - 396.47s |  know a lot about this. This lock is not well suited for the job. I will call attention to
396.47s - 402.55s |  leashy tools briefly. Who has heard about these before? A good chunk of people in the room.
402.55s - 407.31s |  These are a game changer when it comes to threat modeling. And I suspect that in the next
407.31s - 413.95s |  five or ten years, we're going to see more and more criminals on a lower level using them.
413.95s - 421.03s |  Because they are so damn easy to pick. So next time you're at work or even at home, if your
421.03s - 426.97s |  keyway looks like this, with the little Z shape at the bottom, that Schlage C keyway, if it
426.97s - 432.45s |  says Schlage on top, you're okay. Schlage locks are well made, they have security pins,
432.45s - 436.59s |  they're tight tolerances. They're still very pickable with these leashes, but it takes at
436.59s - 441.69s |  least a little bit of skill. If it says nothing on top, that means it's a Chinese clone of a
441.69s - 447.47s |  Schlage C keyway. Picking is very easy, just raking, but with these leashes it makes it
447.47s - 453.71s |  trivial. No skill required whatsoever. And so that's that's a tool you can look up and if you
453.71s - 460.85s |  use those in your workplace, particularly for higher security, higher criticality doors, at
460.85s - 464.55s |  the very least you want to use a proper Schlage, but ideally switch it out for a higher
464.55s - 469.49s |  security lock that this tool does not exist for. The last thing that leashes are capable of is
469.49s - 473.77s |  these numbers along the back here. Once you pick the lock, you can actually read off the
473.77s - 478.87s |  number and make a key for that lock based on picking it once and the information that tool
478.87s - 484.43s |  pulls out for you. So again, something that if your employer doesn't want someone with 30
484.43s - 488.57s |  seconds of access to the lock to be able to then make a key that works forevermore, it's worth
488.57s - 496.40s |  bringing up. Forcible entry is worth talking about even though in the PhysSec village we
496.40s - 501.54s |  talk about lock bypass a lot and covert entry, how you can get in without damaging stuff, your
501.54s - 506.78s |  threat model in the real world is usually forcible entry. And so that's something that what
506.78s - 511.58s |  that's why I've taglined this, why hackers often get physical security wrong. You need to
511.58s - 518.62s |  think about what's actually going to be done. No door is invulnerable. Any door can be
518.62s - 524.16s |  breached with sufficient force, skill, time, money and motivation. And forcible entry is
524.16s - 529.66s |  usually the way to do that. So this image here is a halogen tool. It is what firefighters
529.66s - 534.00s |  use. There is a full science to this that has been developed over the past 80 years that
534.00s - 539.70s |  firefighters use to get into burning buildings as fast as possible. Criminals are not quite
539.70s - 543.88s |  so fast. They're a little bit louder. They have a different set of tools and techniques that
543.88s - 549.72s |  they use. But any door can be forced with sufficient time. The defense against that is
549.72s - 557.40s |  detection and response. And we're going to drill that into this talk as well. You need to
557.40s - 561.70s |  think about your threat modeling when talking about forcible entry. So if say you you look
561.70s - 565.34s |  this up a bit, you'll you'll learn about thermal lances and various advanced forcible entry
565.34s - 569.72s |  tools. That's usually not within the threat model for most employers and most most
569.72s - 577.22s |  facilities. Um you uh or UFC 402001 has a good taxonomy of that. So if you want a nice
578.20s - 584.72s |  science based way to explain what the forcible entry resistance of a door is going to be
584.72s - 594.78s |  without actually forcing it and damaging it, this is a great reference doc for you. So we'll
594.78s - 599.78s |  switch back into slide mode, see if videos load. And you want to look at the full set of
599.78s - 605.26s |  hardware as well. So this is an Abloy lock. Abloy Protek. It is not going to be picked. The
605.26s - 610.12s |  locking hardware itself has not given in the forced entry. This hollow wooden door has just
610.14s - 615.14s |  splintered like a toothpick. And so even just knocking on a door, pushing it with your palm,
618.02s - 623.96s |  giving it a prod with your knee, you can feel where that door gives. And you can get a feel
623.96s - 629.60s |  for if I were to hit this with a battering ram with my shoulder, give it a good kick, where is
629.60s - 634.46s |  that door going to give? Is it going to give? And that's something that is relevant if you
634.48s - 640.32s |  have items of value or that would be a great problem to your company from a secrecy
640.32s - 645.32s |  perspective for instance, if it got out. So I talked about the um, the science that
648.96s - 657.54s |  firefighters use to lever doors open. What often happens is something like this. So we see
662.44s - 666.48s |  burglar walking along carrying a gym bag full of tools. Gym bags full of tools by the way are
666.50s - 671.50s |  one of their biggest uh, carrying cases of choice. And so we're going to see how he uses this
674.16s - 678.88s |  crowbar to actually lever that door open. So there's lots of places you can get purchase
678.88s - 683.88s |  around the jam here. And we'll take a look at his advanced uh, technique that he uses. Nope,
685.72s - 693.74s |  right through the window. Right, so a big ol' window like that, it's good for people to see
693.78s - 699.22s |  in and to merchandise the store during open hours, but that's just a little door for him at
699.22s - 703.80s |  that point. Right, so again depending on the money you want to spend to harden that door,
703.80s - 708.16s |  detection and response is your ideal situation there. What happens in real life in situations
708.16s - 712.44s |  like this by the way, is he walks the block and he cases it out. And he's going to look for
712.44s - 717.20s |  stores that have a vulnerability like that. And so it's like the old joke about you just have
717.20s - 721.74s |  to outrun your friend, not the bear. You just have to be more secure than your neighbor and
721.74s - 726.18s |  that's going to cause low level attackers like this to go somewhere else. And that applies in a
726.18s - 730.22s |  threat model where you're just protecting money, you're just protecting assets of a relatively
730.22s - 736.22s |  low value. He's going to go in and he knows to be in and out in five minutes. Right, he's
736.22s - 740.70s |  going to grab, the till should be empty but anything of value there, any merchandise of
740.70s - 745.70s |  value, smash, literally a smash and grab in and out in five minutes. So if you see a jam like
745.84s - 750.84s |  this, thin wood veneer, one and a half inch screws holding these metal strike plates in, that's
754.94s - 760.78s |  going to survive one kick and someone's through. So forcible entry is worth considering. To
760.78s - 765.66s |  secure a site you need detectors on the entire perimeter or the interior, delay the intruder
765.66s - 773.09s |  and respond fast enough with greater force to stop someone who has forced their way in. In
773.09s - 778.19s |  just a time we'll skip through a few. There are some alarm bypasses that we talk about in
778.19s - 783.77s |  the village. So if you have detection that's a magnetic contact sensor and that magnet can
783.77s - 789.37s |  be bypassed by holding a surrogate magnet up to it. That's something that is a whole lot
789.37s - 793.87s |  less common to see and is not in many threat models of someone that's just smashing the window
793.87s - 798.11s |  open. But you know what, if they smash that window open and walk through the window, at no
798.11s - 802.85s |  point does the door open, at no point does that contact sensor trip and that person is inside
802.85s - 807.79s |  without tripping the alarm. And so that's why something like an internal areas detector is
807.79s - 814.05s |  worth considering. We also have PIR sensors in the village and a cool little corridor you
814.05s - 819.19s |  can walk back and try to evade those. And so that's something you can practice, get hands on
819.19s - 824.33s |  with it and go back to your workplace and be like, I successfully evaded this at DEFCON,
824.33s - 829.97s |  here's how I did it. And assess whether it's in your threat model for an attacker to actually
829.99s - 839.27s |  try that. So we'll skip through a bunch in the interest of time. This is probably the most
839.27s - 845.95s |  important diagram to understand for most workplaces. This is a standard setup for an
845.95s - 850.95s |  electronic access control door. So you tap your fob, the door opens and you enter. What's
853.45s - 858.33s |  important to consider now is what happens when you exit and what happens when someone forces
858.35s - 863.35s |  in. When you exit, you tap or you don't tap the fob, you just approach the door on the secure
866.49s - 872.67s |  side and this request to exit sensor, it uses passive infrared technology, detects that
872.67s - 877.07s |  someone is exiting, it's gonna tell the alarm controller, someone's on the inside, someone's
877.07s - 882.21s |  exiting, when the door opens and it's detected by this magnetic contact sensor, it says
882.23s - 889.71s |  suppress the alarm, someone's exiting. When someone enters, they tap their badge here and
889.71s - 894.05s |  then it detects door open, someone's entered, normal entry, no problem. If that door gets
894.05s - 899.05s |  forced open, we have contact sensor breached, no exit detected here, no card swipe, that's
901.29s - 906.83s |  when it's gonna send a door forced alarm. What happens with these door forced alarms, 80%
906.83s - 912.61s |  of the time is nothing. They get logged somewhere, sometimes they don't even get logged, there
912.63s - 918.53s |  is no response. And so we're not talking about hacking a functional system, we're talking
918.53s - 923.67s |  about a system that was not functional from the start. Stupid shit. And that's the type of
923.67s - 928.37s |  thing that is really gonna get employer's attentions and is worth bringing up before you
928.37s - 933.77s |  start talking about hacks and bypasses and how you can cause a functional system to not
933.77s - 941.68s |  work as intended. This is one of those things that's worth bringing up as well. Quick show
941.68s - 946.26s |  of hands, who has seen or heard of the canned air attack? Where you trip those requests to
946.26s - 952.74s |  exit sensors. So for those who haven't, it's where you spray canned air upside down under the
952.74s - 957.88s |  door or through the door and it hits this request to exit sensor, it finds a thermal
957.88s - 963.38s |  signature different than ambient, the door thinks someone is then leaving, and half the time
963.38s - 967.52s |  it'll actually unlock the door at the mag strike here, or at the very least it will disable that
967.52s - 972.26s |  door forced alarm and let you force your way through without setting off an alarm. That's
972.26s - 976.90s |  something that's worth trying. And if that succeeds at your workplace, it is worth bringing
976.90s - 981.90s |  that up. Uh going through events in the interest of time we'll we'll skip that. So a quick
984.58s - 991.02s |  checklist to follow. Of just does your access control system function as intended? Does it
991.02s - 995.66s |  allow entry to the correct card? Deny entry to the wrong card? You would be surprised how
995.66s - 1000.66s |  often that is misconfigured. Does it reliably allow egress without false alarming? Often
1002.84s - 1008.44s |  these things are tuned too narrowly or the timing is set up wrong so that it doesn't
1008.44s - 1014.12s |  correctly associate the two events of request to exit trip and contact sensor open. False
1014.12s - 1019.08s |  alarms too much. What do facilities managers do when they get too many false alarms? They
1019.08s - 1024.52s |  just turn off the damn alarm. And now you've got no detection, people can freely bypass
1024.52s - 1030.26s |  forcible entry etc. Prop the door open for five minutes. Does it alarm? There should be
1030.26s - 1035.60s |  door held detection on these things. If there is not, simply propping open the door, coming in
1035.60s - 1040.74s |  open hours, propping it coming back later, let someone in, no detection whatsoever, and the
1040.74s - 1045.40s |  door of course is propped and unlocked. And then simulate a forced entry. Test that that
1045.40s - 1050.24s |  alarm system works, that it goes somewhere that someone actually responds. How do you
1050.24s - 1058.49s |  simulate a forced entry? So we'll pop back to the diagram here. You stand at the door, you
1058.49s - 1063.77s |  wait for this detector to click back off, so it thinks it's been too long since someone's been
1063.77s - 1070.11s |  at the door, and then you carefully open that door without tripping the request to exit
1070.11s - 1076.41s |  sensor. Alternatively, you can do a bypass from the unsecure side, under door tool, poke the
1076.43s - 1082.51s |  latch etc. Simulating a forced entry to- and testing whether that alarm actually gets set
1082.51s - 1089.11s |  off. Cameras are also worth looking at. It is worth simply asking your employer, can I look at
1089.11s - 1093.15s |  the camera feed? Once you've established that you know something about this field, and see if
1093.15s - 1097.89s |  it would actually be useful. If there's some sort of crime or malfeasance here, is this gonna
1097.89s - 1103.49s |  give us any value whatsoever? Absolutely not. It is far too far, far too grainy to see
1103.51s - 1110.05s |  license plates, to see faces, and we've got major washing out of the light contrast here. So
1110.05s - 1114.85s |  lighting and cameras go hand in hand. If you have a camera that's directly illuminated, you can
1114.85s - 1117.85s |  just look at it and see there's, there's a floodlight on this camera, well that's what it's
1117.85s - 1125.67s |  gonna look like here. IR glare, cameras directly create the infrared light for night vision. When
1125.67s - 1131.67s |  you see that with an object too close, it washes out the whole rest of the field of view. In this
1131.69s - 1135.73s |  case it might have been a camera setup that was fine when it was installed, and then this tree
1135.73s - 1140.83s |  grew over the, the subsequent years. So something worth looking at there as well. And then of
1140.83s - 1146.87s |  course just resolution as well. A 360 degree camera gives you absolutely nothing to go off in
1146.87s - 1150.51s |  terms of faces, license plates, the sort of thing that's actually gonna be useful for
1150.51s - 1163.12s |  investigating if something happens down the road. And again, stupid shit. Tampering, blocking,
1163.14s - 1169.10s |  and repositioning. Reach up this camera, point it at the sky. Stuff like this. Think about the
1169.10s - 1176.34s |  third dimension. Someone coming in from the top and, and accessing those. A nice ladder is
1176.34s - 1182.32s |  provided here to get access to that camera up there, and we see all the time cameras that, that
1182.32s - 1187.32s |  get vandalized, repositioned, et cetera, in order to, to bypass that detection there. So quick
1188.00s - 1193.00s |  test your camera coverage that you can do once you've established a bit of, of rapport with
1195.56s - 1201.04s |  your facility's team. Do a walkthrough of your facility, entrances, exits, sensitive areas to
1201.04s - 1205.88s |  be protected, and then check the footage after of that walkthrough. Can you see identifying
1205.88s - 1211.28s |  per- details of the person on tape? Read license plates on vehicles? When is the person not in
1211.28s - 1217.02s |  view? Can you tell what the person is doing? And then try in situations like at night,
1217.02s - 1223.36s |  shutting off power, inclement weather. In all of these cases, do you still have useful
1223.36s - 1232.24s |  information, and if not, that's something that's worth bringing up. And of course, when dealing
1232.24s - 1237.28s |  with any business, and we do this all the time, but particularly your own employer as an
1237.28s - 1241.98s |  internal employee, you need to understand their threat model, what they're protecting, and the
1241.98s - 1246.98s |  risks involved. So if the probability's very low, it takes a lot of skill, effort, et cetera, to
1249.42s - 1255.46s |  do it, and the impact is not catastrophic to the business, the dollar value associated with
1255.46s - 1260.86s |  fixing it that would make it worth it has to be very low. If it's gonna be an expensive fix,
1260.86s - 1265.90s |  that's not worth it to do. And so applying everything over to this risk matrix here helps you
1265.90s - 1270.34s |  prioritize in your mind what is worth bringing up. Cause if you bring up a whole bunch of low
1270.34s - 1276.18s |  criticality items, they're gonna stop taking you seriously. So bring up the most, most
1276.20s - 1281.22s |  critical, the easiest to demonstrate. Again, that stupid shit, that reaching around and
1281.22s - 1286.22s |  hitting the um, the crash bar, that hitting the button on the other side, misconfiguration,
1290.52s - 1295.06s |  systems that don't work correctly in the first place, and then once you've got the system
1295.06s - 1300.56s |  working correctly, then you can start hardening against bypasses where it matches your threat
1300.58s - 1306.22s |  model correctly. So make a note of all findings, bring up the most critical to underscore
1306.22s - 1311.62s |  importance, and get connected with your internal facilities team if there is one. If it's a
1311.62s - 1316.06s |  small employer and there isn't, maybe that's gonna become part of your job. And that's
1316.06s - 1319.66s |  something to think about if you want that to be the case. If you're here at this talk, if you're
1319.66s - 1324.80s |  interested in this, you probably would love that to be the case. Uh, and don't be a pedant about
1324.80s - 1329.78s |  low probability, low impact findings, prioritize things, and again, focus on getting systems
1329.80s - 1335.56s |  working as intended before worrying about the bypasses. So everything I've talked about
1335.56s - 1339.44s |  today and a whole lot more, you can try in the physical security village just across the
1339.44s - 1344.44s |  hall. I'll be beside the stage after this to take any questions, and thank you very much.


url: https://www.youtube.com/watch?v=zqGB07UaI6A
title: DEF CON 32 - Breaking Boundaries: Popping Shells in the Airgap w $10 & Arduino Magic - Daniel Beard
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=zqGB07UaI6A",
  "title": "DEF CON 32 - Breaking Boundaries: Popping Shells in the Airgap w $10 & Arduino Magic - Daniel Beard",
  "description": "Many medical devices are \u201cnot connected to a network\u201d, so let\u2019s bring our own! This talk will teach you how to create a BadUSB device that can wirelessly execute payloads on \u201cairgapped\u201d systems like medical devices that aren\u2019t connected to the internet. With only $10 of off-the-shelf hardware and some basic Arduino code you too can start popping shells in the device lab.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1458,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 4.80s | This text was transcribed using whisper model: large-v2

 All right. Welcome, everyone, to Popping Shells with $10 and a Bit of Arduino Magic,
4.80s - 13.20s |  or aka Let's Redefine Physical Access. First off, who am I? I'm Dan Beard. I'm a software
13.20s - 18.40s |  engineer at MedCrypt, used to direct MedISO, previously CTO of Promenade Software, where we
18.96s - 22.32s |  worked on medical devices as a contractor, so worked with a lot of different companies.
23.12s - 26.80s |  I personally coded on at least 10 different medical devices and collaborated on
26.80s - 31.84s |  so many more, mostly in vitro diagnostic instruments, so that's like lab equipment,
32.72s - 37.92s |  some implantables, some therapeutic devices, infusion pumps, you name it. The IVD and
37.92s - 41.04s |  therapeutic are bolded because that's mainly what this attack is going to be against,
41.92s - 47.76s |  not so much implantables. All views expressed are my own. My company is making me say this.
47.76s - 51.28s |  It does not reflect the opinions of current or past employers. I did this all in my own time.
51.28s - 58.00s |  It's all open source. Don't get mad at them. Okay. So medical device design 101,
58.00s - 62.08s |  especially on those bolded ones, IVD or therapeutic devices in a hospital setting
62.08s - 69.52s |  or lab environment, typically you're going to have the embedded board that is going to be doing the
69.52s - 74.00s |  medical thing, whatever it is with the actual medicine. That's going to be running on something
74.00s - 78.56s |  very important, like an RTOS. It's going to be bare metal. You're going to have a custom FPGA
78.56s - 82.24s |  because it needs to be time critical. You're not going to be running an operating system on that.
82.24s - 86.80s |  However, for anything that has a user interface more complicated than maybe a couple buttons,
86.80s - 90.96s |  you're going to have a main board or user interface board that's typically running
90.96s - 95.92s |  Windows or Linux. Good old-fashioned Windows or unless you're doing something with Yocto,
95.92s - 102.16s |  even good old-fashioned Linux, right? These are PCs that are connected via CAN bus, CAT6, RS232
102.16s - 106.24s |  to the thing that's actually doing the medical thing. If you can own them, you can pretty much
106.24s - 112.48s |  own the device. That's what we're going to be attacking through this vector. Some more definitions
112.48s - 116.72s |  just to make sure we're all on the same page. What is bad USB? A lot of you probably know what that
116.72s - 122.64s |  is, but let's catch some people up. It's, what, two decades old at this point? It's when a USB dongle
122.64s - 128.32s |  announces itself as a human interface device. It says, I'm a mouse. I'm a keyboard. I'm a USB
128.32s - 133.04s |  Ethernet controller. I'm a USB COM port, right? Operating system, there's no signature checks on
133.04s - 137.60s |  that. There's no validation that you are what you say you are. It just believes you and goes,
137.60s - 141.52s |  okay, cool, you're a keyboard. Give me some keys. Oh, you're a mouse? All right, give me some mouse
141.52s - 148.40s |  events. COM port? Sure, why not? Here's input and output, right? Some examples of this are from our
148.40s - 154.32s |  friends at Hack5 and OMG. You got the rubber ducky. You got the OMG elite cable. These are things you
154.32s - 163.92s |  can buy right now. So bad USB in my med device? It's not that bad. You know, to, to exploit it,
163.92s - 169.52s |  you'd need physical access for an extended period of time. You'd probably need an internet connection
169.52s - 173.28s |  for persistence and, you know, we're air gapped or we do, we have a network connection, but it
173.28s - 177.12s |  can't reach out to the internet. So you can't download payloads and you'd have to do it to a
177.12s - 181.52s |  logged in session. And we make people log in and out all the time. So it, it's really not, not that
181.52s - 186.08s |  big a deal. And you may be looking at this and rolling your eyes, but having been in the industry
186.08s - 190.96s |  for 10 years, I saw this on threat models. I heard it at the biohacking village when I was able to
190.96s - 194.64s |  like pop a shell by hooking up a keyboard and typing on it. These are things that people say,
194.64s - 201.04s |  and it's kind of been industry standard for a while now. So last year, after I got told it again,
201.04s - 204.80s |  and I got tired of hearing it, I'm like, no, I'm going to prove you guys wrong. These, these
204.80s - 209.52s |  assumptions, they don't hold. To exploit it does not require physical access for an extended period
209.52s - 214.00s |  of time, only for a very short amount of time. It does not require an internet connection for
214.00s - 218.48s |  persistence, but we can bring our own internet connection and we can wait and deploy payloads
218.48s - 222.08s |  whenever we want. We don't have to do it right, right when we plug it in, right? We can wait until
222.08s - 226.24s |  it's nighttime and we can wait until we see someone log in or, or something, or using the device.
227.84s - 231.68s |  Um, so to prove that wrong, to build a device that would do that, we kind of want three things.
231.68s - 237.60s |  We want something that's wireless, so it has a wifi radio. We want something that's cheap,
237.60s - 241.28s |  so we can leave it in there and walk away and don't care that we never get it back.
241.28s - 246.16s |  And we need something that can actually emulate a USB hit device. So these, these are kind of the
246.16s - 252.32s |  three requirements. Our friends at LilyGo have us covered on all three of those fronts. This is the
252.32s - 259.84s |  T-Dongle S3. It's a $10, $10 and 50 cents, thanks inflation, out of China, uh, $15 out of their US
259.84s - 263.92s |  warehouse. So if you want to get it just that little bit faster, uh, it's only $5 more. It
263.92s - 269.44s |  looks like a USB device. It's got a fancy color screen. It has wifi and Bluetooth if you want to
269.44s - 274.48s |  use Bluetooth and you can program it in insert language here, C++, MicroPython, Arduino, anything
274.48s - 281.92s |  the ESP32 can do that you can program it with. Um, so introducing, drum roll please, the software
281.92s - 292.48s |  to do it, RadioJack, hence the red, the red shirt. Yeah. All right. Um, so on the T-Dongle S3, I have
292.48s - 298.72s |  a whole bag here flashed, uh, with this open source software. It's open source at RadioJack.io.
298.72s - 304.16s |  It emulates a keyboard and mouse. It hosts its own wifi server. You can telnet to it. You can drop
304.16s - 308.72s |  payloads. Right now there's pre-programmed a Windows payload for having a PowerShell, a prompt,
308.72s - 312.80s |  and I'll go over how that exactly how that works, but nothing says it couldn't work on Linux. I was
312.80s - 316.48s |  just too lazy to put it together. Okay. I didn't have enough time. You can do it too. I await your
316.48s - 321.52s |  pull requests. Please issue pull requests. Uh, it's reflashable so you can change it over and
321.52s - 325.36s |  over. And of course it has a laughing skull animation. What hacker tool would be complete
325.36s - 344.03s |  without a laughing skull animation? Um, anyone want this one? All right. All right. So, uh,
344.03s - 349.31s |  it's programmed in Arduino. Why Arduino? First and foremost, most importantly, the drivers just
349.31s - 353.71s |  kind of worked and I didn't have to mess around with them the first try. Um, and again, I'm lazy.
353.71s - 357.95s |  So I just went with it. Uh, both the hit and wifi libraries worked out of the box. There was,
357.95s - 362.99s |  there was no mucking around. It's real easy, but secondarily to prove how, how easy I'm not doing
362.99s - 367.07s |  some complicated thing up here. I'm not releasing an O day that took a PhD six months of like
367.07s - 372.83s |  intense genius work. High schoolers learn this crap, right? I am dumb. If I can do this, anyone
372.83s - 380.11s |  can do this. This is not, this is not, you know, some out there like government level attack. Um,
380.11s - 385.15s |  so how to use that one that you just got, you plug it into the target, you connect to the SSID
385.15s - 390.19s |  that's displayed on the screen. Each one is using the, um, the serial number of the device. So it
390.19s - 394.51s |  has a different SSID. So if you want to go over to the biohacking village right now and connect
394.51s - 399.31s |  it up to a medical device, each user should have a different SSID so that you're not connecting to
399.31s - 402.91s |  the wrong one. You don't know which one you're connecting to. The passwords are all the same
402.91s - 407.87s |  in the base firmware. The password is the password, all lowercase, real easy to remember.
408.43s - 413.55s |  You tell net to the IP that's shown on the screen and you follow the good command line interface.
413.55s - 418.19s |  Um, some of the features that has out of the box are drop the payload, open a remote PowerShell
418.19s - 421.47s |  prompt, uh, type as a keyboard, you can type whatever you want. It'll emulate the keyboard
421.47s - 424.51s |  and just type it out. So if you need to do like a password prompt or something before you drop
424.51s - 428.75s |  the payload and you know the password, you can do it that way. Um, and as a comport, that's how
428.75s - 435.76s |  the payload communicates with you. Uh, when you get a shell is through a virtual comport. Uh,
435.76s - 440.80s |  here's, you know, kind of to visualize what's going on here. Step zero not shown is actually
440.80s - 447.12s |  plug it into the device. So walk by and just knock it in. Step one is connect to the wifi,
447.12s - 451.84s |  drop the payload. The payload opens up a PowerShell prompt very quickly types up a whole
451.84s - 457.12s |  bunch of PowerShell code, minimizes itself. And what that PowerShell code does is it waits for
457.12s - 462.96s |  a connection on the comport, the virtual USB comport and just pipes text back and forth.
462.96s - 466.56s |  So anything you type goes to PowerShell. Anything it types goes back to you over telnet.
467.52s - 472.00s |  Remember this is wifi. So you can be the one room over, right? You can, you don't have to be at the
472.00s - 476.80s |  device. You can look like you're really innocent over there with your, your phone on your SSH.
476.80s - 483.92s |  You're just texting, but really you're typing on a, a shell. Um, let's see if my internet access
483.92s - 493.02s |  is going to break this. So proof of concept, I know everyone POC or GTFO. Let's see if this launches.
493.50s - 506.83s |  There we go. So here's an example plugged into my windows, a gaming PC, say drop the payload.
506.83s - 521.41s |  It just dropped it. I entered into serial mode and now the PowerShell prompt, I can do whatever
521.41s - 531.23s |  I want on that computer as the current user. Uh, and if anyone's thinking windows on my medical,
531.23s - 547.73s |  yes, windows is everywhere in medical trust me. So I did this about October. I was, I was high
547.73s - 550.69s |  off Defcon. I was like, I'm going to code this thing and approve these people wrong. I'm going
550.85s - 557.01s |  to be so cool. Maybe I'll get a talk out of it at biohacking village. Like, yeah, all right. I'm
557.01s - 564.37s |  stoked. And, uh, not even a week after my first to get hub commit for the, for the POC, um, OMG
564.37s - 572.85s |  cable released this into their firmware wasted. Oh, they did it better than me. Oh no. The stealth
572.85s - 578.77s |  link cable overhead X, I hit X still think. So it looks like a USB cable. It's the OMG cable.
578.77s - 583.57s |  It looks amazing. It uses the same kind of backdoor thing where it drops a payload and you
583.57s - 589.57s |  can do a backdoor. Um, it, it does it over the hit packets instead of a comport, which is more
589.57s - 594.61s |  elegant. Honestly, it's a great way of doing it. It's got sexy marketing. It's ready to buy today.
594.61s - 598.69s |  And, uh, it's just kind of way better than my hobby project. I, I still stand by though,
598.69s - 603.25s |  that radio jack is a better name than hit X stealth link. So hack five, if you want to like
603.25s - 609.82s |  buy the URL off me, call me, you know? Uh, so I'm like, I'm going to one up them. What can I do on
609.82s - 613.42s |  my hobby project? It's going to be better than this like sexy polished thing that costs a lot
613.42s - 619.34s |  of money and they put a lot of work into, right? Enter LoRa. So LilyGo, same company, makes an
619.34s - 625.10s |  almost as cheap, right? $15 to $20, depending on which warehouse you buy it from. The LoRa S3. So
625.10s - 629.10s |  it, it's still cheap. It kind of has a screen. It's not color, but it's still a cool screen.
629.90s - 635.18s |  Still has wifi and Bluetooth, still programming Arduino, but it's got LoRa, which means we can do
635.18s - 641.82s |  things a lot longer range. If you don't know what LoRa is, it's a long distance radio. You don't
641.82s - 644.46s |  need to have a license. You can go out and use it right now. It's on the consumer bands.
645.18s - 649.26s |  Theoretical range of three plus miles. Uh, realistically, I, I could only test it to a
649.26s - 653.90s |  mile and a half before I run into line of sight issues. So I don't know. Um, but theoretically
653.90s - 658.78s |  more than pretty much my three plus miles. Um, and it does kind of sort of require line of sight.
658.78s - 663.50s |  Like if it's, if it's on a device and you have like close to a window, you can, you can still
663.50s - 667.50s |  kind of get in. It'll reflect off the walls and it works. You don't need to be in the window,
667.50s - 672.62s |  but if you were in, let's say a, you know, an MRI lab or radiology lab without any windows in the
672.62s - 680.75s |  basement, you're not going to get out. So how to use it on literally this, this device, exactly
680.75s - 686.03s |  the same, same SSID, same password, follow the same prompts. Uh, you drop it, you drop the
686.03s - 692.83s |  payload and it's just over LoRa instead of wifi. Got the same visualization here. Only difference
692.91s - 698.91s |  is that, uh, if you, if you look, you have to have a LoRa board on the other side talking miles
698.91s - 705.55s |  away and then it does the same, it's the same interface. Um, I live in Chicago. I'm lucky
705.55s - 708.91s |  enough to live in the loop right here. I'm not going to tell you which building, but one of
708.91s - 715.71s |  those. Um, and with a directional antenna, I was able to use a shell from 1.2 miles away.
715.71s - 722.62s |  Yeah. How's that for physical access? So I kind of open it up to you again, open source,
722.70s - 727.98s |  welcome all pull requests. Can we take it further? Can we do a multi-hop, uh, mesh-tastic network,
727.98s - 732.86s |  right? Like in, in SoCal, they have a mesh-tastic network that goes from LA all the way down to
732.86s - 739.02s |  Tijuana. Like, could you be in another country and execute shell commands over just this, like
739.02s - 743.82s |  hopping over a mesh-tastic network, right? Can we do a wifi bridge where it hops on, you know,
743.82s - 747.50s |  a Starbucks wifi and now you could be anywhere in the world. You just got to know the IP address.
747.74s - 753.42s |  What ideas do you have to make this attack better? Um, the, the takeaway for anyone who's
753.42s - 757.74s |  building a device that's running on like a consumer Linux or windows is you only need a
757.74s - 762.30s |  few minutes and a few dollars and you can exploit bad USB. You don't need an internet connection.
762.30s - 769.66s |  You don't need extended physical access. Mitigations for anyone building a device.
769.66s - 774.46s |  One, cover your USB ports. Like if you're not using them, cover them. If I need to take a
774.46s - 779.34s |  Dremel to your device, then maybe I'll buy, you'd need extended physical access. Someone's
779.34s - 785.82s |  going to notice that you were there, right? Okay. Someone might notice that if you, if you do need
785.82s - 791.26s |  them for maybe service or something like that, then disable the USB stack until the user does
791.26s - 796.94s |  something explicit until they want to export a report until they say, Hey, I need a flash new
796.94s - 800.46s |  firmware on the device, or Hey, I'm a service tech and I've logged in with my special service
800.46s - 806.62s |  tech password, right? Don't just have it open all the time. Only have it open when you need it.
806.62s - 810.94s |  And that's, um, that's a much smaller attack surface than just someone able to plug it in
810.94s - 818.08s |  whenever they want. So that's it. Thank you. Anyone have any questions? And, uh, to encourage
818.08s - 827.30s |  questions, I will be throwing out more of these to anyone who asks one. And I talked really fast.
827.30s - 831.46s |  So I'm a little bit, a little bit, uh, soon. So I have lots of time for questions.
839.97s - 846.29s |  The question was, what have I tested it on so far? So, so far, um, a couple of different
846.29s - 852.05s |  windows devices, um, mostly PCs. Um, there is one currently plugged into a medical device
852.05s - 856.29s |  in the biohacking village that happens to be running a windows front end. So go ahead and
856.29s - 874.29s |  check it out. It's already there. See if I can hit you with it. Ready? So the question was,
874.37s - 879.33s |  can I access the machine or the boards to do something that do I need to access the machine?
879.33s - 893.54s |  Ah, yeah. So here, let me throw you one. So typically, and this is typically, there are
893.54s - 899.14s |  exceptions on most medical devices. They kind of assume that the physical connection is secure by
899.14s - 905.54s |  itself. So if you, if you have like control of that main user interface board running windows,
905.54s - 909.94s |  you can issue whatever commands it could issue to the RTOS. So there may be,
910.82s - 915.46s |  there may be safety, uh, bounds. Like if you try and do something that's obviously not safe,
915.46s - 919.38s |  it'll say no, but you got a lot of control that you really shouldn't have. You could
919.38s - 923.54s |  dispense more medication than you should. You could raise temperatures higher than you should.
929.01s - 931.89s |  Yeah. They assume that we're physically controlled. The only thing that can
931.89s - 935.49s |  talk to us is our windows front end. And, and, and let's just secure that.
946.56s - 951.20s |  So I didn't measure latency specifically. Uh, the wifi one is near imperceptible.
951.20s - 958.24s |  The Laura one, um, the latency wasn't, wasn't bad, but the throughput was like a 28.8 K modem.
958.24s - 961.52s |  So like you're, you're going back to the eighties, but Hey, for a shell,
961.52s - 978.19s |  that's kind of all you need, right? You can still issue commands. Oh, it's like kind of,
978.19s - 982.99s |  so the question was, have I set up the ESP 32 to like be a repeater almost and repeat
983.71s - 992.30s |  the messages or so that w that was one of the things I wanted to do. Like that said, Hey, what,
992.30s - 996.30s |  what else can we do with this right now? It's just point to point, but there's no reason you
996.30s - 1004.54s |  couldn't do that. Right. All right. Let's see if I can hit you. Did I get you that? Sorry. Okay.
1009.22s - 1022.30s |  Sorry. Can you ask a little louder? Can I, Oh, can Laura go through windows? Absolutely can.
1022.30s - 1028.46s |  It does affect the, um, the signal strength, but it absolutely can go through windows. And
1028.46s - 1034.46s |  when I was testing it on my PC, I was just within visual range of a window and I was still able to
1034.46s - 1050.46s |  access it. Have I tried doing it with the Mac? I haven't, but it would absolutely work. Uh,
1050.46s - 1055.74s |  it would, the USB stack would be, it's a hid device. You would just need to change the, um,
1055.74s - 1059.34s |  the payload. So instead of dropping into a PowerShell, you're dropping into a, whatever
1059.34s - 1073.95s |  Mac is using these Z shell or whatever. Yeah. The question is, let's go to this side. I haven't just
1073.95s - 1077.79s |  cause I have a medical background, but I mean, if they're running windows, Linux, or Mac,
1077.79s - 1104.26s |  it's some sort of consumer operating system. It's going to work. So the question is if the,
1104.26s - 1111.70s |  if the windows machine requires authentication, is there a bypass? So, so no, there's no bypass,
1111.70s - 1115.54s |  but because you can wait, you can wait until someone logs in to drop the payload. It's not
1115.54s - 1119.30s |  just plug it in. And then like, it starts doing the payload automatically. You can wait until you
1119.30s - 1122.34s |  from across the room, see them log in and then go, ah, I'm going to, I dropped it.
1127.04s - 1131.84s |  Okay. Let's see, let's get someone real far away. Let's that's where they're with the blue
1131.84s - 1142.96s |  blinky badge. Yeah. What's the oldest OS I found in the wild windows XP. Okay. I'm going to,
1142.96s - 1152.66s |  I'm going to check this. No, no guarantees it gets to you. Nice. All right. Uh, you there in
1152.66s - 1168.42s |  the white shirt. So right now it's, it's manual, but once you're connected, you could script,
1168.42s - 1171.70s |  I mean, it's over telnet. So like you could make a Python script to wait until something happens.
1174.90s - 1221.57s |  All right. So the question was once, once you're connected to it, you can use it as a point to get
1221.57s - 1226.85s |  into the rest, excuse me, of the network because you're right. You do have access as whoever the
1226.85s - 1233.33s |  current user is. Um, I, I haven't done that, but that's, that's the beyond just hacking into a
1233.33s - 1238.29s |  medical device. That's one of the reasons you want to protect against this is that now you have a
1238.29s - 1244.05s |  point where you're, you're in the air gapped network. Right. And you are somewhat trusted
1244.05s - 1254.35s |  probably. So yeah, you have, you could use that absolutely as a jumping off point. All right. Uh,
1254.35s - 1264.35s |  in the orange shirt, I can't hear you from this far away. Sorry.
1274.06s - 1277.42s |  So the, the question was, wouldn't someone notice you going up to a medical device and
1277.42s - 1288.13s |  sticking the USB stick in? You have a lot of confidence. Sorry. So the question was,
1288.13s - 1291.81s |  wouldn't someone notice the, uh, the USB stick sticking out of the medical device?
1292.85s - 1297.89s |  I mean, from my opinion, no, you'd, you'd have to have a lot of confidence in, in, you know,
1297.89s - 1302.69s |  nurses and doctors noticing things to, to notice this little teeny thing sticking out. There's a
1302.69s - 1306.29s |  lot of things that do plug in, you know, in and out of devices. I don't think they're going to
1306.29s - 1310.85s |  notice something small. That being said, this specific device with the firmware that's flashed
1310.85s - 1317.33s |  on it has a big skull on it. And the reason is, you know, I don't want people using this for evil,
1317.33s - 1322.05s |  right? Like use this where, you know, when you have permission and if anyone sees it and has
1322.05s - 1326.21s |  a skull on it, yeah, then they might ask some questions, but you know, you could change that
1326.21s - 1336.45s |  in the firmware to not display a literal skull on a screen. Right. Let's do it. Someone over here.
1341.36s - 1347.76s |  I think this is USB 3.0. Oh, USB-C version. They don't have a USB-C version. No,
1347.76s - 1352.16s |  but honestly email Lily go and say, Hey, I want a USB-C version. They might make it.
1357.57s - 1359.89s |  Nope. That was a bad one. Sorry. All right. All the way over here.
1364.83s - 1369.79s |  What got me interested? So the question was, what got me interested in developing this? It was
1369.79s - 1374.03s |  one that I heard that, that quote that I was saying, right? Well, it's not that big a deal.
1374.03s - 1378.27s |  Someone would notice and you were air gap. So it doesn't really matter, or we are connected
1378.27s - 1381.79s |  to a network, but you know, it's, it's the network's protected. You don't actually have
1381.79s - 1386.75s |  internet access. Right. Hearing that over and over and over again, and kind of scratching my head
1386.75s - 1390.75s |  and going, that doesn't, that doesn't seem right. It seems like someone could bring their own wifi
1390.75s - 1397.23s |  network. Right. And then searching around and before the OMG cable released a HIDAC stealth
1397.23s - 1402.43s |  link, there was, there was nothing that I could find that had that. So, okay, I'll build it. And,
1402.43s - 1413.78s |  and now you can't say that to me anymore. Right. How are we doing on time? Okay. I got one more
1413.78s - 1425.30s |  minute. So I can answer one more question. You there. Are there any limitations on the device?
1429.63s - 1437.44s |  I can't hear you over the person talking behind me. Ah, the only limitation is the memory on
1437.44s - 1450.38s |  the device itself. Oh, 128 Meg. So yeah, you can have a pretty big payload. All right. Thanks,
1450.38s - 1454.54s |  everyone. I'll be, I'll be dropping these off to other people later. So I still have about like 10
1454.54s - 1458.14s |  and then I can, I can give out.


url: https://www.youtube.com/watch?v=wCt-93lEIME
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
title:
DEF CON 32 - Exposing the Occultations in Large Off-Grid Solar Systems - Dan Berte & Alexandru Lazar

content:
{
  "webpage_url": "https://www.youtube.com/watch?v=wCt-93lEIME",
  "title": "DEF CON 32 - Exposing the Occultations in Large Off-Grid Solar Systems - Dan Berte & Alexandru Lazar",
  "description": "This talk reveals stunning vulnerability findings in leading solar manufacturers that, when exploited, the stake is the grid. We'll explore three massive vulns in the management platform and discuss how they can be weaponized to become chilling nation security risks.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1085,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 2.00s | This text was transcribed using whisper model: large-v2

 It didn't warn me it was gonna be bright, so
3.16s - 5.80s |  We still got people coming in but so this is
6.88s - 12.64s |  Gonna start doing a little bit of the intro we're talking about. So while everybody comes in we'll get to the meat of it
12.64s - 13.64s |  so
13.64s - 20.16s |  Welcome. Oh, everybody's having a great great convention. Thanks for showing up. This is fantastic. We're really excited to talk about
21.20s - 25.16s |  Some of this stuff because it's fresh off the presses. So we're gonna be talking about
27.12s - 29.12s |  Photovoltaics
29.12s - 34.64s |  And some of the findings that are recent for us so I have here with me
35.32s - 37.32s |  Alexander Losser as one of a
38.52s - 44.56s |  Scenarios query researchers. We both work for a company called Bitdefender. You may have heard of I
45.68s - 51.42s |  Added a link here to our work so you can refer to it later some of the
53.24s - 55.24s |  Vulnerability research that we do so
55.40s - 57.36s |  We've been doing
57.36s - 62.12s |  Among other things we've been doing IOT vulnerability research for the last 10 plus years
62.96s - 64.36s |  on
64.36s - 69.72s |  Normally and typically consumer grade devices that are popular or interesting or something that we find
70.44s - 74.24s |  Just yeah interesting to look at so during this time. We've
75.08s - 82.76s |  Published over 25 high-profile cases and findings and we have dozens of white papers that came out of that research
83.40s - 85.60s |  this is a pretty small team, but
86.56s - 91.22s |  It's been it's been really lucrative and and exciting on our academic and
91.92s - 95.12s |  Educational side so I want to quote a couple of a couple of
95.88s - 102.24s |  High-profile cases that we we covered findings that we had so I'll say ring doorbell for example edge LG TVs
102.24s - 108.70s |  This is something that's as fresh as a month old. Maybe you know the fire stick from Amazon. Maybe the August August lock ring a bell
110.04s - 111.56s |  wise
111.80s - 114.48s |  Outlet you fight ease of his cameras and more
115.84s - 118.68s |  What's interesting that through our research and what we found?
119.24s - 121.24s |  obviously beside vulnerabilities
121.28s - 127.90s |  Is that more than 30% of the vendors never reply or they don't reply timely?
128.56s - 129.84s |  and
129.84s - 132.40s |  To our contact and we try to reach out to them and it takes
133.64s - 139.52s |  Often it takes them more than 180 days to do so and what's even more concerning is that?
140.52s - 147.52s |  20% of these people take more than a year to fix the vulnerabilities that we are trying to communicate to them or never actually patch
147.52s - 151.92s |  These sometimes or most of the times exceeding the end-of-life cycle of that product
151.92s - 157.44s |  So here's a PSA to all the vendors if you could pass on the word
158.04s - 163.28s |  Appoint a permanent contact set up a vulnerability disclosure program and a you're all for it
163.64s - 168.96s |  Put a PGP PGP key on it and monitor that inbox can't stress that enough so
169.80s - 171.80s |  and
171.84s - 174.52s |  This is the has been for the last
175.48s - 182.44s |  Decade and a half or more the most haunted terrorist in the United States and abroad when it comes to the power grid
183.24s - 185.24s |  the squirrel
185.24s - 189.32s |  And it's called squirrel terrorism. There is a squirrel index
189.84s - 194.12s |  On Wikipedia and we have a couple of quotes here. For example, we have
194.84s - 195.92s |  a
195.92s - 200.48s |  Former deputy director of the NSA that said frankly the number one
201.52s - 204.44s |  threat today to the grid is squirrels and
205.12s - 206.60s |  then
206.60s - 211.56s |  The threat to the Internet infrastructure services post by squirrels may exceed the one
212.36s - 216.72s |  Post by cyber attacks and so on so on. So basically the narrative here is in general
217.60s - 220.84s |  That cyber security is not really potential
221.48s - 226.20s |  Straight-up concern when it comes to the power grid because most of the actual
227.64s - 229.64s |  attacks were of natural causes
230.56s - 232.56s |  Squirrels fires, whatever have you in general?
232.60s - 236.76s |  The grid is really highly regulated and protected and secured
236.76s - 241.56s |  So a lot of the cyber attack woes don't really apply even though we have you know
241.56s - 244.56s |  Warnings from CIA with examples and NSA and all this stuff. So
245.32s - 246.76s |  to that
246.76s - 248.76s |  enter solar
249.12s - 251.60s |  And this is what we're gonna talk quickly about today
251.60s - 257.60s |  So obviously green energy is the forefront of everything that we do. So as it's transforming the global landscape
257.60s - 259.92s |  We're seeing just you know last year
260.80s - 262.80s |  over 500 gigawatts of
263.40s - 265.64s |  Of capacity added by solar
266.52s - 269.00s |  Just last year, which is three-quarters
270.12s - 276.32s |  It's a it's an explosive growth, which obviously is fantastic for us. But at the same but at the same time brings
277.32s - 279.16s |  You know
279.16s - 286.76s |  They you know, the growing number of systems obviously brings more interest and more focus to the to them to potential attackers
286.76s - 291.82s |  So as the capacity increases, the question is, you know is security keeping up?
292.88s - 295.60s |  As both businesses and consumers are starting to add
296.72s - 299.48s |  solar panels to their to their portfolios now
300.32s - 306.52s |  Again this space a solar is less hurdle hardened and regulated by as legacy
307.32s - 308.92s |  power generation
308.92s - 315.32s |  So to that point we investigated a manufacturer called day and a measurement platform called Solomon to find out
316.52s - 317.68s |  Why?
317.68s - 322.20s |  It's because these are smart systems and they can be obviously controlled remotely
323.32s - 325.32s |  someone in our office noted something that was
326.08s - 332.96s |  Interesting after installation, so we decided to keep digging an inverter and I'll show you I'll show you a
335.48s - 340.24s |  Sketch just to see how the how the stuff works out could be added on both these platforms
341.24s - 346.36s |  Using their apps. You just needed the serial number. So it was interesting enough
346.68s - 351.24s |  So here's a diagram of a system and trying to understand how it works. This applies for both
352.36s - 354.36s |  residential customers, but also
354.96s - 356.96s |  Larger platforms as well. So you have
357.60s - 361.48s |  You have the solar panels. Let's say you have solar panels on top
361.48s - 362.64s |  You know on your home
362.64s - 369.32s |  These connect to an inverter that feeds the grid the grid is connected to the inverters connected to a data logger
369.64s - 371.32s |  that's a bridge between
371.32s - 372.92s |  all these systems
372.92s - 379.28s |  And the data logger sends information to a cloud platform that feeds into various application and management
379.76s - 382.64s |  Systems as well. So again the logger the
383.56s - 387.32s |  Is the conduit that connects everything to the internet and isn't, you know
387.32s - 391.64s |  Responsible for the settings on the data collection and updates of the whole system
393.52s - 397.64s |  In general it's these will be connected and they won't be
398.08s - 400.68s |  Because they wouldn't work. Otherwise with a grant with a grid
400.88s - 406.56s |  So obviously end users can control the system from the internet from their phones or just another platform
406.56s - 409.90s |  and they can talk directly to the platform and I'm gonna invite Alex to
410.66s - 413.46s |  Discuss and walk us through how we investigated the platform
416.94s - 421.58s |  Okay, so we started with a man-in-the-middle attack on the day cloud app
422.22s - 426.30s |  We only use the user certificate no need to patch the application
427.10s - 431.82s |  Among the traffic we found a suspicion login request using hard-coded credentials
431.82s - 438.42s |  I don't know if you can see them, but it is smart configurator at solarmanpv.com and the password
439.02s - 441.02s |  1 2 3 4 5 6
441.22s - 443.22s |  First place on the rocky list
444.95s - 450.03s |  Okay, what is the account used for it gets information about a user's device?
450.35s - 453.99s |  For example the model the version and a password
454.75s - 461.11s |  This account is not linked to any user account. So it works for any device no matter who owns them
461.91s - 468.11s |  Now I mentioned the password a logger while it is running has an access point active
468.63s - 474.23s |  The SSID of the access point has a convenient naming scheme it starts with a P
474.87s - 481.15s |  Underscore serial number. So if you have the serial number of the logger we can get into the access point
481.75s - 483.75s |  Let's see how an attack would look
484.39s - 488.39s |  First we find an access point that corresponds to the naming scheme
489.03s - 492.43s |  Then we get the serial number. We use the hard-coded account
493.47s - 495.47s |  To make the request and get the password
496.03s - 498.79s |  Connect to the access point and just profit
499.31s - 502.43s |  Okay, those question marks do some heavy lifting
502.43s - 508.79s |  But it basically boils down to sending 80 commands to the logger to get access to the user interface
509.43s - 513.55s |  To get access to the user's Wi-Fi network and just send
514.51s - 516.51s |  commands to
516.51s - 517.83s |  the logger
517.83s - 522.51s |  Now there are some downsides to this attack. First of all, you need physical proximity
523.23s - 526.39s |  Then you need to maintain said physical proximity
526.99s - 533.19s |  You also only get one device at a time and as much fun as war driving is it's not very efficient
533.19s - 535.19s |  I think we can do better
536.07s - 539.51s |  Now we looked at other platform features and
540.87s - 545.07s |  We saw that users can only view statistics and information about their system
545.83s - 550.55s |  To make changes they require to add a business account as a guest
551.31s - 554.23s |  How is this done? Well, there is a search API
554.91s - 558.83s |  That returns data about all users and organizations
559.35s - 563.59s |  In the front end, we only see the name of the business when we search for them
564.11s - 569.07s |  But in the back end, we have emails, phone numbers, addresses, user IDs
570.19s - 576.11s |  For example, we have a vote, an endpoint for a business. We have the administration name, the
577.07s - 583.75s |  Admin's phone number and for the users, we get the last login IP. We get their address if they put it there
585.47s - 589.51s |  By itself, it's not really exploitable at most being a privacy issue
590.27s - 593.43s |  But it gives us a ballpark for the total number of users
593.91s - 597.79s |  About three and a half millions and the total number of businesses
598.43s - 600.43s |  over 300,000
600.79s - 603.99s |  We'll keep this in mind as it might be useful later
606.11s - 608.11s |  Now I talked about
608.39s - 615.59s |  SolrMan and Dey and that's because until recently Dey was using the SolrMan infrastructure to run his code
616.59s - 621.55s |  But recently they built its own datacenter and migrated its user to a new database
622.03s - 629.91s |  The code also runs on their new datacenter, but we wondered maybe the code is still pretty similar
630.91s - 632.11s |  and
632.11s - 636.27s |  It turns out it's very similar. A token from Dey
636.83s - 644.39s |  will work on SolrMan. It gives access to an account that has the same user ID, but the users were migrated so now a
645.11s - 650.11s |  User from Dey has a different user ID from the one on SolrMan
651.19s - 659.07s |  So the user IDs are also incremental. A new account gets an ID of about 14 million on SolrMan and at about
659.55s - 661.55s |  13 million on Dey
661.59s - 667.51s |  This means that by creating new accounts on Dey you could take over over 1 million accounts
668.39s - 670.95s |  That's good, but I think we can do even better
672.55s - 677.03s |  Now I keep talking about the JVT tokens and let's see how they are obtained
677.63s - 679.63s |  For a normal user is pretty straightforward
680.67s - 689.59s |  You send the email address, the password, the hash password and you get back a JVT token containing your email and your user ID
689.75s - 691.03s |  A
691.03s - 693.03s |  business account is a bit different
693.83s - 700.95s |  One account can manage multiple organizations and when logging in an admin will choose which business to manage
701.35s - 706.11s |  The server creates a token that specifies the organization's ID
707.91s - 710.27s |  Let's see the steps. The first step is
711.39s - 718.95s |  basically identical to a normal user and I highlighted in the decoded token the fields that pertain to the organization
719.03s - 721.03s |  the organization ID and the group ID
722.19s - 725.27s |  At the second step using the token from the first one
725.87s - 731.83s |  we get a list of organizations that an admin can manage and
732.95s - 737.07s |  In the third step, we have another login request
737.67s - 744.75s |  to the same endpoint, but this time it's it uses an authorization header with the barrier token we got from the first step and
745.75s - 750.71s |  In the post body, we also have the same token together with the organization ID
751.47s - 753.47s |  the server responds and
753.99s - 759.35s |  completes the fields that I highlighted earlier and pertain to the user organization
760.23s - 765.07s |  Now, what is the issue? In the third step, the endpoint uses data
765.71s - 771.91s |  From the token we sent in the post body and creates the new token that has access to the organization
772.27s - 778.39s |  So we thought let's just change the user ID and email and the token we sent and it just worked
779.03s - 781.43s |  No signature checks. No errors
782.35s - 789.28s |  Didn't even need alg none. The endpoint didn't even need the authorization header. We could use it
790.84s - 798.24s |  Just like that. This is a request with a manufactured token that we sent and the one we received
799.24s - 804.44s |  The tokens here look pretty similar the one on the left is the one we manufactured and
804.96s - 809.80s |  The difference between them is that the one on the left has a bad signature because obviously we don't know the key
810.16s - 813.96s |  to sign the token, but the one on the right is signed by the server and
814.60s - 817.88s |  It gives us access to any account we want. I
819.40s - 825.80s |  Mentioned that we need the ID and email to create this token. But if you remember earlier we have some
826.68s - 830.28s |  Endpoint which gives us this information for all accounts
830.76s - 835.68s |  So this time all three and a half million accounts were risking takeover
837.36s - 841.32s |  Kudos to them they fixed this in 24 hours since we contacted them
842.60s - 846.32s |  Now I'll let Dan talk about the impact
849.09s - 851.09s |  Thanks Alex. So
851.61s - 857.65s |  This context I'll show this more in the timeline. So this is very fresh. We published the findings
857.81s - 859.81s |  just a couple of days ago, so
861.49s - 862.89s |  Take this
862.89s - 869.97s |  List of vendors with a little bit of a grain of salt. It's mostly inferred, but it's a highly let's just say highly informed
870.65s - 874.97s |  Chance that these vendors were also impacted because they do share the solar moon
875.69s - 877.17s |  platform and
877.17s - 881.09s |  Potentially is the same database and we can additionally infer
882.21s - 885.85s |  their potential impact by the fact that we were seeing
887.93s - 895.05s |  Stuff like this popping up around the same time we informed the vendors of the findings so
895.97s - 901.45s |  Some of these vendors also patched right away and informed the users about the existing patches now
903.05s - 905.05s |  Let's talk a little bit about
906.21s - 911.37s |  The actual impact in terms of you know users so we were seeing
912.33s - 916.57s |  You were estimated about three and a half million users could have been impacted by the vulnerabilities
917.57s - 921.81s |  Exemplified here and more than three hundred thirty thousand businesses
922.69s - 924.69s |  All these control multiple systems
925.85s - 932.53s |  Of course, there's a PII component. So having access to the platform could enable a malicious actor to
933.37s - 935.37s |  obtain information
936.37s - 943.15s |  About the users and location and so on so forth. So that's bad in itself bad enough in itself, but but at the same time
943.75s - 947.07s |  Having access and controlling being able to control the inverters
948.43s - 954.99s |  Through the management platform could also either overload or under load the grid. So basically user imagination
955.67s - 960.79s |  Of what could it be done here? Also, it's worth mentioning that the platform
961.55s - 963.91s |  serves about a fifth of
964.55s - 969.75s |  World's total solar generation capacity. So it's quite a quite an impressive number
970.67s - 975.07s |  Kind of put that into perspective it's larger than what the U.S.
975.75s - 978.91s |  Generates through photovoltaics alone. So
980.03s - 983.31s |  The question is does this finally beat the squirrels now?
985.27s - 989.75s |  Because and of course the echoes of national security
991.39s - 993.39s |  Follow the idea here being that
994.47s - 995.95s |  the
995.95s - 1002.15s |  Conversation generally around the grid is that as I said earlier, it's either the squirrels or natural or natural causes
1002.35s - 1004.71s |  We're not here to place FUD around
1006.47s - 1007.83s |  About
1007.83s - 1012.83s |  Solar but kind of trying to shine a light that the situation might be changing for the future
1012.83s - 1014.83s |  And I think it warrants a little more attention
1015.55s - 1020.91s |  I have the timeline here. We contacted the companies sometime in mid-may
1021.23s - 1025.23s |  They've been fairly responsive at both acknowledging and
1026.47s - 1028.47s |  fixing the vulnerabilities
1028.47s - 1033.31s |  And we actually closed disclosure to the to these findings just a few days ago
1034.23s - 1038.39s |  With that said I'm inviting you to ask whatever questions there might be
1038.83s - 1045.35s |  You can also find us at the IT village. We have a we have a little table there and we have a challenge
1046.11s - 1048.11s |  to Hacker TV
1048.19s - 1052.59s |  And please do not forget if you know a vendor
1054.31s - 1058.23s |  Remind them to appoint a permanent contract a contact for a vulnerability
1060.15s - 1066.67s |  Findings to set up a program for vulnerabilities a URL for it put a PGP key on it and monitor that inbox, please
1066.67s - 1069.91s |  So with that said thank you for coming. We're open for questions
1070.47s - 1078.26s |  And if there's no questions just come by
1078.78s - 1083.30s |  Come by the village and we can talk more. So thanks so much for your time. I'll see you guys there. Thank you
1083.90s - 1086.30s |  You


url: https://www.youtube.com/watch?v=vJWzTt2ANAQ
title: DEF CON 32 - Analyzing the Security of Satellite Based Air Traffic Control -Martin Strohmeier
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=vJWzTt2ANAQ",
  "title": "DEF CON 32 - Analyzing the Security of Satellite Based Air Traffic Control -Martin Strohmeier",
  "description": "Automatic Dependent Surveillance \u2013 Contract (ADS-C) is a satellite-based aviation datalink application used to monitor aircraft in remote regions. It is a crucial method for air traffic control to track aircraft where other protocols such as ADS-B lack connectivity. Even though it has been conceived more than 30 years ago, and other legacy communication protocols in aviation have shown to be vulnerable, ADS-C\u2019s security has not been investigated so far in the literature. We conduct a first investigation to close this gap. First, we compile a comprehensive overview of the history, impact, and technical details of ADS-C and its lower layers. Second, we build two software-defined radio receivers in order to analyze over 120\u2019000 real-world ADS-C messages. We further illustrate ADS-C\u2019s lack of authentication by implementing an ADS-C transmitter, which is capable of generating and sending arbitrary ADS-C messages. Finally, we use the channel control offered through a software-defined ADS-C receiver and transmitter as a basis for an in-depth analysis of the protocol weaknesses of the ADS-C system. The found vulnerabilities range from passively tracking aircraft to actively altering the position of actual aircraft through attacks on the downlink and the uplink. We assess the difficulty and impact of these attacks and discuss potential countermeasures.\n\nWe will further look at satellite-based ADS-B receivers and discuss their security and how they relate to ADS-C.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1445,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 7.36s | This text was transcribed using whisper model: large-v2

 Thanks, and welcome to my talk on analyzing the security of satellite-based air traffic control.
7.36s - 13.36s |  My name is Martin Strohmeyer. I work at the cyber defense campus, which is part of the
14.08s - 16.96s |  procurement agency and part of the Swiss Department of Defense.
18.88s - 27.36s |  So DEF CON and other conferences have a long range of talks about attacks on air traffic control.
28.08s - 31.84s |  It's obviously an interesting critical infrastructure.
34.16s - 38.72s |  If you are able to attack something, it could have potentially catastrophic consequences.
39.44s - 46.40s |  This is an overview of typical technologies, communications protocols that are being used by
47.60s - 51.84s |  commercial aircraft and other aircraft in flight.
51.84s - 62.08s |  And basically, since around the early 2010s, a lot of practical attacks on pretty much all of
62.08s - 70.16s |  these communication technologies in aviation have been shown and demonstrated. The principle
70.16s - 75.44s |  is always the same. You examine these standards, aviation standards, they are known, they're
75.44s - 83.60s |  available. There's no security, no authentication in them. You implement them, you build a receiver.
83.60s - 91.28s |  These might also be useful for enthusiasts, plane spotters, that stuff powers flight radar or flight
91.28s - 97.84s |  aware. But from a security perspective, if you have a receiver, it's also not difficult to
97.84s - 102.88s |  implement a sender or transmitter using software-defined radios. And when you do that,
102.88s - 108.24s |  you can do security analysis and you profit. And that's something that has been done for all of
108.24s - 115.92s |  these technologies, whether it's aircraft-aircraft, aircraft-ground, or also GPS is well known.
116.88s - 122.32s |  And since they all have no security built in, it's not difficult to attack them. It's quite obvious.
123.92s - 132.24s |  But a few technologies nicely fitting in with the aerospace topic have come up over the past
132.96s - 139.36s |  decade or so, where aircraft are talking to satellites and kind of trying to replace some
139.36s - 143.28s |  of these technologies or at least enhance them. So that's what this talk will be about.
144.48s - 152.80s |  Just a quick teaser. My colleagues will have a talk tomorrow on creative stage two, attacking
152.80s - 158.32s |  the collision avoidance system. So that was one of the last technologies that hadn't been
158.32s - 167.84s |  demonstrated from this whole overview. So tomorrow, 1415, that's your opportunity to
167.84s - 174.32s |  see a real attack on this as well. But this talk is about space-based air traffic control. So what
174.32s - 181.12s |  do we understand under that? There's two different technologies actually. One I'll touch on briefly
181.12s - 188.24s |  and one more in detail. First one is satellite ADS-B. And the second one is the so-called ADS
189.12s - 199.84s |  contract. So let's look at that. Satellite ADS-B. You all probably have heard of these ADS-B attacks.
199.84s - 206.08s |  There have been talks since 2010. People like RenderMan have had main stage talks
206.80s - 212.24s |  demonstrating the problem here. It's well known to be vulnerable. The terrestrial
212.96s - 219.68s |  transponder technology, aircraft sending data to the ground, trivial to receive,
220.24s - 227.84s |  send ghost aircraft, everything is possible. The problem is space-based ADS-B is essentially just
227.84s - 234.48s |  the same. Some companies have built constellations in low Earth orbit, and they're simply picking up
234.48s - 242.72s |  these same terrestrial signals and then giving them to air navigation service providers to
242.72s - 247.36s |  air traffic control. That is obviously helpful where you don't have terrestrial receivers,
247.36s - 253.84s |  so over the oceans or in mountainous areas. One of these providers, Aerion, also on the
253.84s - 261.20s |  homepage, they say, yeah, it's just ADS-B. There's nothing else here. What they however also said
261.68s - 275.12s |  when they went widely public with it, said, okay, we're 485 miles up in space. So you can't attack
275.12s - 280.48s |  that. It's not like somebody is attacking that signal. They could attack GPS, which they can,
280.48s - 284.24s |  and obviously is a widespread problem, and particularly over the past year now.
284.24s - 287.92s |  But they're not going to attack the actual terrestrial ADS-B signal.
288.88s - 295.36s |  500 miles up in space, too far away. At the time, we already thought, honestly,
295.36s - 300.48s |  there's bullshit. It's just an engineering problem. You need more power. You can do just the same.
301.28s - 306.64s |  They pick up the signals from aircraft flying 30,000 feet, 10 kilometers.
308.88s - 314.88s |  They pick that up in space, right? So what's 10 kilometers more sending from the ground? It's not
314.88s - 322.00s |  a problem, quite obviously. And yes, space is quite obviously not inherently secure.
322.00s - 328.48s |  We've seen this last year, latest last year here at Hackersat. Of course, you can communicate
328.48s - 335.12s |  with satellites in two way and attack them. I think there's no doubt about this.
338.13s - 345.09s |  And yeah, back then, at least we postulated a theoretic attack. We didn't actually send to their
345.09s - 353.01s |  satellites. Would not be legal. But we said, hey, here, these are kind of the requirements
353.01s - 360.13s |  that you have to think about relation, position relation to the aircraft and the satellites.
360.13s - 366.37s |  And then you can simply send ghost aircraft also to these satellites. Not a problem.
368.62s - 374.30s |  So very much possible. We haven't done it in practice for regulatory reasons, but
376.46s - 382.22s |  it's certainly not secure. There's no reason to believe so. That brings me to the second
382.22s - 389.74s |  technology, ADS-C, which is much less well known, I would say. It's been developed
390.94s - 397.90s |  already late 90s, but only become quite popular over the past five or 10 years. Also in the wake
397.90s - 405.74s |  of the MH-370 incident, tracking aircraft over oceans has become quite a popular topic.
407.26s - 413.10s |  So what does ADS-C or full name Automatic Dependent Surveillance contract actually do?
414.06s - 421.26s |  Well, it picks up aircraft information and sends it to air traffic service units, they call it,
421.26s - 426.06s |  which is basically ground stations. There are dozens or even hundreds around the world.
426.62s - 432.54s |  And this information includes aircraft position, altitude, speed, navigational intent,
433.18s - 438.30s |  metrological data. Of course, this is all very useful for air traffic control, air traffic
438.30s - 443.42s |  surveillance, route monitoring, in particular, if you're over the Atlantic or Pacific
443.42s - 450.75s |  and have no updates from your aircraft and where they are. This is roughly the setup.
452.91s - 460.35s |  Aircraft gets their position, of course, also from GNSS, GPS services. It then connects to
461.15s - 466.67s |  different types of satellites, typically geostationary satellites from Enmasat. But it
466.67s - 473.31s |  can also be actually LEO Constellations also offer these services. And then the satellites
473.31s - 479.87s |  forward the data to the ground, and there it's being routed to the air navigation service
479.87s - 489.55s |  provider who require that content. There's also VHF, HF version of all of this, but that's not
490.11s - 499.82s |  what we're looking at here. What's the purpose? I think I alluded to it. The goal is really to
499.82s - 506.06s |  enable aircraft monitoring in very remote areas. We don't have terrestrial surveillance of aircraft.
507.18s - 513.42s |  If you do that, if you know where the aircraft are, rather than just roughly estimating from,
513.42s - 519.98s |  you know, leaving US mainland towards Europe, after two hours, you might not really know where
519.98s - 525.74s |  they are anymore. If you know where they are, you can more efficiently utilize the airspace
525.74s - 531.10s |  because you can minimize separation between different aircraft. And the second effect,
532.70s - 537.34s |  you reduce the reliance on traditional voice communication between pilots and controllers.
537.98s - 543.90s |  These channels are quite congested, quite busy. And you can like this, if you put a lot of the
543.90s - 550.22s |  data on these digital satellite channels, you can use these for more urgent correspondence.
551.82s - 560.22s |  There's roughly comparison. This is a image from ASB exchange. And it shows roughly where you can
560.22s - 570.54s |  have crowdsourced terrestrial reception of aircraft signals. So by and large, that's
571.50s - 579.74s |  where a lot of people live. And also, a lot of, let's say, more wealthy people live who can put
579.74s - 586.70s |  up receivers on the ground and feed it to the systems. All of the red areas, you will never
586.70s - 595.74s |  have any, any reception, any surveillance of aircraft. So if we overlay this with ADC coverage,
595.74s - 603.02s |  we can see that this sort of satellite coverage fills in a lot of the red gaps, certainly
603.02s - 610.86s |  Pacific, Atlantic, even Indian Ocean, and also partly you can see over Africa and some other
611.90s - 616.54s |  terrestrial areas. So how does ADC actually work?
616.54s - 623.02s |  Let's look first at uplink and then downlink messages.
624.78s - 631.50s |  Basically, ADC, they initiate the connection always. So they request a certain aircraft
631.50s - 638.62s |  that's flying to provide them with a so-called contract that can either be periodic.
639.90s - 644.86s |  With that sort of periodic contract, you maybe get regular updates every 10 minutes or so
645.42s - 650.06s |  of position, altitude, and the other information they want, or they can ask for certain events.
651.02s - 658.86s |  So for example, when they want a waypoint change, so when aircraft is flying towards
658.86s - 663.90s |  a certain waypoint, and they know that, and they can request a change of that waypoint
663.90s - 673.50s |  through these contracts. That's roughly how the message is looking, but I won't get into detail
673.50s - 679.02s |  here. And then we have the probably more interesting downlink part. So this is where
679.02s - 687.42s |  the aircraft answers with ADC reports, which go to the air traffic control service provider.
688.06s - 693.82s |  The aircraft sends, as I said, for example, periodic updates, position everything every 10
693.82s - 703.34s |  minutes, or in these events, if change events, cases, it sends certain reports regarding that.
704.38s - 709.26s |  Again, that's what the messages look like. They will include position, latitude, longitude,
709.26s - 715.26s |  altitude, some timestamp, and then depending on the type of the report, it will include some more
715.26s - 723.66s |  information. So why is all that important? I slightly alluded to this already. If we don't
723.66s - 729.66s |  have this kind of new modern technology, the air traffic controllers will have to rely on
729.66s - 737.02s |  pre-computed aircraft trajectories, roughly guesstimating where the aircraft is, which is
737.02s - 742.38s |  not so great for surveillance. And they will use voice communication, just the same finding out
742.38s - 748.70s |  where the aircraft is and what they're doing, in particular in remote areas, using HF and the
748.70s - 756.54s |  likes. And that's not the most precise technology or the most available one. So in short, ADC is
756.54s - 763.10s |  very crucial for aircraft monitoring these areas. It's being rolled out, as we've seen on the map,
763.10s - 770.38s |  quite a lot of commercial aircraft have it now and use it. And in contrast to many of the other
770.38s - 776.30s |  technologies that were in the earlier slides, this hasn't been studied at all. Not in terms
776.30s - 783.66s |  of use cases, really, in the scientific community, but also in the security community in terms of,
783.66s - 791.15s |  well, what can we do with it? What can we do against it? So what about security?
792.43s - 797.55s |  There's a paper on this, on what I'm going to say. So we talked about this at this year's
798.43s - 804.91s |  SpaceX workshop already. But if you prefer it in written form, you can look it up.
805.55s - 812.67s |  But I cover most of this in the following slides. So that's our system model and our
812.67s - 819.39s |  threat model. Basically, we have the satellite in the middle, we have the ground earth station,
819.39s - 825.79s |  as they call it, and we have the aircraft earth station, which might sound a bit weird, but
825.79s - 830.43s |  you know, aircraft is still on the earth while a satellite is not. So that's why they call it
831.47s - 836.11s |  that way. Different frequencies that we have to look at. So the aircraft
837.23s - 842.11s |  uses the 1.6 gigahertz frequency to talk to the satellite. And then there's a different up and
842.11s - 847.87s |  down in frequency from the satellite to the ground station, 3.6 gigahertz and 6.5 gigahertz.
848.59s - 853.87s |  And we have three different types of attackers that we consider. First one is a passive attacker,
853.87s - 860.91s |  you could also call it an eavesdropper. The eavesdropper simply needs to be in range of the
860.91s - 867.07s |  whole satellite beam of the geostationary satellite. So that's not very complicated.
867.63s - 875.07s |  But we have realized that at least in Europe, you need to be in a 5g free zone to listen to
875.07s - 882.43s |  the downlink because the 3.6 gigahertz area frequency is exactly at least in Europe, the 5g
882.43s - 889.39s |  frequency or one of the 5g frequencies. And if you have one of these transmitters, ground stations
889.39s - 895.87s |  nearby, you will not be able to receive the very weak satellite signals. So that was an issue that
895.87s - 902.67s |  we had to contend with. Then we have two active attackers. One is attacking the downlink. So
902.67s - 910.43s |  basically, transmitting the same data as we see on the downlink towards the earth station. And
910.43s - 916.51s |  an uplink attacker. So somebody who sends to the satellite, which is more complicated, absolutely,
916.51s - 923.79s |  you need more power. And we've been speaking to some experts, depending on the satellite setup,
924.75s - 931.63s |  there may be some beam forming going on. So you might, it might not be sufficient to stay in
932.75s - 937.47s |  just anywhere in the satellite beam, you may also need to be close to a ground station,
937.47s - 944.83s |  depending on the satellite setup. So let's go through it one by one. What can we do with
944.83s - 950.75s |  eavesdropping on ADC messages, the content we've seen is mostly position waypoints.
951.55s - 957.71s |  And there's some meta information such as the aircraft ID, some identifiers. And
958.99s - 966.67s |  mostly this is useful for reconnaissance on aircraft. So you know where they are,
966.67s - 973.39s |  you know what they sent, you know where they're going, that is quite nice. Can be used for
974.43s - 979.95s |  attacks on aircraft, also on other protocols, or for active attacks on ADC itself.
980.83s - 987.79s |  We can link these identifiers to databases that are available online. And then from there,
988.67s - 994.11s |  you may imagine a lot of privacy violations. I'm sure you've seen all the kerfuffle about people
994.67s - 1002.03s |  tracking Elon Musk or Taylor Swift's aircraft, right? If you haven't, then I can recommend my
1002.03s - 1008.83s |  talk, the village last year. I think it's just been put online last week. So you can find it
1008.83s - 1020.90s |  on YouTube. Let's move on towards the active attacks first on the uplink. And here, mostly
1020.90s - 1026.58s |  what you can do is different sorts of denial of service attacks. So if we look at the protocol
1026.58s - 1034.34s |  here, the aircraft locks on, it will be confirmed, it will be acknowledged. And of course, if you
1034.34s - 1042.98s |  attack this handshake, then you might simply be able to prevent the lock on. And then there's no
1042.98s - 1051.62s |  ADC connection. That's, yeah, it's a denial of service of ADC. You have other technologies
1051.62s - 1058.58s |  available, of course. So it's not immediately safety relevant at all. But it's certainly an
1058.58s - 1065.86s |  attack. And there are several places in the protocol where you can do this. On the downlink
1065.86s - 1073.86s |  end, it gets a bit more interesting. Here, you can do spoofing of aircraft positions towards the,
1074.58s - 1082.50s |  or yeah, towards the air traffic control provider. What you can't do, just to preface this,
1083.30s - 1090.90s |  is to inject ghost aircraft. Why? Because as we've seen earlier, the air traffic controller
1090.90s - 1097.46s |  always initiates the connection to an aircraft. So they will do that towards an aircraft they
1097.46s - 1105.54s |  know is already flying. And if they get a response, okay, great. But if they get a response from an
1105.54s - 1110.10s |  aircraft they haven't initiated a connection with, it will just be discarded and ignored.
1110.90s - 1115.78s |  If, however, they already have a connection, then it's absolutely possible to send different
1115.78s - 1121.06s |  positions than the one from the aircraft. And we've illustrated this here with our own setups.
1121.06s - 1129.14s |  So on the left, we have real aircraft positions that we received. And you can just send, you know,
1129.14s - 1134.26s |  for the same aircraft, 10 positions clustering together, and it would be displayed this way.
1135.06s - 1141.30s |  Likewise, you can flood ground stations with emergency mode messages from basically all the
1141.30s - 1146.82s |  existing aircraft that they have a contract with. That's the picture of the flight management system
1146.82s - 1152.18s |  here. That's where the pilot can put this on. And then, of course, they will be flagged with
1152.18s - 1160.18s |  the air traffic controller and get priority, get certain routines set up. And here, you can
1161.14s - 1167.22s |  basically do this for all the aircraft at the same time, which would again be causing some chaos and
1167.22s - 1175.78s |  some denial of service. We've done some real world evaluation as far as that is legally possible.
1177.30s - 1182.74s |  That's our receiver setup. So we've both set up downlink and uplink receivers.
1184.90s - 1189.46s |  The pipelines for the receivers are available online on GitHub,
1190.90s - 1197.46s |  having a later slide. But mostly, you can download it, put it together with your software
1197.46s - 1202.90s |  defined radios and antennas. Then you have to look, follow tutorials, look at the channels,
1202.90s - 1208.82s |  and you can receive the data. You have to look, check also which satellite is in your area.
1208.82s - 1217.30s |  So this is the InMarsat coverage of the geo satellites. So for us, it would be the AlphaSat.
1217.30s - 1223.14s |  If we look at it in Europe, in the US, you would get different satellites and their aircraft
1223.14s - 1230.50s |  connections. That's the pipeline, the setup. Definitely credit to all these people who
1230.50s - 1238.02s |  have written the super interesting, super useful receiver software, SDR receiver,
1238.02s - 1244.34s |  Jero, and a lot of tutorials. You set the whole thing up, save the data, and analyze it. That's
1244.34s - 1251.38s |  what we did. That's how these setups look like. The uplink, much easier, as you see, can be a
1251.38s - 1259.78s |  super small antenna on the left. For the downlink, you need something in the eight feet dish size.
1259.78s - 1266.90s |  So your house might be, you might have to have a decent sized garden for this.
1268.42s - 1274.18s |  Some data insights. We just looked at this for a few weeks, collected a lot of messages. You see
1274.18s - 1282.34s |  the black points, which are the positions here, 2,500 aircraft, communicating with 50, 60 ground
1282.34s - 1288.26s |  stations. If you want to see more on this, other people are collecting the data as well. So tbg
1288.26s - 1298.50s |  airframes.io, you always get the last two days. These are typical routes that you can follow with
1298.50s - 1307.30s |  that setup. Then, as I've mentioned, we arrested, we built a transmitter. And it works. It's a
1307.30s - 1312.10s |  straightforward student work, building a transmitter from a receiver from all of these
1312.82s - 1321.78s |  existing SDR implementations. We tested it. It's fairly binary. We set up our own ground station.
1322.34s - 1329.94s |  We tested the transmitter, can generate arbitrary messages on ADC, including all of the sub layers.
1330.66s - 1335.06s |  So we injected these messages into our dish, into our ground stations.
1335.70s - 1343.22s |  And lo and behold, it works. So if you have a receiver software ADC, you can simply inject
1344.02s - 1349.86s |  any legitimately looking message and you cannot tell it apart from the messages that we get from
1349.86s - 1358.48s |  an aircraft. That brings me to the conclusion of my talk today. I hope I could explain that
1358.48s - 1364.16s |  satellite edge of control certainly helps increase airspace efficiency in many areas.
1364.72s - 1371.36s |  Unfortunately, security was never a concern. There's no authentication, which is as problematic
1371.36s - 1379.76s |  in space as on the ground. Passive attackers can eavesdrop and follow aircraft, do whatever
1380.64s - 1385.92s |  what may they might find interesting with it. And you can follow a lot of aircraft just with
1385.92s - 1391.92s |  a single receiver, which is nice. Active attackers can inject signals and disrupt
1391.92s - 1400.00s |  air traffic control to a certain extent. And the resources certainly are quite straightforward or
1400.00s - 1407.92s |  trivial. So it's basically a master thesis here. Student can do this and set up costs for
1408.80s - 1416.88s |  the transmitters are a few hundred euros. So not a problem. That's it for me. Just another teaser.
1417.52s - 1425.44s |  We have some, if you're interested in injection of signals into satellite dishes,
1426.32s - 1432.88s |  there's also a talk on the DEFCON main stage tomorrow, track three, breaking the beam at 2.15.
1433.60s - 1438.56s |  And next week at USENIX security, the paper is online under this link. So
1439.12s - 1441.84s |  just I hope I could do this as well. Thank you.


url: https://www.youtube.com/watch?v=sjd5LrzHus0
title: DEF CON 32 - A dive into world of Aircraft PKI - Matt Gaffney
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=sjd5LrzHus0",
  "title": "DEF CON 32 - A dive into world of Aircraft PKI - Matt Gaffney",
  "description": "From protecting Aircraft Software Parts to authenticating aircraft to ground networks, aircraft use PKI in their day-to-day operations. In this talk we will cover the typical use cases, technologies, and regulations in play and touch upon the emerging threat of the Post-Quantum world and what it could mean for the protection of embedded software we find on aircraft.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1506,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 7.68s | This text was transcribed using whisper model: large-v2

 So I'm Matt Gaffney also known as Gaffers. I'm a principal engineer at United
7.68s - 14.36s |  Airlines. I'm also a village lead at the Aerospace Village so a big shout out to
14.36s - 20.88s |  those guys put on a great show this year. I'm going to do a shallow dive into
20.88s - 24.80s |  aircraft PKI and I've got a few caveats to start with. Like I said this is a
24.80s - 30.52s |  shallow dive into the topic. I see a few operators that I recognize in the room
30.52s - 35.56s |  and at least one expert who will know this topic several times better than I
35.56s - 39.76s |  ever will and you'll understand when I say this this is something you can
39.76s - 46.00s |  easily spend three days talking about. It is so complex. So there are some
46.00s - 50.16s |  simplifications and there are some generalizations and I'm also only going
50.16s - 55.00s |  to speak to what I'm authorized to speak to. And through the village our
55.00s - 58.96s |  ethos is to bring light and not heat to the topic of cyber in aerospace. So this
58.96s - 62.28s |  will be supplier agnostic and there are some industry challenges that we're
62.28s - 69.16s |  working together to fix which I cannot cover. All right that's what we'll go
69.16s - 76.80s |  through today. The importance, some use cases, methods A, B and C, a bit of it on
76.80s - 83.04s |  ATA spec 42 and then some about post-quantum world PKI for aircraft. I've
83.04s - 85.92s |  included a slide of acronyms because I know the slides are going to be
85.92s - 91.68s |  available later through DEFCON but like I said those you who work in aerospace
91.68s - 95.56s |  will know what I'm talking about. I will try to name them out every time I
95.56s - 101.80s |  mention the first time around. If I don't just throw something at me. So why is it
101.80s - 105.16s |  important? Well in aviation with this thing called field loadable software or
105.20s - 110.60s |  FLS and in modern commercial aircraft FLS is everywhere and don't just think
110.60s - 115.24s |  about your IFE right. You know it's like you're in flight entertainment sorry
115.24s - 120.20s |  with your films or movies. We have sensors which generate logs for
120.20s - 123.44s |  maintenance and preventive maintenance, communication systems,
123.44s - 128.32s |  control surfaces and navigation databases. And then for legacy and in
128.32s - 134.32s |  most cases on next-gen aircraft if you wanted to update the firmware in a line
134.36s - 139.48s |  replaceable unit or an LRU you'd have to take it out and put a new one in.
139.48s - 145.32s |  Whereas with the enabled aircraft there are certain LRUs to which you can just
145.32s - 150.04s |  push new FLS to activate new features or just to update the functionality to fix
150.04s - 155.68s |  any bugs. And if you saw my talk on DEFCON 28 on the aircraft information
155.68s - 160.24s |  systems domain you might remember my favorite factoid and that's that
160.24s - 165.88s |  there are about 1,400 different software parts on a 787 and to control
165.88s - 174.64s |  the bathrooms. So these are the typical use cases. It's not an exhaustive list
174.64s - 179.28s |  but it covers the main use cases in commercial aviation and those which I
179.28s - 186.40s |  generally have time for today. So aircraft operators receive FLS from
186.40s - 190.84s |  multiple sources. They can be manufacturers, OEMs, suppliers and even
190.84s - 196.80s |  from internal teams who can build a subtype of FLS called UMI or user
196.80s - 202.16s |  modifiable information. A good example of UMI is a configuration load for the
202.16s - 205.84s |  aircraft information systems domain on certain aircraft which will define
205.84s - 210.84s |  things like connectivity to the ground, enabling and disabling features or
210.84s - 214.72s |  systems. And that is a part we would create and sign before we can put it on
214.72s - 219.48s |  the aircraft. And when we receive an FLS from an external source we are required
219.48s - 224.08s |  by regulation to verify its authenticity. For handling FLS the
224.08s - 227.40s |  manufacturers provide operators with the software to which we configure them
227.40s - 231.44s |  with the verified suppliers trust chains and that allows us to verify it's been
231.44s - 238.38s |  signed by the trusted entity. As important as verifying its
238.38s - 243.06s |  authenticity it's vital we check the FLS integrity as well and we're also
243.06s - 248.74s |  required by regulation to do that as well. In fact through various standards
248.74s - 251.30s |  we're mandated to do this before uploading to the aircraft and there's a
251.30s - 254.18s |  new requirement and I'm sure I'm gonna get some eye rolls from somebody in the
254.18s - 260.38s |  front row here about the recent implementation or basically new rules
260.38s - 267.02s |  around using ARINC 645-1 portable data loaders or PDLs. It's been a bit of a
267.02s - 273.94s |  thing for us but these enforce signature checking of the FLS prior to loading
273.94s - 277.86s |  onto the aircraft for in a technical sense so we're not relying on the on the
277.86s - 281.62s |  mechanic or the technician to do those checks you actually can't physically put
281.62s - 287.20s |  it on the aircraft until that signature has been checked which is great. And it
287.20s - 290.60s |  may or may not surprise you when I say that an aircraft can generate
290.60s - 294.88s |  hundreds of megabytes if not several gigabytes of data per flight length.
294.88s - 299.38s |  We've come a long way from the days of OOE messages over A cars although they
299.38s - 305.76s |  do still exist. The vast majority of data comes from the engines or certain
305.76s - 309.68s |  aircraft if you have a Navy pilot and he slams it on a landing some F you know
309.68s - 315.40s |  the carbon fiber aircraft they also generate stress data and as soon as the
315.40s - 318.36s |  aircraft touches down you get that infamous weight on wheels signal to the
318.36s - 321.40s |  avionics it will start trying to establish a link to the ground systems
321.40s - 328.41s |  and sometimes even before the aircraft reaches the gate. These connections are
328.41s - 333.17s |  typically 4G and Wi-Fi and most airport gates have an access point for a service
333.17s - 338.97s |  called gate link which can best be described as a common use network
339.05s - 343.29s |  dedicated for aircraft traffic and for that reason many operators also
343.29s - 347.77s |  implemented VPN through gate link to their network boundary and depending on
347.77s - 352.01s |  the aircraft each VPN can require between one and three certificates just
352.01s - 358.09s |  for that connection and that's per aircraft. It's also worth noting the logs
358.09s - 363.15s |  are digitally signed and verified before being ingested by the operator in the
363.15s - 370.30s |  relevant tools or sent on to third parties for analysis. Certificates can
370.30s - 376.18s |  also be used to enforce boundary server and even application authentication. It
376.18s - 382.18s |  does require mapping these certificates to AD identities which is fun especially
382.18s - 386.02s |  if you operate a large number of enabled aircraft and it's no secret that you
386.02s - 390.98s |  know at United we're trying to upgrade our fleet I think when I started with a
390.98s - 395.26s |  hundred and fifty enabled aircraft in our fleet which was a minority by the
395.26s - 398.62s |  time we finished updating it we'll have over a thousand enabled aircraft and
398.90s - 403.58s |  that's gonna mean a lot of work in terms of this PKI and the connectivity piece
403.58s - 411.30s |  and the final use case I'd like to cover today touches a little bit on ETA spec
411.30s - 415.70s |  42 which I'm going to cover a bit later on but suffice to say there are some
415.70s - 421.54s |  real wins possible using certificates in smart cards for user authentication. Not
421.54s - 425.74s |  only does it provide two-factor without a mobile device but it has advantages
425.74s - 430.86s |  from a user experience perspective as well. If you're in a public facing role
431.22s - 436.42s |  would you rather a password with 15 plus characters which is rotated every three
436.42s - 449.09s |  to 12 months or would you prefer a smart card with a pin code instead and every
449.09s - 454.25s |  time you log in you type in a pin code and when you pull the smart card out it
454.25s - 458.57s |  locks the screen automatically. So you get great security you also get a great
458.57s - 463.57s |  user experience as well and if you're a gate agent working in a public area that
463.61s - 470.60s |  could be a real win. We're working on it but going back to signing FLS so ETA
470.60s - 475.96s |  spec 42 requires all PKI subscribers to authenticate to the PKI management
475.96s - 480.92s |  platform using those smart card based hardware certificates like I just showed
480.92s - 488.94s |  you my hand there. The spec puts a huge emphasis on identity verification, dual
488.94s - 494.50s |  controls and audit of all activities. Without strong authentication mechanisms
494.62s - 499.50s |  all of that would be for naught. In some scenarios and depending on the method
499.50s - 503.30s |  used to sign the FLS the signing certificate can be held on the smart
503.30s - 508.58s |  card of those specific authorized sorry those specific subscribers who are
508.58s - 514.93s |  authorized to sign the software. So coming on to the signing then so signing
514.93s - 523.01s |  FLS method A on the left there we're receiving the receiving the software or
523.01s - 528.77s |  it's coming from that internal team and in method A it's typically in this
528.77s - 535.41s |  scenario it's typically unsigned. If it was signed it would just be verified and
535.41s - 543.37s |  then put into the storage or the repository. But in method A you get
543.37s - 549.77s |  your data your software part here which is an ARINC 665 load. Basically it's
549.77s - 554.41s |  an ARINC standard of zip file structures and the header files and
554.41s - 563.21s |  then using the manufacturer provided tools the device sponsor here will use
563.21s - 570.05s |  their smart card and they will the software will then verify that
570.05s - 575.73s |  certificate on his smart card with an OCSP response and if it's valid the
575.73s - 579.25s |  software will go ahead and sign that software using that device sponsors
579.25s - 585.25s |  private key and it creates a load with a signed OCSP response along with the
585.25s - 589.97s |  data and the encrypted hash or the signature. And this is great it's got a
589.97s - 595.17s |  bunch of advantages. So once an FLS has been signed with a valid certificate it
595.17s - 599.85s |  never needs to be signed again unless that software is modified. So it doesn't
599.85s - 605.53s |  matter if that certificate is revoked later or it expires we know that at the
605.53s - 612.79s |  time of signing that that certificate was valid. And also in this situation the
612.79s - 616.75s |  aircraft does not need to an access a CRL or a certificate revocation list it
616.75s - 622.15s |  just needs to be configured with a trust chain. The disadvantages are you don't
622.15s - 626.75s |  control the PKI and you have to pay for it and also you know these ground system
626.75s - 630.35s |  environments often use virtual machines and if you can imagine here I've
630.35s - 635.31s |  oversimplified it here but this device sponsors probably on it on a laptop going
635.31s - 639.71s |  to a jump box to go into a high secure zone and you've got to get that smart
639.71s - 643.43s |  card that he's got his laptop read by the software that's on a VM through a
643.43s - 647.43s |  jump box. That can be tricky to set up and I'm probably getting some nods in
647.43s - 656.63s |  the front row I can't see for the lights. Method B a little bit more simplistic so
656.63s - 663.63s |  we will receive data signed or unsigned if it's signed we verify the signature
663.63s - 671.31s |  and then strip it off and then we keep our signing signature or signing
671.31s - 678.67s |  certificate sorry in a HSM which is used by that software checks on this is
678.67s - 683.67s |  checked by the CRL of course and then goes a much more simple structure here
683.67s - 687.71s |  and then goes into repository. From the repository I didn't cover that in the
687.71s - 691.27s |  last slide sorry there are multiple ways to get that from the repository to the
691.27s - 697.43s |  aircraft. There is this over-the-air technique which some aircraft enable us
697.43s - 701.63s |  to do. It still requires a mechanic or a technician to go into the cockpit and
701.63s - 705.47s |  press some buttons and there's some other conditions which have to be true
705.47s - 710.23s |  as well so all this science fiction you read about changing software in flight
710.23s - 714.15s |  yeah I'm going to tell you what those conditions are but there are conditions
714.15s - 718.51s |  which stop that kind of thing. We can also use USBs and these are not your
718.51s - 724.75s |  typical USBs you keep at home these are actually assigned as tools and they are
724.75s - 727.79s |  treated as such they're signed in and out the tool store they go through
727.79s - 732.59s |  procedures to wipe and clean them or at least they should anyway and then the
732.59s - 737.11s |  one in the middle there is a PDL or a portable data loader that's what I was
737.11s - 745.39s |  talking about earlier there at 6451 and they will connect to the network pull
745.39s - 748.39s |  the software into the PDL you walk to the aircraft and plug the PDL into the
748.39s - 754.46s |  aircraft and do it that way and then there's method C which is very similar
754.46s - 762.50s |  to method A but it also includes a signed SCDP response as well okay and as
762.50s - 768.26s |  far as I'm aware and correct me if I'm wrong but I'm not aware of this method
768.26s - 773.02s |  in use for commercial aircraft today may well happen in the future but today it's
773.02s - 777.82s |  not currently in operation for commercial aircraft but it does have
777.82s - 784.70s |  practical uses where FLS is designed to be kept for a long term because while I
784.70s - 787.86s |  said earlier in method A the FLS doesn't need to be reassigned that's only as
787.86s - 793.42s |  long as the CA it was issued for from remains valid so that could be a few
793.42s - 798.10s |  years or it could be 20 years depending on when you've caught it in that cycle
798.10s - 803.54s |  method C allows for really long-term FLS to remain valid with the least amount of
803.54s - 807.98s |  disruption to any aircraft FLS you've got loaded on there it's also an
807.98s - 812.14s |  interesting solution for record-keeping in aircraft maintenance
812.14s - 815.34s |  where you have to keep documentation sometimes for the lifespan of the
815.34s - 818.38s |  aircraft and be able and you have to be able to prove that it hasn't been
818.38s - 828.70s |  modified during that time so this is a typical process load for the generation
828.70s - 832.38s |  of an aircraft certificate it is not by all means the only way of doing it but
832.38s - 838.06s |  I'm pressed for time so it's the only one I'm going to cover today so keying an
838.06s - 841.14s |  aircraft is part of the maintenance function and this means procedures are
841.14s - 844.70s |  in place to make sure it's done only when authorized and there's adequate
844.70s - 850.22s |  documentation and approvals in the process so obviously your device sponsor
850.22s - 854.42s |  here or you know somebody in your technical operations department tech ops
854.42s - 860.02s |  will generate the key instruction or the key generation work instruction and then
860.02s - 864.58s |  someone would go to the aircraft and generate that key pair and then
864.58s - 869.38s |  depending on whether you've got over the air or whether you're using PDLs and
869.38s - 875.54s |  USBs you will bring that CSR back to the network validate it and then send it off
875.54s - 884.06s |  to your PKI provider the RA function there that's the registration authority
884.06s - 889.90s |  that's an interesting one so this is an ATA spec 42 requirement and it's all
889.90s - 897.86s |  about dual control ATA spec 42 requires the PKI to have this registration
897.86s - 903.74s |  authority who proves all registrations and requests and when an airline
903.74s - 908.54s |  outsources their PKI operation to a third party there can be a need to
908.54s - 913.42s |  insert an airline employee as the RA inside the PKI provider and that's where
913.42s - 918.50s |  this stuff gets interesting and this is especially important for confirming
918.50s - 923.78s |  aircraft identities because the PKI provider they do PKI they don't do
923.78s - 932.02s |  aircraft right not all the time but there is one and this can this creates a
932.02s - 935.70s |  challenge when it comes to the audit side of the of the PKI and obviously
935.70s - 940.30s |  that audit is a key part of spec 42 but yes the RA will authenticate and
940.30s - 944.22s |  approve the CSR that then gets passed on to the certificate authority who will
944.22s - 949.50s |  again validate the CSR information and then and the signature and then issue
949.50s - 955.22s |  the certificate and then your technician goes back retrieves the certificate
955.22s - 958.86s |  generates the word loading work instruction takes it to the aircraft the
958.86s - 963.90s |  aircraft validates certificate and you know Bob's your uncle that's a typical
963.90s - 967.74s |  process and as you can see one of the key things is that just like if you were
967.74s - 971.42s |  generating you know a key pair on a server the private key stays on the
971.42s - 984.76s |  aircraft spec 42 so the ATA e-business data security working group or the DSWG
984.76s - 989.96s |  is set is to set the strategic path for these standards and ensure that all
989.96s - 994.80s |  project team efforts and specification changes requests are consistent with the
994.80s - 1000.00s |  industry's e-business vision mission and strategic plan I couldn't paste that
1000.00s - 1006.16s |  from their website I never sound that professional but basically it's a
1006.16s - 1010.36s |  group formed by experts across the industry including OAMs manufacturers
1010.36s - 1018.96s |  operators I'm in there I feel very I feel less intelligent than I usually do
1018.96s - 1022.16s |  in that room because these guys have just brains the size of a planet but
1022.16s - 1026.34s |  it's important that we're there suppliers are in the room and then
1026.34s - 1031.14s |  interested parties from the ATA membership as well and an ATA spec 42
1031.14s - 1033.74s |  has a strong emphasis on the establishment of trust based on
1033.74s - 1038.66s |  verified identity so when you become a subscriber as a person you go through
1038.66s - 1043.50s |  identity checks to verify that you are who you say you are and that then goes
1043.50s - 1049.14s |  through two-person control as well we also have strong emphasis on certificate
1049.14s - 1055.42s |  usage technical and procedural controls protection of PII audit documents it's
1055.54s - 1060.46s |  410 pages and it's very complex language I'm gonna be straight with you the first
1060.46s - 1065.06s |  time I read it it was tough I did not get it it took me several reads and it
1065.06s - 1070.38s |  also put me to sleep a few times I'm not gonna lie it's a good cure for insomnia
1070.38s - 1078.58s |  but we were told that all PKI have to basically used to design software parts
1078.58s - 1082.98s |  shall now be compliant with the ATA spec 42 so what that means is if we're using
1083.14s - 1088.42s |  one certificate to sign parts then we're gonna start using ATA spec 42
1088.42s - 1093.14s |  compliant certificates for all of our PKI so that's what we've been doing
1093.14s - 1098.46s |  audit scope is defined by the network and technology used in operating the PKI
1098.46s - 1103.26s |  it's a bit like the fruit of the poison tree so everything the PKI touches is in
1103.26s - 1108.70s |  scope so remember that RA role I was talking about earlier this is where it
1108.70s - 1113.34s |  gets fun because the RA is considered part of the PKI but they use the
1113.34s - 1119.62s |  operators IT and network and so to avoid bringing that in the entire operator IT
1119.62s - 1125.10s |  into a very painful and thorough audit they need to use a very locked down IT
1125.10s - 1131.58s |  device which with you know bare bones of what's required and you know minimum
1131.58s - 1136.14s |  interaction with the network and the infrastructure it's strictly controlled
1136.14s - 1139.06s |  by the certificate policy and the certificate practice statement and forms
1139.06s - 1142.78s |  a part of the on-site checks during the annual audit so we've got a few of these
1142.78s - 1146.42s |  in you know all over the country actually because a lot of us are remote
1146.42s - 1149.98s |  and the auditors gonna have to go and fly and see them and check they're
1149.98s - 1158.66s |  locked down to the specifications in the CPS so it's it's fun and then finally so
1158.66s - 1164.42s |  the challenges to aviation PKI in a post quantum world this one's been really you
1164.42s - 1170.18s |  know eating away at my brain the last you know six to twelve months because
1170.18s - 1173.46s |  the the threats are not only very real but also very difficult to figure out in
1173.46s - 1178.62s |  terms of aviation depending on who you talk to quantum computer capable of
1178.62s - 1184.10s |  breaking Shor's algorithm is either 5 10 15 or 20 years away but regardless an
1184.10s - 1190.02s |  aircraft lifespan is typically 30 years or even more and once an aircraft is
1190.02s - 1196.46s |  certified it's really hard to change it it's certainly very expensive I mean the
1196.46s - 1199.62s |  rumor is it takes so much testing that changing one line of code in the avionics
1199.62s - 1202.14s |  costs a million dollars just because you have to go through all those tests
1202.14s - 1206.70s |  afterwards don't know if that's true or not but that's what I've been told so
1206.70s - 1211.94s |  imagine how much effort it would take to enable post quantum key sizes across all
1211.94s - 1217.58s |  manufacturers and all fleets does the hardware in the LIU have the required
1217.58s - 1223.46s |  memory and processing power for PQ algorithms the switch from SHA-1 to
1223.46s - 1229.58s |  SHA-2 back in about 2017 caused a friend of mine in a previous job to complain a
1229.58s - 1235.06s |  lot about how it now took 10 minutes to create a key pair instead of the
1235.06s - 1239.94s |  five minutes that it used to how long with a post quantum safe signature take
1239.94s - 1244.26s |  to generate in an LIU I don't know that's that's gonna be interesting one
1244.26s - 1253.64s |  to do so I'm coming to the end here and I want to talk about a little bit about
1253.64s - 1260.84s |  the way ahead so the operator level some advice from the DSWG is to start
1260.84s - 1267.00s |  invent an inventory of all your PQI use cases and when NIST finally figures out
1267.00s - 1272.64s |  which algorithms we are good to use for which use case start identifying those
1272.64s - 1277.00s |  suitable algorithms for each one and then with the manufacturers and OEMs
1277.00s - 1279.36s |  we're going to figure out the embedded software challenge because that's a big
1279.36s - 1284.40s |  one if you've ever coded in C dealing with memory pointers and the
1284.40s - 1288.56s |  digital signature which was you know a few dozen kilobytes is now several
1288.56s - 1295.40s |  megabytes that's going to be fun and of course we need to do a lot of testing
1295.40s - 1299.96s |  regulator approval and it's not going to happen in the timeline we've got for
1299.96s - 1303.84s |  post-quantum computing to become a thing but we go threat so we're up
1303.84s - 1307.20s |  against it on that front I'm gonna be back in the village after this talk if
1307.20s - 1311.48s |  anyone's to come and talk about post-quantum PKI I'm all ears I'd love
1311.48s - 1316.40s |  to hear from any experts out there I can take that back to the DSWG and those and
1316.40s - 1320.52s |  maybe sound a little bit more intelligent than I usually do but yeah
1320.52s - 1323.68s |  or if you want to come back and talk PKI I'll be there for a little bit I've got
1323.68s - 1328.48s |  my lot I live in Chicago now so now I'm you know it's obligatory to become a
1328.52s - 1333.08s |  fan so I've got my lot if you want that too but yeah I've got a few moments for
1333.08s - 1345.90s |  questions I think crack it is light is bright thank you so gentlemen the front
1345.90s - 1365.14s |  and it's it's hard to say yes to that the reason being is that it's not
1365.14s - 1370.90s |  specifically covered in regulation a lot of this isn't actually it's actually
1370.90s - 1375.98s |  more to do with the manufacturers send down recommendations and instructions to
1375.98s - 1379.86s |  operators on how to do things and they also build things around a secure
1379.86s - 1384.50s |  framework they all have product security teams and they all do a lot of work they
1384.50s - 1387.70s |  can't share a lot of information with us except for these recommendations and
1387.70s - 1391.10s |  instructions right and the FAA is quite rightly said even if it's a
1391.10s - 1394.46s |  recommendation you implemented it as if it was an instruction right so that's
1394.46s - 1400.66s |  that's good and that's what we do so that signing of the logs coming off the
1400.66s - 1404.18s |  aircraft obviously is probably a part of that risk assessment that the
1404.18s - 1407.90s |  manufacturers have gone through because that is potentially safety related if
1407.90s - 1417.78s |  the logs are tampered with then either a required you know maintenance check or
1417.78s - 1421.14s |  job is not going to be done or it's gonna be done and it's not required
1421.14s - 1425.78s |  right and that's a problem so that's why they're signed so when they come off and
1425.78s - 1433.16s |  they're analyzed we're sure their integrity yeah good question yes sorry
1433.16s - 1449.76s |  Jackie's sorry so again with method a you just grab a new certificate and
1449.76s - 1460.72s |  carry on with method B you get a new certificate and re-sign everything yes
1460.72s - 1469.96s |  sir yeah yeah yeah I would say logs I mean all of it yeah yeah folk was a part
1469.96s - 1474.52s |  of that so for those who don't know focal data is engine related and
1474.52s - 1479.96s |  actually we don't decode that it goes to back to the engine manufacturers they
1479.96s - 1494.82s |  decode it and they're really nice they sell it back to us yeah as well yeah
1494.82s - 1499.14s |  all right I think I'm being kicked off stage and so like I said I'm in the
1499.14s - 1504.90s |  village you want to come and chat and you know share some a lot thanks


url: https://www.youtube.com/watch?v=zkoTwQRXMz0
title: DEF CON 32 - UDSonCAN Attacks Discovering Safety Critical Risks by Fuzzing - Seunghee Han
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=zkoTwQRXMz0",
  "title": "DEF CON 32 - UDSonCAN Attacks  Discovering Safety Critical Risks by Fuzzing - Seunghee Han",
  "description": "Some diagnostic services in UDSonCAN that could affect driving should be disabled while driving and protected by authentication mechanisms such as SecurityAccess. However, without these security measures, attackers can cause a serious safety risk to the driver using only diagnostic messages. In this talk, we introduce UDSonCAN attacks discovered through fuzzing and describe their countermeasures. These attacks can cause a moving car to suddenly stop or a stationary car to suddenly acceleration with just simple diagnostic messages. We discovered these vulnerabilities in the latest electric vehicle model and have prepared a demo.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1409,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 9.68s | This text was transcribed using whisper model: large-v2

 Hello, my name is Seunghee Han. I'm a small girl from Korea and the first author of this talk.
9.68s - 18.48s |  It's my first time at DEF CON so I'm very nervous and so excited. Anyway, the title of this talk
18.48s - 28.48s |  is UDS on CAN attacks, discovering safety critical risk by fuzzing. In this presentation, I will
28.48s - 34.88s |  talk about the weak points that I found in the latest EV models by fuzzing test.
38.74s - 46.02s |  Before the presentation, let me introduce ourselves. We are all security researchers
46.02s - 54.82s |  at Autocrypt. Autocrypt is a mobility security company. Nowadays, we are focusing on vehicle
54.82s - 68.50s |  security. With the 2020 WP.29, it's a car cyber security rules. All car makers must get CSMS
68.50s - 76.42s |  certification. So we have been doing fuzzing tests with many OEMs and tier suppliers.
76.42s - 85.22s |  During the fuzzing test, I found some strange behavior in the car. The moving car was stopped
85.78s - 95.30s |  or it didn't move. This video is showing the weak point that I found in the latest EV model.
95.86s - 119.39s |  Let's take a look. Can we play a sound? Okay, let's see one more. The moving car was stopped.
119.95s - 128.11s |  Are you interested? Now, I will explain why this happened. So please pay attention.
130.11s - 139.95s |  Contents are as follows. First, I will explain UDS and fuzzing. Then I will explain what the
139.95s - 146.59s |  type of attacks that I did and explain how to prevent this weak point.
148.51s - 155.07s |  I told you, I found a weakness during the fuzzing test. The moving car was stopped
156.03s - 164.67s |  or didn't move at all. I will explain how these problems are connected to UDS and what caused
164.67s - 174.99s |  them. First, UDS is a protocol used for communication with vehicles. It is defined in
174.99s - 183.39s |  ISO 14229. I don't have a car, but if you have one, you probably go to a repair shop
184.19s - 192.75s |  when something goes wrong with your car, right? The tool used to find out what's wrong is UDS.
193.71s - 201.15s |  During this process, the diagnostic tool and the car communicate using UDS to determine the
201.15s - 213.71s |  problem. As I mentioned, UDS services perform important functions, so not everyone can use
213.71s - 221.31s |  these services freely. You can see some of the security measures on this slide. I will give you
221.95s - 233.60s |  more details later. To ensure that UDS is well-protected, many car companies do fuzzing
233.60s - 242.24s |  tests. Fuzzing is a testing method where random or unusual data is fed into a system to find
242.24s - 250.64s |  problems. The goal of this test is to see how the system behaves under stress and to find
251.20s - 260.32s |  security issues. In the vehicle industry, we commonly do black box fuzzing using commercial
260.32s - 269.60s |  fuzzers. There are many talks about CAN, UDS, and UDS fuzzing in CHP. Check out those talks
270.48s - 281.89s |  for more details. During the UDS fuzzing test, we discovered something is wrong. The vehicle
282.21s - 291.01s |  functions with two services. The first is ECU reset, and the second is communication control.
292.21s - 300.21s |  Based on these findings, we made real-world attack scenarios. The first scenario is
300.21s - 312.03s |  sudden stop, and the second is disabling of vehicle usage. Before explaining the attacks,
312.03s - 322.19s |  you need to understand the two services. The first service is ECU reset. It is used to reset
322.19s - 339.36s |  the ECU. It is often used for troubleshooting or testing purposes. This is the actual method
339.92s - 353.28s |  that I did. You can perform hard reset with the first sub-function. This is the hard reset method.
354.72s - 364.70s |  And you can perform soft reset with the third sub-function. It's the soft reset method.
372.72s - 382.96s |  With the ECU reset method, you can stop the vehicle's engine. There are two scenarios
382.96s - 390.88s |  that I did. The first is sending an ECU reset message to a moving vehicle to make it stop
390.88s - 401.65s |  suddenly. And the second scenario is vehicle disabling. Continuously sending ECU reset messages
401.65s - 410.77s |  to disable the vehicle's functions. The root cause of these issues is that ECU reset is not
410.77s - 419.97s |  disabled in drive mode. Normally, this service is restricted during driving because it can be
419.97s - 432.93s |  dangerous. And ISO 14229 says that the condition of server is ignition is on and system not be in
432.93s - 446.51s |  an operational mode. I tested this on a new Lattice EV SUV model. And the target ECU is the
446.51s - 459.30s |  gateway control unit. I conducted the test while the vehicle was driving. Here are the attack steps.
460.10s - 468.26s |  Connect the laptop to the vehicle's OBD port using a CAN interface and just start the engine.
469.46s - 480.54s |  Then we send a message and observe the vehicle. It's that simple. This photo shows the hardware
480.54s - 489.26s |  setup. The OBD cable is connected to the OBD port and the laptop is connected via the CAN interface.
490.14s - 500.62s |  The CAN bus parameters are set to standard values. The first scenario is sudden stop scenario.
503.28s - 512.64s |  Set up the hardware setting and just we send the ECU reset message to moving vehicle.
514.40s - 523.66s |  Then the moving vehicle comes to a sudden stop. Let's check it out through the video.
524.78s - 551.10s |  The video is very short, so watch it carefully. Um, no sounds. Okay, let's see one more. We sent a message
552.14s - 561.82s |  then the moving car was stopped. I'm gonna play one more. This time, please look at the cluster.
567.95s - 575.23s |  After the message, the cluster was turned off. It was rebooted, but the car shut down.
576.91s - 591.97s |  The video on the left shows the exterior. You can see the car
591.97s - 599.17s |  moving back and forth and back and forth, which shows that the brake pedal was not pressed.
601.74s - 610.86s |  This attack can cause mechanical failure or damage. At high speeds, this could lead to serious
610.86s - 622.54s |  accidents. The second scenario is vehicle disabling. It's similar to the first scenario,
622.54s - 631.82s |  but in this case, the ECU reset message is sent continuously. The vehicle cannot be controlled
631.82s - 649.97s |  until the attack stops. The vehicle starts and the message is sent continuously. The vehicle
649.97s - 659.01s |  will not start and the gear shifting is disabled. The vehicle is completely uncontrollable.
668.21s - 681.01s |  Let's watch it one more time. Again, the cluster. Please look at the cluster. The cluster screen
681.01s - 694.10s |  turns off and multiple warnings appear. Due to the continuous attack, the cluster shuts down
694.10s - 710.02s |  and the vehicle becomes uncontrollable. The driver appears to be very confused. Here are the logs of
710.02s - 718.98s |  the ECU reset attacks. Some parts are blurred for security reasons. You can see the logs of both
718.98s - 730.64s |  hard reset and soft reset. To summarize the ECU reset attack, in drive mode, you can stop
730.64s - 739.84s |  the engine by using ECU reset message. Continuous attacks can prevent the driver
739.84s - 748.32s |  from controlling the vehicle. Also, the cluster will reboot and appear multiple warnings.
748.96s - 758.24s |  These attacks can be very dangerous on the road. Therefore, this service must be operated
758.24s - 768.37s |  only in not ready state. Here is the first service description. How is it? It's good?
769.09s - 780.72s |  Okay, now I will explain the second service. The second service is communication control.
781.60s - 789.68s |  This service is, it is used to control the communication functions of the ECU. This is
789.68s - 801.22s |  the actual message that I did. And also, you can set the control type using the sub functions.
803.14s - 818.32s |  The strange behavior appears with sub function one and three. Use sub function one to enable
819.20s - 828.72s |  Rx and disable Tx of the ECU. This is the message for sub function one.
830.24s - 841.44s |  And you also use sub function three to disable Rx and Tx. This is the message for sub function
841.44s - 855.31s |  three. You can control the ECU's communication type using this method. An attacker can disable
855.31s - 867.47s |  Tx and Rx of the ECU by transmitting communication control message. I performed two scenarios.
867.47s - 876.35s |  The first is brief pause and sudden movement. And second scenario is vehicle disabling.
877.15s - 884.59s |  The root cause of this strange behavior is that communication control is not disabled in drive
884.59s - 898.11s |  mode. And also, this service does not require security authentication. The first scenario
898.11s - 907.63s |  is brief pause and sudden movement. Set the hardware setting and set the gear to drive.
908.51s - 919.47s |  Then just resend the message. The driver will release the brake pedal to move forward.
920.67s - 928.11s |  But the vehicle does not move for a few seconds even when the foot is taken off the brake pedal
928.11s - 939.81s |  in drive mode. After a few seconds, the vehicle suddenly moves. Okay, let's check it out through
939.81s - 971.68s |  the video. I'm sorry to the sound is not playing. I'm gonna play one more. Please check the cluster.
975.63s - 983.47s |  The gear is set to drive. Then we send a message. The vehicle doesn't move even when the brake
983.47s - 992.27s |  pedal is released. Then after a few seconds, it suddenly moves. It's an interesting symptom.
996.61s - 1003.17s |  I'll explain the second scenario. The second scenario is vehicle disabling attack.
1004.85s - 1009.73s |  It's similar to the first, but this time we send message continuously.
1010.61s - 1018.37s |  When attack messages are sent in subsection, the driver loses complete control over the vehicle.
1019.25s - 1062.10s |  Let's take a look. We sent message continuously. Yeah, the driver sets the gear to drive.
1062.90s - 1076.93s |  Then we sent a message. We sent message continuously. The scariest part is that we don't
1077.81s - 1091.09s |  know when the attacker will stop. When we stop the attack, the vehicle suddenly starts moving.
1093.52s - 1103.31s |  If the driver is pressing the gas, it's very, very dangerous. Okay, let me summarize the communication
1103.31s - 1111.31s |  control attack. This type of attack can disable the transmission and reception of the ECU.
1112.27s - 1120.35s |  As shown in the previous video, it can control the vehicle either briefly or continuously.
1122.19s - 1130.91s |  Unlike on previous attack ECU reset, this attack doesn't turn off ECU.
1132.35s - 1143.54s |  So when the attack stops, the vehicle could suddenly move. Therefore, this service should
1143.86s - 1155.20s |  be operated only in not ready. Here are the logs of communication attacks. Some parts are blurred
1155.20s - 1167.49s |  for security reasons too. So how could these attacks happen in real life? You might wonder.
1168.45s - 1178.85s |  Here are some examples. First, an attacker secretly enter the vehicle and connect the
1179.89s - 1190.59s |  wireless OBD device. Some OEMs use wireless diagnostic tools. Since drivers usually don't
1190.91s - 1200.27s |  check the OBD port, the vehicle could be unprotected. And second, attacks can happen
1200.27s - 1206.51s |  from a short distance using wireless communication like Wi-Fi or Bluetooth.
1208.03s - 1217.63s |  Some OEMs use Wi-Fi to connect diagnostic tools. Vehicle without security measures are very
1217.63s - 1224.43s |  vulnerable to these type of attacks. That's why such attacks could happen at any time.
1226.27s - 1234.83s |  So I'll suggest two countermeasures for these attacks. The first, important services like
1234.83s - 1242.27s |  ECU reset and communication control must be operated only in not ready state. It's meaning
1242.27s - 1250.75s |  when the engine is off. The second, these services should only be possible after security
1250.75s - 1257.71s |  access authorization is granted. I shortly mentioned the security access service earlier.
1261.79s - 1269.31s |  To time restrictions, I will explain just one thing about the security access authorization.
1270.11s - 1277.95s |  There is the security access service. This service uses a seed and key to provide security
1277.95s - 1287.95s |  procedure. It only unlocks security when the correct seed and the key. If authentication
1287.95s - 1299.09s |  fails, it locks the ECU for a certain time to enhance security. There is also when connecting
1299.57s - 1309.46s |  a diagnostic tool, some OEMs use security algorithms. And another measure is the gateway
1309.46s - 1318.46s |  safety function. Previously, various data could be accessed without filtering but now
1319.66s - 1325.42s |  the gateway filters the data allowing only certain information to be accessed.
1326.38s - 1336.14s |  So I discovered this weak point in April. After conducting additional tests, I reported on June
1336.14s - 1345.90s |  10th. But I was told that the vulnerability is not actionable in reality and that it works as
1346.86s - 1357.90s |  is designed. However, I still believe it is a weakness. I believe that after sharing my
1357.90s - 1369.36s |  presentation today, you will agree with me. Okay, finally, let me summarize. Some diagnostic
1369.36s - 1378.16s |  services can have a significant impact on vehicle driving. If an attacker transmits the diagnostic
1378.16s - 1387.92s |  message to driving vehicle, a serious accident may occur. So security for diagnostic services
1387.92s - 1401.02s |  is essential. That's all for my presentation. Thank you for listening. Okay, my name is Seunghee Han.
1401.02s - 1406.30s |  I'm from South Korea, not North. Thank you.


url: https://www.youtube.com/watch?v=vRjB6TutzuM
title: DEF CON 32 - The Village Peoples' Panel What Really Goes On in a Village - Panel
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=vRjB6TutzuM",
  "title": "DEF CON 32 - The Village Peoples' Panel  What Really Goes On in a Village - Panel",
  "description": "The Villages are a key part of the DEFCON experience - join this panel of staff members of the DEFCON Villages to get an inside scoop on all the intricacies of organizing a village. Topics from finding sponsors to setting up equipment to making sure everyone gets to take a break during the event - there's a whole lot that goes on behind the scenes at DEFCON villages!",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 3311,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.27s - 2.57s | This text was transcribed using whisper model: large-v2

 Okay. So I'll start the panel since it's 10 o'clock
2.57s - 3.97s |  and I'm really on time with stuff.
3.97s - 7.61s |  So Honi. Honi is our Village Coordinator.
7.61s - 8.13s |  Good morning.
8.13s - 10.29s |  Good morning. Hi. Good morning.
10.29s - 14.37s |  Honi is our Defcon Village Lead Coordinator.
14.37s - 15.61s |  So is Pedro.
15.61s - 17.13s |  So is Reyes in the back
17.13s - 19.85s |  tweeting because e-mails just came through.
19.85s - 22.05s |  Do you want full names or what are we doing?
22.05s - 25.41s |  So Tom, ICS Village Lead.
25.41s - 27.41s |  Justin, Car Hacking Village.
27.41s - 29.15s |  Nina, Biohacking Village.
29.35s - 32.07s |  Muteki, Blue Team Village.
32.07s - 33.63s |  Do you want your real name?
33.63s - 35.23s |  Cassandra from Red Team Village.
35.23s - 36.23s |  That's me. It's my real name.
36.23s - 37.75s |  Oh, I'm sorry. Savannah.
37.75s - 39.11s |  This is my life now.
39.11s - 41.27s |  Savannah, Red Team Village.
41.27s - 42.27s |  Do you want your real name?
42.27s - 43.19s |  Yes.
43.19s - 45.35s |  Matt, Aerospace.
45.35s - 47.31s |  Now, Honi, what questions do you have for us
47.31s - 49.11s |  or do we self-moderate?
49.11s - 51.71s |  Go for it. Why do we do what we do?
51.71s - 53.07s |  What is the point of the villages?
53.07s - 56.07s |  Or actually we should do, what do the villages do?
56.07s - 57.15s |  What's the mission vision?
57.15s - 58.67s |  Blah, blah, blah, blah, blah, blah.
58.67s - 60.27s |  I can start.
60.27s - 63.55s |  I have a really adorable little story that I want to tell.
63.55s - 67.27s |  So Blue Team Village has been around for about seven years.
67.27s - 69.11s |  This is our seventh year.
69.11s - 71.47s |  We started, you know, a ragtag bunch of different people
71.47s - 73.23s |  who decided to throw a village together
73.23s - 75.15s |  and had no idea what the hell they were doing,
75.15s - 77.31s |  which is how DEF CON works in general, right?
77.31s - 78.87s |  It's a thing.
78.87s - 80.83s |  So we've been around for a few years.
80.83s - 83.59s |  Over the pandemic, you know, we had to go virtual for DC28.
83.59s - 87.15s |  And around that time, we started a mentoring program.
87.23s - 89.31s |  So met a lot of different people from all over the world,
89.31s - 93.35s |  got to do some remote events, you know, talks, things like that.
93.35s - 97.19s |  So this year, one of our first speakers
97.19s - 101.03s |  was actually someone who I had met who was from India
101.03s - 104.39s |  and then kind of like progressed in their career
104.39s - 106.03s |  with some help in the mentoring program.
106.03s - 109.31s |  And he actually gave a talk at Blue Team Village,
109.31s - 110.75s |  did a really awesome job.
110.75s - 112.75s |  And I got to give an intro, which was really cool.
112.75s - 115.39s |  But what really stuck out to me is like, you know,
115.83s - 119.55s |  the villages are communities in themselves.
119.55s - 121.75s |  They're organizations within DEF CON
121.75s - 123.99s |  that really help bring people together
123.99s - 126.43s |  based on common interests.
126.43s - 128.19s |  And being able to provide that space
128.19s - 129.79s |  for someone to like learn and grow,
129.79s - 131.03s |  to network within the community,
131.03s - 134.31s |  and then be able to progress their career to speak
134.31s - 137.67s |  is just like, I get a little like crazy, you know,
137.67s - 139.15s |  sometimes planning all this stuff
139.15s - 140.35s |  and then watching it come together.
140.35s - 142.59s |  And then I'm like, why am I doing this?
142.63s - 144.83s |  And then like, I get to see someone
144.83s - 146.71s |  who has grown because of what we do.
146.71s - 149.11s |  And that's like the fucking coolest thing.
149.11s - 150.63s |  So that's why I do this.
152.11s - 154.67s |  I can add to that because I 100% agree with you.
154.67s - 156.55s |  This is my fifth year running Car Wrecking Village.
156.55s - 159.23s |  Car Wrecking Village has been around for 10 years.
159.23s - 160.75s |  One of the biggest things I really encourage
160.75s - 161.91s |  is trying to get younger people
161.91s - 164.07s |  or newer people into this industry.
164.07s - 165.51s |  Over the last three years,
165.51s - 167.27s |  I've brought new people that weren't even
167.27s - 168.27s |  security people at all.
168.27s - 170.55s |  They were just tech people that are interested.
170.55s - 173.23s |  Some of them from ages 17 to 20.
173.23s - 177.15s |  And now two of them have jobs in security
177.15s - 178.47s |  and come here every year
178.47s - 179.87s |  and are part of helping the village.
179.87s - 181.75s |  So similar to her,
181.75s - 182.87s |  that's the reason why I do this
182.87s - 184.23s |  is to grow the communities
184.23s - 186.03s |  and to grow the next versions of the, you know,
186.03s - 187.43s |  us and people who can ensure
187.43s - 189.83s |  that the world's gonna be secure in the future.
189.83s - 192.27s |  I really care about cyber physical systems
192.27s - 195.51s |  as probably most of us up here on this panel do.
195.51s - 196.79s |  So that's why I do what I do.
196.79s - 198.63s |  I've also worked some in aerospace,
198.63s - 200.43s |  but I just wanna make sure the vehicles
201.31s - 202.15s |  and stuff you guys are getting into
202.15s - 203.27s |  are somewhat safe
203.27s - 206.51s |  and trying to make the people up top care a little bit.
206.51s - 207.63s |  It's kind of hard sometimes,
207.63s - 211.19s |  but yeah, I do it for the people.
214.75s - 215.79s |  Yeah, I guess I have to agree
215.79s - 216.83s |  with what they were saying too.
216.83s - 219.39s |  I think whenever there's a lot of like new students
219.39s - 221.11s |  or people in general that come to DEF CON
221.11s - 223.27s |  and they want to learn the specific niches.
223.27s - 225.51s |  So like all of us are obviously in specific niches
225.51s - 227.63s |  in these cybersecurity space.
227.63s - 229.15s |  And for example, like we had,
229.15s - 230.43s |  I have a friend,
230.43s - 231.43s |  it's like a family friend of a friend,
231.43s - 232.51s |  but he had come to DEF CON
232.51s - 234.59s |  and had never been to anything like this.
234.59s - 236.55s |  And he already had spoken to someone on Friday,
236.55s - 239.27s |  offering them an internship like within the village
239.27s - 240.87s |  and like being able to provide that space
240.87s - 242.83s |  where people can network and meet people
242.83s - 245.43s |  is I would say anything in any industry,
245.43s - 246.27s |  especially in ours,
246.27s - 247.79s |  networking is so important,
247.79s - 249.03s |  but then also giving a space
249.03s - 250.11s |  to be able to have people grow
250.11s - 252.47s |  like their offensive security skills.
252.47s - 254.47s |  And then also kind of take that over to other villages
254.47s - 258.14s |  to learn other areas too.
258.14s - 260.10s |  Okay, so I guess mine's a little bit different
260.18s - 263.50s |  because I'll start off with,
263.50s - 266.26s |  I'm a pilot and there's a joke in there
266.26s - 268.70s |  where like, how do you know you're at a party with pilot?
268.70s - 269.62s |  They'll tell you.
269.62s - 272.78s |  So that's how I start all my talks.
272.78s - 276.70s |  But the qualifier there is when I get in airplanes,
276.70s - 278.58s |  when I'm flying them,
278.58s - 282.30s |  I want to be comfortable with the risks
282.30s - 284.38s |  that are inherent with just flying any airplane
284.38s - 286.26s |  and not anybody on the ground
286.26s - 287.86s |  or anybody in the back of the airplane
287.86s - 290.10s |  doing anything that they shouldn't be.
290.10s - 291.90s |  And so I want to make sure
291.90s - 295.14s |  the people on board my airplane are safe.
295.14s - 296.78s |  But one of the things that we find
296.78s - 301.42s |  in the Aerospace Village is while mentoring is fantastic,
301.42s - 305.38s |  we are just struggling to get the companies to show up,
305.38s - 306.54s |  the manufacturers,
306.54s - 309.66s |  the people that build the systems in the airplanes,
309.66s - 311.42s |  everybody's got their silos,
311.42s - 314.70s |  everybody wants to keep everything to be black boxes.
314.70s - 319.06s |  And so we are really trying to get the manufacturers
319.06s - 322.02s |  and all of those other companies involved
322.02s - 324.34s |  and talking about the systems
324.34s - 325.54s |  that they have on board the airplane
325.54s - 328.34s |  because it is fascinating.
328.34s - 330.98s |  I mean, I can easily be flying an airplane,
330.98s - 333.50s |  a commercial airplane that is 20 years old
333.50s - 335.82s |  and I can guarantee you 20 years ago,
335.82s - 337.22s |  they were not built
337.22s - 339.18s |  with any sort of cybersecurity standards.
339.18s - 342.14s |  So how are you bolting that on in today's world?
342.14s - 344.10s |  It needs to be talked about.
344.42s - 345.62s |  So that's what's driving me.
345.62s - 347.82s |  It's sort of a selfish interest
347.82s - 351.06s |  of getting more attention paid to this space.
351.06s - 352.10s |  I mean, I hate flying.
352.10s - 353.86s |  So like I completely support that.
355.46s - 358.30s |  Everyone, my name is Tom Van Norman with ICS Village.
358.30s - 361.54s |  We started ICS Village here 11 years ago.
361.54s - 362.38s |  Time flies.
363.98s - 365.74s |  So we are a registered nonprofit.
365.74s - 367.90s |  We go many conferences throughout the year.
367.90s - 370.06s |  We have sponsors, we have grants,
370.06s - 371.22s |  we have all that fun stuff.
371.22s - 373.46s |  But we started it 11 years ago,
373.86s - 374.70s |  and it was just a bunch of people
374.70s - 378.82s |  that answered a call for villages, I think it was,
378.82s - 380.90s |  and applied for it and went.
381.78s - 385.34s |  The reason I got into it was because back then,
385.34s - 387.30s |  not so much now, but a little bit now,
387.30s - 388.50s |  we'd have people up on the stage,
388.50s - 392.58s |  whether it's DEF CON or in a magazine or whatever,
392.58s - 394.98s |  talking about hacking that PLC,
394.98s - 397.50s |  hacking this thing, and they're full of shit.
397.50s - 400.98s |  It didn't, they're just wrong on what they're saying.
400.98s - 405.38s |  So I come from control systems, engineering, technician,
405.38s - 408.18s |  all that stuff out in the field doing things.
408.18s - 410.42s |  And when we see people up on stage saying,
410.42s - 414.38s |  oh, we can do this thing with that thing,
414.38s - 416.26s |  all right, maybe, but it doesn't matter.
416.26s - 418.10s |  It really does not matter.
418.10s - 421.30s |  So instead of countering that person saying,
421.30s - 424.46s |  hey, you really don't know, let's educate, let's uplift,
424.46s - 426.82s |  let's go and spread, instead of spreading FUD,
426.82s - 430.30s |  let's go and show people what you can do, what matters,
430.30s - 431.86s |  because not everything matters, right?
431.86s - 435.14s |  You can put, we can secure your control system
435.14s - 438.50s |  80% pretty easy, the other 10% is hard,
438.50s - 440.74s |  and the other 10% is extremely hard.
440.74s - 443.06s |  So let's educate, let's make it awareness,
443.06s - 447.26s |  let's do things for the community, the people's things.
447.26s - 449.14s |  In a long way, let's bring new blood in.
449.14s - 450.02s |  We're all getting old.
450.02s - 452.10s |  We're all gonna retire here, right?
452.10s - 458.68s |  And let's bring new people in.
458.68s - 460.24s |  I forgot what I was gonna say.
461.80s - 463.44s |  Just wanted to say a couple of things.
463.44s - 464.76s |  Yeah, sorry, I'll say a couple of things.
464.76s - 468.80s |  So Pedro and I, where you are, the village leads, right?
468.80s - 472.24s |  And then Ray's, we brought him on this year to just do,
472.24s - 474.16s |  I think it's just an outstanding job
474.16s - 475.76s |  setting up these creator stages.
476.96s - 479.36s |  Main focus for this right here is we wanted to
479.36s - 482.04s |  kind of like uplift a lot of the content
482.04s - 485.00s |  that all the villages are bringing to DEF CON
485.00s - 487.52s |  and give it recorded space.
489.20s - 490.84s |  I know it's outside of the village spaces,
490.84s - 493.36s |  so it's not as conducive as what some of you guys
493.36s - 494.64s |  want all the time.
494.64s - 498.44s |  But we really wanted to like sort of start upbranding
498.44s - 499.92s |  a lot of the content that you're bringing.
499.92s - 502.84s |  And that way we can have both the village sponsors,
502.84s - 506.72s |  our village brand into it as well on top of that as DEF CONs.
508.36s - 510.68s |  The main thing though that like Pedro and I see
510.68s - 512.76s |  for ourselves is we're kind of the middlemen
512.76s - 515.00s |  between DEF CON and the villages.
515.00s - 517.44s |  Villages come to us and they have these crazy ideas
517.44s - 518.68s |  of things that they're gonna bring this year
518.68s - 519.92s |  and we have to figure out, okay,
519.92s - 522.84s |  how do we scope and tailor this with DEF CON
522.84s - 525.00s |  to make sure that they can bring what they wanna bring?
525.00s - 527.28s |  Namely, Nina brought some really, really cool stuff
527.28s - 528.44s |  this year.
528.44s - 530.72s |  One's like a giant robot.
530.72s - 531.76s |  I can talk about that.
531.76s - 532.60s |  Okay, I'm sorry.
533.92s - 536.36s |  But all those things basically they come with a cost
536.36s - 537.68s |  in the sense of like square footage,
537.68s - 539.32s |  which we have a finite amount for.
539.32s - 542.76s |  So like for us, it is playing the middleman
542.76s - 545.92s |  between DEF CON and the village leads
545.92s - 547.72s |  and making sure that we can support them
547.72s - 549.44s |  as best as we possibly can.
549.96s - 552.32s |  And also at the same time, sometimes the requests of like,
552.32s - 553.68s |  hey, we need 20,000 square feet.
553.68s - 555.84s |  We're like, do you really though?
555.84s - 558.40s |  We maybe tailor that down a little bit.
558.40s - 563.20s |  But I think Pedro and I, like we see the villages
563.20s - 566.56s |  as some of the premier content at DEF CON.
566.56s - 569.92s |  The value that they bring is outstanding.
569.92s - 573.72s |  A lot of the pen testing that occurs here is world-class.
573.72s - 575.44s |  The value, the return on investment,
575.44s - 577.20s |  a lot of the sponsors have when they come
577.20s - 581.24s |  and they bring their devices, their vehicles,
581.24s - 584.84s |  parts of their planes, the whole nine yards to DEF CON.
584.84s - 587.28s |  And the amount of research CVEs
587.28s - 591.00s |  that are produced by these villages is outstanding.
591.00s - 593.44s |  And in one weekend in comparison to like,
593.44s - 596.12s |  if you were to quantify that on the amount of pen tests
596.12s - 597.40s |  and the amount of money they'd have to spend
597.40s - 600.76s |  in the normal market, it's insane.
600.76s - 603.84s |  So, I mean, Pedro and I are huge fans obviously,
603.84s - 606.24s |  cause we stick around and keep doing this for some reason,
606.32s - 608.12s |  but we also wanted to say thank you.
609.48s - 612.56s |  So, Biohacking Village has been around for 10 years.
612.56s - 613.96s |  I've run it for nine.
613.96s - 617.68s |  My first year of being with the Biohacking Village,
617.68s - 620.64s |  every single time on that pamphlet that they give you
620.64s - 621.48s |  was completely wrong.
621.48s - 624.00s |  So I sat in the room and at some point they were like,
624.00s - 625.56s |  you keep sitting here, what's wrong with you?
625.56s - 626.76s |  And I was like, I wanna be part of this,
626.76s - 628.04s |  let's hook up, let's do this.
628.04s - 629.48s |  So anyway, I've run it for nine years.
629.48s - 631.76s |  We have five different labs, the device lab,
631.76s - 633.28s |  which is all the manufacturers,
633.28s - 635.04s |  the medical device manufacturers bring their wares,
635.04s - 638.16s |  hardware, software, firmware, embedded, whatever.
638.16s - 640.20s |  And they put that in front of the table
640.20s - 643.48s |  and they ask the hacker community to break their shit.
643.48s - 644.84s |  It is not hyperbole.
644.84s - 646.20s |  Over the last 16 hours,
646.20s - 648.00s |  there have been 42 vulnerabilities found
648.00s - 652.36s |  from 10 medical device manufacturers, 25 devices.
652.36s - 654.08s |  These are devices, most of these devices
654.08s - 656.48s |  are things that currently live in hospitals.
656.48s - 661.16s |  So in that room is $3.5 billion worth of medical devices
661.16s - 664.36s |  and about $4 trillion worth of brainpower and IP.
664.40s - 668.44s |  We also have a capture the flag, tabletop exercises, talks,
668.44s - 671.28s |  and something else that I never remember, workshops.
671.28s - 672.40s |  That's what we do.
672.40s - 676.12s |  So all of this takes 360 days to put together,
676.12s - 678.72s |  two days to load in and three days for a conference.
678.72s - 680.88s |  We've already started talking about the badge for next year
680.88s - 683.12s |  because this is very consuming.
683.12s - 685.32s |  And I agree with a lot of the things that you said
685.32s - 686.88s |  about how DEF CON is trying to help us
686.88s - 688.36s |  and work through this.
688.36s - 690.88s |  Biohacking Village has three times more space
690.88s - 693.00s |  than we had last year, which is why this year
693.00s - 694.68s |  we could bring a surgical robot.
694.68s - 698.84s |  So the pincers are as big as like the ends of two needles
698.84s - 701.32s |  trying to get tiny microscopic things
701.32s - 702.68s |  out of people's bodies.
702.68s - 703.72s |  That's what we have over there.
703.72s - 704.60s |  If you have an opportunity,
704.60s - 705.96s |  you should definitely play with it
705.96s - 709.16s |  because this surgical robot lives in the hospitals.
710.20s - 715.00s |  Our sponsors are the million dollar, billion dollar people.
715.00s - 718.00s |  I am really harsh with people
718.00s - 720.92s |  about how they need to be here and show up.
720.92s - 722.76s |  The Biohacking Village has a partnership
723.52s - 725.40s |  with the FDA where it's called We Heart Hackers
725.40s - 728.16s |  that the manufacturers can write on their submissions
728.16s - 729.56s |  that they were hacked at DEF CON.
729.56s - 730.60s |  This is a big deal to them.
730.60s - 734.12s |  They understand the reasons behind it.
734.12s - 736.72s |  The other part is the Biohacking Village is a CNA.
736.72s - 738.56s |  So if something is found and they can't report it,
738.56s - 740.28s |  the manufacturers can't report it themselves,
740.28s - 742.56s |  we will happily report it for them.
743.44s - 744.68s |  There was something else that I was gonna say
744.68s - 745.60s |  that was probably important.
745.60s - 746.76s |  Oh, why do I do this?
746.76s - 749.32s |  I am really fucking overwhelmed and tired
749.32s - 751.12s |  of patients going into hospitals
751.12s - 753.56s |  and being in a world of hurt
753.56s - 755.52s |  and then the hospital doesn't work.
755.52s - 757.56s |  So they may have to have their surgeries redone
757.56s - 759.60s |  or they don't understand what's happening to them
759.60s - 761.64s |  and nobody is able to explain it.
761.64s - 762.76s |  Nobody should go to the hospital,
762.76s - 765.08s |  get put attached to a machine and go,
765.08s - 765.92s |  what is this?
765.92s - 766.76s |  What am I doing here?
766.76s - 768.24s |  And nobody has a real answer.
768.24s - 770.12s |  When the blue screen of death recently happened
770.12s - 771.36s |  because of CrowdStrike,
771.36s - 773.00s |  I wasn't working in the hospital,
773.00s - 774.40s |  I was working in the hospital.
774.40s - 778.16s |  And I was blown away by the nurses and the staff
778.16s - 779.80s |  that were like, we gotta go back to paper
779.80s - 781.20s |  and I don't even know what the sheet says.
781.20s - 782.56s |  I don't know how to do this.
782.56s - 785.20s |  So for me, this is one of those things
785.20s - 787.40s |  that like sits in my soul about we gotta fix this.
787.40s - 790.44s |  This is enough, we gotta do it.
790.44s - 791.40s |  I appreciate that
791.40s - 793.96s |  because I had malpractice as a kid in surgery
793.96s - 796.36s |  and I do not trust doctors or any hospitals or any of that.
796.36s - 798.60s |  So thank you for doing that.
798.60s - 799.88s |  I wanna add to that a little bit.
799.88s - 801.32s |  So I talked a lot about,
801.32s - 802.84s |  or I talked about like,
802.84s - 803.80s |  for me the personal thing,
803.80s - 804.64s |  like the mentoring
804.64s - 807.36s |  and kind of bringing new people into the field.
807.36s - 809.64s |  One thing I love about being part of the Blue Team Village
810.48s - 811.88s |  is like we cover all of these areas.
811.88s - 814.68s |  Like the people that come to learn about IR,
814.68s - 818.00s |  threat hunting, CTI and things like that
818.00s - 821.92s |  span every single field on this table.
821.92s - 823.44s |  Like, you know,
823.44s - 826.28s |  these are the people that are going out to do defense
826.28s - 828.88s |  when there's a cyber attack against a hospital
828.88s - 832.24s |  or, you know, an airline company or whatever.
832.24s - 833.48s |  Apparently it's really hard to hack planes,
833.48s - 835.56s |  which is definitely good.
835.56s - 838.24s |  Makes me feel better as someone who hates flying.
838.28s - 841.24s |  You know, and then that's just to be like,
841.24s - 843.72s |  seeing all of these pieces come together
843.72s - 846.24s |  is really, really cool.
846.24s - 848.12s |  And I've learned a lot from it.
848.12s - 849.20s |  Yeah, just love it.
851.08s - 852.92s |  Got any more questions for us, Honey?
854.04s - 855.76s |  Can we ask Honey questions?
855.76s - 857.44s |  Maybe we could talk about.
860.21s - 861.05s |  Sure.
867.61s - 868.85s |  So Nina, why don't you,
868.85s - 871.81s |  you talked about how you,
871.81s - 875.05s |  you're able to have the companies actually like say,
875.05s - 877.25s |  hey, we were hacked at DEF CON.
877.25s - 880.81s |  How are you able to frame that in a positive light?
880.81s - 883.53s |  Because we've tried,
884.61s - 888.45s |  so a lot of the aircraft and associated systems
888.45s - 889.69s |  are certified.
889.69s - 892.41s |  And so if anything happens to them,
892.41s - 893.97s |  they are no longer certified.
893.97s - 897.29s |  And so there's a very much a line between,
897.29s - 899.21s |  hey, us tinkering with things
899.21s - 901.53s |  and what actually goes on an airplane.
902.21s - 905.13s |  How are you able to get these manufacturers to say,
905.13s - 907.73s |  hey, we want to do this.
907.73s - 909.81s |  We want to brag about how we brought it to DEF CON.
909.81s - 912.21s |  Because on our end, on the aviation side,
912.21s - 913.61s |  people are nervous about saying,
913.61s - 915.29s |  I brought my airplane.
915.29s - 917.29s |  I brought my systems to DEF CON.
917.29s - 919.01s |  We're slowly making progress, but yeah.
919.01s - 919.85s |  How have you done that?
919.85s - 921.89s |  It's a lot of aggressive hope and prayer.
923.01s - 925.61s |  So my background is I've worked in hospitals for 20 years
925.61s - 927.29s |  and being in the hospital.
927.29s - 928.93s |  So I worked on the electronic medical record
928.93s - 929.77s |  and then the APIs
929.85s - 931.97s |  and putting all of the devices into the EMR.
931.97s - 934.05s |  So all of the information would sync
934.05s - 935.93s |  and just watching how all of it happened.
935.93s - 937.41s |  I was super annoyed.
938.85s - 943.85s |  The moment is that one of the FDA humans
944.17s - 946.73s |  is the medical device manufacturer.
946.73s - 947.77s |  That's bullshit.
947.77s - 950.25s |  The medical device cybersecurity director
950.25s - 952.17s |  for CDRH at the FDA.
952.17s - 955.01s |  She used to work for one of the medical device manufacturers
955.01s - 956.61s |  and now she runs the thing at the FDA.
956.61s - 959.81s |  And she is super invested in ensuring patient safety.
959.81s - 961.21s |  We're all patients at the end of the day.
961.21s - 962.45s |  Whether you go to the doctor or not,
962.45s - 963.45s |  you have an EMR somewhere.
963.45s - 966.57s |  You have an MRN, medical record number, somewhere.
966.57s - 969.17s |  So we are all affected by this no matter what happens.
969.17s - 972.29s |  When they come up and they're like, this isn't for me.
972.29s - 973.49s |  I'm not okay with this.
973.49s - 976.89s |  I'm like, sure, but I'm aggressive.
976.89s - 978.69s |  I think we all know that at this point.
979.69s - 982.57s |  I will go up to them and tell them their revenue.
982.57s - 984.49s |  Your revenue cycles will be affected by this.
984.49s - 986.97s |  The ROI of them coming to DEF CON
986.97s - 989.85s |  and bringing their devices here will say, you did this.
989.85s - 992.61s |  You trusted this community to do the hard thing for you.
992.61s - 994.69s |  What they do here is worth,
994.69s - 997.01s |  but the vulnerabilities and the pentest here
997.01s - 1001.57s |  are worth about 350 to like $750,000
1001.57s - 1004.33s |  that they're getting for like nothing to do this.
1004.33s - 1007.89s |  So they can come here, get all of their shit tested,
1007.89s - 1010.05s |  hardcore, go home and fix it.
1010.05s - 1011.01s |  No big deal.
1011.01s - 1013.25s |  They can report it or just say it's a finding
1013.25s - 1014.45s |  and go fix it.
1015.45s - 1018.05s |  So great.
1018.05s - 1019.93s |  If I have to get involved,
1019.93s - 1022.97s |  that is a very different level of annoyance for them.
1022.97s - 1025.09s |  They have vulnerability disclosure programs
1025.09s - 1026.33s |  that I'm like everything.
1026.33s - 1027.17s |  That's a great question.
1027.17s - 1028.65s |  So the device lives here.
1029.93s - 1031.81s |  Oh, sorry.
1031.81s - 1033.05s |  So I was just asking like,
1033.05s - 1035.17s |  how does she ensure that these vulnerabilities
1035.17s - 1037.01s |  that they're finding actually get fixed?
1037.01s - 1038.37s |  So it's cool to find all this stuff,
1038.37s - 1040.21s |  but a lot of times you can't guarantee they get fixed.
1040.21s - 1042.17s |  So just curious on how you track and monitor
1042.21s - 1044.97s |  and ensure these vulnerabilities are getting fixed.
1044.97s - 1048.61s |  So every day I send an email back to everybody
1048.61s - 1051.05s |  stating this is the number of vulnerabilities we have.
1051.05s - 1052.21s |  I talk to the hackers around,
1052.21s - 1053.69s |  I talk to the manufacturers and I collate,
1053.69s - 1055.29s |  make sure everything is correct.
1056.25s - 1058.97s |  They have their own vulnerability disclosure programs
1058.97s - 1061.65s |  that everything is supposed to be sent to immediately.
1061.65s - 1064.17s |  If they have to go through me as not just me,
1064.17s - 1066.37s |  but through the biohacking village as a CNA,
1066.37s - 1067.81s |  that becomes a CISA issue
1067.81s - 1069.37s |  that they don't want to get involved with.
1069.41s - 1072.29s |  So they're pretty good at fixing their things.
1072.29s - 1073.33s |  You have some legislation on your side.
1073.33s - 1075.05s |  We do have legislation on our side.
1075.05s - 1075.89s |  That's nice.
1079.85s - 1081.37s |  I think that's why you're making more progress
1081.37s - 1082.57s |  than most of us.
1082.57s - 1084.09s |  Yeah, I guess.
1084.09s - 1086.93s |  So somebody at work told me I was wrong about a piece of law
1086.93s - 1089.09s |  and I was like, I'm not wrong about what this is.
1089.09s - 1092.53s |  And I started law school, so nobody likes me right now
1092.53s - 1095.61s |  because I'm like, it's not what that says.
1095.61s - 1098.85s |  So Nina, I have to say,
1099.41s - 1100.37s |  I had to disagree.
1101.61s - 1105.09s |  I had to disagree with most of this stuff here.
1106.41s - 1108.01s |  Well, first you can talk about hospitals.
1108.01s - 1108.93s |  We all need healthcare.
1108.93s - 1111.09s |  Either we need it today, tomorrow, whatever.
1111.09s - 1113.09s |  We all need healthcare.
1113.09s - 1115.41s |  If we don't have the ICS stuff, guess what doesn't work?
1115.41s - 1117.53s |  Your robot, your other stuff, right?
1119.13s - 1123.41s |  So where I disagree with a lot of people here,
1123.41s - 1124.97s |  I think coming here and finding vulnerabilities
1124.97s - 1126.45s |  is a horrible idea.
1126.45s - 1128.09s |  From a business, I'm a business owner,
1128.13s - 1129.65s |  is a horrible idea.
1129.65s - 1130.49s |  Why?
1130.49s - 1131.33s |  I don't know who you are.
1131.33s - 1132.17s |  I don't know who you are.
1132.17s - 1133.01s |  I don't know who you are.
1133.01s - 1134.97s |  Now I leave here saying my device is secure
1134.97s - 1138.05s |  because X, Y, and Z found vulnerabilities.
1138.05s - 1140.77s |  Completely bad idea, horrible idea.
1140.77s - 1144.29s |  Where if I go and if I pay ABC company,
1145.29s - 1146.85s |  they still might not find the vulnerabilities,
1146.85s - 1148.85s |  but now I have somebody to hold accountable.
1148.85s - 1150.61s |  Now I have somebody to go back and say,
1150.61s - 1153.25s |  hey, you know what guys, you gave me a report
1153.25s - 1156.17s |  and this low hanging fruit thing was not found.
1156.17s - 1158.81s |  Where I come to any conference and find a vulnerability
1158.81s - 1160.09s |  and I leave with that good feeling that,
1160.09s - 1161.29s |  hey, we found, what'd you say?
1161.29s - 1162.93s |  How many vulnerabilities?
1162.93s - 1165.13s |  42, 42.
1165.13s - 1166.61s |  Interesting.
1166.61s - 1167.45s |  Really interesting.
1167.45s - 1169.37s |  Do they have a testing model?
1169.37s - 1170.21s |  Yeah.
1170.21s - 1171.85s |  Didn't seem like it.
1171.85s - 1173.93s |  Those are tested before they get here.
1173.93s - 1175.45s |  But so if they're tested before they get here,
1175.45s - 1176.65s |  how do they find 42?
1177.77s - 1179.97s |  Do you wanna go to them just to accept these copies?
1179.97s - 1180.81s |  Is that what we're here for?
1180.81s - 1182.53s |  Okay, we're leading, it's a leading question.
1182.53s - 1184.89s |  Okay, I'm gonna interrupt
1185.21s - 1186.53s |  and throw something else out there.
1186.53s - 1188.33s |  So I think you can tell by this point
1188.33s - 1190.17s |  that we're all really passionate about what we do
1190.17s - 1192.13s |  and we've all been doing it for a very long time,
1192.13s - 1193.93s |  which brings up a really good point.
1193.93s - 1195.89s |  So villages are separate organizations.
1195.89s - 1197.81s |  We have very few people
1197.81s - 1199.89s |  that have been invested for a long time.
1199.89s - 1201.77s |  All of us, I think pretty much,
1201.77s - 1204.13s |  we start planning pretty much right after DEF CON.
1204.13s - 1206.85s |  We have a hot wash, we kind of review lessons,
1206.85s - 1209.09s |  you go through lessons, learn, make some changes.
1209.09s - 1212.85s |  At the end of the day, it's usually a few people
1212.85s - 1214.37s |  at the very top of the organization
1214.85s - 1217.09s |  that define what the village does.
1217.09s - 1220.13s |  And one of the issues that I think we have with that
1220.13s - 1221.41s |  is people get burnt out.
1222.49s - 1224.45s |  I don't know how Nina is functioning right now.
1224.45s - 1226.21s |  I don't know how I'm functioning right now.
1226.21s - 1228.13s |  I went to a metal festival in Germany
1228.13s - 1229.97s |  and then flew in from Germany on Tuesday
1229.97s - 1230.81s |  and hit the ground running
1230.81s - 1233.49s |  because we had unload set up Wednesday,
1233.49s - 1235.33s |  12 hours in the village on Thursday.
1235.33s - 1237.25s |  I didn't eat until like 9 p.m.
1237.25s - 1238.61s |  I never made it to merch.
1238.61s - 1241.77s |  I have like one 4XL, which is what I got.
1241.77s - 1244.49s |  So I think it's like, this kind of passion is great,
1244.49s - 1245.93s |  but like, I don't know.
1245.93s - 1247.45s |  I guess maybe my question to other panelists is
1247.45s - 1251.29s |  how do you work on getting other people involved?
1251.29s - 1254.17s |  And because none of us are paid for this either.
1254.17s - 1255.01s |  At least I'm not.
1255.01s - 1255.85s |  I don't know.
1255.85s - 1256.69s |  Are you getting paid?
1256.69s - 1257.53s |  Yeah, no.
1257.53s - 1258.37s |  This is all volunteer work.
1258.37s - 1259.41s |  We have full-time jobs.
1259.41s - 1262.25s |  So how do each of your villages handle
1262.25s - 1264.25s |  like getting people involved
1264.25s - 1267.41s |  so that you don't have to be completely run into the ground?
1268.33s - 1269.45s |  Yeah, that's a really good question.
1269.45s - 1271.69s |  So I'll start from the Car Hacking Village side.
1272.89s - 1274.61s |  We go to a lot of different events as well.
1274.61s - 1276.77s |  So we don't just go to DEF CON.
1276.77s - 1278.65s |  We do Black Hat Middle East.
1278.65s - 1280.89s |  We do a lot of different global events as well.
1280.89s - 1283.33s |  So we try to get as much recognition as possible.
1283.33s - 1285.57s |  And through that, typically we find a lot of people
1285.57s - 1287.13s |  that have no clue what any of this stuff is
1287.13s - 1288.65s |  or how to get into car hacking.
1288.65s - 1291.29s |  So I usually like to try to bring them as volunteers
1291.29s - 1292.61s |  because a lot of those people are pretty driven
1292.61s - 1294.05s |  to want to learn and grow.
1294.05s - 1295.77s |  And I don't mind if you don't know anything,
1295.77s - 1296.77s |  we can teach you that.
1296.77s - 1298.61s |  As long as you have motivation and drive,
1298.73s - 1302.49s |  then we will welcome you in and bring you to help volunteer.
1302.49s - 1303.81s |  So that's kind of been my philosophy.
1303.81s - 1305.81s |  As long as I can find someone that's driven and motivated,
1305.81s - 1308.25s |  I can teach them the ropes and bring them in.
1308.25s - 1309.89s |  And usually that's helped us a lot.
1309.89s - 1312.97s |  So a lot of our volunteers within the last two years
1312.97s - 1316.37s |  have been younger kids from graduating right out of college,
1316.37s - 1318.41s |  some that are even younger than that,
1318.41s - 1320.53s |  that are just really eager and seeing the stuff in the news
1320.53s - 1322.41s |  about cars getting hacked and hearing about these things
1322.41s - 1323.97s |  and just wanting to be involved.
1323.97s - 1326.85s |  And then they send us an email
1326.85s - 1328.49s |  or they see us at a conference and we're just like,
1328.49s - 1330.33s |  hey, you seem pretty motivated and driven.
1330.33s - 1332.89s |  Here's my contact information, stay in contact with me
1332.89s - 1334.81s |  and we'd love to have you volunteer.
1334.81s - 1336.05s |  It's worked really well for us,
1336.05s - 1337.77s |  but it is kind of more ad hoc.
1337.77s - 1338.81s |  So it is difficult,
1338.81s - 1341.85s |  but we've tried to do call for volunteers in the past
1341.85s - 1343.25s |  and it gets a little bit chaotic
1343.25s - 1345.77s |  because what you'll learn is you get a bunch of people
1345.77s - 1347.01s |  that just want to get a badge
1347.01s - 1348.77s |  and they just want to get access to the event.
1348.77s - 1350.09s |  And that's the most difficult thing to do
1350.09s - 1352.17s |  is how do we find people that are gonna be dedicated
1352.17s - 1354.01s |  and stay in the village and not wander off
1354.01s - 1355.21s |  and go do other things
1355.21s - 1357.93s |  because we want to ensure we put on a show for you guys.
1357.93s - 1359.33s |  We want to make sure you guys can actually come
1359.33s - 1361.37s |  and hack a car or come and hack a medical device
1361.37s - 1363.93s |  or rip apart an airplane or whatever it might be.
1363.93s - 1366.57s |  So yeah, it's definitely a difficult thing to do.
1366.57s - 1368.41s |  Call for volunteers is hard.
1368.41s - 1370.45s |  I recommend trying to go to more events,
1370.45s - 1372.61s |  but then that exhausts us all.
1373.61s - 1375.89s |  On the exhaustion piece, if nobody's seen me yesterday,
1375.89s - 1378.13s |  I had an IV in my arm, I don't even drink.
1378.13s - 1379.65s |  I was just so dead and exhausted
1379.65s - 1381.17s |  and didn't eat or dehydrated.
1381.17s - 1383.69s |  So yeah, we're all very stubborn, dedicated people
1383.69s - 1384.77s |  and we love what we do
1384.77s - 1387.85s |  and we're just gonna keep doing it until we can't.
1388.85s - 1393.85s |  So we take a similar model to Car Hacking Village.
1394.57s - 1396.21s |  We don't do call for volunteers.
1396.21s - 1398.61s |  We just get inundated with people
1398.61s - 1401.53s |  that hit us up on LinkedIn, Twitter, whatever,
1401.53s - 1402.81s |  say, hey, we want to do something.
1402.81s - 1404.89s |  Great, come here, talk to us.
1404.89s - 1405.97s |  And they don't show.
1405.97s - 1407.73s |  And it takes a lot of recycles.
1409.61s - 1410.49s |  We have a Justin here that,
1410.49s - 1413.57s |  hey, when you have a person that comes up and says,
1413.57s - 1415.57s |  I really want to help out here.
1415.57s - 1416.41s |  Fantastic.
1417.05s - 1418.13s |  Now you approached me.
1418.13s - 1419.49s |  Now you volunteered.
1419.49s - 1421.01s |  Now let's go do this.
1421.01s - 1422.01s |  It may or may not work out,
1422.01s - 1423.93s |  but tell you what, we have people,
1423.93s - 1424.89s |  I'll be doing this 11 years.
1424.89s - 1426.97s |  We still have people from 10, 11 years ago
1426.97s - 1428.09s |  that come around.
1429.49s - 1430.49s |  Hey, how can I help?
1430.49s - 1432.81s |  They're not involved anymore officially,
1432.81s - 1434.13s |  but how can we help?
1434.13s - 1434.97s |  What can we do?
1434.97s - 1436.05s |  Do you need that stuff moved, set up?
1436.05s - 1437.65s |  And we do that.
1437.65s - 1442.65s |  The one thing that we struggled with a long time is money.
1443.29s - 1444.13s |  Right?
1444.13s - 1448.69s |  So Defcon, very, very thankful we get the badges we get,
1448.69s - 1449.53s |  but you know what?
1449.53s - 1453.29s |  It's going to cost us almost 40,000 bucks to be here.
1453.29s - 1455.57s |  Y'all got $40,000, right?
1455.57s - 1456.41s |  Real money.
1456.41s - 1458.25s |  This is real money that is coming out of our-
1458.25s - 1459.09s |  It's 70.
1461.85s - 1463.61s |  The budgets are wild.
1463.61s - 1466.65s |  So the one thing that we do now
1466.65s - 1468.89s |  is we find sponsors, companies,
1468.89s - 1471.85s |  people that want to be involved that pay their own way.
1473.21s - 1474.05s |  I'm sorry.
1474.05s - 1475.77s |  INL has escape rooms down there.
1475.77s - 1476.61s |  Great.
1476.61s - 1477.45s |  Bring that stuff.
1477.45s - 1478.27s |  You're paying your own way.
1478.27s - 1480.65s |  You're a lab, you're a corporation, whatever.
1480.65s - 1483.65s |  That 30, 40,000 bucks is just for the village volunteers
1483.65s - 1486.21s |  to come here, travel, shipping, stuff like that.
1486.21s - 1490.33s |  Our shipping today will be probably three, 4,000 bucks
1490.33s - 1491.17s |  going on.
1491.17s - 1492.01s |  I don't know what it was coming in.
1492.01s - 1492.85s |  We didn't get the bill yet,
1492.85s - 1495.25s |  but it's real money.
1495.25s - 1496.09s |  Real money.
1496.09s - 1497.89s |  And it used to come out of our own pockets.
1497.89s - 1501.69s |  Now we get sponsors and stuff to do this,
1501.69s - 1504.77s |  but I saw you got a tractor trailer down there.
1504.77s - 1506.01s |  I bet you that was expensive.
1506.01s - 1508.61s |  Even if they donated it, there's still a cost there.
1508.61s - 1510.05s |  There's hours of coordination.
1510.05s - 1511.73s |  There's time, there's effort.
1511.73s - 1513.69s |  And you probably have a real job, right?
1513.69s - 1514.53s |  Oh yeah.
1514.53s - 1515.37s |  Yeah.
1515.37s - 1517.57s |  And Nina, you work too, don't you?
1517.57s - 1518.57s |  I think so.
1518.57s - 1519.57s |  Yeah, all right.
1519.57s - 1524.29s |  So we have probably thousands of hours
1524.29s - 1526.09s |  between all of us leading up to this event
1526.09s - 1529.53s |  starting next week for next year.
1529.53s - 1530.77s |  And hopefully you invite us back next year
1530.81s - 1531.81s |  because if not, we're gonna be really pissed
1531.81s - 1533.25s |  if we start planning for next year
1533.25s - 1534.53s |  and you don't invite us.
1536.37s - 1539.93s |  But yeah, anybody wants to get involved,
1539.93s - 1541.17s |  I'd highly recommend getting involved.
1541.17s - 1543.89s |  A couple of years ago, we brought in the maritime.
1543.89s - 1545.73s |  So wave.
1545.73s - 1546.69s |  I see you guys back there.
1546.69s - 1547.53s |  There you go.
1550.41s - 1552.61s |  Maritime folks join ICSY
1552.61s - 1555.21s |  because it's a floating control system, isn't it?
1556.13s - 1558.93s |  So we have a lot of really, really, really cool stuff there,
1558.93s - 1560.93s |  but we can't come here without people saying,
1560.93s - 1562.81s |  hey, I wanted to do that, this or that,
1562.81s - 1564.61s |  and I wanna help, I wanna volunteer.
1564.61s - 1565.81s |  And it could be raising money.
1565.81s - 1567.37s |  It could be maintaining a website.
1567.37s - 1571.49s |  It could be moving those boxes from A to B.
1571.49s - 1576.29s |  So come down, talk, and we'll get you involved.
1577.85s - 1578.97s |  I just wanna reframe real quick.
1578.97s - 1583.53s |  How many of you are, this is your first DEF CON.
1583.53s - 1586.21s |  How many of you have gone to all the villages
1586.21s - 1587.61s |  or seen all the villages?
1587.61s - 1589.53s |  There's a lot of villages.
1589.57s - 1591.69s |  I just wanted to see, okay.
1591.69s - 1592.53s |  Oh, I was just gonna say,
1592.53s - 1593.53s |  like agreeing with Justin too,
1593.53s - 1595.89s |  with like actually going up at an event,
1595.89s - 1597.29s |  I think some of the best volunteers
1597.29s - 1599.41s |  that we kind of get out of DEF CON
1599.41s - 1601.01s |  are the ones that either one,
1601.01s - 1602.41s |  they never even sign up for a call for volunteer.
1602.41s - 1603.77s |  They just offer to help.
1603.77s - 1606.09s |  And they're the one who ends up staying like the entire time
1606.09s - 1608.29s |  and they end up being like a long-term volunteer.
1608.29s - 1610.57s |  And it's so helpful to help like delegate out tasks
1610.57s - 1612.61s |  with like the crowd control and whatnot.
1612.61s - 1615.69s |  And then also like people that just have been with us
1615.69s - 1617.49s |  from the beginning or like they're on a shift
1617.49s - 1620.01s |  and then they notice people aren't showing up to volunteer
1620.01s - 1621.13s |  and then they end up sticking around.
1621.13s - 1622.37s |  Like, it's so helpful to us
1622.37s - 1623.69s |  to be able to put the village together
1623.69s - 1626.53s |  because I think people don't realize how stressful it is.
1626.53s - 1627.65s |  Like all of us leading up,
1627.65s - 1629.65s |  like everyone probably wants to kill each other,
1629.65s - 1633.13s |  like leading up to DEF CON, but we all love each other.
1633.13s - 1634.37s |  Yeah.
1634.37s - 1636.49s |  I think going kind of off of what Tom was talking about
1636.49s - 1638.61s |  with the logistics of getting things here
1638.61s - 1640.73s |  and doing, you know, bringing a tractor here.
1640.73s - 1642.61s |  So we've been trying to do this tractor trailer
1642.61s - 1644.73s |  or this tractor for the last three years.
1644.73s - 1648.61s |  It's last year they pulled out two weeks before.
1648.61s - 1651.29s |  So we had everything planned, we had everything ready to go.
1651.29s - 1652.69s |  We worked with them, you know,
1652.69s - 1655.21s |  we figured out we can get the vehicle in and everything.
1655.21s - 1658.21s |  And the company was like, nope, cold feet and left.
1658.21s - 1660.37s |  So we have to really quickly in two weeks figure out,
1660.37s - 1661.73s |  okay, how do we bring another vehicle in?
1661.73s - 1662.57s |  How do we do all this?
1662.57s - 1664.25s |  So there's a lot of complexity
1664.25s - 1666.29s |  and logistics that go on behind the scenes
1666.29s - 1668.77s |  to ensure that there's actually a tractor here.
1668.77s - 1670.57s |  So this year we're really happy to have one.
1670.57s - 1671.53s |  And the company that brought it
1671.53s - 1674.21s |  actually gave us their diagnostics laptop as well.
1674.21s - 1676.33s |  And they said, have fun with it, do whatever you want.
1676.33s - 1678.25s |  We're shredding it in a machine when it's done.
1678.25s - 1680.53s |  So you guys can have fun.
1680.53s - 1682.73s |  So it's really cool to see the progress
1682.73s - 1683.93s |  that's happened over the years
1683.93s - 1686.49s |  and the fact that now these companies are this open
1686.49s - 1687.97s |  and willing to work with us
1687.97s - 1690.09s |  and actually willing to give us their diagnostics laptop.
1690.09s - 1691.69s |  I think that's wild, but yeah,
1691.69s - 1694.69s |  it's a lot of logistics going on behind the scenes.
1694.69s - 1698.13s |  That makes me really glad that at BTV we have swag.
1698.13s - 1701.85s |  Like that's our shipping, nothing crazy, just swag.
1701.85s - 1704.45s |  We had a semi-truck, a Rivian, and a Tesla.
1704.45s - 1709.45s |  So the Rivian was driven here, the semi-truck, it was SIA.
1709.73s - 1712.81s |  So if anybody knows S-A-I-A, they're all over the US.
1712.81s - 1715.57s |  So it wasn't really hard for them to pick a truck out
1715.57s - 1719.69s |  and get it here, but yeah, it's a lot of logistics going on.
1719.69s - 1721.05s |  So I think one of the common law things
1721.05s - 1722.01s |  that we all do with each other
1722.01s - 1723.45s |  is we have chat groups with each other.
1723.45s - 1725.57s |  And when something happens, it's, did you see this?
1725.57s - 1726.41s |  How's it affecting you?
1726.41s - 1727.33s |  How's it affecting me?
1727.33s - 1729.61s |  How do we do the things?
1729.61s - 1732.81s |  And so I'm like you now, I lost my train of thought.
1732.81s - 1735.01s |  That always results in Nina calling us.
1735.01s - 1737.69s |  I do call a lot of people.
1737.69s - 1739.65s |  Hody's up here like, it's really weird
1739.65s - 1741.57s |  that all the villages are now asking the same question
1741.57s - 1742.81s |  at the same time.
1742.81s - 1744.77s |  I know their call has occurred as soon as I start,
1744.77s - 1746.81s |  we all, you know, Pedro and I start getting hit up
1746.81s - 1750.05s |  by all of you at the same time with the exact same question.
1750.05s - 1751.57s |  I don't know why they keep doing this.
1751.57s - 1753.97s |  We're still ganged up on like all the time.
1753.97s - 1754.85s |  We actually do like them.
1754.85s - 1755.69s |  They're great people.
1755.69s - 1756.57s |  Thank you for what you do.
1756.57s - 1758.61s |  Another interesting perspective I'll help you guys
1758.61s - 1760.81s |  understand and don't kick me for this one,
1760.81s - 1762.49s |  but Defcon pays us nothing.
1762.49s - 1764.05s |  They give us nothing.
1764.05s - 1766.13s |  All they did this year, which was really awesome.
1766.13s - 1767.29s |  They gave us hotel rooms.
1767.29s - 1768.69s |  I really appreciated that.
1768.69s - 1770.85s |  And that was something new that they did.
1770.85s - 1773.05s |  So it's nice to see that Pedro and Hody
1773.05s - 1774.89s |  are actually trying to take care of us more.
1774.89s - 1776.45s |  In previous years, it's kind of been like,
1776.45s - 1777.89s |  hey, call for villages.
1777.89s - 1778.81s |  Cool, do your own thing.
1778.81s - 1780.09s |  Come on in.
1780.09s - 1782.33s |  So it's nice to see that Defcon as an organization
1782.33s - 1784.77s |  is actually caring about what we're bringing
1784.77s - 1787.41s |  and what we're doing and trying to bring some value back
1787.45s - 1789.01s |  to us to help with what we're doing.
1789.01s - 1790.53s |  So sorry about that.
1790.53s - 1791.37s |  No, you're good.
1791.37s - 1792.29s |  He just whispered to me to be nice.
1792.29s - 1793.49s |  I am gonna be nice.
1793.49s - 1794.33s |  Let me.
1796.61s - 1799.61s |  So I think a good thing,
1799.61s - 1801.77s |  and it's not in a perfect state yet, right?
1802.65s - 1804.57s |  Well, I will say on the sponsorship side,
1804.57s - 1808.41s |  Pedro and I, we started getting a little bit more recognition
1808.41s - 1809.73s |  in some of the other places that we go.
1809.73s - 1811.09s |  People are coming up to us.
1811.09s - 1812.89s |  Our networks are saying, hey, Pedro and Hody,
1812.89s - 1814.73s |  they're the village leads.
1814.73s - 1816.45s |  We've had a couple sponsors walk up to us
1816.45s - 1818.21s |  or people from different companies saying,
1818.21s - 1819.89s |  hey, we would like to sponsor a village.
1819.89s - 1822.85s |  So we've tried to marry some of that stuff up.
1822.85s - 1825.25s |  I will say that I think a couple of them worked out
1825.25s - 1826.13s |  and a few of them didn't,
1826.13s - 1827.49s |  but we're always trying to do that.
1827.49s - 1830.49s |  I know Kevin from Defcon is definitely trying to do that.
1830.49s - 1832.33s |  I think this is a little bit of a weird year
1832.33s - 1835.37s |  with the Audible moving from Caesars to LVCC.
1835.37s - 1837.21s |  I think that there was a little bit of gun shyness
1837.21s - 1838.05s |  on some of those sides.
1838.05s - 1840.69s |  So I think that we can definitely do a much better job
1840.69s - 1841.65s |  for you guys.
1841.65s - 1844.69s |  I'm hoping after this year that we get back on track
1844.69s - 1845.53s |  with some of it.
1846.73s - 1848.29s |  He mentioned the hotel rooms.
1848.29s - 1853.29s |  So there is basically a fund that comes in through,
1854.97s - 1856.93s |  I don't know if I'm allowed to say it.
1856.93s - 1858.33s |  We get a fund basically.
1860.61s - 1862.25s |  We get a fund of money, right?
1862.25s - 1865.49s |  And it's decided on how it's easiest to divvy it out.
1865.49s - 1867.17s |  Previously, we had done some stuff with them
1867.17s - 1870.01s |  where we were able to supply them funds for food
1870.01s - 1870.85s |  during the con,
1870.85s - 1872.25s |  because that's, I know, a major pain point for them
1872.25s - 1874.21s |  because they're stuck inside of a village.
1874.21s - 1876.65s |  Food is 10 miles away
1876.65s - 1878.73s |  because we're stuck inside of a convention center
1878.73s - 1880.01s |  and you're not allowed to bring outside food
1880.01s - 1881.53s |  and drink inside.
1881.53s - 1885.23s |  So that was a pain point we tried to help alleviate.
1886.77s - 1888.73s |  This year, I thought we were doing it again,
1888.73s - 1889.57s |  but I was told not.
1889.57s - 1891.49s |  So we got hotel rooms for you guys.
1891.49s - 1894.57s |  And once again, Pedro and I are pushing
1894.57s - 1897.73s |  for better execution on a lot of these things.
1897.73s - 1900.85s |  We had everything set up and we had a different timeline
1900.85s - 1903.53s |  than what we were given at the end of the day.
1903.53s - 1906.89s |  So we're always pushing and trying to drive
1906.89s - 1910.57s |  towards getting you guys as much information as possible.
1910.57s - 1913.13s |  That way, it's easier for you to plan and execute on things.
1913.13s - 1914.29s |  That way, you're also not spending money
1914.29s - 1916.25s |  on something that we're gonna hopefully provide to you
1916.25s - 1917.49s |  type deal as well.
1918.73s - 1919.57s |  But yeah.
1920.45s - 1921.89s |  I had a question for everybody here.
1921.89s - 1922.73s |  Can I go real quick?
1922.73s - 1924.29s |  Yeah.
1924.29s - 1925.13s |  Great.
1926.33s - 1930.97s |  So this is a point of admiration for real.
1931.93s - 1933.25s |  I've done this for 10 years, right?
1934.13s - 1936.41s |  I think two years ago when you took over, was it two?
1936.41s - 1937.25s |  Pedro and I took over.
1937.25s - 1938.09s |  Yeah.
1938.09s - 1940.61s |  I had so many long discussions with them
1940.61s - 1945.61s |  because I am really, village building is my passion.
1945.93s - 1949.09s |  So, so many conversations with both of them to be like,
1949.09s - 1952.25s |  this is how we as a group like to do the things.
1952.25s - 1954.05s |  This is how we need timelines.
1954.05s - 1956.49s |  We need help doing this, whatever, whatever, whatever.
1956.49s - 1958.01s |  And they actually listened,
1958.01s - 1962.81s |  which from the large Defcon Corporation moment perspective,
1962.85s - 1963.77s |  super helpful.
1963.77s - 1966.49s |  So for me, at least this year, it was,
1967.57s - 1970.05s |  honestly, this is the best year for the biohacking village.
1970.05s - 1971.13s |  I hardly had to do anything
1971.13s - 1973.69s |  because it was so well executed.
1973.69s - 1976.13s |  So that's good for you.
1976.13s - 1976.97s |  I would agree.
1976.97s - 1978.97s |  Even with changing facilities and buildings
1978.97s - 1980.21s |  and all that chaos that happened,
1980.21s - 1981.89s |  you guys still smoothed it out
1981.89s - 1983.01s |  and made it pretty easy for us.
1983.01s - 1985.17s |  So yeah, big kudos to you guys for that.
1985.17s - 1988.01s |  I'll have you guys know that like in January, February,
1988.01s - 1991.37s |  Pedro and I had everything laid out, mapped out,
1991.37s - 1993.49s |  every process, every system.
1993.49s - 1995.97s |  And then, you know, we get a phone call of, hey, stop.
1995.97s - 1996.81s |  And-
1996.81s - 1998.13s |  Right, that's a good point
1998.13s - 2001.85s |  because all of us were planning for whatever it was.
2001.85s - 2003.81s |  All of us were planning for other hotels
2003.81s - 2004.93s |  and we were super invested
2004.93s - 2006.89s |  because we knew the blueprints, we were there.
2006.89s - 2009.65s |  And then suddenly it was like, fuck you, Defcon changed.
2009.65s - 2011.09s |  It's like, oh God, what to wear?
2011.09s - 2012.49s |  What are we doing now?
2012.49s - 2013.33s |  And then it was-
2013.33s - 2014.85s |  Our messaging was softer than that,
2014.85s - 2015.85s |  just so you're aware.
2017.37s - 2019.49s |  And it was all of us going, well, where are we gonna be?
2019.49s - 2020.33s |  What are we gonna do?
2020.33s - 2021.17s |  How are we shipping?
2021.81s - 2022.65s |  What's the cost?
2022.65s - 2023.49s |  What are we doing?
2023.49s - 2024.33s |  I know this is recorded.
2024.33s - 2026.49s |  I curse a lot, everybody knows.
2026.49s - 2029.49s |  So it was, I think you softened it, yes.
2029.49s - 2030.93s |  And I think the transition to this year
2030.93s - 2033.65s |  was a lot easier than I thought it was going to be.
2033.65s - 2035.33s |  I honestly felt so bad for both of you.
2035.33s - 2036.65s |  When I saw that, I was like, oh my God,
2036.65s - 2037.49s |  they're gonna be slammed.
2037.49s - 2039.85s |  So we were, Blue Team Village is pretty organized.
2039.85s - 2041.01s |  I mean, like, I like to joke
2041.01s - 2042.17s |  that we're the most organized village
2042.17s - 2044.61s |  because Blue Teamers are the people that have jobs
2044.61s - 2046.25s |  and, you know, are professionals.
2046.25s - 2047.57s |  I don't have a job.
2047.65s - 2049.25s |  I don't have a job.
2050.69s - 2052.09s |  Them's fighting words, yeah.
2054.73s - 2056.37s |  Tell that to my employer, please.
2057.89s - 2059.13s |  So I do have a question.
2059.13s - 2059.97s |  No, no, I'm not done yet.
2059.97s - 2060.81s |  Hang on, hang on, hang on.
2060.81s - 2062.17s |  You're gonna give me a job?
2063.33s - 2064.25s |  You can interview with me.
2064.25s - 2065.09s |  We'll see how it goes.
2065.09s - 2065.93s |  It'll be fine.
2066.97s - 2070.81s |  But I think, wait, I was going somewhere with that one.
2070.81s - 2073.89s |  I think you made me, it was my turn to pause.
2073.89s - 2075.57s |  I think what I was really getting at was like,
2075.57s - 2077.05s |  you know, we're really organized
2077.57s - 2080.01s |  and we kind of have this consistent, like,
2080.01s - 2081.81s |  way that we do things and whatnot.
2081.81s - 2083.25s |  So I was trying, we were trying to do
2083.25s - 2084.65s |  as much as possible by ourselves
2084.65s - 2085.61s |  and answer our own questions
2085.61s - 2087.37s |  and not, like, rely on Honey and Pedro so much
2087.37s - 2089.57s |  because we knew that they were getting inundated with stuff.
2089.57s - 2091.73s |  So I'm gonna jump on the train of, like,
2091.73s - 2092.73s |  you guys are doing a great job.
2092.73s - 2095.53s |  So can we actually give Honey and Pedro a round of applause?
2095.53s - 2098.96s |  Yeah.
2100.96s - 2104.52s |  Pedro's coming up here.
2104.52s - 2105.48s |  Pedro.
2105.48s - 2108.60s |  I've been waiting all day to say, no, I'm just kidding.
2108.60s - 2111.12s |  I just want to say that I picked up a few nuggets
2111.84s - 2112.68s |  here and there, and I would just like to start off
2112.68s - 2116.20s |  by saying that Honey and I are also not paid by DEF CON.
2116.20s - 2118.32s |  We are stipend volunteers.
2118.32s - 2119.60s |  So just keep that in mind
2119.60s - 2123.92s |  when everybody's asking for meetings nonstop.
2123.92s - 2126.12s |  We also have families and lives and work
2126.12s - 2127.16s |  and et cetera, right?
2127.16s - 2129.48s |  I have two dogs that I love dearly.
2129.48s - 2131.12s |  My children think that I love my dogs
2131.12s - 2132.48s |  more than I love them.
2132.48s - 2133.88s |  And sometimes they're right.
2134.88s - 2136.44s |  My dogs never talk back.
2137.76s - 2140.40s |  Regarding volunteers, a lot of first timers
2140.40s - 2142.16s |  always ask, how can I get involved?
2143.28s - 2146.80s |  I'd just like to shout out to one of the new
2146.80s - 2147.96s |  to be goons next year.
2147.96s - 2149.44s |  His name is Irf.
2149.44s - 2151.20s |  He showed up early.
2151.20s - 2152.28s |  I think it was Tuesday.
2152.28s - 2153.84s |  He was like, hey, I'm here.
2153.84s - 2154.84s |  Do you guys need anything?
2154.84s - 2157.48s |  Helped us just like with loading in, counting badges.
2157.48s - 2160.12s |  We had already counted badges at least five times.
2160.12s - 2162.36s |  And since he was fresh blood, I was like, okay,
2162.36s - 2163.88s |  do me a favor, open these boxes
2163.88s - 2165.28s |  and start counting them one by one.
2165.28s - 2168.20s |  We're talking about 930 plus badges.
2169.16s - 2171.48s |  Then he was like, hey, if we're done here,
2171.48s - 2172.44s |  I'm gonna go check out
2172.44s - 2174.00s |  and see if any of the villages need help.
2174.00s - 2174.96s |  So next thing I know,
2174.96s - 2177.80s |  he's down at Packet Hacking Village running cable.
2177.80s - 2180.00s |  That was Tuesday, Wednesday.
2180.00s - 2181.52s |  Thursday, he came back to help us.
2181.52s - 2182.56s |  And then he was like, okay, cool.
2182.56s - 2183.88s |  I'm going back to Packet Hacking.
2183.88s - 2187.60s |  So honestly, reaching out via LinkedIn
2187.60s - 2190.76s |  and trying to be like, hey, cool, let me in.
2190.76s - 2192.60s |  And then never showing up, that's gonna happen.
2192.60s - 2194.16s |  But if you really wanna get involved,
2194.16s - 2196.36s |  the easiest thing to do is just to show up
2196.36s - 2199.00s |  and just be like, I'm here, what do you need?
2199.00s - 2199.84s |  The other-
2199.84s - 2201.28s |  You said LinkedIn, LinkedIn's a big thing.
2201.28s - 2204.24s |  Oh, I mean, you can reach out to me on LinkedIn
2204.24s - 2205.68s |  if you can find me.
2205.68s - 2208.20s |  That's a contest, right?
2208.20s - 2209.52s |  The other thing I wanted to mention
2209.52s - 2213.72s |  is that I want to say that I picked up a small tidbit
2213.72s - 2215.56s |  over at Car Hacking.
2215.56s - 2219.12s |  I do vulnerability research in embedded systems.
2219.12s - 2221.20s |  And I picked up a small tidbit.
2221.20s - 2224.12s |  I'm contemplating buying a car
2224.12s - 2225.24s |  and I'm going for the jugular.
2225.24s - 2228.12s |  So on Nina's behalf,
2228.12s - 2229.72s |  I do think that these manufacturers
2229.72s - 2231.80s |  should be working with us
2231.80s - 2233.88s |  to try to find these vulnerabilities,
2233.88s - 2235.00s |  get them disclosed and patched
2235.00s - 2237.20s |  before it ends up in the public consumption.
2237.20s - 2239.08s |  And so reaching over to ICS,
2239.08s - 2241.12s |  like if you wanna live in the black box,
2241.12s - 2243.00s |  people like me are gonna find it.
2243.00s - 2245.12s |  I already know what's there.
2245.12s - 2246.24s |  I'm not gonna just put it out there
2246.24s - 2249.36s |  because I wanna be the first one to go after it.
2249.36s - 2252.04s |  So I'm kind of in between Tom and Nina, literally.
2252.96s - 2255.16s |  And one of the things we did this year,
2255.16s - 2256.56s |  I still have a question I wanna go back to
2256.56s - 2257.56s |  that kind of goes into volunteers,
2257.56s - 2260.20s |  but one of the things we actually were able to do this year
2260.20s - 2262.92s |  is get the auto ISAC out here to help.
2262.92s - 2265.24s |  So for those that don't know what an ISAC is,
2265.24s - 2268.04s |  it's an information sharing and analysis center.
2268.04s - 2269.04s |  They have one for automotive.
2269.04s - 2270.92s |  So this is the first year they came out and sponsored
2270.92s - 2273.00s |  and actually tried to be a part of DEF CON,
2273.00s - 2274.08s |  which normally they're not
2274.08s - 2276.08s |  because they're more on the blue team and monitoring side
2276.08s - 2277.52s |  and trying to fix things.
2277.52s - 2279.56s |  But this is one way we're trying to bridge the gaps
2279.56s - 2283.64s |  is bringing companies or organizations like that here
2283.64s - 2285.96s |  to help when we do find things or we do have issues,
2285.96s - 2287.92s |  they can at least work right away with the OEMs
2287.92s - 2289.88s |  and submit that to them.
2289.88s - 2290.92s |  Yeah, so I just wanted to say that,
2290.92s - 2291.84s |  but the question I had,
2291.84s - 2292.76s |  and I know we don't have much time
2292.76s - 2295.16s |  because I can see that clock back there.
2295.16s - 2297.40s |  How many volunteers do you guys all have
2297.40s - 2302.40s |  and how do you work with them regarding like times
2302.60s - 2304.68s |  and shifts and stuff like that?
2304.68s - 2307.68s |  I'll start on my side and then I'll let it go down.
2307.68s - 2310.00s |  So on our side, we have 35 volunteers
2310.00s - 2313.12s |  and then about 20 other sponsors and people that come in.
2313.12s - 2316.28s |  So I have about 60 to 70 people I deal with
2316.28s - 2317.12s |  throughout this event
2317.12s - 2319.16s |  that are always asking me for information.
2319.16s - 2321.24s |  How do they need this or need that?
2321.24s - 2323.08s |  And what time do they have to be at places?
2323.08s - 2324.80s |  So outside of the logistics of planning
2324.80s - 2325.84s |  and getting people here,
2325.84s - 2328.04s |  while we're here, it's just chaos.
2328.04s - 2331.20s |  Like I'm literally trying to manage 70 people right now
2331.20s - 2332.72s |  and it's insane because they're all like,
2332.72s - 2333.56s |  hey, where are we eating?
2333.56s - 2334.48s |  Where is this going on?
2334.48s - 2335.68s |  Where is that going on?
2335.68s - 2337.84s |  So it's very complex and difficult to do.
2337.84s - 2340.16s |  And I'm curious on how some of you guys handle that
2340.16s - 2341.84s |  because I could use some advice.
2344.67s - 2348.43s |  So we have about 70 volunteers, if not maybe 80.
2348.43s - 2351.51s |  We have two leads that lead that, Mike and Danielle.
2351.51s - 2353.31s |  And Mike actually like built out
2353.31s - 2355.67s |  this whole custom portal for us this year.
2355.67s - 2356.51s |  I think he was telling,
2356.51s - 2357.35s |  he was trying to tell other villages
2357.35s - 2359.63s |  that he'll like help y'all like get it too.
2359.63s - 2360.95s |  It's just something he like customly built
2360.95s - 2363.39s |  to be able to kind of like assign shifts
2363.39s - 2365.59s |  because we do, like we were mentioning earlier,
2365.59s - 2367.11s |  we don't always have volunteers show up.
2367.63s - 2369.39s |  So we always have to kind of like
2369.39s - 2370.51s |  reach out to others and whatnot,
2370.51s - 2372.99s |  but we do have those two people that are managing those.
2372.99s - 2374.75s |  And we do have around 70 people
2374.75s - 2376.55s |  that are volunteering throughout the con.
2376.55s - 2379.23s |  And it's a lot of names to keep track of as well.
2379.23s - 2380.11s |  And I'll let Matt.
2381.55s - 2384.07s |  Yeah, so we have internal volunteers
2384.07s - 2386.71s |  and then a lot of our activities,
2386.71s - 2390.39s |  the companies that bring their own activities,
2390.39s - 2392.63s |  they are sort of in charge of their own.
2392.63s - 2395.63s |  So if you're a Boeing, if you're a Lockheed
2396.03s - 2398.39s |  and you bring 10 people, it's up to you
2398.39s - 2401.43s |  how you wanna staff your activity.
2401.43s - 2406.23s |  For, or Embry-Riddle through the Aviation ISAC,
2406.23s - 2410.63s |  they brought 15 students and they also just, yeah.
2410.63s - 2412.67s |  So for their activity, they were,
2412.67s - 2414.47s |  we let them handle their own scheduling.
2414.47s - 2417.87s |  There's some activities where it's literally two people
2417.87s - 2422.27s |  and they are there every single hour for the entire con.
2422.27s - 2424.75s |  And internally, we have our own set of volunteers
2425.87s - 2429.19s |  about 20 or so people to help with workshops,
2429.19s - 2433.11s |  to help with just organizing everything.
2433.11s - 2435.19s |  And thankfully we have a volunteer coordinator
2435.19s - 2436.51s |  that takes care of all that.
2436.51s - 2437.83s |  And yeah, we've got,
2437.83s - 2439.59s |  we're trying some new software this year.
2439.59s - 2442.07s |  We'll see if that actually was a success or not.
2442.07s - 2444.63s |  I think so, just to try and get things organized
2444.63s - 2447.95s |  because all too often we're just shooting from the hip
2447.95s - 2449.83s |  and saying, okay, I've got a need
2449.83s - 2451.99s |  and who can do it right now?
2452.99s - 2456.07s |  Yeah, we have, we kind of split them up a little bit.
2456.07s - 2458.95s |  So we're a 501C3 nonprofit.
2458.95s - 2460.95s |  We have board of directors.
2462.03s - 2463.79s |  So this year it's basically myself
2463.79s - 2465.79s |  and two of the other directors,
2465.79s - 2467.55s |  shout out Crime Santa and Omenscan,
2468.51s - 2471.15s |  that are, we kind of start the initial planning
2471.15s - 2472.35s |  and then we kind of downstream
2472.35s - 2474.63s |  to consistent staff that we have.
2474.63s - 2476.51s |  So basically our leads.
2476.51s - 2478.23s |  So we have like Daniela and Satan
2478.23s - 2479.99s |  who manage all the volunteers.
2480.99s - 2483.75s |  We have Definga dealing with the CTF that we have.
2483.75s - 2485.19s |  We do our own CTF,
2486.79s - 2487.63s |  a whole bunch of other people
2487.63s - 2489.95s |  that are involved in kind of organizing things.
2489.95s - 2493.27s |  Cheerio handled all the workshops, things like that.
2493.27s - 2495.15s |  And then we have also some day volunteers
2495.15s - 2496.55s |  where we'll sign like doors
2496.55s - 2499.35s |  and kind of that crowd management info booth,
2499.35s - 2500.99s |  things like that.
2500.99s - 2503.35s |  I would say like staff wise.
2503.35s - 2505.07s |  So three directors staff wise,
2505.07s - 2507.79s |  maybe 10 to 15 that are involved
2507.79s - 2509.67s |  in the actual planning phase.
2510.35s - 2511.19s |  And then we wind up with anywhere
2511.19s - 2513.07s |  between like 30 and 70 volunteers,
2513.07s - 2514.43s |  depending on who shows up.
2515.87s - 2520.87s |  So yeah, the badge thing is always challenging.
2521.11s - 2523.67s |  Cause you know, we do get badges from DEF CON
2523.67s - 2525.47s |  that we try to give to the volunteers,
2525.47s - 2527.43s |  but we want to make sure that they go to the people
2527.43s - 2528.67s |  that show up year after year.
2528.67s - 2530.11s |  And that's always a challenge.
2530.11s - 2531.55s |  I knew the spice was coming.
2533.03s - 2534.43s |  Not even that spicy.
2534.43s - 2535.27s |  Yeah.
2535.27s - 2536.27s |  Well, since we're on that topic,
2536.27s - 2537.79s |  let's talk about badges.
2537.79s - 2542.79s |  So as village logistics advocates,
2543.11s - 2545.79s |  we have a finite pool of badges
2545.79s - 2549.19s |  that we can sprinkle across all the content creators.
2550.27s - 2551.59s |  We have secret shoppers.
2551.59s - 2552.71s |  I don't know if you know this,
2552.71s - 2555.23s |  but we have secret shoppers that are evaluating you.
2555.23s - 2557.03s |  You'll never pick them out.
2557.03s - 2558.07s |  And then we get feedback.
2558.07s - 2559.43s |  And based off of that feedback,
2559.43s - 2563.87s |  that's how we're also providing quantifiable,
2563.87s - 2565.67s |  you know, metrics to DEF CON
2565.67s - 2568.67s |  to try to advocate for more badges for villages.
2568.67s - 2572.75s |  So one of the things that constantly comes across to us
2572.75s - 2574.87s |  is how can I get more badges?
2574.87s - 2576.99s |  There's always going to be a limit, right?
2576.99s - 2579.31s |  Just because each village thinks
2579.31s - 2580.55s |  that they need the most badges
2580.55s - 2583.11s |  and each village thinks they need the most space,
2583.11s - 2586.19s |  but we only have so much to spread around.
2586.19s - 2589.47s |  So you will normally get questions from us
2589.47s - 2592.27s |  and we will usually ask for justifications.
2592.27s - 2594.83s |  Sometimes, you know, depending on the request,
2594.83s - 2596.47s |  we'll even go as far as like,
2596.47s - 2599.55s |  provide us a schedule of who's working for how long.
2601.95s - 2602.99s |  I'll comment on that.
2602.99s - 2603.91s |  Do you really want that?
2603.91s - 2605.35s |  Yeah, oh yeah, we're going there.
2605.35s - 2609.03s |  So we've been doing this for 11 years now
2609.03s - 2612.67s |  and we're going to be $30,000, $40,000 into this.
2612.67s - 2614.59s |  A lot of freaking money, right?
2614.59s - 2616.59s |  Not even counting the hardware or any,
2616.59s - 2618.55s |  and our sponsors will go and bring stuff
2618.55s - 2621.95s |  and we're not counting that money.
2621.95s - 2624.67s |  I don't think I've ever been asked by DEF CON
2625.51s - 2626.35s |  what we put into things,
2626.35s - 2627.55s |  how many thousands of hours
2627.55s - 2629.11s |  and how many tens of thousands
2629.11s - 2631.11s |  or hundreds of thousands of dollars.
2631.11s - 2633.95s |  We're asking for a badge that,
2633.95s - 2638.19s |  I don't know, what's this thing, $60, $70 for a badge?
2638.19s - 2639.99s |  No, no, no, no, no, that's retail.
2639.99s - 2641.51s |  What's the thing cost?
2641.51s - 2642.99s |  75 bucks.
2642.99s - 2647.23s |  So when we're putting in tens of thousands of dollars,
2647.23s - 2648.83s |  those questions never come back to us
2648.83s - 2650.67s |  and, hey, what did you put in?
2650.67s - 2654.07s |  But we're constantly fighting for poker chips for food
2654.11s - 2655.67s |  or a couple of hotel rooms.
2655.67s - 2657.23s |  Extremely, I think we're all extremely grateful
2657.23s - 2658.47s |  for everything.
2658.47s - 2661.35s |  It still seems one way on what we're doing here.
2661.35s - 2663.95s |  So, you know, we got 40 badges.
2663.95s - 2666.35s |  We bought 20 and so we have 60 badges.
2666.35s - 2670.23s |  Put $15,000 into the pot here for the other badges.
2670.23s - 2671.71s |  All right, 10 minutes.
2671.71s - 2674.63s |  The, sell us these things at cost.
2674.63s - 2675.99s |  These things aren't 500 bucks.
2675.99s - 2677.63s |  They're $75.
2677.63s - 2678.63s |  Sell them to us at cost
2678.63s - 2681.31s |  because we are down in that village nonstop.
2685.00s - 2689.00s |  I'll give you the CEO response type style
2689.00s - 2692.00s |  because I don't want to get myself into trouble.
2692.00s - 2695.24s |  I will say that everything you see at DEF CON costs money.
2695.24s - 2696.76s |  Oh, yeah, 100%.
2696.76s - 2697.60s |  Everything in your village,
2697.60s - 2700.48s |  you pay nothing to be in the village.
2700.48s - 2703.00s |  The space, the floor, the real estate,
2703.00s - 2706.00s |  all the requests that you have, DEF CON is paying for that.
2706.00s - 2707.16s |  Not going to go into how much that is
2707.16s - 2709.56s |  because even I personally don't know how much that is
2709.56s - 2711.60s |  because we're not privy to that knowledge, right?
2711.72s - 2714.56s |  But I know that DEF CON does invest a lot of money
2714.56s - 2716.20s |  for the real estate, for the space,
2716.20s - 2717.84s |  and for a lot of the logistics that go into it.
2717.84s - 2720.96s |  I'm not taking away from anything that the villages do
2720.96s - 2721.80s |  as far as that goes,
2721.80s - 2724.76s |  because I understand Nina and a few of the other leads
2724.76s - 2725.84s |  have kind of expressed to me like,
2725.84s - 2727.20s |  hey, this is what we're investing in this.
2727.20s - 2730.80s |  And trust me, Pedro and I are cognizant of it.
2730.80s - 2732.52s |  And that's why we're trying to push for more sponsorship
2732.52s - 2734.12s |  and everything else like that for you.
2736.04s - 2738.72s |  From DEF CON's perspective,
2738.72s - 2742.20s |  the badge does mean something more than just the 70 bucks.
2742.20s - 2745.44s |  That is access to the con itself.
2745.44s - 2747.88s |  And so there is a drastic difference between,
2747.88s - 2751.28s |  hey, I have 50 volunteers who are coming
2751.28s - 2752.48s |  and they're working the entire time.
2752.48s - 2754.12s |  Like, okay, that's easier justification.
2754.12s - 2755.76s |  Or I have somebody who's gonna come
2755.76s - 2758.64s |  teach a 30 minute workshop, I want a badge.
2758.64s - 2760.32s |  There's a drastic difference between the two of those.
2760.32s - 2763.28s |  So like, I'm not saying you, I'm not saying you.
2763.28s - 2766.20s |  But there are some instances where we are trying
2766.20s - 2767.24s |  to kind of clean that up,
2767.24s - 2770.12s |  because one, it's not fair to ICS Village
2770.12s - 2773.00s |  if we're giving 80 badges to somebody
2773.00s - 2774.20s |  and that's what they're doing.
2774.20s - 2776.16s |  And you're sitting at 50, right?
2776.16s - 2777.52s |  Or some of those lines, right?
2777.52s - 2778.36s |  Someone got 80 badges.
2778.36s - 2781.08s |  We wanna make sure it's equitable across the, shh.
2781.08s - 2782.32s |  We wanna make sure it's,
2782.32s - 2784.40s |  these are all fake numbers, it's okay.
2784.40s - 2785.76s |  We wanna make sure that it's equitable
2785.76s - 2786.88s |  across the board, right?
2786.88s - 2790.96s |  And that the support that we're giving out is appropriate.
2791.92s - 2794.36s |  A lot of times we're also not making the decision.
2794.36s - 2795.92s |  We are advocating for you.
2795.96s - 2797.56s |  When we ask for the justifications,
2797.56s - 2799.28s |  not because Pedro and I want to be nosy
2799.28s - 2800.80s |  and be on inside your business.
2800.80s - 2803.44s |  It's that way when we take that information
2803.44s - 2804.88s |  and we're going and we're advocating,
2804.88s - 2806.56s |  we're arguing for you.
2806.56s - 2809.32s |  You know, there are behind backroom deals
2809.32s - 2810.72s |  that we're trying to work for you
2810.72s - 2812.64s |  to ensure that you guys get as much support
2812.64s - 2813.96s |  as we possibly can for you.
2813.96s - 2816.12s |  And that's our entire role in this, so.
2816.12s - 2816.96s |  I'm gonna pivot off that real quick.
2816.96s - 2818.76s |  I have one quick thing to add.
2818.76s - 2819.60s |  Hold on.
2819.60s - 2820.44s |  It's really small.
2820.44s - 2822.00s |  I just wanna say one thing, six minute warning.
2822.00s - 2824.12s |  Oh, I just wanna say,
2824.12s - 2826.76s |  I think maybe when Kevin or you guys took over,
2826.76s - 2828.92s |  I can't remember, but prior to that,
2828.92s - 2831.36s |  us village leads and the ones that run everything,
2831.36s - 2834.64s |  we used to only get like three or four of these.
2834.64s - 2836.68s |  So with having a staff of 30 or 40 people
2836.68s - 2837.92s |  and only getting three or four of these
2837.92s - 2839.08s |  and trying to bring people in and out
2839.08s - 2840.80s |  while we're setting up is very difficult.
2840.80s - 2843.64s |  So it's been very nice that over the last few years,
2843.64s - 2846.28s |  they've been able to get us like 20 badges or 30 badges
2846.28s - 2848.48s |  because that's actually the amount of staff that we have.
2848.48s - 2849.68s |  And then we don't have the issues
2849.68s - 2851.08s |  of people coming in and out during setup.
2851.08s - 2853.96s |  So I just wanna say that there has been a lot of improvements
2854.80s - 2855.84s |  in the badges and getting us that access
2855.84s - 2857.16s |  because prior to it, it was like,
2857.16s - 2859.08s |  you'd give it, they'd give us four, maybe five.
2859.08s - 2861.64s |  And it's like, it's not really helping us.
2861.64s - 2864.60s |  So they have definitely helped us a lot more on that side.
2864.60s - 2866.80s |  So what I was gonna add, I think someone,
2866.80s - 2869.08s |  I heard the word equitable and it triggered something.
2869.08s - 2873.16s |  So the main reason that I think we really wanna have
2873.16s - 2878.00s |  more badges is because we have volunteers year over year
2878.00s - 2881.44s |  who are newer to the industry,
2881.44s - 2883.76s |  could really benefit from being here at DEF CON,
2884.56s - 2887.36s |  but don't have the financial resources to afford much.
2887.36s - 2889.28s |  So they're splitting shitty hotel rooms,
2889.28s - 2893.08s |  getting cheap flights and 400 plus dollars
2893.08s - 2895.56s |  for a badge is actually quite a lot.
2895.56s - 2896.64s |  So, and that's one of the things
2896.64s - 2898.40s |  that we can quantifiably provide
2898.40s - 2901.32s |  to those volunteers and staff.
2902.24s - 2903.88s |  That's ultimately like we're here
2903.88s - 2905.88s |  to provide content to people.
2905.88s - 2907.92s |  I think a secondary reason that we're here
2907.92s - 2910.60s |  is to help people grow in their careers
2910.60s - 2911.76s |  and to help them network.
2911.76s - 2913.28s |  Like we've had, as Blue Team Village,
2913.28s - 2914.72s |  we've had so many people get jobs
2914.72s - 2917.28s |  because of volunteering for the village.
2917.28s - 2919.52s |  Actually, my last two jobs I got
2919.52s - 2921.52s |  because of people I knew from Blue Team Village.
2921.52s - 2922.76s |  And I wouldn't have been able to do that
2922.76s - 2925.84s |  if I couldn't afford to come here and volunteer originally.
2925.84s - 2927.60s |  My question is, what are you doing
2927.60s - 2929.92s |  with any of that money you might make?
2929.92s - 2931.84s |  Because it's what we do is all the money
2931.84s - 2932.80s |  we're making during this.
2932.80s - 2934.64s |  So we sell badges, obviously,
2934.64s - 2937.16s |  we're a nonprofit organization as well.
2937.16s - 2939.56s |  The way our board works is all the money we make from this,
2939.56s - 2941.12s |  we dump back into this.
2941.16s - 2943.68s |  None of us make any of it, none of us keep any of it.
2943.68s - 2945.64s |  That's why we're giving away a car this year.
2945.64s - 2947.40s |  But we take our money and we pour it
2947.40s - 2949.04s |  right back into DEF CON.
2949.04s - 2951.48s |  So I'm just curious what you guys are doing with your money
2951.48s - 2953.72s |  because I try to, like this year,
2953.72s - 2956.16s |  I knew one of my volunteers that came out,
2956.16s - 2958.28s |  a younger kid, kind of from a family
2958.28s - 2960.00s |  that doesn't have a lot of finances.
2960.00s - 2962.96s |  And I was able to buy his flight and help him get out here.
2962.96s - 2964.96s |  And I've done that with a lot of other people as well.
2964.96s - 2967.28s |  I know like Kamal's right here in the stands.
2967.28s - 2969.00s |  He's from Japan, we flew him out here.
2969.00s - 2972.60s |  So we try to do the best we can to fund our staff as well
2972.60s - 2974.48s |  outside of what DEF CON gives us
2974.48s - 2976.16s |  based off of what you guys are giving to us
2976.16s - 2979.76s |  through badges or other things like that, so.
2979.76s - 2981.16s |  Yeah, that's a constant thing that we're working on,
2981.16s - 2983.20s |  trying to bring it back to supporting
2983.20s - 2986.04s |  the people that make this village possible.
2986.04s - 2987.64s |  And I think Nina and I have had
2987.64s - 2989.32s |  some side conversations about that.
2989.32s - 2990.96s |  So maybe I'll hand it over to you
2990.96s - 2993.56s |  and you can add to that for two minutes.
2993.56s - 2994.44s |  Five minute warning.
2994.44s - 2995.76s |  50 seconds on the clock.
2996.76s - 2999.12s |  So just circling back to the other question,
2999.12s - 3001.00s |  there's eight people on the core for us.
3001.00s - 3005.76s |  And then it's, this year we have 25 people
3005.76s - 3010.64s |  that are bringing people in through the Hippocratic Oathing.
3010.64s - 3011.96s |  But at the end of the day,
3011.96s - 3013.80s |  there's about 300 people that I am managing
3013.80s - 3015.80s |  that one, I've probably never met before.
3015.80s - 3018.92s |  And two, that are highly committed to doing village stuff.
3018.92s - 3020.60s |  A lot of them don't end up leaving the village
3020.60s - 3023.20s |  because it's highly interactive, it's immersive,
3023.20s - 3024.76s |  all of that.
3024.80s - 3026.36s |  I don't remember your question.
3026.36s - 3027.52s |  What do we do with the money?
3027.52s - 3028.52s |  Is that what we do with the money?
3028.52s - 3029.36s |  Sorry.
3029.36s - 3030.20s |  Like supporting volunteers.
3030.20s - 3031.72s |  Oh, supporting volunteers.
3031.72s - 3035.52s |  I, ooh, there's a lot of work that goes into this.
3035.52s - 3038.36s |  So I pay for at least the core people.
3038.36s - 3040.36s |  I pay for their flights, I pay for their hotels,
3040.36s - 3043.40s |  I give them a stipend, and everybody is on their way.
3043.40s - 3046.32s |  Because again, this is, it's eight hours
3046.32s - 3048.44s |  that the attendees get to be in the room,
3048.44s - 3050.32s |  but it's like a 12 hour day for all of us.
3050.32s - 3052.80s |  Because they're still set up and there's, yeah.
3052.80s - 3054.52s |  It's like 14, 15 most of the time.
3055.28s - 3056.12s |  Oh no, I mean during the con,
3056.12s - 3058.48s |  because before that we're here for like forever.
3059.36s - 3061.64s |  And it's ensuring that the attendees
3061.64s - 3063.36s |  get the experience that they came here for, right?
3063.36s - 3065.12s |  You're paying a lot for this conference.
3065.12s - 3067.32s |  We want you to have everything that you need
3067.32s - 3069.16s |  to one, be involved.
3069.16s - 3072.12s |  Two, three, oh my God, English is hard today.
3072.12s - 3074.12s |  Two, be invested.
3075.08s - 3077.32s |  The other part of this is, what do we do with the money?
3077.32s - 3078.72s |  It just gets poured back in.
3078.72s - 3081.68s |  This year, Biohacking Village is functioning at a loss
3081.68s - 3084.56s |  because there's, to a lot of the points, right?
3084.56s - 3086.28s |  There's a lot of investment that we had to do.
3086.28s - 3088.40s |  We are not getting a lot of the money back
3088.40s - 3091.56s |  because we just, our prices aren't high
3091.56s - 3093.44s |  because we need everybody to do the things.
3093.44s - 3094.72s |  So at the end of the day,
3094.72s - 3096.80s |  it's what conference are we going to next?
3096.80s - 3099.88s |  How do we get support from the people in this room,
3099.88s - 3105.79s |  the sponsors, the community, DEF CON, things like that.
3105.79s - 3108.11s |  Any last questions before we have to stop?
3108.11s - 3108.95s |  I think there's a question in the crowd.
3108.95s - 3118.08s |  We got a question out here.
3118.08s - 3119.24s |  So we're not associated with.
3120.00s - 3122.56s |  Yeah, none of us are subsidiaries.
3122.56s - 3125.08s |  So he asked us, are we all 5013Cs
3125.08s - 3127.72s |  and are we subsidiaries of, yeah, English is hard.
3127.72s - 3129.32s |  Are we subsidiaries of DEF CON?
3129.32s - 3132.64s |  And the answer of the 5013C is it's spotty.
3132.64s - 3135.04s |  Some of us are, some of us might not be,
3135.04s - 3137.08s |  but none of us are subsidiaries of DEF CON.
3137.08s - 3140.78s |  We are all independent organizations.
3140.78s - 3142.26s |  Yeah, so a lot of the villages though,
3142.26s - 3143.70s |  and a lot of the newer ones,
3143.70s - 3146.90s |  I think are the ones that aren't 5013Cs.
3146.90s - 3148.94s |  We encourage them to push that way
3148.94s - 3150.58s |  because it actually changes a lot of the landscape
3150.58s - 3152.50s |  for them at DEF CON.
3152.50s - 3155.14s |  And it opens up some additional funding avenues
3155.14s - 3157.94s |  potentially in the future for us, for them as well, so.
3161.90s - 3163.98s |  What is the corporate structure of DEF CON itself?
3163.98s - 3165.30s |  That's probably outside the scope of this panel.
3165.30s - 3166.14s |  Yeah, and we got two minutes left.
3166.14s - 3167.38s |  Tony doesn't want to answer that either.
3167.38s - 3169.66s |  I definitely don't want to answer that.
3169.66s - 3170.50s |  Yeah, I guess-
3170.50s - 3171.58s |  I mean, maybe do like a 30 second,
3171.58s - 3173.22s |  like for each wrap up or something.
3173.22s - 3174.06s |  Yeah, yeah.
3174.06s - 3174.90s |  Hey, go for it.
3174.90s - 3175.74s |  You want to go first?
3175.74s - 3176.58s |  For what?
3176.58s - 3177.42s |  30 second wrap up.
3177.42s - 3179.26s |  Oh, come down to Isis Village.
3179.26s - 3180.86s |  You'll see everything we have,
3180.90s - 3182.82s |  like escape rooms and sponsors, volunteers,
3182.82s - 3183.70s |  all that other stuff.
3183.70s - 3185.14s |  They're really cool hands-on things.
3185.14s - 3189.14s |  Remember, ICS is in manufacturing cars in the hospitals.
3189.14s - 3191.86s |  We do have jobs also.
3191.86s - 3195.18s |  Airports, without ICS, airports don't work.
3195.18s - 3196.86s |  So we're everywhere.
3196.86s - 3198.10s |  Come down and talk to us.
3199.62s - 3200.74s |  Yes, here.
3200.74s - 3201.58s |  Sweet, Tom.
3201.58s - 3202.82s |  So you're going to take my job, right?
3202.82s - 3203.66s |  Yes.
3203.66s - 3205.10s |  You own all of us, so it sounds like Tom's next.
3205.10s - 3205.94s |  Sweet.
3205.94s - 3206.78s |  Cool, thanks.
3206.78s - 3208.42s |  Yeah, so Justin Carrick Village.
3208.42s - 3209.38s |  Definitely come check us out.
3209.38s - 3211.50s |  We got a tractor here, semi-truck.
3211.50s - 3214.58s |  We have Rivian who actually put a CTF in their vehicle,
3214.58s - 3216.54s |  so you can actually hack their vehicle.
3216.54s - 3219.02s |  Obviously, it's not a vulnerability in the car.
3219.02s - 3221.50s |  They made it vulnerable theirself and put flags in it.
3221.50s - 3222.34s |  So it's really cool.
3222.34s - 3224.54s |  And we're also giving away a Tesla
3224.54s - 3225.98s |  for our first place prize.
3225.98s - 3226.82s |  And outside of that,
3226.82s - 3228.38s |  we've also done stuff for kids this year.
3228.38s - 3229.22s |  We have a kid's badge
3229.22s - 3231.78s |  that we've been giving away to the kids.
3231.78s - 3233.42s |  And yeah, we're just trying to do as much as we can
3233.42s - 3234.50s |  to give back to the community
3234.50s - 3236.02s |  and making sure that all the money
3236.02s - 3236.90s |  that you guys might give us,
3236.90s - 3238.82s |  either through donations or through badges,
3238.86s - 3240.10s |  we pour back into this event
3240.10s - 3241.86s |  so that way we can keep running it every year
3241.86s - 3244.30s |  and go bigger and bigger if we can.
3244.30s - 3245.22s |  Everything they said.
3245.22s - 3246.54s |  And come to the Biohacking Village.
3246.54s - 3247.38s |  You are all patients.
3247.38s - 3248.54s |  You should all be very concerned
3248.54s - 3251.50s |  about the vulnerabilities in these medical devices
3251.50s - 3252.70s |  because they will affect your life.
3252.70s - 3254.74s |  And every single one of these villages
3254.74s - 3258.22s |  impacts Biohacking Village and the medical care you do get.
3258.22s - 3259.18s |  I'll keep it brief.
3259.18s - 3260.14s |  And just to say,
3260.14s - 3261.62s |  if you're thinking about getting involved with the village,
3261.62s - 3262.46s |  go volunteer.
3262.46s - 3263.58s |  It'll change your life.
3263.58s - 3264.58s |  Come see the Red Team Village.
3264.58s - 3266.70s |  We have lots of workshops and talks still today.
3266.70s - 3267.54s |  Most of us are, I think,
3267.54s - 3269.22s |  closing probably like around like 12-ish today,
3269.22s - 3270.14s |  but still come see us.
3270.14s - 3270.98s |  We'd love to have you guys.
3270.98s - 3272.38s |  Lots of swag at Red Team Village still.
3272.38s - 3273.78s |  Please come and take it all.
3274.74s - 3275.58s |  Okay.
3275.58s - 3276.42s |  Airplanes are cool.
3276.42s - 3277.54s |  Space is cool.
3278.54s - 3279.42s |  Drones are cool.
3279.42s - 3281.02s |  Come see us in Aerospace Village.
3281.02s - 3288.56s |  Pilots are cool.
3288.56s - 3290.48s |  My 10 second spiel is,
3290.48s - 3294.00s |  Pedro and I have quit at least four times each this year.
3294.00s - 3295.48s |  The only reason that we're still around
3295.48s - 3298.56s |  is because we've done it on alternating points,
3298.56s - 3300.68s |  but also because of these amazing people,
3300.68s - 3301.64s |  all the village leaders,
3301.64s - 3304.76s |  they do an amazing job bringing content to DEF CON.
3305.64s - 3306.48s |  Thank you.
3306.48s - 3307.32s |  I'm just here for the swag.
3308.44s - 3309.44s |  And to hack cars.


url: https://www.youtube.com/watch?v=mrb_3z5OP2M
title: DEF CON 32 - Bluetooth Blues: Unmasking CVE 2023-52709-The TI BLE5-Stack Attack - Kevin Mitchell
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=mrb_3z5OP2M",
  "title": "DEF CON 32 - Bluetooth Blues: Unmasking CVE 2023-52709-The TI BLE5-Stack Attack - Kevin Mitchell",
  "description": "In this talk, I will detail my discovery and analysis of CVE 2023-52709, a vulnerability in the TI Bluetooth stack. This flaw allows the stack to fail in generating a resolvable Random Private Address (RPA), which can lead to a Denial of Service (DoS) for already bonded peer devices. The discussion will cover the technical aspects of the vulnerability, the implications for automotive security, and potential mitigation strategies.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1590,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 6.96s | This text was transcribed using whisper model: large-v2

 Okay. Thank you all for joining. My name is Kevin Mitchell. Today I want to talk to you
6.96s - 14.20s |  all about a vulnerability that I discovered while testing a phone as key system. The official
14.20s - 22.80s |  vulnerability title is CVE-2023-52709. The name of this talk is Bluetooth Blues Unmasking
22.80s - 38.43s |  CVE-2023-52709, the TI-BLE5 stack attack. Okay. So here's the agenda. First I'm going
38.43s - 44.87s |  to do a brief introduction, go into a little bit of a speaker bio, look at the impact of
44.87s - 49.27s |  denial of service attacks on keyless entry systems, and then we're going to jump into
49.27s - 55.43s |  the origin of the vulnerability itself, the timeline, the testing setup, the testing results,
55.43s - 59.59s |  the outcome, the consequences, and then I want to talk to you about the vulnerability
59.59s - 65.59s |  disclosure process with Texas Instruments and Bosch, and then we're going to jump into
65.59s - 71.23s |  the denial of service attack details, looking at the attack mechanisms, also looking at
71.23s - 76.25s |  some Wireshark analysis, and then I'm going to jump into the root cause analysis, give
76.25s - 82.95s |  you some context behind the root cause analysis, some background, and then a detailed explanation.
82.95s - 88.15s |  Then we're going to jump into the affected devices, the initial assessment of the affected
88.15s - 96.95s |  devices, the updated list. After a couple of months of looking at this vulnerability,
96.95s - 101.31s |  we found that it was more and more devices that were impacted by it. Then we're going
101.31s - 107.19s |  to look at some of the real world impacts, potentially the supplier pre-production cost
107.19s - 111.79s |  of the vulnerability, just looking at it from how much it would cost like Texas Instruments
111.79s - 117.95s |  before these devices actually go into vehicles, and then just to give you some context, look
117.95s - 123.23s |  at like some NISTA recall numbers as far as like how many recalls are typically done by
123.23s - 130.45s |  NISTA on a year-to-year basis, and then going to the mitigation strategy, how Texas Instruments
130.45s - 137.03s |  put out like an SDK to mitigate this issue, and then the conclusion, outcome, consequences,
137.03s - 140.59s |  and then we're going to do a question and answers, and then you all can connect with
140.59s - 147.19s |  me if you like. So a little bit about myself. My name is Kevin Mitchell. I've been doing
147.19s - 152.07s |  IT since about 2008 once I joined the Army as a human resources information management
152.07s - 160.23s |  system specialist. Then I worked for Hewlett-Packard for a little bit. Then I went to FCA where
160.23s - 166.67s |  I was hired as a certified ethical hacker on the Uconnect team after the infamous Jeep
166.67s - 171.15s |  attack. I was like the only cybersecurity professional on the Uconnect team out of like
171.15s - 178.71s |  a team of 30 QREs. I was like the only one specializing in automotive cybersecurity then,
178.71s - 182.95s |  and then I went on to work for Mercedes-Benz Financial Services where I was doing some
182.95s - 188.97s |  penetration testing, vulnerability management, as well as penetration testing management.
188.97s - 193.47s |  Then I got into like some web application penetration testing, and then now to my current
193.47s - 197.91s |  job right now where I am a senior automotive security tester where I work for a company
197.91s - 205.51s |  called ETAS, and ETAS's primary goal is to enhance tomorrow's automotive software, and
205.51s - 209.05s |  so like the way that I contribute to that goal is just by being an automotive security
209.05s - 217.55s |  tester. I hack cars. And so I want to give you a quote by a famous hacker. The advance
217.55s - 221.35s |  of technology is based on making it fit in so that you really don't even notice it, so
221.35s - 229.11s |  it's a part of everyday life by Bill Gates. And so if you look at technology, it's really
229.11s - 233.11s |  baked into every aspect of our life. Like from the time that you wake up, you're probably
233.11s - 238.71s |  using technology to make coffee to your daily commutes, and that's really where I want to
238.71s - 243.43s |  focus on because I'm an automotive security tester, so I'm looking at technology when
243.43s - 251.35s |  it comes to the automotive industry. And so I'm not here to pick on any one OEM, but
251.35s - 256.23s |  I just did a random Google search, like how many vehicles does GM produce in a year? And
256.23s - 264.75s |  so it says in the year 2023, GM sold about 6.2 million vehicles, right? So my next point
264.75s - 270.07s |  is what is the average cost of an automotive recall? And so that average cost of an automotive
270.07s - 278.15s |  recall is about $500. And so if you're looking at 6.2 million vehicles times 500, you really
278.15s - 282.39s |  get to see, like, the impact. And that might not be an accurate number, but we're just,
282.39s - 287.63s |  you know, providing these numbers for context and seeing, like, how much, you know, a recall
287.63s - 294.63s |  could actually affect your everyday life. And so it leads me to my next quote. The problem
294.63s - 300.39s |  with technology is when it doesn't work, you're SOL. That's from a clerk at a corner
300.39s - 308.87s |  store after a failed tap to pay. So now I'm going to jump into the origin of the CVE itself.
308.87s - 314.39s |  Okay, so if you look at these updates, I didn't provide exact dates for them. I just kind
314.39s - 319.59s |  of provided the months. But if you're tracking, we'll just say each update was a different
319.59s - 325.55s |  day. So the first update, Texas Instruments acknowledges the vulnerability disclosure
325.55s - 332.39s |  that we provided them on the phone as key systems in the BLE-5 stack. The next update
332.39s - 340.03s |  the next day, the Texas Instruments engineers were unable to reproduce the issue based on
340.03s - 347.77s |  the report that we sent them. Then I replied with instructions on how to actually reproduce
347.81s - 353.45s |  the issue. The next day, they came back and said, we cannot reproduce this issue. And
353.45s - 358.85s |  so after that, I doubled down and just reworded my previous email in telling them how to reproduce
358.85s - 363.53s |  the issue. And then, you know, I was working with Bosch. So a couple of Bosch engineers
363.53s - 371.81s |  suggested that I test the TI launch pad, which is just like, yeah, it's essentially just
371.81s - 377.59s |  like a microcontroller that's used for development. And they were like, you should pretty much
377.59s - 381.91s |  test the launch pad to see if you can get the launch pad to fail in the same way that
381.91s - 387.45s |  you got the phone as key systems to fail. And so the next update, TI engineers were
387.45s - 391.81s |  asking me clarifying questions and tripling down based on the previous communications
391.81s - 395.19s |  that they actually couldn't just reproduce the issue. So then I decided to schedule a
395.19s - 401.15s |  meeting with the stakeholders. I demoed the issue, and I was able to reproduce the issue
401.15s - 407.71s |  and show them the actual testing method on how I was actually able to do that. And this
407.71s - 411.23s |  is happening. You know, this is going on the entire month of August and then the entire
411.23s - 417.83s |  month of September. And so the Bosch engineers that I actually worked with, they were able
417.83s - 422.87s |  to reproduce the same issue that we had initially sent them, that we had initially sent Texas
422.87s - 427.51s |  Instruments. And so the reason why it was important that Bosch engineers actually, you
427.51s - 432.75s |  know, helped me verify that this was actually an issue, because if I'm telling them they
432.75s - 437.11s |  have a vulnerability and I'm the only one who can demo the vulnerability, is it really
437.11s - 442.51s |  a vulnerability? Or if it's not really reproducible by anybody besides me, is it even something
442.51s - 448.43s |  that can be verified? Where's the veracity in that? So then we actually had the Bosch
448.43s - 453.79s |  engineers come into the ETAS office, and the Bosch engineers were also able to reproduce
453.79s - 458.31s |  the issue on the Phonus key systems. And before then, I was able to reproduce the issue
458.31s - 463.59s |  on the launch pad, like they suggested. And so we now have, I was able to reproduce the
463.59s - 468.35s |  issue on the Phonus key systems and the launch pad, and Bosch engineers were able to do the
468.35s - 472.59s |  exact same thing. And so at this point, I think it's a pretty good time to report it
472.59s - 478.07s |  to Bosch PSIRT. And the reason why I reported it to Bosch PSIRT is because they're a CNA.
478.07s - 485.23s |  They have the ability to, they have the ability to create CVEs. And so, you know, I wanted
485.23s - 490.87s |  to get this out there as soon as possible. So then Texas Instruments stakeholders respond
490.87s - 497.39s |  to Bosch really, you know, putting forth that CVE and contacting them. And they said that
497.39s - 504.03s |  they needed, you know, time to review the issue and try to reproduce again. So the next
504.03s - 511.39s |  update, you know, this happened, like I said, August, September, November. Yeah. August,
511.39s - 517.91s |  September, October, November. And by the time we get to November, the TI engineers are like
517.91s - 524.11s |  quadrupling down and they're pretty much saying, we're going to stop testing this issue until
524.11s - 527.75s |  you can show us exactly how to do this. But at this time, I had already shown them how
527.75s - 535.15s |  to do this like three or four times. So internally, TI is actually escalating this issue. And
535.15s - 541.55s |  then Bosch, some Bosch engineers pretty much detail the differences in Texas Instruments
541.55s - 549.21s |  testing setup and my testing setup. A few moments later, Texas Instruments engineers
549.21s - 558.09s |  are finally able to reproduce the vulnerability on the launch pad or aka the CC26X2R1. And
558.09s - 564.77s |  the reason why this is important, this is important is because the vulnerability or
564.77s - 572.25s |  I'm sorry, the responsible disclosure period does not start until after the engineers of
572.25s - 579.69s |  the responsible company are able to reproduce the issue. And so that responsible disclosure
579.69s - 584.85s |  period was about like six months. And so that mean, that meant that I actually couldn't
584.85s - 589.57s |  talk about this vulnerability until six months till after they were able to reproduce the
589.57s - 595.77s |  issue. Coincidentally enough, two weeks after they were able to reproduce the issue, they
595.77s - 604.49s |  had a mitigating SDK, and they were ready to push out that the mitigations. Okay, so
604.49s - 609.13s |  now I'm going to go into like the testing setup. And I forgot to give my disclaimer
609.13s - 614.85s |  that all the images were created by chat GPT. But we have like an Alice in Wonderland theme
614.85s - 619.81s |  here. So you'll keep seeing like Alice in Wonderland kind of theme here. And what I'm
619.81s - 625.45s |  trying to show with this image is like you're using legacy systems on new vehicles, you're
625.45s - 629.65s |  using the legacy technology on new vehicles, and there's pretty much making them vulnerable.
629.65s - 637.77s |  So the hardware setup that you know, we use was going to be the CCX2, the CC26X2R1 as
637.77s - 645.37s |  the device under test. And then we also had a BLE654 dongle as the central device that's
645.37s - 650.45s |  actually connecting to the device under test and testing it. And then we're also using
651.45s - 657.13s |  Defensics test case. The specific test case for this vulnerability was test case 1001.
657.13s - 662.53s |  And it's a security manager protocol test case. And I'll jump into that in detail. Shout
662.53s - 668.33s |  out to Synopsys for in Defensics for, you know, helping me discover this vulnerability
668.33s - 673.93s |  and you know, having the tools that allow me to do my job. So it's my quick shout out.
673.93s - 679.89s |  So the testing results. So the outcome of the test when running Defensics fuzzing test
679.89s - 688.13s |  case 1001 on loop mode, the device under test using a resolvable private address for
688.13s - 697.57s |  connecting or connectable advertising, the device ends up generating unresolvable RPAs
697.57s - 702.09s |  after a while, which causes a denial of service. And I'll really jump into this. So I went
702.09s - 710.05s |  back and forth with Texas Instruments on the CVE base score because in the phone as
710.05s - 715.85s |  a key system, it failed every time. And once it failed, if you are using your phone as
715.85s - 723.77s |  a key and you lock your door and I come behind you and run this exploit, you actually can't
723.77s - 729.13s |  get back into your vehicle until you hard reset the vehicle. So if we're looking at
729.13s - 735.05s |  the CIA or, you know, triad, we're looking at confidentiality, integrity and availability.
735.05s - 739.77s |  In my mind, if I knocked off one of those, you know, triads, if I knocked off availability,
739.77s - 743.93s |  I would think it's a high severity vulnerability at the very least. But they, you know, came
743.93s - 747.25s |  back and said, you know, this is the case when it comes to phone as key systems, but
747.25s - 754.85s |  it might not be the case in every other application that uses the TI BLE5 stack. And so that made
754.85s - 761.73s |  me think that, oh, this might be a little bit bigger, you know, issue than just automotive.
761.73s - 768.01s |  So the consequence of this is the vulnerability can impact BLE devices running the affected
768.01s - 775.29s |  SDK versions and the devices that are enabled with Bluetooth privacy with resolvable private
775.29s - 779.29s |  address feature. And I'm going to jump into this a little bit later about the context
779.29s - 785.73s |  about the RPAs. And so the vulnerability disclosure, the, you know, the vulnerability
785.73s - 793.03s |  disclosure that the Texas Instruments PSIRT team came back and pretty much they created
793.03s - 800.33s |  an internal PSIRT ID. And this is the PSIRT ID. And this was the initial advisory, the
800.33s - 805.13s |  very, very initial advisory before we started to discover how many different devices that
805.13s - 812.65s |  this actually affected. So they just labeled this as the CCX or CC26X2R1 BLE denial of
812.65s - 817.85s |  service through unexpected RPAs. And like I said, this is just the first response that
817.85s - 825.09s |  they gave us. When Bosch PSIRT actually published their security advisory based on what Texas
825.09s - 831.81s |  Instruments sent us, they created the CVE with the same base score, and they updated
831.81s - 837.97s |  the title of that CVE to TI Bluetooth stack can fail to generate resolvable random private
837.97s - 842.49s |  addresses leading to a denial of service for already peer-bonded devices. And I'm going
842.49s - 847.85s |  to jump into that because it's, you know, it's kind of deep because if a device is already
847.85s - 854.17s |  peer-bonded to it and I'm running this attack on it, then every device that was previously
854.17s - 858.61s |  connected to it will not be able to actually connect to it again until there is a hard
858.61s - 862.13s |  reset. Now, if we're talking about a vehicle, then you actually have to get into the vehicle
862.13s - 866.69s |  and hard reset the vehicle or restart it. But if you're only like using your phone as
866.69s - 871.53s |  a key, then how are you going to do that? So looking at the details itself, we're looking
871.53s - 879.01s |  at Defensics Test Case 1001, and this is specifically on the CC26X2R1. And the reason why I'm showing
879.01s - 888.53s |  this is because Defensics Test Case 1001 does not always work on the development chip
888.53s - 894.41s |  or the development board, but the test case works 100% of the time on the phone as key
894.41s - 901.37s |  systems. And the reason why I decided to escalate this to Bosch PSIRT is because there was another
901.37s - 910.81s |  test case that worked specifically on the phone as key systems and on the CC26X2R1.
910.81s - 914.85s |  And this is Test Case 3. And I'm not sure how small that font is, but I can kind of
914.85s - 920.69s |  go over it with you all. So you get a pairing request, and then you get a pairing confirm
920.69s - 926.01s |  that the testing device or the central is sending the device under test. So it sends
926.01s - 931.05s |  it a pairing request, and then it also sends it a pairing confirmation, and then it sends
931.05s - 936.89s |  it a pairing random. And when it sends it that pairing random, essentially, encryption
936.89s - 942.01s |  fails and the device no longer is responding to previously peer-bonded devices. And this
942.01s - 946.97s |  is a little bit of context to showing you exactly, like, the structure of the packets
946.97s - 954.78s |  that were being sent to the device under test. Okay. And so we're looking at a Wireshark
954.78s - 960.98s |  analysis of Test Case 3 because Test Case 3 is, you know, something that we're building
960.98s - 967.02s |  our proof of concept off of. So like I said, you send it the 128 bytes plus the 8-byte
967.02s - 974.66s |  header, and it receives that pairing request. And then it – then you also send it a pairing
974.66s - 980.46s |  confirmation, and then you send it a pairing random. And so we developed a POC that pretty
980.46s - 985.78s |  much automates the connection of the pairing process with the Bluetooth device, sending
985.78s - 990.62s |  a specific sequence of pairing messages that, you know, like I said, the pairing request,
990.62s - 994.38s |  encryption confirmation, pairing random. And like I said, this will pretty much get
994.38s - 1000.82s |  the device to fail 100 percent of the time. So we'll have a GitHub, and the POC isn't
1000.82s - 1004.62s |  published as of yet, but as soon as I get done with this talk, I'll make sure that I
1004.62s - 1010.30s |  make this, like, available to everybody. And so if we're looking at the root cause analysis,
1010.30s - 1014.66s |  this is where it's going to get maybe a little technical, maybe a little bit boring. Every
1014.66s - 1020.80s |  Bluetooth low-energy device has a unique 48-bit address, and these addresses are pretty
1020.80s - 1025.94s |  much characterized into public addresses and then random addresses. And the random addresses
1025.94s - 1032.02s |  can be further classified into static addresses or private addresses, and depending on whether
1032.02s - 1038.16s |  or not they change. And furthermore, private addresses can either be resolvable or non-resolvable.
1038.16s - 1044.18s |  So all BLE devices must either have a public address or a random static address, and they
1044.18s - 1050.30s |  also can have a resolvable or non-resolvable private address, which is pretty much just
1050.30s - 1055.66s |  typically used for, like, security reasons. And so this is the boring but exciting part
1055.66s - 1061.14s |  for me. Okay, so you have random addresses, random private addresses, which are pretty
1061.14s - 1066.06s |  much used in addition to public or random static addresses when a device wishes to protect
1066.06s - 1073.14s |  its privacy. And then moving on to the resolvable random private addresses, a resolvable private
1073.14s - 1078.14s |  address is true to its name. It's intended to have users, like, have this pre-shared
1078.14s - 1083.70s |  key that the device can pretty much figure out the address every time it changes. And
1083.70s - 1088.98s |  so the pre-shared key is the identity-resolving key, which is used to generate and resolve
1088.98s - 1095.38s |  random addresses. Kind of boring stuff, right? And then we have non-resolvable random private
1095.38s - 1102.70s |  addresses. And non-resolvable random private addresses is pretty much used by devices when
1102.70s - 1110.34s |  they want to prevent tracking. And this is not commonly used, but it's relevant for this,
1110.34s - 1119.30s |  you know, hack. And so providing a little bit of context, the BLE core specification
1119.30s - 1125.90s |  of the Bluetooth 5.3 core specification of Volume 6, Part B, 4.7, the resolving list,
1125.90s - 1130.94s |  if the link layer using the resolving list and the peer device has been resolved but
1130.94s - 1136.38s |  encryption fails, the resolvable private address shall be immediately discarded and
1136.38s - 1140.74s |  a new private address will be generated. So this is kind of like, you know, where we're
1140.74s - 1144.86s |  looking at. I'm providing you all a little bit of context as well as, like, this root
1144.86s - 1152.10s |  cause analysis. So this is what we received back from Texas Instruments verbatim for,
1152.10s - 1157.90s |  like the reason for the failure. So the malformed packet in our stack map link layer encrypt
1158.06s - 1163.50s |  decrypt will return false and then trigger RPA update. But however, at this point, the stack
1163.50s - 1168.94s |  has not terminated the link. So for the next ACL packet within the same connection, that function
1168.94s - 1173.42s |  will still get called. And when that function gets called right before the RPA update is
1173.42s - 1179.46s |  happening, then the RPA update using encryption will fail, which leads to non-resolvable private
1179.46s - 1184.42s |  addresses. And so the reason why I gave you this context before is because it's like the
1184.42s - 1188.62s |  device is actually operating according to the Bluetooth stack itself or according to the
1188.62s - 1194.82s |  Bluetooth specification itself, right? It receives a pairing request, it receives a
1194.82s - 1199.22s |  pairing confirmation, and then it receives a pairing random and that pairing random
1199.26s - 1204.42s |  actually makes the encryption fail. And once the encryption fails, then the MAC address is
1204.46s - 1209.38s |  automatically discarded. The MAC address is automatically discarded. And when the MAC
1209.38s - 1214.46s |  address is automatically discarded, every previously peer bonded device can no longer can
1214.46s - 1220.26s |  connect to the device. So that's what we're seeing. And that's kind of like, you know, the
1220.26s - 1227.50s |  root cause analysis of of the vulnerability itself. I found it exciting, you know, to really
1227.50s - 1231.50s |  do like a deep dive and understand exactly what's happening, because it's not like Texas
1231.50s - 1238.34s |  Instruments, like, did a bad job at actually, like, you know, developing this system. Things
1238.38s - 1243.46s |  just happened too fast. And like I said, the link wasn't actually terminating. So it just
1243.46s - 1249.90s |  caused a denial of service. So now we want to look at the affected devices. So initially, we
1249.90s - 1257.18s |  had 19 different affected parts and two different software development kits. And so these
1257.18s - 1261.86s |  are all the kits and the software versions that were affected by it in the software stack. I
1261.86s - 1267.02s |  was pretty proud of myself, like the BLE-5 stack, you know, vulnerability on that. It seemed,
1267.06s - 1272.98s |  you know, rewarding, especially being a penetration tester on automotive, you know, on
1272.98s - 1277.42s |  vehicles. And sometimes if you don't go about it the right way, you really can't talk about some
1277.42s - 1281.62s |  of your research. And so this was just a confirmation that we went about it the right way,
1281.62s - 1286.38s |  we handled the responsible disclosure period the right way. And now, you know, we're, you
1286.38s - 1293.98s |  know, enjoying the fruits of my labor. So Texas Instruments, after a couple of months, you
1293.98s - 1297.06s |  know, I was asking them, hey, when are you guys going to publish? When are you guys going to
1297.06s - 1301.54s |  publish? And I realized that they weren't publishing because they were still discovering
1301.98s - 1307.70s |  devices within their inventory that were still vulnerable. And so they updated it from 19
1307.70s - 1314.30s |  parts to 28 parts in six different software versions. And I found this pretty interesting,
1314.30s - 1323.42s |  right? There's a BLE-5 stack, BLE-5 stack, BLE stack 2.X, I don't know what that is. But at
1323.42s - 1330.54s |  any rate, we have, you know, an updated parts list, and it included 28 parts. And I did a, you
1330.54s - 1336.66s |  know, a little bit of a research on the, on all of these parts that are listed here. And I was
1336.66s - 1340.58s |  looking at the real world impact. And so if you go on texasinstruments.com, you can actually
1340.58s - 1344.86s |  search their inventory by parts. And so I was able to see all of these vulnerable parts that
1344.86s - 1349.78s |  were listed here. And what I have in bold are just the automotive parts. And so, you know, I'm
1349.78s - 1354.42s |  suspecting in Texas Instruments, the reason why they said that this is not a high severity
1354.42s - 1358.10s |  vulnerability is because they have other devices such as like medical devices that this
1358.10s - 1363.18s |  vulnerable, that this vulnerability is, is, is present on. I haven't done the research to see,
1363.18s - 1368.94s |  you know, what devices are actually affected. But you know, I was just more so concerned about
1368.94s - 1374.06s |  like the automotive part of it. So there's like, 2.6 million devices that they have in their
1374.06s - 1380.54s |  inventory. And that's about $2.6 million in inventory that they have. But that is before
1380.54s - 1387.38s |  these devices actually get sold to any OEM and OEM puts their software on top of that. So that's
1387.38s - 1391.42s |  why I call it a supplier pre production costs of the vulnerability because we're just looking at
1391.42s - 1397.34s |  it from Texas Instruments. We're not looking at it if like GM or Ford purchased one of these and
1397.34s - 1403.34s |  then they developed, you know, vulnerable software on top of that. And so I think I'm
1404.42s - 1412.06s |  think I'm good on time. I got like two minutes left. Okay, so Mr. recall. So, you know, I
1412.06s - 1417.54s |  believe this is for the year 2022. And we're just looking at electrical systems. And so if we
1417.54s - 1424.98s |  have, you know, 3.4 million, you know, electrical system recalls averaging at around like
1424.98s - 1433.30s |  $500, then that's like $1.7 billion. Right. And the reason why I put this here is because like,
1433.66s - 1441.54s |  as as a security engineer, or as a penetration tester, it's kind of hard to quantify your impact
1441.62s - 1447.82s |  on the world. It's kind of hard to quantify exactly, you know, the impact that you're having
1447.98s - 1453.02s |  on figuring out some of these things. And so my thing is like, say, for instance, each one of
1453.02s - 1458.82s |  these recalls doesn't cost $500. Maybe if it only costs 1% of that, we're still looking at $17
1458.82s - 1464.06s |  million. So you should really just do a penetration test on your system before you're stuck
1464.06s - 1468.38s |  paying, you know, for recalls that that might cost you, you know, billions or millions of
1468.38s - 1475.14s |  dollars. And so like I said before, it was pretty interesting that Texas Instruments was able to
1475.14s - 1481.74s |  come up with a fix and publish that fix two weeks after they were able to reproduce it but
1481.74s - 1488.86s |  couldn't reproduce the issue for like six months. I thought that was, you know, genius of them. And
1488.86s - 1494.62s |  this is the mitigating strategies that they put out. I know that they still have a lot of SDKs
1494.62s - 1501.54s |  that they have to publish in order to make sure that all of the systems are mitigated or
1501.54s - 1508.74s |  remediated in the right way. But they're still working on that right now. And right on time.
1509.18s - 1526.28s |  Questions? Any questions? Right there. So for scanning and talking to the launchpad, we use
1526.32s - 1542.38s |  Defensics as well. We also use Bluetooth CTL. And we also use the TI launchpad with a software
1542.38s - 1549.82s |  called Sniffle that was developed by NCC group. And it specifically scans for long range
1549.82s - 1556.10s |  advertisements or extended advertisements that are specific to BLE 5. That answers your
1556.10s - 1571.37s |  question. Mr. McKee. Oh, can I get this last question right here? All of the devices, the 19
1571.37s - 1577.49s |  devices are in the CVE. The extended list has not been updated or published yet. We're still
1577.49s - 1583.09s |  waiting. You can get it. Yes, yes. And I believe that this is publicly available. There's a QR
1583.09s - 1586.21s |  code. You guys can connect with me on LinkedIn. Thank you for your time.


url: https://www.youtube.com/watch?v=ldsK81hGs_Q
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
title:
DEF CON 32 - The wild and wonderful world of early Microprocessors w/a focus on 6502 - Michael Brown

content:
{
  "webpage_url": "https://www.youtube.com/watch?v=ldsK81hGs_Q",
  "title": "DEF CON 32 - The wild and wonderful world of early Microprocessors w/a focus on 6502 - Michael Brown",
  "description": "This presentation will be a combination of history lesson, technical introduction, and some demonstration. The target audience are those who may never had a chance to experience early microcomputers but want to get an introduction to the world of \u201cretro computing.\n\nToday everyone's laptop or smartphone either run an Intel, AMD, or ARM processor. And most probably can't tell you exactly what they have or know any details of them. It\u2019s all a black box to most. But back in the 70s and 80s, computer hobbyists & hackers knew they had a Z80, 6502, 6809, 68000 or other processor, and often knew the details and could and did program them in assembly. But while the industry has moved past the Apple II, Atari 400/800/XL/XE, Commodore 64 et al, there are still many who continue to use and enjoy these computers. Even to build and create new and exciting items for them as well as brand new systems using this old tech.\n\nIn this presentation, we will delve into microprocessor history of the 8-bit and early 16-bit systems, with a particular focus on the MOS 6502, one of the most popular microprocessors. We will touch a little on the systems that used the 6502, and take a quick look into how to program the 6502, even showing a couple of 6502-based systems. Importantly for many, we will delve into some of the resources available for those wishing to enter this world also.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 3209,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 1.60s | This text was transcribed using whisper model: large-v2

 Thank you all for coming.
1.60s - 7.70s |  This is the 12 o'clock talk on the wild and wonderful world of 8-bit microprocessors.
8.08s - 11.94s |  And I'll be doing a focus on the MOS6502.
12.24s - 13.54s |  I do apologize.
13.54s - 17.16s |  There is not much of a demo in this talk.
17.16s - 20.26s |  I was hoping to have more of a demo, but I've had some technical problems.
20.26s - 23.74s |  So, this, we're going to go more into more of history and technology.
24.08s - 27.54s |  For some of you, this might be stuff you've never heard of before.
27.98s - 29.32s |  That's what it's all about.
29.32s - 33.58s |  And I have quite a few slides with a lot of resources and information.
33.94s - 37.64s |  So, you're certainly welcome, and I encourage you guys to take pictures of them.
38.04s - 41.62s |  I've been actually adding to these slides.
41.90s - 44.34s |  So, they might not have, they're not going to have the latest version.
45.00s - 46.50s |  So, let me start.
46.50s - 47.52s |  My name is Michael Brown.
47.84s - 51.86s |  This is my normal bio I do with these talks, which I typically talk about InfoSec stuff.
52.26s - 54.20s |  This isn't an InfoSec talk.
54.20s - 56.80s |  So, I'm not going to really go over this.
57.32s - 58.66s |  But why am I here?
58.90s - 62.38s |  I actually grew up in the era of 8-bit computers.
62.38s - 67.40s |  You know, when I was a kid, it was the Apple II and the Atari 8-bit, Commodore 8-bit.
67.80s - 71.02s |  My first game console was an Atari 2600.
71.70s - 75.36s |  My first computer was actually an Atari 800XL,
75.82s - 78.46s |  which I got around in 84 when I was going to college.
78.98s - 86.22s |  And I can tell you that it was a big change going from writing papers on a typewriter
86.80s - 91.28s |  to using a word processor to write up my papers.
91.76s - 97.08s |  And I actually remember an incident when I turned in one of my first papers
97.08s - 101.28s |  to my English teacher that I use on the word processor.
101.66s - 109.12s |  And she marked off the fact that I didn't put quotes around the book, all the titles.
109.68s - 112.36s |  And I had to go and take it back to her and tell her, like, no, no, no, no, no.
113.00s - 115.58s |  I italicized the titles.
115.96s - 117.52s |  They don't need to be quoted.
118.56s - 119.84s |  And she didn't realize that.
119.84s - 121.74s |  And then, of course, gave me back the points.
122.28s - 124.76s |  Because that was just too new at that time.
126.00s - 129.34s |  My second computer was an Atari 1040ST-FM.
129.84s - 133.96s |  You will impress me if you come up afterwards and tell me what
133.96s - 136.70s |  that means without looking it up.
137.80s - 143.36s |  When I was in college, among other things, I actually did programming in the 6502 and the 68000.
144.02s - 146.60s |  You know, these are some of the computers I used.
146.60s - 150.16s |  And I used these wonderful programming languages that maybe some of you know of,
150.16s - 152.34s |  maybe you don't, later on I do see.
152.84s - 154.50s |  I still got my computers.
154.74s - 156.42s |  I've added to my collection.
156.42s - 157.78s |  I don't have a huge collection.
158.18s - 161.20s |  But I, you know, I enjoyed using these computers at the time.
161.54s - 164.00s |  I enjoy using modern computers.
164.54s - 170.98s |  What I find kind of disappointing with a lot of people who get into computer science is they,
171.36s - 173.12s |  because I'm a computer science major.
173.12s - 174.96s |  I was never a computer engineer.
175.24s - 177.94s |  I wasn't, you know, hardware wasn't what I was about.
177.94s - 179.28s |  I was about writing software.
179.58s - 184.68s |  But my view is always, from the beginning, was I'm writing software.
184.96s - 186.06s |  It runs on a computer.
186.06s - 187.56s |  I should know about the hardware.
188.14s - 191.60s |  And unfortunately, what I saw was a lot of computer science majors,
192.24s - 194.24s |  the computer was just a black box.
194.74s - 198.14s |  I remember talking to them and asking them, hey, what processor is in that computer?
198.14s - 200.68s |  And they're like, I don't know.
201.08s - 203.38s |  And of course, today it's even worse.
203.68s - 208.58s |  I know that my computer here, my laptop, is a Core i7.
208.58s - 216.42s |  But I'd have to look it up to find out which of the 20-some generations of the i7 it is
216.42s - 220.42s |  or what capabilities, because, you know, nowadays we're just pretty much oblivious.
220.90s - 226.00s |  So kind of the outline, we'll talk about some of the timeline, computer types.
226.44s - 229.64s |  We'll get into like some of the semiconductor companies,
229.64s - 231.08s |  which I find kind of interesting.
231.46s - 234.10s |  We'll look at, you know, more about the microprocessor units.
234.10s - 235.80s |  We'll look more at the 6502.
235.80s - 239.76s |  We'll talk a little bit about assembly language, which it's either something
239.76s - 243.30s |  that is really interesting to you or freaking boring.
243.76s - 247.16s |  You know, it's, or, you know, the worst thing possible.
247.16s - 249.92s |  And then I want to, I put together a lot of good resources,
249.92s - 252.16s |  at least a lot of things that I think are good resources.
252.52s - 255.56s |  So I encourage you guys to take pictures of that.
256.28s - 261.92s |  So the timeline, the 70s, which is what, as I said, this is when I was in high school, you know,
261.92s - 267.86s |  we had Intel came out with the 8080, which kicked off the microcomputer era.
267.86s - 272.94s |  We have the Altair, you know, followed up by other processors.
273.20s - 279.06s |  You know, you had the Apple II, the Commodore, you know, the TRS-80 Model 1,
279.06s - 285.44s |  the so-called Trash 80, as everyone called it, and so forth into the 70s.
285.44s - 288.38s |  The TI's computer, and the rest.
288.38s - 290.44s |  And then in the 80s, we get more.
290.44s - 298.36s |  We get the VIC-20, the Commodore 64, the IBM PC, the Macintosh, and then, of course,
298.36s - 301.52s |  you know, the Macintosh, the ST, the Amiga.
302.02s - 305.28s |  I didn't want to go further, because now we're getting outside of 8-bit.
305.28s - 310.62s |  When I was doing this, I wondered, should I get into RISC processors?
310.92s - 315.42s |  Because that's another whole, you know, topic, and that's kind of interesting and kind of sad.
315.86s - 318.76s |  So, I didn't want to kind of overwhelm things.
319.26s - 324.16s |  When we talk about computer types, there's a lot of different ways to categorize them.
324.46s - 327.62s |  These are the ones that I understood when I was into computer science.
327.62s - 332.56s |  We talked about the mainframes, you had minicomputers, and you had microcomputers.
333.06s - 339.66s |  And I'll be honest, this is the distinction I've always been told about what,
339.78s - 342.46s |  why is this a mainframe, why is this a minicomputer?
342.82s - 345.34s |  And usually, the way they said it's like, well, it's about size.
345.70s - 350.36s |  Your mainframes were your huge room-based computers, the ones you see in the TVs
350.36s - 353.40s |  and movies with the tape drives going and whatnot.
353.98s - 356.86s |  And the minicomputers were smaller, the size of a refrigerator.
357.52s - 363.16s |  Earlier on, it was, you know, these companies, you know, IBM and these others,
363.16s - 365.12s |  they were called Snow White and the Seven Dwarves.
366.22s - 368.58s |  Through mergers, it became IBM and the Bunch.
369.12s - 375.70s |  And today, yes, mainframe computers are still being made, but now by these companies.
376.38s - 378.52s |  The minicomputers were kind of interesting.
378.52s - 382.40s |  You had, you know, digital and data, data general and all these others.
382.72s - 385.14s |  And they no longer exist.
385.62s - 388.64s |  You know, there are no minicomputers as a market.
389.02s - 393.88s |  And almost all those companies either don't exist or they've moved out.
394.74s - 398.90s |  Microcomputers started, of course, as the small, you know, more of a hobbyist,
399.26s - 402.32s |  getting into the business computers with MIT or the MITS,
402.82s - 406.46s |  MSci, Sol, you know, and the Apple, Atari, Commodore.
407.02s - 409.82s |  But as microprocessors became more and more powerful,
410.10s - 413.34s |  you now had microprocessor-based servers.
413.54s - 416.94s |  And those kind of moved in and wiped out the minicomputers.
417.60s - 421.92s |  And then I debated putting a lower level,
421.92s - 427.22s |  which would have been your microcontrollers, which in many cases are microprocessors being used
427.22s - 433.46s |  to control hardware, you know, disk drives and this sort of stuff.
433.46s - 436.30s |  So let's talk about micro semiconductor manufacturers.
436.30s - 437.24s |  This is kind of interesting.
437.58s - 440.52s |  The first major one is called Shockley Semiconductor.
440.90s - 446.10s |  It was founded by the guy who created transistors, a guy named William Shockley.
446.56s - 451.24s |  Unfortunately, Shockley was one of these people who was like a brilliant,
452.08s - 454.92s |  you know, scientist, a lousy manager.
455.72s - 457.12s |  So he established his company.
457.32s - 459.48s |  He brought all these engineers on board.
459.76s - 460.78s |  He trained them.
461.72s - 463.88s |  They didn't like working for him, and they left.
464.38s - 470.16s |  And these people, there was eight of them, and they are known as, and I'm not making this up,
470.60s - 475.58s |  they are the traitorous eight who left Shockley Semiconductor
475.98s - 479.32s |  to go found a new company called Fairchild Semiconductor.
479.96s - 483.38s |  And Fairchild was a subsidiary of Fairchild Camera.
483.80s - 490.76s |  And we have Fairchild Semiconductor for having Silicon Valley.
491.14s - 493.88s |  They literally created Silicon Valley.
494.30s - 496.38s |  They were established in California.
496.82s - 503.04s |  And then the funny thing was with Fairchild is many of the people that came to Fairchild left
503.72s - 508.00s |  to establish other companies, and sometimes even left those and established other companies.
508.30s - 510.56s |  And these are referred to as the Fairchildren.
511.34s - 514.92s |  And there's even, you can go online and you can see these charts of all these companies
515.20s - 517.82s |  that have been like second generation from Fairchild
517.82s - 521.32s |  that spread this knowledge of the semiconductors.
521.72s - 526.06s |  Fairchild's big claim to fame is that they were one of two companies
526.06s - 530.82s |  that created the integrated circuit that gives us all the computer chips that we use today.
531.54s - 533.96s |  They did create their own microprocessor,
533.96s - 537.72s |  which until recently I didn't even know existed, called the F8.
538.42s - 543.90s |  And they created their own game console called the Channel F, which I again have to admit,
544.70s - 547.94s |  I don't remember that when I was a kid.
548.46s - 552.96s |  But the big thing that made the Channel F important is it was the first one
552.96s - 557.62s |  to use ROM cartridges for the games, which became the standard
557.62s - 559.48s |  of all the game consoles that followed.
559.80s - 565.02s |  You know, all the Atari's used game consoles, the Nintendo and Super Nintendo
565.02s - 568.80s |  and the Sega Genesis and all those, all used ROM cartridges
569.06s - 571.36s |  until they came along sort of using CDs.
573.10s - 576.70s |  One of the big Fairchildren is this little company called Intel,
577.08s - 581.26s |  which was for, it stood for Integrated Electronics, very, very creative name.
581.76s - 586.84s |  And it was actually two of the guys that were the traders that went and founded Intel.
587.56s - 590.98s |  Intel, when they were established, made memory chips.
591.26s - 592.40s |  That's really what they did.
594.14s - 599.94s |  But what made a difference is when, was when a Japanese calculator company went to them
599.94s - 607.20s |  and said, hey, we need some chips made because we're going to make four sets of calculators
607.62s - 611.02s |  and we need chips in them to make them function.
611.40s - 615.16s |  And they were saying like, well, okay, we have four calculators with different features.
615.50s - 621.42s |  So why don't you make us four sets of chips for these four calculators?
621.84s - 625.58s |  But one of the engineers at Intel said like, no, that's not a good idea.
625.94s - 632.84s |  Let's make one set of chips that we can program and use in all four of these.
633.20s - 639.76s |  And that, what they created was the 4004, which is a four-bit processor.
640.60s - 642.82s |  That was actually the first microprocessor.
643.10s - 645.44s |  It was then replaced with a better 4040.
646.18s - 650.66s |  And then shortly thereafter, another calculator company came with the same thing
651.06s - 657.52s |  and the same engineers then created the 8008, now an eight-bit processor.
657.84s - 661.52s |  And then they made it better and created the 8080.
662.62s - 666.28s |  And again, they created these to be used in calculators.
666.56s - 669.70s |  No one created these for being used in computers.
670.04s - 675.12s |  It took other people to look at this and go like, hey, I can take this 8080 chip
675.68s - 677.44s |  and make it into a computer.
678.14s - 683.82s |  And those were the guys at MITS or MITS, depending on what you believe is the name
683.82s - 690.46s |  of the company, and that was the Altair 8800, which was, it's not the first personal
690.46s - 697.24s |  computer, but it was the first commercially available personal computer.
697.46s - 698.84s |  And that kicked it all off.
699.04s - 702.46s |  And of course, the people that wanted these were more people that were hobbyists and
702.46s - 703.10s |  engineers.
703.10s - 707.32s |  They, you know, at that time, as I said, you had many computers and mainframes that
707.64s - 710.36s |  you didn't get to sit at and work on the computers.
710.68s - 716.18s |  People wanted their own computer that they could have and can work on and do stuff
716.20s - 721.28s |  with, as well as now they can be used for practical purposes and businesses.
722.96s - 728.68s |  Shortly thereafter, Intel created the 8086, which is now a 16-bit processor.
729.60s - 732.74s |  And that then, of course, was used for more powerful computers.
733.22s - 739.40s |  They then started a series of kind of iterations that gave us the 80186 and so
739.40s - 742.88s |  forth. You know, the 286, the 386.
743.14s - 748.02s |  The 386 is now a 32-bit processor, so now we're moving up and becoming more and more
748.02s - 756.66s |  powerful. And the 486, the next one was supposed to be the 8586, but instead,
756.66s - 762.06s |  Intel decided to call it a Pentium because you can't copyright a number, but you can
762.06s - 763.06s |  copyright a name.
764.18s - 766.88s |  And then with the Pentium, there was all the various different variations of the
766.88s - 771.10s |  Pentium, which, I'm sorry, I can't, I couldn't keep up with it even at the time.
771.10s - 775.28s |  We had the Pentium 2 and the 3 and the 4 and the DX and so forth.
776.20s - 779.44s |  I think around the Pentium 4 is when they went to 64-bit.
781.48s - 784.36s |  Intel also tried their hand at RISC processors.
784.64s - 788.00s |  That's the i86, 860 and 960.
789.12s - 789.96s |  Those are dead.
790.92s - 795.80s |  Most of the other ones, they actually made them for several decades, but then stopped
795.80s - 798.76s |  doing so. And then there was also the Itanium.
798.80s - 801.00s |  That was another architecture they tried out.
801.40s - 805.20s |  That was useful for a while, and it's also dead.
805.60s - 810.12s |  Nowadays, it's the one on the next line, the Atom and the Celeron, which are the
810.12s - 814.64s |  low-power ones for, meant for like tablets and embedded systems.
815.28s - 822.40s |  The Core 3579, which for laptops and desktops, and then the Xeon for servers.
823.84s - 827.56s |  One thing that I've noticed in the last few years with Intel, and maybe others of
827.56s - 833.54s |  you have noticed the same thing, is that Intel is still pretty big with desktops and
833.54s - 836.54s |  laptops and servers, but that's it.
838.54s - 842.34s |  They, you know, they tried getting into smartphones.
842.82s - 843.86s |  That didn't go.
844.42s - 848.54s |  They tried getting into like the Arduino space.
848.58s - 851.58s |  There was actually an Intel-based Arduino called the 101.
852.18s - 853.30s |  That didn't last.
853.80s - 858.64s |  They tried getting into the single board computer like the Raspberry Pi.
859.28s - 864.04s |  I'm not sure how many people here remember the Minnow board that they put together.
864.68s - 865.68s |  That didn't last.
865.96s - 872.44s |  They tried other little IoT devices like the Edison, which, you know, I got and several
872.44s - 880.64s |  others. And, you know, it's like outside of desktop servers and laptops, Intel doesn't
880.64s - 882.20s |  exist. Everything else is ARM.
883.10s - 887.94s |  You know, every one of you who has a smartphone with you, that's an ARM-based
887.94s - 892.30s |  processor. You know, I seriously doubt you have anything that's not an ARM-based
892.30s - 899.70s |  smartphone. ARM is now being used by Apple for their systems.
901.14s - 906.90s |  There is actually already, we're seeing ARM-based laptops that'll run Windows.
907.34s - 909.46s |  I'm hearing of ARM-based servers.
909.82s - 912.18s |  So I don't know what that means.
912.74s - 913.94s |  So it's kind of interesting what's happening.
915.74s - 921.78s |  Subbing back, I mentioned that certain engineers at Intel had created the 4040 and
921.78s - 927.78s |  8080. Those were a gentleman by the name of Federico Fagan, along with a Japanese
927.78s - 930.50s |  engineer named Masatoshi Ishima.
931.10s - 938.90s |  They actually left Intel to form Zilog, which is, and I'm not joking, it was picked
938.92s - 942.72s |  because it's the last name in integrated electronics.
943.36s - 950.60s |  And they created the Z80, which was a much improved version of the 8080, so improved
950.92s - 957.16s |  that the Z80 in the market kind of displaced the 8080 from systems.
957.16s - 961.48s |  And so everyone who was using what would have been an 8080-based system was using a
961.54s - 970.66s |  Z80. And until April of this year, they were still manufacturing the original Z80 chip
970.94s - 971.86s |  and selling it.
973.46s - 974.90s |  That's not the end of the Z80.
974.90s - 979.38s |  They have replacement chips such as the EZ80 you can still get.
979.38s - 982.42s |  So you can still get Z80 chips and use them.
982.82s - 984.58s |  They try their hand at others.
984.58s - 988.08s |  They did a Z800, which is a 16-bit processor.
988.92s - 992.80s |  And then they went with a 32-bit with a Z80,000.
993.00s - 997.40s |  And if you're like, I never heard of those, well, it wasn't that successful.
999.40s - 1005.08s |  These are what we refer to, and I don't know if I, where I got the term from, is these
1005.08s - 1009.88s |  are the eights, that almost the processors use the letter eight, the number eight on
1009.88s - 1014.48s |  it. The other set that we talked about that's really major starts off with
1014.48s - 1019.74s |  Motorola. They start off with the Z, the 6800 processor.
1020.78s - 1022.30s |  It had some success.
1022.98s - 1029.10s |  A lot of the early computer companies, MITS and MSCI, did release 6800-based systems
1029.10s - 1031.90s |  with an 8-bit processor, but it wasn't that big.
1032.50s - 1037.82s |  They replaced it with a more powerful 6809, which is an 816-based system.
1038.26s - 1043.74s |  Probably its claim to fame is it was one used in the Tandy color computer.
1044.54s - 1046.10s |  Which was used for many years.
1046.26s - 1052.18s |  And I was actually really surprised to learn how much involvement Motorola had in
1052.18s - 1055.62s |  actually the creation of the color computer, which I never knew.
1055.62s - 1057.86s |  I learned that, you know, like the last couple of years.
1059.86s - 1065.46s |  Then, of course, much more famously is the 6800, sorry, 68000, which is, of course,
1065.46s - 1070.50s |  used in the Macintosh, the ST, the Commodore, many Unix workstations.
1070.72s - 1074.48s |  Sega Genesis used it and so forth.
1074.92s - 1076.96s |  So a very, very popular processor.
1077.36s - 1084.60s |  They then extended out, the 68000 is a 1632-bit system, and then the full 32-bit was
1084.60s - 1087.88s |  a 68020, or the 020, as we call it.
1088.40s - 1093.72s |  And there was a progression of those, the 020 to 060, which was used in subsequent
1093.72s - 1097.52s |  Macintoshes, Amigas, and Atari systems.
1098.26s - 1103.50s |  Motorola also got into trying their hand at RISC processors with the 88000.
1104.54s - 1116.50s |  However, in the mid-90s, they got involved with the AIM consortium, which was Apple, IBM,
1116.80s - 1128.64s |  and Motorola to compete against the Windows, sorry, the Microsoft Intel duopoly.
1129.60s - 1133.12s |  And they were going to make, you know, and part of that was the PowerPC.
1133.52s - 1138.68s |  Now, the PowerPC was a RISC-based architecture from IBM, but the idea was
1138.68s - 1141.76s |  that Motorola and IBM would create the chips.
1142.06s - 1147.54s |  Motorola, IBM, and Apple would all build PowerPC systems.
1149.18s - 1152.14s |  Apple would move Macintosh to PowerPC and so forth.
1152.86s - 1156.38s |  The funny thing is, as I was actually at IBM at that time and then went to
1156.38s - 1162.02s |  Motorola, so I got to see a lot of PowerPC-based systems that never got to
1162.02s - 1162.46s |  market.
1162.50s - 1165.70s |  There were some cool ones, but that's just how it is.
1166.68s - 1172.16s |  Going back to the 6800, as I said, that was Motorola's, you know, 8-bit processor
1172.16s - 1175.28s |  initially, and there were some problems with it.
1175.28s - 1180.92s |  One thing they discovered from feedback from their customers or potential customers
1181.24s - 1184.68s |  was that, one, they thought it was just a little bit too powerful for what they
1184.68s - 1190.48s |  needed, but more importantly, a lot of their potential customers thought it was
1190.48s - 1192.08s |  too expensive as a chip.
1192.14s - 1198.78s |  Motorola was charging over $300 for a chip, and you need to understand that when
1198.78s - 1204.42s |  you're building a system, yes, your CPU chip is important, but there's also other
1204.42s - 1209.14s |  chips you need, and if it's already $300 for that CPU chip, and then add the
1209.14s - 1212.74s |  others, then you have kind of an expensive system, and that was a problem.
1213.10s - 1217.50s |  One of the engineers at Motorola by the name of Chuck Peddle was involved with
1217.50s - 1223.08s |  that, and he was, like, trying to work out a low-cost alternative at Motorola for
1223.08s - 1229.64s |  the 6800 until basically Motorola told him to knock it off, yeah, and so he
1229.64s - 1233.12s |  wasn't happy by that, and some of those people weren't happy, so they left
1233.12s - 1236.88s |  Motorola, and this was a group of people that included Chuck Peddle, an
1236.88s - 1242.28s |  associate by the name of Bill Minch, and they left Motorola, and they went to the
1242.28s - 1245.24s |  next company on the slide there.
1245.86s - 1251.30s |  So let me make a couple of things really clear about this company, because a lot
1251.30s - 1253.94s |  of people get this wrong, get these two things wrong.
1253.98s - 1258.26s |  I've seen it in YouTube channels, on videos on YouTube that are incorrect.
1258.46s - 1262.02s |  So first of all is, how do you say its name?
1263.66s - 1267.14s |  If you think it's MOS Technology, you're wrong.
1267.74s - 1274.22s |  It is MOS Technology, because you don't want to confuse it with another company
1274.24s - 1279.88s |  that exists at the time called MOS Tech, which I listed up there, and that's very
1279.88s - 1284.56s |  true, because I know as a kid, well, at that time, I was even confused myself.
1285.56s - 1291.12s |  The next thing that I've seen that several videos would claim is that Chuck
1291.12s - 1295.88s |  Peddle and the other guys from Motorola founded MOS Technology.
1296.12s - 1297.20s |  No, they did not.
1297.56s - 1303.08s |  MOS had already been in existence for several years as a, again, as a memory
1303.26s - 1306.58s |  company. They just joined the company.
1306.94s - 1311.58s |  There, they created two chips, the 6501 and the 6502.
1312.14s - 1317.66s |  And if you're going, well, I've heard of the 6502, I never heard of the 6501.
1317.70s - 1319.34s |  Well, there's a reason, let me explain it.
1320.70s - 1325.34s |  These two chips are largely, are mostly the same in terms of architecturally.
1326.38s - 1329.22s |  It was meant to be a scaled down version of 6800.
1329.22s - 1331.46s |  I'll show, I'll show, I'll explain that shortly.
1331.96s - 1334.16s |  But there were some differences.
1334.60s - 1341.48s |  The main difference is the 6501 was pin compatible with a 6800.
1341.72s - 1349.12s |  That means if you're, if you have a board that you designed to use the 6800, you
1349.12s - 1355.04s |  can then go get a 6501, which would be way, way, way cheaper, and plop it in and
1355.04s - 1356.64s |  off you, off you run.
1356.92s - 1360.40s |  Yeah, the opcode would not be compatible, you would still have to program it.
1360.62s - 1364.02s |  But you would save your development time because you've got, you know, you've
1364.02s - 1365.50s |  already got a board that'll use it.
1366.74s - 1369.14s |  Motorola didn't like that, and they sued them.
1369.38s - 1371.46s |  So they never brought it to market.
1371.70s - 1375.58s |  I don't understand how you can sue over that.
1375.58s - 1378.18s |  I mean, you, you know, you copyright your pinouts.
1378.18s - 1379.34s |  I don't, I don't understand that.
1379.58s - 1384.78s |  Because Intel didn't, as far as I know, never, never, you know, sued Zilog about
1384.78s - 1385.58s |  the Z80.
1386.22s - 1388.06s |  So I don't understand that.
1388.08s - 1392.32s |  So anyway, so the 6502 is what came out, they did make a lot of different
1392.32s - 1394.92s |  derivatives, things that were like slightly different, different of it, and
1394.92s - 1395.56s |  so forth.
1395.92s - 1401.40s |  MOS technology existed in a separate company, Commodore later soon bought them
1401.40s - 1401.88s |  out.
1402.36s - 1404.84s |  So they would have a ready source of chips.
1405.00s - 1408.36s |  So they also were the ones that manufactured the specialized chips for
1408.36s - 1410.36s |  the Commodores and the Amiga computers.
1412.20s - 1416.08s |  And unfortunately, MOS went under when Commodore went under.
1416.26s - 1422.02s |  However, one of the other guys I mentioned, Bill Minch, he left Commodore
1422.54s - 1426.74s |  and formed his own company called Western Design Company.
1427.18s - 1430.50s |  I had to be kind of careful, sometimes I say Western Digital, which is wrong.
1431.94s - 1437.70s |  And then he licensed the 6502 chip to make it because that was the common
1437.70s - 1440.30s |  thing there is you'd have multiple companies making chips.
1440.82s - 1445.50s |  Then what he did was he teamed up with with a couple other companies that were
1445.50s - 1446.88s |  making 6502.
1447.16s - 1451.92s |  And they developed a new version of it called the 65CO2.
1451.92s - 1454.56s |  The C means it's made using CMOS.
1455.76s - 1458.08s |  And it's an improved version of 6502.
1458.28s - 1461.28s |  They fixed some bugs, they added some opcodes.
1462.40s - 1464.60s |  And they still make them today.
1465.04s - 1469.36s |  You want a 6502 chip today, you can still buy them, they're a few bucks.
1469.56s - 1474.24s |  You can go to like DigiKey and Mouser and those guys and you can still get it.
1474.50s - 1477.86s |  Shortly thereafter, he made a new version.
1478.14s - 1485.02s |  And that's the 65816, which is an 816 bit version of the 6502.
1485.26s - 1493.18s |  It can emulate fully the 6502 or can go, you know, an 816 bit processor.
1494.10s - 1500.18s |  It's best known and use has been in the Apple IIgs, which was not quite the last
1500.18s - 1502.42s |  Apple II, but probably one of the best ones.
1502.84s - 1505.76s |  And it was used in the Super Nintendo.
1506.36s - 1509.36s |  So if you use a Super Nintendo, guess what, you use that.
1510.04s - 1515.84s |  So that's and these, as the other group is compute processor, that's the eights.
1516.00s - 1517.64s |  So these are the sixes.
1518.76s - 1522.08s |  There are a few other companies, I just want to quickly mention Texas Instrument.
1523.56s - 1526.40s |  Huge in calculators, still big in calculators.
1527.28s - 1530.88s |  But I was surprised to learn that that for a period of time, they actually made
1530.88s - 1532.08s |  many computers.
1533.40s - 1540.00s |  They took that architecture and made a processor called the TMS 9900, which they
1540.00s - 1545.84s |  used in their computer called the TI 99 slash four, which I remember it, it was,
1546.48s - 1551.72s |  it was an interesting computer, I'll say it that say it that way, that the
1551.72s - 1554.04s |  processor was an 816 processor.
1554.24s - 1559.52s |  The problem was, was, you know, I, there's debate whether it was kind of a
1559.52s - 1563.22s |  crippled design because of infighting within the company.
1563.34s - 1564.90s |  So it wasn't very successful.
1566.34s - 1571.58s |  Another company, which is I thought I should list more as a could have been is
1571.58s - 1573.02s |  National Semiconductor.
1573.78s - 1576.66s |  They had a series of chips called the 32,000.
1577.16s - 1584.18s |  And I do know that Atari looked at them, maybe Amiga looked at them as possibly
1584.62s - 1588.58s |  then the processor for the next generation, but they didn't go with them
1588.60s - 1591.12s |  and said they went to motor with Motorola 68,000.
1591.40s - 1595.08s |  So who knows what might have happened if that didn't, that didn't go.
1595.92s - 1598.60s |  The last one I'll mention is RCA.
1598.64s - 1600.84s |  Yes, yes, that's Radio Communications of America.
1601.24s - 1604.68s |  They had an 8-bit processor called the 1802.
1605.32s - 1608.36s |  All I would say for that is take a look at that on Wikipedia.
1608.36s - 1609.60s |  It's very, very interesting.
1609.88s - 1614.12s |  They actually use that in space probes.
1614.88s - 1616.28s |  So kind of insane.
1616.50s - 1619.74s |  Now, if you're like, well, you forgot this company, you forgot that company.
1619.74s - 1621.02s |  There are other companies out there.
1621.26s - 1623.38s |  A lot of them, all they do is they make chips.
1623.58s - 1625.22s |  They don't design chips.
1626.14s - 1633.34s |  Even today, Apple designs their own software, their own silicon, the M1, 2, 3,
1633.34s - 1635.06s |  and 4, but they don't make it.
1635.30s - 1639.46s |  They go to another company and say, here, here's a design, make us these chips.
1640.50s - 1645.06s |  ARM, you know, ARM is nothing more than, you know, a licensing company.
1645.48s - 1646.88s |  They don't make ARM chips.
1647.12s - 1649.08s |  They design the ARM architecture.
1649.24s - 1653.64s |  They give it to other companies like Broadcom and all the others, and they make it.
1654.36s - 1658.08s |  You know, this has a, you know, an ARM processor in it.
1658.20s - 1659.16s |  ARM didn't make it.
1659.56s - 1664.08s |  They went to Broadcom and, you know, which is part, you know, tied to the Raspberry Pi
1664.08s - 1665.40s |  people, and they made it.
1665.40s - 1666.44s |  That's just how it is.
1668.36s - 1671.52s |  I thought I should make, I should mention this because a lot of people don't
1671.52s - 1674.32s |  understand again about, you know, if you don't understand the history of computers,
1674.78s - 1678.38s |  when you think about the IBM PC and they, some people think how, oh, how radical it
1678.38s - 1683.22s |  is and, you know, it's standardized things, and that's just not quite the way it was.
1683.22s - 1688.18s |  In the early seventies, we did have a standard, which was, you know, many
1688.18s - 1692.26s |  companies, and I mentioned several, you know, Altair, M-Sci, Promenco, and a lot
1692.26s - 1697.22s |  of these others who built standard business computers, they used, used the Z80
1697.22s - 1703.10s |  chip, they had what was called the S100 bus, which also known as the Altair bus,
1703.10s - 1709.12s |  which was an IEEE standard bus up until the 19, the mid nineties, people were
1709.12s - 1717.08s |  still making S100 based systems, and they use CPM as the operating system.
1718.56s - 1721.72s |  But unfortunately, other than that, there was, there was little standards that, you
1721.72s - 1726.24s |  know, floppies, dries was all of those, you had eight, you know, eight inch, you
1726.24s - 1730.64s |  had five and a quarter, you had, you know, you might not know what the, what I mean
1730.64s - 1735.66s |  by hard sector and soft sector, double sided, double density, you know, is all a
1735.66s - 1738.86s |  lot of complexity with these things, it was pretty crazy.
1740.50s - 1745.46s |  Look into the CPM operating system, again, it's one of like, what might have
1745.46s - 1752.90s |  been CP, we might have been using CPN instead of MS-DOS, if certain things had
1752.90s - 1759.74s |  not gone certain ways, it's either a, either a ridiculous story, or a sad story,
1759.74s - 1761.04s |  or however you want to look at it.
1763.24s - 1766.44s |  So it goes a little beyond what I wanted to talk about here, but it is
1766.44s - 1767.04s |  interesting.
1769.24s - 1775.08s |  So, um, I don't know if people, I've been saying things like eight bits, 16
1775.08s - 1777.48s |  bit, I've even said that I ate 16.
1778.44s - 1780.76s |  Does anyone know understand what the hell I'm saying?
1780.98s - 1786.68s |  When I say these things, I see some hand raised, okay, good, if that's the case,
1786.68s - 1789.94s |  because a lot of people don't, it's ridiculous.
1791.58s - 1797.54s |  To give you an example, the Atari came out with one of their game consoles
1797.54s - 1804.10s |  toward the end called the Jaguar, which they toted as being a 64 bit system.
1804.66s - 1810.22s |  And their, their marketing tagline was, you know, do the math.
1810.86s - 1815.70s |  But if you look at the system, and I'm pretty positive that no, it was not a
1815.72s - 1817.28s |  64 bit system.
1817.56s - 1820.60s |  It was, I think either 16 or 32.
1820.74s - 1824.80s |  That's the problem with these terminologies is that we as technology
1824.80s - 1828.00s |  people, we understand that, oh, this is an eight bit system.
1828.00s - 1829.14s |  This is a 16 bit.
1829.28s - 1831.08s |  Oh, yeah, we haven't, we can have an eight 16.
1831.08s - 1832.76s |  That's in between, that's more powerful.
1833.08s - 1837.52s |  But then you get to these marketing dweebs, and they just do ridiculous
1837.52s - 1837.84s |  things.
1837.84s - 1841.80s |  I came across an article around this time where they talked about this system,
1842.04s - 1844.36s |  and they were claiming it was a 64 bit system.
1844.36s - 1848.86s |  And I'm like, wait, wait a minute, I know what the processor is in that system.
1849.06s - 1851.86s |  It isn't, it isn't a 64 bit.
1851.86s - 1855.50s |  And I'm reading the article and realizing that the person who wrote it was like
1855.52s - 1860.94s |  adding things together, like, oh, well, it's, you know, I'm taking the address
1860.94s - 1865.26s |  bus and the data bus and this and I'm adding them all together in a 64 bit.
1865.26s - 1866.54s |  So it's a 64 bit system.
1866.54s - 1869.46s |  And I'm like, no, that's not how it works.
1869.56s - 1875.64s |  I was also surprised to learn, because only because I never use these computers
1875.64s - 1882.24s |  that we also had 12 and 24 bit and 48 bit computers at one time, which I was
1882.24s - 1884.56s |  surprised, but I never I never use those.
1885.52s - 1889.52s |  You know, when we talk about processors, these the things we look at, you know,
1889.52s - 1892.62s |  clock speed, I remember people think that clock speed is real important.
1892.88s - 1894.96s |  And it's not as important as people think.
1895.90s - 1900.02s |  If you go and watch these YouTube videos where people are doing it, you know,
1900.02s - 1903.02s |  they're looking at a new board and seeing how powerful it is, they're not
1903.02s - 1906.38s |  going and looking at the dang clock speed, they're going to run benchmarks
1906.54s - 1909.58s |  to see, oh, how fast can it do these things.
1909.74s - 1911.02s |  So that's more important.
1912.06s - 1919.70s |  But this is kind of interesting is that the 6502 has a 0.43 versus a 68,000 of 0.75.
1919.98s - 1924.50s |  If that's not clear, that means that the 6502 is actually faster than the
1924.50s - 1925.72s |  68,000.
1926.28s - 1930.20s |  But that's also gets into logic of, you know, why, why we went with RISC
1930.20s - 1933.64s |  processors, because, you know, they're more powerful, because they're kind of
1933.64s - 1934.40s |  stripped down.
1935.80s - 1939.08s |  The address bus is entering that tells us how much memory we can access.
1939.40s - 1943.88s |  Almost all eight bit systems have a 24 bit address bus, which which is why they
1943.88s - 1946.44s |  only have 64 k of memory.
1947.76s - 1951.36s |  The size number register is kind of interesting, because you got some CPUs
1951.36s - 1956.78s |  that have like, one or two registers, and others would like multiple, if you
1956.78s - 1959.66s |  don't understand what I mean by a register, that's the storage space, if
1959.66s - 1962.98s |  you will, within the processor, if you're going to do anything, you have to
1962.98s - 1966.30s |  pull it out of memory, pull it into the processor and work with it.
1966.90s - 1969.90s |  The data bus is what's important, because that's the that's the, that's
1969.90s - 1973.90s |  the highway, the data highway within the computer, that data is moving around.
1974.10s - 1978.30s |  If you got an eight bit processor, all the auxiliary chips need to be eight
1978.30s - 1980.46s |  bit, you can't be mixing and matching.
1982.06s - 1987.82s |  So I always like to throw this out, which is the IBM PC, which had all these
1987.82s - 1988.82s |  capabilities.
1989.58s - 1992.14s |  How many people think this was a 16 bit system?
1993.24s - 1995.26s |  How many people think this was an eight bit system?
1996.02s - 1997.14s |  Okay, good.
1997.14s - 2002.66s |  It's an eight bit system, because the 8088 processor is really an eight 16 bit
2002.66s - 2003.46s |  processor.
2003.62s - 2007.90s |  So the PC is an eight bit system, even though most people think it's 16 bits.
2008.40s - 2010.00s |  A lot of the
2011.92s - 2015.60s |  I really can't call them a clone in the early days more than IBM compatible.
2015.92s - 2022.44s |  They were full 16, because they either use the 8086, or the 8186, and so forth.
2022.78s - 2024.40s |  So it's actually kind of interesting.
2025.44s - 2027.44s |  So let's get into the these chips.
2027.44s - 2029.12s |  I talked about the 6800.
2030.04s - 2031.76s |  These are the specs, I'm not going to read it.
2033.08s - 2034.60s |  That's actually what they look like.
2035.42s - 2039.10s |  Please note, it had 72 instructions, what we call opcode.
2040.14s - 2043.02s |  As I said, it was really cost $360.
2043.02s - 2045.14s |  That was in 70s dollars.
2046.06s - 2049.98s |  Then over time, they reduced it to $179, then to $69.
2050.42s - 2052.46s |  I don't know how long they were making this.
2052.46s - 2056.66s |  But what I've been able to see is they were, they were still making these for
2056.66s - 2058.22s |  probably a couple of decades.
2059.98s - 2065.04s |  Now, I was trying to find a similar chart that what I show here.
2065.06s - 2069.62s |  For the 6502, but this I thought that was useful, because again, people need to
2069.62s - 2073.82s |  understand that when a company makes a processor, they're making other chips to
2073.82s - 2074.90s |  work with it.
2075.22s - 2078.42s |  So in this case, you see that, you know, you have the 68,000 processor.
2078.74s - 2081.38s |  In this case, they have a separate chip for the for the clock.
2082.74s - 2085.22s |  Then they have, of course, chips for ROM and RAM.
2085.94s - 2090.50s |  And then they have a PIA, that's a Peripheral Interface Adapter, that's and
2090.50s - 2092.18s |  then of course, a communications adapter.
2092.18s - 2097.00s |  So the whole idea was that if Motorola was not just selling you the processor,
2097.00s - 2101.32s |  that's what two of all these companies, they're selling you the complete set of
2101.32s - 2103.24s |  chips for your system.
2104.76s - 2108.13s |  Architecturally, this is what we look at.
2108.13s - 2112.93s |  We look at the inside with the with the registers, you see the 6800 versus the
2112.93s - 2113.85s |  6502.
2114.49s - 2117.73s |  The 6800 had two registers, they got rid of one.
2118.41s - 2119.81s |  But otherwise, they're pretty similar.
2119.81s - 2122.61s |  They have index registers and stack registers and so forth.
2122.61s - 2126.15s |  Those are all needed in time inside the chip to do the work that it does.
2126.87s - 2132.41s |  So then we have the 6502, which of course, you see it's a it looks just just the
2132.41s - 2135.29s |  same as if it's a four pin dip, as it's called.
2136.69s - 2142.17s |  It has only 55 instructions versus the 77 of the 6800.
2143.65s - 2147.13s |  So the funny thing is, I've actually read some stuff where people have complaint
2147.17s - 2154.41s |  have claimed, I don't know if that's true or not, is that the 6502 is a
2154.41s - 2160.63s |  6502 might be the first risk chip, because they reduce the instruction set.
2161.39s - 2164.63s |  I don't know who can make that determination.
2165.75s - 2167.27s |  But that's what they did.
2168.87s - 2172.51s |  The original cost for this chip was $25.
2173.23s - 2177.47s |  And one of the ways they were able to do this was not just that it was a reduced
2177.47s - 2181.15s |  design was they were able to improve manufacturing.
2181.53s - 2185.89s |  Now, as I understand it, and those of you who have more knowledge, you can you can
2186.61s - 2189.85s |  get with the actor and tell me I'm got this wrong.
2190.05s - 2195.25s |  But as I understand it, the chip yield at that time was pretty lousy, as in you'd
2195.25s - 2201.77s |  run a make a bunch of chips, and 70% of them were bad, i.e. had to throw them
2201.77s - 2207.01s |  away, which is why chips are so costly, because the yield was so poor.
2207.31s - 2211.75s |  But apparently someone that you know, one of the motor engineers that came to MOS had
2211.75s - 2216.11s |  worked out a way I don't know what it is, I'm sorry, I'm not an engineer in this
2216.11s - 2223.15s |  area, a way of fixing the chips after production, such that they had a good
2223.15s - 2229.39s |  yield going and suddenly going being 70% bad to like 30% bad.
2229.91s - 2232.67s |  And thus they were able to sell the chips a lot cheaper.
2233.13s - 2238.85s |  And it was because of this price, that a couple of guys by the name of Steve Jobs
2238.85s - 2243.37s |  and Steve Wozniak looked at this and go like, hey, this is the chip that we can
2243.37s - 2248.05s |  use to put together this little home computer we've been thinking about, which
2248.29s - 2251.49s |  if you don't know who those people are, those are the guys that created the Apple
2251.49s - 2253.29s |  one and the Apple two, and so forth.
2254.27s - 2261.99s |  So, so what have been the 6502 been used for a lot of stuff over and over in the
2261.99s - 2268.55s |  UK, they, you know, the acorn computers, the BBC micro was used it, the Apple one,
2268.55s - 2275.43s |  the two and the three, and all the variations used it, the Atari home game
2275.43s - 2281.39s |  systems, the Atari eight bit systems used it, Commodore used it for their that all
2281.45s - 2289.37s |  the pet models of vic 2064, and so forth, the Nintendo used it, others used it, and
2290.45s - 2294.41s |  Bender from Futurama, use the 6502.
2295.45s - 2300.97s |  So then, of course, as I said, the 65816 chip was used in the two GS and the super
2300.97s - 2301.49s |  NES.
2301.97s - 2306.25s |  And as I said, Western design is still making and selling these chips.
2306.31s - 2309.43s |  Yeah, that's all they do is they, as far as I know, that's pretty much what they
2309.43s - 2310.23s |  manufacture.
2310.39s - 2312.91s |  So clearly, people are using these for a lot of embedded system.
2312.95s - 2317.71s |  Sadly, I don't know, they don't even say specifically what they're being used for,
2317.71s - 2319.07s |  but it's got to be used heavily.
2319.95s - 2324.19s |  Another interesting computer is the Kim one, which was created by Chuck Peddle at
2324.19s - 2329.83s |  MOS, it was a way to, it was a single board pewter to kind of sell the 6502, it
2329.83s - 2331.51s |  was so cheap that people bought that.
2331.51s - 2335.05s |  Those are very collectible, I've never never seen one.
2335.25s - 2337.93s |  So I'm not even sure, I think they were probably about yay big.
2339.25s - 2346.45s |  And if it's not clear, that keypad is basically hexadecimal numbers, and some
2346.45s - 2347.17s |  other commands.
2347.17s - 2349.33s |  So no, it's not a typewriter keyboard.
2351.97s - 2355.57s |  I know that Commodore was still making these even though after they bought out.
2356.19s - 2359.91s |  I know that Commodore was still making these even though after they bought out
2361.35s - 2365.83s |  MOS, and then of course, some of the secondary sources were 652 made their
2365.83s - 2369.03s |  own the the sim one and the aim 65.
2369.31s - 2372.95s |  And then I found this kind of interesting slide, I thought was
2372.95s - 2375.99s |  interesting that showed all the different systems that the clones of it
2375.99s - 2380.63s |  that popped up, I actually brought one that I've been building that I need to
2380.63s - 2384.41s |  try to fix, which is, this is the power one.
2384.77s - 2389.53s |  So you can see it's pretty small, it's got a keypad, an LED, there's something
2389.53s - 2391.85s |  wrong with it, I got to try to figure out how to fix this.
2392.09s - 2396.01s |  But, you know, if you come to me, if you visit me at the hacker halt at the
2396.17s - 2399.49s |  hardware hacking village, you can take it, you can have a chance to take a look
2399.49s - 2400.37s |  at it and so forth.
2400.61s - 2401.61s |  That's why I brought it.
2402.83s - 2408.93s |  So programming, which is always so much fun, which is a semi language program,
2408.93s - 2412.15s |  which is either miserable or whatever.
2413.07s - 2415.87s |  I think most people have you've done programming, probably done high level
2415.87s - 2420.43s |  programming, I know I have, you know, C and basic and Pascal and so forth.
2421.39s - 2426.55s |  The way I look at it is these programs are written to make it easier for us to
2426.55s - 2431.35s |  put in put down our ideas into how a program should work.
2432.27s - 2437.75s |  But the thing is, is they have to be then converted into the language of the
2437.77s - 2441.73s |  machines, which is machine code, which is, you know, binary coding, and so
2441.73s - 2442.21s |  forth.
2443.21s - 2444.97s |  How good that is, is unknown.
2444.97s - 2449.49s |  That's why many people do still write a do a semi language programming because
2450.41s - 2453.73s |  they can, you know, get down to the nitty gritty of the hardware and actually
2453.73s - 2454.57s |  write to it.
2455.01s - 2457.01s |  Unfortunately, it's not really fun.
2457.33s - 2458.97s |  But people do write it.
2458.97s - 2463.91s |  I was actually surprised that if you visit no starch press here, they actually
2463.91s - 2467.89s |  have a book on arm, a semi language programming, and I think they also have
2467.89s - 2470.41s |  one for x86 programming.
2470.89s - 2475.37s |  So the thing is also with parameters, when we do these higher level languages,
2475.37s - 2479.29s |  there's things like, you know, an if then statement, you know, if this
2479.29s - 2483.33s |  condition has been met, then do this, if you get a for loop or a while loop, and
2483.33s - 2488.13s |  all that they don't, that doesn't exist in a semi languages, you do have things
2488.13s - 2494.23s |  like a compare command, like, hey, do these two things compare, which is
2494.23s - 2495.39s |  higher, which is lower.
2495.75s - 2500.01s |  But from that, then you have to build that logic of that if statement or the
2500.01s - 2501.35s |  for loop and this sort of stuff.
2501.71s - 2504.27s |  So it becomes a little bit more complex.
2506.55s - 2509.91s |  So this is what 6502 looks like.
2509.91s - 2511.83s |  And it's I guess, three letter coding.
2512.27s - 2516.51s |  And these are some of the ones in like, there's an ad with carry, there's the
2516.51s - 2522.29s |  compare, there's the load, the accumulator, that means you're grabbing a
2522.29s - 2526.01s |  number out of memory and pulling the accumulator so you can do math on it.
2527.61s - 2533.65s |  The 6502 has only two math, math commands, it can add, and it can
2533.65s - 2534.41s |  subtract.
2534.57s - 2535.53s |  And that's it.
2536.19s - 2540.89s |  If you want to do multiply and divide, you're going to have to use add and
2540.89s - 2541.85s |  subtract.
2542.55s - 2548.67s |  So, and of course, if you're have any sense, you're going to, you're going to
2548.67s - 2549.71s |  comment your code.
2549.71s - 2552.95s |  Otherwise, we were going to look at your semi language, your semi coding, like, I
2552.95s - 2554.23s |  don't know what the hell you're doing here.
2555.27s - 2560.27s |  If you would like to try out 6502 semi language, I found this really cool
2560.27s - 2562.55s |  website, it uses JavaScript.
2562.55s - 2565.35s |  So you can actually do a semi language programming there.
2565.55s - 2568.61s |  And it's both not it's not just it's not just like, oh, here's a window to do a
2568.61s - 2569.19s |  semi language.
2569.43s - 2573.23s |  It is done as a tutorial, where you can go on there and you can write, you know,
2573.23s - 2575.63s |  put in the code, you can see what happens and so forth.
2575.99s - 2578.79s |  And also to serve with this other one, which is an online tutorial.
2579.35s - 2581.43s |  Yeah, feel free to take pictures of these.
2582.03s - 2582.79s |  These are really good.
2583.13s - 2585.35s |  So this is what a semi language looks like.
2587.67s - 2590.99s |  The left side is a semi language to do a bubble sort.
2591.51s - 2596.63s |  And then on the right side is bubble sort in thing C.
2598.63s - 2603.55s |  So that looks like really, really fun things to write, which is probably why I
2603.55s - 2608.55s |  don't recall doing a whole lot of out of a semi language even in college, really
2608.55s - 2609.15s |  simple stuff.
2609.87s - 2614.87s |  Okay, this is the point where I would recommend you might want to pull your
2614.87s - 2618.03s |  phones out, because I'm going to be giving a lot of resources, you are
2618.03s - 2619.79s |  totally free to take pictures.
2619.79s - 2621.11s |  That's why I do this.
2621.83s - 2627.35s |  I'm always the mind of I'm here to help educate you and show you where you can go
2627.35s - 2628.59s |  next after this.
2629.51s - 2636.67s |  So websites, right at the top 6502.org is like the place for anything about this.
2636.71s - 2642.95s |  The 6502, there's Buku resources, emulators, software sources, hardware,
2643.27s - 2645.31s |  tutorials, and everything like that.
2645.59s - 2649.51s |  The other one is a neat one that I discovered, they have a lot of pages on
2649.51s - 2655.11s |  the 6502, and so forth, and a lot on the Kim one, including PDF scans of a lot of
2655.11s - 2658.15s |  the documentation, which I thought was really, really cool.
2659.59s - 2661.79s |  The last one is the Internet Archive.
2662.43s - 2666.59s |  If you are interested in looking for books, and you can't find them, or they're
2666.59s - 2671.11s |  really, really expensive, try going there and searching, you can probably find
2671.11s - 2673.13s |  them as PDF scan.
2673.13s - 2676.43s |  So all the books I talked about, you can probably find them there if you don't
2676.43s - 2676.87s |  want them.
2677.07s - 2680.07s |  Me, I want physical books.
2680.11s - 2681.23s |  That's, that's just me.
2681.41s - 2688.19s |  So, so I'm not sure if you guys familiar with Adam Osborne, the Osborne
2688.19s - 2692.29s |  computer, but one of the things that I liked about him is he had his own
2692.29s - 2697.41s |  publishing company, which then became part of McGraw Hill as Osborne McGraw
2697.41s - 2701.53s |  Hill, and it was one of my favorite sources for books.
2701.73s - 2705.29s |  So he did a series called an introduction to microcomputers.
2705.29s - 2712.61s |  I had four volumes numbered zero through three, but I only recommend you look at
2712.61s - 2713.69s |  getting the first two.
2714.67s - 2719.39s |  You can get them really inexpensive off of like Amazon and eBay, make sure you
2719.39s - 2721.07s |  get the last edition.
2721.07s - 2723.27s |  But those are really, really good introduction to this.
2725.47s - 2729.55s |  I don't have volume two and three, they go for the people ask for stupid money
2729.55s - 2730.71s |  for it, and I'm like, sorry.
2731.03s - 2736.87s |  But if you really are into into the hardware of microprocessors, the last two
2736.87s - 2739.19s |  books you might want to get, I actually got them.
2739.63s - 2742.07s |  They're literally about two inches thick.
2742.29s - 2744.65s |  It's not they're not going to tell you how to program these, but they're going
2744.65s - 2748.77s |  to tell you about all the electronics and the hardware of these processor night.
2748.97s - 2750.53s |  To me, that was like really, really cool.
2750.81s - 2753.21s |  But I'm a nerd.
2753.21s - 2755.49s |  So what can you say?
2757.48s - 2761.90s |  When it comes to a semi language program, one of my two authors is Lance
2761.90s - 2766.78s |  Leventhal, who did all these things through Osborne McGraw Hill.
2767.54s - 2770.18s |  He did the 65021, which had a second edition.
2770.18s - 2771.42s |  That's that's what it looks like.
2771.72s - 2775.24s |  He also did an assembly language subroutine series, which I was not aware
2775.24s - 2778.64s |  of, but I got the 65021 recently.
2779.04s - 2783.42s |  The 68000, I know I used that in college, but he did others.
2783.42s - 2794.04s |  He did a 6800, a 6809, the Z8000, the 8085, and so forth, as well as assembly
2794.04s - 2796.40s |  language subroutines for some of these, these ones.
2797.02s - 2800.78s |  Please be advised that people are asking stupid money for these.
2800.78s - 2808.86s |  But if you go on lulu.com, someone has made available his Z80 and the first
2808.86s - 2811.64s |  edition of the 6502 book there on Lulu.
2811.90s - 2815.62s |  And I think they cost about 20 bucks or 30.
2815.70s - 2817.30s |  Yeah, I think about 20 bucks or 30 bucks.
2817.58s - 2820.30s |  So if you don't want to buy a used copy, go there.
2821.00s - 2826.06s |  The other guy is Rodney Zaks, who founded Cybex Books, which is still
2826.06s - 2828.12s |  around, but as an imprint of Wiley.
2828.52s - 2832.32s |  He did actually a four book series on the 6502.
2832.92s - 2836.36s |  I know I used his 6502 book in college.
2836.60s - 2839.84s |  The last one is the fourth edition with that really cool cover.
2840.12s - 2841.92s |  I have most of the series.
2841.92s - 2844.90s |  I'm trying to get the, I'm trying to find the application book, but I want that
2844.90s - 2849.48s |  cover, but his other, he's got a really great Z80 book that I want to get.
2849.48s - 2852.06s |  Again, I'm not going to pay the stupid money people are asking for.
2853.22s - 2855.46s |  But he's another good one.
2855.90s - 2864.94s |  I found on Tindy that someone had reprinted the, these MOS books on the
2864.94s - 2868.94s |  Kim one, I actually brought one of them with me that you guys can take a look
2868.94s - 2874.68s |  at, I got the user manual, but he had these on Tindy, he might be running out.
2874.98s - 2877.62s |  So if you want them, get them while the getting's good.
2877.76s - 2882.24s |  Other books are these on the 65816.
2882.56s - 2885.28s |  I've had the Osborne one, but I've never done programming.
2885.44s - 2890.52s |  The last one was actually from Brady, but now Western Design has reprinted it.
2890.52s - 2893.56s |  So you can easily get it off of Amazon.
2894.60s - 2898.96s |  But I've had people, I've read stuff that people don't think it's that
2898.96s - 2900.44s |  good of a book for a semi-language program.
2900.44s - 2902.68s |  So just be, be aware.
2903.28s - 2905.48s |  I have not got it myself, so I cannot speak.
2905.94s - 2909.22s |  So you want to actually play around and program with these.
2909.22s - 2910.50s |  Well, you have various options.
2910.50s - 2912.34s |  It's kind of depending on what you want.
2913.46s - 2916.90s |  Do you want hardware or are you happy with software or something in between?
2917.18s - 2918.78s |  That, that's, that's up to you.
2920.14s - 2923.58s |  There are many communities of fans that still keep these things to going and
2923.58s - 2925.02s |  they're actually creating new stuff.
2926.66s - 2929.50s |  I can actually have wifi on my Atari 8 bits.
2929.50s - 2934.90s |  I'm, I can have, I can use compact flash and SD cards for storage because
2934.90s - 2936.72s |  of the work that these people have done.
2937.04s - 2940.48s |  So if you want, you can go get the classic 8 bit, you can go on the
2940.48s - 2945.80s |  eBay and take a look, just be aware that sometimes they work, sometimes they don't.
2945.82s - 2947.20s |  Most of the buyers are pretty honest.
2947.20s - 2948.56s |  They'll say like, no, this doesn't work.
2948.80s - 2950.40s |  You're getting this for parts or whatever.
2950.64s - 2952.84s |  You might need to do some retrobriting, which is to clean
2952.84s - 2954.32s |  up the coloring and so forth.
2954.64s - 2964.56s |  But I've gotten an 800, a 1200 XL and a 130 XE off of eBay for what I
2964.58s - 2966.42s |  thought was reasonable, reasonable prices.
2967.62s - 2970.18s |  So just, just be aware.
2971.50s - 2974.58s |  If you want brand new, check out this.
2976.14s - 2978.78s |  This is an effort of a guy by the name was the 8 bit guy.
2979.14s - 2982.86s |  It's a brand new 65, 65 or two base system.
2983.22s - 2986.34s |  They are currently making and selling developer systems.
2986.34s - 2988.62s |  They cost about 300 bucks.
2989.30s - 2991.94s |  They're still having people developing software and so forth.
2992.24s - 2995.88s |  So, but it looks, it's a, I think it's kind of a cool, cool project.
2995.88s - 2996.88s |  So take a look at it.
2997.68s - 3000.08s |  Like I said, you can do chem one clones.
3000.08s - 3002.16s |  Like I said, this, this is a chem one clone.
3002.48s - 3006.00s |  I got this off of Tendy and you can have, and I got the extra stuff.
3006.00s - 3008.20s |  I'm trying to like get this thing to work and so forth.
3008.20s - 3013.52s |  So if you want different, there's all other, if you go into Tendy and just
3013.52s - 3016.60s |  search, let's search for 65 two, you can find out there's the Pico
3016.60s - 3018.68s |  computer actually brought mine with me.
3018.92s - 3020.48s |  I still got to get that working.
3020.74s - 3022.54s |  The Roscoe is kind of interesting.
3022.54s - 3025.38s |  It's real old school computer.
3025.38s - 3028.38s |  That's what it, what's it, what it stands for, or you can do the other one, but
3028.38s - 3029.78s |  there's others that are there on Tendy.
3029.78s - 3033.30s |  If you know, it's like what you want, do you want to, you want a computer where
3033.54s - 3036.98s |  you're going to have to basically hook it to your laptop and send it code and
3036.98s - 3040.14s |  whatnot, or do you want one that's more of a standalone computer with a, with
3040.14s - 3044.46s |  a keyboard and screen, you know, there's different options if you don't want
3044.46s - 3046.58s |  that, you can go hardware alternatives.
3046.58s - 3050.68s |  One is emulation through what's called field programmable gate array.
3051.00s - 3052.32s |  Look into the Mr.
3052.32s - 3059.32s |  Project where people are emulating all kinds of retro computers in that, in
3059.32s - 3060.48s |  this, what have Mr.
3060.48s - 3061.08s |  System.
3061.56s - 3065.44s |  You might've seen the various minis that have been hit in the market.
3065.48s - 3070.92s |  There has been the Atari 400 mini and the Atari 2600 and the Commodore mini
3070.92s - 3075.64s |  and the Amiga mini and the Nintendo mini and the Sega mini, and I'm probably
3075.66s - 3078.94s |  missing some, but, and they're all done with FPGA.
3079.58s - 3084.86s |  Then there's this interesting one, which is the mega 65 from Germany, which they
3084.86s - 3089.50s |  have basically recreated what would have been Commodore's last eight bit system
3089.50s - 3090.74s |  using FPGA.
3091.10s - 3095.26s |  I thought about getting it until I looked at the price and it's like, not yet.
3095.46s - 3098.50s |  So, and if you want, if you just, if you're not going to, you just want
3098.50s - 3102.22s |  software emulation again, check out the 6502 or for that.
3102.72s - 3103.08s |  Videos.
3103.08s - 3104.56s |  There's a lot of cool videos out there.
3104.88s - 3107.08s |  What the eight bit guy is a neat guy.
3107.08s - 3111.88s |  He's the guy that behind the commander X 16 low spec gamer has some neat videos.
3111.88s - 3113.80s |  The first one is on the 6502.
3114.12s - 3118.12s |  He did one of the Z80 recommend you look up his one on the arm.
3118.64s - 3124.80s |  You will then learn why you, you have the 6502 to thank for the, for, for arm
3124.80s - 3125.60s |  processors.
3125.60s - 3130.54s |  So, and also look for videos with Chuck Peddle, Bill Minch, Rodney Zaks, and
3130.54s - 3131.46s |  all these other guys.
3131.70s - 3132.62s |  They're really, really cool.
3132.90s - 3134.18s |  You want events and groups.
3134.18s - 3138.66s |  There's the vintage computer Federation, and I was really shocked that they have
3138.66s - 3144.26s |  these all around the country as well as overseas and look for groups in your
3144.26s - 3146.66s |  area that are into retro computing.
3147.86s - 3150.34s |  So if you want to contact me, that's my Twitter handle.
3150.34s - 3153.46s |  I am, I am at retrocomputing.com.
3153.72s - 3154.72s |  That's my Twitter handle.
3154.72s - 3160.36s |  I am, I am on the DEF CON discord as well as as one for the makers community.
3160.60s - 3162.56s |  So if you want to reach out to me, that's great.
3162.84s - 3163.88s |  That's my LinkedIn.
3164.24s - 3171.16s |  I would recommend you, there's a retro tech community over there, someplace
3171.16s - 3172.36s |  that you can drop by then.
3172.66s - 3173.52s |  I was disappointed.
3173.52s - 3174.80s |  They had no Atari stuff.
3174.80s - 3175.32s |  I'm sorry.
3175.32s - 3178.64s |  I'm an Atari and, and there's also the hardware hacking village.
3178.84s - 3180.80s |  After this, I'm going to head over to the hardware hacking village.
3181.02s - 3183.74s |  I'll have a few of my things with me.
3184.02s - 3186.34s |  You want to talk with me and tell me I'm an idiot.
3186.38s - 3189.74s |  I don't know what the hell I'm talking about and I shouldn't have been here or
3189.74s - 3192.38s |  what have you, or you have questions and comments and whatnot.
3193.18s - 3197.34s |  I'm happy to hang out there and you can see, you can, I'll even let you touch my
3197.34s - 3197.84s |  stuff.
3198.06s - 3201.02s |  So thank you very much.
3201.14s - 3204.22s |  And I will see you all later.


url: https://www.youtube.com/watch?v=UmBNgn_9-zY
title: DEF CON 32 - Building a secure resilient nationwide EV charging network - Harry Krejsa, Sarah Hipel
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=UmBNgn_9-zY",
  "title": "DEF CON 32 - Building a secure resilient nationwide EV charging network - Harry Krejsa, Sarah Hipel",
  "description": "Unprecedented investments in vehicle electrification are creating new pathways for hackers to exploit EVs and EV chargers. Many of these risks are theoretical and have not been demonstrated in the wild\u2026yet. Policymakers are racing to better understand systemic cyber risks present in this new EV ecosystem\u2014particularly those which might impact the electric grid\u2014so we can devise effective mitigations now. This talk offers a White House policymaker\u2019s perspective on the changing EV landscape, new policy measures under consideration to identify and reduce the impact of vulnerabilities, and the critical role that hackers can play in focusing our work.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1374,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 6.24s | This text was transcribed using whisper model: large-v2

 Alright, good afternoon. My name is Harry Kreisa and I work at the White House
6.24s - 10.68s |  Office of the National Cyber Director. I am Sarah Heupel. I work at the Joint
10.68s - 15.94s |  Office of Energy and Transportation. And we're really excited to talk to you here
15.94s - 22.20s |  today about how our digital ecosystem is going to be a big part of our clean
22.20s - 25.44s |  energy transition and how the clean energy transition is going to be
25.44s - 29.28s |  changing our digital ecosystem. We are excited to tell you about what we've
29.28s - 34.16s |  been learning about EVs, vehicle electrification, and how those lessons
34.16s - 39.84s |  are going to inform the broader clean energy transition. And what we are doing
39.84s - 43.32s |  in government and how we're hoping to partner with you and the broader DEF CON
43.32s - 47.72s |  community to prepare that digital ecosystem for the most ambitious,
47.72s - 57.12s |  abundant, and exciting version of this transition that is possible. So we have
57.12s - 61.28s |  some early lessons from this process. You may have heard that the Biden-Harris
61.28s - 65.28s |  administration is engaging in some generational level investments in our
65.28s - 69.52s |  infrastructure, in our advanced manufacturing capacity. A lot of it
69.52s - 73.04s |  downstream from the bipartisan infrastructure law, the Inflation
73.04s - 76.80s |  Reduction Act, and the Chips and Science Act. Some of the largest clean energy
76.80s - 81.32s |  and advanced manufacturing investments in the history of the United States and around the world.
81.32s - 86.32s |  And in that process, we've started to get some early lessons from this
86.32s - 91.44s |  breakneck deployment of clean energy technologies. And that is that in many
91.44s - 97.44s |  cases, decarbonization is digitization. Clean energy technologies are often much
97.44s - 103.72s |  more technically sophisticated, interconnected, and supply chain complex
103.72s - 109.32s |  than the fossil-based analogs that they're replacing. We're thusly getting a
109.32s - 113.88s |  better appreciation for how the future that we're moving into powered by clean
113.88s - 119.84s |  energy is going to be capable of much more than just a lower carbon one. It's
119.84s - 125.48s |  going to be capable of a near zero marginal cost electricity world. A world
125.48s - 129.08s |  where we're going to be able to have software-defined grid management, virtual
129.08s - 135.08s |  power plants, and just a much more exciting, resilient, and flexible future
135.08s - 138.88s |  than could have ever been possible without those kinds of advanced
138.88s - 144.28s |  clean energy technologies. Now there's also some hurdles between here and there.
144.28s - 151.24s |  The clean energy ecosystem has a lot more new stakeholders, new entrants in it
151.24s - 155.64s |  than a lot of traditional infrastructure sectors. We're benefiting from the
155.64s - 159.40s |  dynamism and innovation of a lot of these new entrants and these
159.40s - 164.32s |  smaller organizations, but they also come without the same decades of experience
164.32s - 168.28s |  that some of the traditional infrastructure players have. Those traditional
168.28s - 171.68s |  infrastructure players often know each other, they know their regulators, they're
171.68s - 175.92s |  used to thinking in terms of threats, threats from state-bound actors, from
175.92s - 179.88s |  criminals, and they're used to thinking about how they interact with each other
179.88s - 185.08s |  in a way that the clean energy ecosystem has not had the same time to develop yet.
185.08s - 191.04s |  We have also seen that this deployment is happening at the pace and speed that
191.04s - 196.72s |  we need to tackle our climate goals, but also at a pace and speed that is faster
196.72s - 202.08s |  than a lot of traditional government mechanisms for regulatory purposes,
202.08s - 208.40s |  industry-led, and public-private standards-building processes are used to
208.40s - 213.48s |  operate that. We also know that, yes, a lot of what we're talking about today is
213.48s - 218.08s |  the dynamics in clean energy specifically, but we're entering a wave
218.08s - 223.80s |  of physical-digital convergence for our entire infrastructure. There's, as a result,
223.80s - 228.80s |  lots of parts of our critical infrastructure that were never designed to be connected to the Internet
228.80s - 233.80s |  have benefited from a sort of accidental air gap for the last few decades, and have never been
233.80s - 238.36s |  prompted to engage in the sort of technology modernization and cyber
238.36s - 242.80s |  security considerations that they're going to need to in the years ahead.
242.80s - 249.80s |  And so we have this once-in-a-generation opportunity to pull a do-over on a bunch of our critical infrastructure,
249.80s - 255.80s |  to use the clean energy transition as an opportunity to rethink how we build
255.80s - 260.80s |  the very foundations of a lot of our society so that it is more capable of
260.80s - 265.80s |  that secure, resilient future while being a lower-carbon MARAC.
265.80s - 270.80s |  And one of the places in our infrastructure where this is most clear
270.80s - 275.80s |  and these dynamics are most prominent is in electric vehicle technology.
275.80s - 279.80s |  I'm going to let my colleague, Sarah, tell you a bit more about that.
279.80s - 287.80s |  Great, thank you. Okay, so in a moment, I'm going to tell you a bit more about the Joint Office of Energy and Transportation.
287.80s - 293.80s |  But to begin with, I want to start from the start, which is that transportation is a leading
293.80s - 300.80s |  greenhouse gas emitting sector, and all of that is led by light-conveying vehicles,
300.80s - 305.80s |  followed by medium-to-heavy-duty vehicles. And I think it's fair to say that the federal government,
305.80s - 310.80s |  and in this case, the Department of Energy, Department of Transportation, and the White House,
310.80s - 316.80s |  is fundamentally, foundationally committed to reducing and eliminating those emissions.
316.80s - 321.80s |  The sales of fully electric and hybrid vehicles are going up.
321.80s - 327.80s |  They're starting to approximate the high-P curve, and that is a big part of transitioning
327.80s - 332.80s |  to cleaner transportation. Cleaner energy is part of that.
332.80s - 337.80s |  In my office, the Joint Office of Energy and Transportation is the technical lead
337.80s - 341.80s |  on the infrastructure build-out that's behind that.
341.80s - 348.80s |  So, a bit more on the Joint Office. We came into being from the bipartisan infrastructure law.
348.80s - 354.80s |  We like to say that we're the startup of government, but I'm from startups, and that's not true.
355.80s - 362.80s |  We are doing government differently, though, and I will say that the focus on affordable, reliable, convenient,
362.80s - 370.80s |  equitable, and safe is a real thing. We are very focused on that, and we are pretty nimble and dynamic.
370.80s - 375.80s |  So, the Joint Office brought in a number of people from the private sector, myself included,
375.80s - 382.80s |  and I am fortunate enough to serve as the lead of engineering for standards, reliability, and cybersecurity.
382.80s - 386.80s |  I have excellent principals, like my principal, Brendan Harris, for cybersecurity,
386.80s - 391.80s |  as well as other folks I've been able to pull in from the private sector in national labs
391.80s - 393.80s |  and other areas of government.
393.80s - 399.80s |  The EV charging ecosystem does have a multiplicity of interdependencies.
399.80s - 404.80s |  It is, I'm sure, old to deal with that for some areas of government.
404.80s - 408.80s |  This is new for this area of government. We'll talk more about that.
408.80s - 413.80s |  The private sector has been trying to crack this nut for a while, but if you're in the automotive area,
413.80s - 415.80s |  you know probably a bit about electric vehicles.
415.80s - 421.80s |  You know that there's the auto manufacturers, there's the EV charging station manufacturers,
421.80s - 426.80s |  network operators, application developers, security, operational security,
426.80s - 429.80s |  and then, of course, there's a tie-in to the utility grid.
429.80s - 437.80s |  Add to that the layer cake, basically, of government from city to state, municipal, tribal, federal.
437.80s - 440.80s |  There's a lot of layers that are happening in this.
440.80s - 443.80s |  So what the joint office is doing is two things.
443.80s - 452.80s |  We are the center of gravity for security and cyber-physical security around the charging infrastructure,
452.80s - 460.80s |  and then we are also seeking to create a web of interconnectedness amongst all these devices and all these players.
460.80s - 464.80s |  It's interoperability, it's reliability, it's security by design.
464.80s - 470.80s |  It's all the principles we cherish from the private sector, from what you all are experts on,
470.80s - 474.80s |  and we're bringing them into the federal government. Just checking my timer.
474.80s - 479.80s |  Okay, so unique infrastructure, unique challenges.
480.80s - 488.80s |  As I talked a bit about, as all the headlines say, electric vehicle charging reliability has some room for improvement.
488.80s - 490.80s |  We're shooting for 97%.
490.80s - 496.80s |  I like all lines myself, but 97% is what our law is, and so that is what we're aiming for.
496.80s - 497.80s |  Some work to go on that.
497.80s - 503.80s |  I could say so much about all of our efforts there, all the funding, the Charging Experience Consortium
503.80s - 506.80s |  that I'm staying on task for cybersecurity right now.
506.80s - 514.80s |  A lot of work for interoperability, data sharing, privacy frameworks, equity, utility coordination that I discussed earlier.
514.80s - 517.80s |  But really, why does this matter?
517.80s - 527.80s |  So again, fundamentally and foundationally, we need everybody who rides and drives electric to trust the infrastructure.
527.80s - 532.80s |  They might not trust the government, they might not know how it got there, they might not know why it's there,
532.80s - 537.80s |  but what I need is for my neighbors, I'm a Detroiter, a Detroit City resident, long time.
537.80s - 546.80s |  I need for my neighbors to pull up and plug their vehicle in, for them to know their data's safe, their vehicle's safe, they are safe.
546.80s - 552.80s |  They can charge an Evert, they can charge in a blackout, they can charge in a tornado, they can trust it.
552.80s - 554.80s |  And that's what we're here to do.
554.80s - 559.80s |  We're here to help provide trust in the system, to anchor that trust,
559.80s - 566.80s |  and to support their ability to ride and drive electric no matter what's thrown at them.
566.80s - 572.80s |  So it is very connected, as I was saying, and interconnected at that.
572.80s - 575.80s |  So we have a number of different players that come into this.
575.80s - 581.80s |  I've discussed a few from automakers, EBSC manufacturers, network operators.
581.80s - 585.80s |  Obviously there's applications developers, cellular providers.
585.80s - 591.80s |  Quite a lot's going to happen with the utility grid that I'll touch on, I'll hint to, I'll allude and foreshadow,
591.80s - 597.80s |  and hopefully you'll find out more about that in the future if you'll follow along with everything we're doing.
597.80s - 603.80s |  And then there's consumer information, there's informational security and operational security,
603.80s - 609.80s |  there's privacy frameworks, and there's the ability for, when I was talking about the layer cake of government,
609.80s - 615.80s |  without going too far into it, but often when there's funding, whether it's BIL or IRA funding,
615.80s - 617.80s |  it kind of flows from the federal government.
617.80s - 623.80s |  They give it to states or they give it to cities and municipalities for different types of programming,
623.80s - 628.80s |  and then those entities select their suppliers and those suppliers execute.
628.80s - 632.80s |  And the entities, whether they're cities or states or whatever level of government,
632.80s - 637.80s |  they need to be able to understand what they're procuring from their suppliers,
637.80s - 643.80s |  ensure excellence in what they're getting from the suppliers, the equipment, the services being rendered,
643.80s - 647.80s |  the reliability, the SLAs, they need to know what they're getting.
647.80s - 649.80s |  So a big part of that is what we offer.
649.80s - 652.80s |  We call that technical assistance in the government.
652.80s - 658.80s |  I'll talk a little bit more about the types of technical assistance we offer to make sure that underpinning,
658.80s - 662.80s |  so everyone who rides and drives electric can trust the infrastructure,
662.80s - 668.80s |  but just want you to keep in mind there's all these parts coming together and the grid.
668.80s - 676.80s |  So this diagram is not really intended to be legible because it's complicated, and that's okay.
676.80s - 678.80s |  Complexity is great, right?
678.80s - 683.80s |  There's a number of different players that have a piece of this block diagram,
683.80s - 687.80s |  whether they're in the private sector, their utilities, or they're in the public sector,
687.80s - 693.80s |  they're in the Office of Electricity, they're the Vehicle Technologies Office, they're our partners in the White House.
693.80s - 698.80s |  So what we're figuring out across the Department of Energy and the Department of Transportation
698.80s - 702.80s |  is what the interplay and interrelatedness of this.
702.80s - 708.80s |  So when vehicles are connected to the grid or they're receiving telematic signals about grid services,
708.80s - 713.80s |  grid information, that they can trust those signals, they can trust that information,
713.80s - 716.80s |  and that the grid can trust those assets and resources.
716.80s - 718.80s |  And it's not just vehicles.
718.80s - 721.80s |  There's other linchpin technologies, right?
721.80s - 725.80s |  There's smart inverters, there's buildings, there's grid-type storage,
725.80s - 729.80s |  there's a lot of distributed energy resources out there.
729.80s - 733.80s |  And the paradigm of how information flows is starting to change.
733.80s - 738.80s |  It's not necessarily just the utility issues some command and control things
738.80s - 741.80s |  and then your air conditioner does something.
741.80s - 748.80s |  We're starting to see that those end devices have minds, or at least they can communicate between each other, right?
748.80s - 752.80s |  Think like autonomous vehicles and paraphernalia communication.
752.80s - 756.80s |  That's what's starting to happen in distributed energy resources as well.
756.80s - 762.80s |  So we need to make sure that those resources are secure, they can securely and intelligently communicate,
762.80s - 769.80s |  they can bring value and a trust chain back up and have revenue-grade data
769.80s - 775.80s |  and have everything securely webbed, connected when they do start to connect to the utility grid.
775.80s - 779.80s |  So that's something that the Department of Energy and our partners at the Department of Transportation
779.80s - 782.80s |  are starting to think a lot about.
782.80s - 788.80s |  So before I turn it back over to Harry, I want to talk a little bit more about what the Joint Office of Energy
788.80s - 792.80s |  and Transportation specifically is working on.
792.80s - 795.80s |  So I come from the private sector, which I mentioned,
795.80s - 799.80s |  and I like to just keep mentioning because it's so new to me to be in the government.
799.80s - 804.80s |  And every time the Department of Energy lab person, I love them so much,
804.80s - 809.80s |  every time they say they wrote a report and somebody didn't read it and they're really upset about it,
809.80s - 814.80s |  I just want to shake them because when do you think they're going to read it?
814.80s - 817.80s |  I worked at Rivian, I worked at Ford before that.
817.80s - 824.80s |  I slept at my desk, I would bring the lamp into my desk for when the lights would go off at work
824.80s - 826.80s |  so I could keep working.
826.80s - 828.80s |  People don't have time to read reports.
828.80s - 830.80s |  That's kind of all there is to it.
830.80s - 832.80s |  There's no report reading time, unfortunately.
832.80s - 834.80s |  We're already missing our kids' baseball games.
834.80s - 837.80s |  I already don't have any hobbies.
837.80s - 838.80s |  There's no reports.
838.80s - 843.80s |  So what we need to do is create tools that make sense and that are,
843.80s - 850.80s |  I wouldn't say competitive with the private sector, but like not that look good,
850.80s - 855.80s |  that compete at the quality level of the private sector.
855.80s - 860.80s |  So one example of that is those of you from or around automotive or working automotive,
860.80s - 864.80s |  you probably know that OEMs often have pretty good security teams.
864.80s - 868.80s |  Maybe you wish it was a little more or better or whatever, especially if you're automotive.
868.80s - 871.80s |  But they're pretty good, they're pretty big, they're usually divided up.
871.80s - 875.80s |  You might even have a PKI specialized team or something fancy like that.
875.80s - 882.80s |  But when you look at EBSC manufacturers, network operators, much smaller companies,
882.80s - 888.80s |  much newer industry, they might only have 30 people that work there.
888.80s - 892.80s |  They probably do have a couple systems engineers that are like dope at cybersecurity,
892.80s - 895.80s |  but not a lot of people.
895.80s - 898.80s |  So expecting one of them to be like a master pen tester
899.80s - 904.80s |  and understand how to run a full star model or really understand how to do this,
904.80s - 909.80s |  how the bandwidth, or have the company be able to pay for a third-party,
909.80s - 913.80s |  excellent pen testing company, like the margin's not there.
913.80s - 916.80s |  So what we want to do is create tooling.
916.80s - 919.80s |  We also in my program, different world of my program,
919.80s - 925.80s |  but we have the first, the Curtin of Energy, direct contribution into open source.
925.80s - 929.80s |  We work with the Linux Foundation Everest Project, which Perry will talk about,
929.80s - 931.80s |  but we'll flash up in a minute.
931.80s - 935.80s |  So through that Everest Project in the Linux Foundation,
935.80s - 939.80s |  we are going to amend on a pen testing tool.
939.80s - 942.80s |  And what that tool would look like is say you've got a great technician,
942.80s - 947.80s |  a great systems engineer, and they'll provide like a hands-on step-by-step
947.80s - 950.80s |  of how to execute a pen test against your system.
950.80s - 953.80s |  How do you layer security? How do you look for threat layers?
953.80s - 955.80s |  How do you evaluate what you have?
955.80s - 959.80s |  How can you find improvements, whether marginal or significant?
959.80s - 964.80s |  It will give you like a step-by-step hands-on walkthrough of really,
964.80s - 968.80s |  really doing an excellent pen test for your domain, for your system specifically.
968.80s - 971.80s |  That's the kind of tooling you need to build.
971.80s - 978.80s |  Other things when I talked about, I'm like 100% less reports as a T-shirt I wear at work,
978.80s - 980.80s |  but we do need to create frameworks.
980.80s - 984.80s |  So frameworks are like the procurement language I talked about before.
984.80s - 986.80s |  The suppliers loved it.
986.80s - 991.80s |  When we put out procurement language, it was like 25 different requirements
991.80s - 995.80s |  that you should ask for for cyber and cyber security for states
995.80s - 998.80s |  when they were looking for suppliers because they're like,
998.80s - 1001.80s |  holy smokes, this is way more thorough than we thought the federal government
1001.80s - 1002.80s |  would come up with.
1002.80s - 1004.80s |  That's the kind of frameworks we want.
1004.80s - 1009.80s |  We want privacy frameworks so consumers know that their data is protected
1009.80s - 1011.80s |  at all times.
1011.80s - 1013.80s |  Data should flow, but it should be protected.
1013.80s - 1014.80s |  They should be able to opt out.
1014.80s - 1018.80s |  They should be able to have the right to be forgiven, forgotten, excuse me.
1018.80s - 1020.80s |  Theoretically, that's just Sarah's opinion,
1020.80s - 1023.80s |  but we need to be able to protect their data and their privacy.
1023.80s - 1025.80s |  So that's a framework we're working on.
1025.80s - 1027.80s |  Another is an incident response.
1027.80s - 1032.80s |  Something happens in the value chain, we should be able to know who jumps on it.
1032.80s - 1033.80s |  The supplier should jump on it.
1033.80s - 1035.80s |  Is the city involved?
1035.80s - 1036.80s |  Is the state involved?
1036.80s - 1038.80s |  Is the federal government involved?
1038.80s - 1042.80s |  Is it like an S fund where we have to go get a subcomponent manufacturer?
1042.80s - 1045.80s |  How do we know where the incident root cause is?
1045.80s - 1046.80s |  How do we take action on it?
1046.80s - 1048.80s |  Who's on first?
1048.80s - 1050.80s |  That's the kind of frameworks that we really need,
1050.80s - 1054.80s |  and that's what we're working on right now.
1054.80s - 1056.80s |  Going forward, where do we want to go next?
1056.80s - 1059.80s |  So I can't believe I made it through a whole talk,
1059.80s - 1064.80s |  and I only mentioned public key infrastructure once, I think, so far.
1064.80s - 1067.80s |  So let me mention it several more times.
1067.80s - 1070.80s |  So my favorite thing ever is public key infrastructure,
1070.80s - 1073.80s |  and we have a lot of activity around this.
1073.80s - 1081.80s |  I have this vision, this goal in life, which is to have roaming for plug-and-charge,
1081.80s - 1083.80s |  a national plug-and-charge, one might call it.
1083.80s - 1085.80s |  Perhaps you even go to Canada and Mexico,
1085.80s - 1088.80s |  and we just call it a North American plug-and-charge.
1088.80s - 1089.80s |  I think we're there.
1089.80s - 1093.80s |  So I heard the fellow earlier talking about injections
1093.80s - 1097.80s |  into ISO 15118-2 when I walked in, my favorite topic.
1097.80s - 1103.80s |  So we have 15118-2, which has PKI referenced in it,
1103.80s - 1106.80s |  public key infrastructure referenced in it.
1106.80s - 1111.80s |  It's been sort of a hot mess and a topic of heated debate and fighting
1111.80s - 1115.80s |  and infighting and outfighting for years and years and years and years.
1115.80s - 1117.80s |  But it seems like we got it together,
1117.80s - 1120.80s |  and there will be a certified trust list, it looks like,
1120.80s - 1124.80s |  and there's a number of different suppliers and North America have opted in.
1124.80s - 1127.80s |  It looks like we have the framework together.
1127.80s - 1130.80s |  So the federal government, because I love public key infrastructure so much,
1130.80s - 1133.80s |  has done quite a lot to make sure folks can trust this
1133.80s - 1135.80s |  when they ride and drive electric.
1135.80s - 1138.80s |  We've done healthy testing, supported it,
1138.80s - 1142.80s |  NREL, the National Renewable Energy Laboratory.
1142.80s - 1145.80s |  We then did adversarial testing against it
1145.80s - 1149.80s |  where we shared best and standard practices for adversarial testing.
1149.80s - 1152.80s |  Now we're moving on to more like firmware-based.
1152.80s - 1155.80s |  So if you have been in the industry,
1155.80s - 1160.80s |  the industry talks about state machines different than, I think,
1160.80s - 1163.80s |  the public sector and national labs who talk about a state machine.
1163.80s - 1168.80s |  So I think about this as, you know, you need to pull certificates out of your HSM
1168.80s - 1172.80s |  and pull them into your charging controller so you can run your TLS library
1172.80s - 1175.80s |  and then know to switch the vehicle from state E to B
1175.80s - 1178.80s |  to start your 15118-2 charging controller.
1178.80s - 1181.80s |  Well, every supplier on earth has to do that,
1181.80s - 1184.80s |  and it's just everybody has to do it over and over and over again.
1184.80s - 1188.80s |  If we could start creating technologies like that as a commodity
1188.80s - 1190.80s |  and releasing them into open source
1190.80s - 1193.80s |  or at least creating standard and best practices,
1193.80s - 1196.80s |  I think that'll help speed up innovation
1196.80s - 1200.80s |  and it'll help American engineering and manufacturing
1200.80s - 1203.80s |  compete better with other geographies.
1203.80s - 1205.80s |  So we're really working on getting into the weeds,
1205.80s - 1209.80s |  getting down to the module level, then at the device level,
1209.80s - 1211.80s |  then into the cloud level.
1211.80s - 1216.80s |  And I'll just make one last pitch for putting the user first in ChargeX.
1216.80s - 1221.80s |  So I do fund one of the largest consortiums within the Department of Energy
1221.80s - 1223.80s |  called the Charging Experience Consortium.
1223.80s - 1228.80s |  I won't bore you to tears with it, but it's 88 private sector partners.
1228.80s - 1231.80s |  So if you are from a company that's not a member of it,
1231.80s - 1233.80s |  we would love to have you.
1233.80s - 1235.80s |  We run three national labs,
1235.80s - 1239.80s |  and we focus on the user experience soup to nuts,
1239.80s - 1241.80s |  everything you can imagine about it.
1241.80s - 1244.80s |  And that's where it all starts, that's where it all ends,
1244.80s - 1247.80s |  equity, user experience, cybersecurity.
1247.80s - 1252.80s |  And with that, I'll have Harry to sum up.
1252.80s - 1256.80s |  So as Sarah described, we've got some big takeaways here
1256.80s - 1261.80s |  from that complex ecosystem that is becoming a more unified one
1261.80s - 1264.80s |  that is providing us this future we want to live in
1264.80s - 1268.80s |  based on creating these stakeholder groups
1268.80s - 1271.80s |  so we know how to navigate all that technical ambiguity,
1271.80s - 1274.80s |  figuring out how to get through standards and balance processes
1274.80s - 1278.80s |  in a more nimble way, making sure we're ahead of where research is going,
1278.80s - 1280.80s |  where technology is going, so we have the opportunity
1280.80s - 1283.80s |  to mitigate systemic risk along the way.
1283.80s - 1288.80s |  And in the spirit of trying to create these stakeholder communities
1288.80s - 1291.80s |  and that sense of shared strategic direction,
1291.80s - 1295.80s |  today the Biden-Harris administration is announcing its priorities
1295.80s - 1298.80s |  for ensuring the digital ecosystem is ready to deliver
1298.80s - 1300.80s |  on the clean energy transition.
1300.80s - 1302.80s |  And that includes five linchpin technologies
1302.80s - 1304.80s |  that Sarah mentioned in there,
1304.80s - 1306.80s |  which are batteries and battery management systems,
1306.80s - 1309.80s |  inverter controls, distributed control systems
1309.80s - 1312.80s |  like virtual power plants, building management systems,
1312.80s - 1314.80s |  and of course EVs and EV cybersecurity.
1314.80s - 1317.80s |  But you may notice here that three or four of those
1317.80s - 1320.80s |  first ones there are all co-residents in EVs
1320.80s - 1322.80s |  and EV charging infrastructure.
1322.80s - 1324.80s |  So there's lots of economies of scale here
1324.80s - 1327.80s |  and lessons that you can bring forward here from this process.
1327.80s - 1329.80s |  And that's why we need you.
1329.80s - 1332.80s |  That's why we need people like you in the car hacking village
1332.80s - 1335.80s |  to tear these things apart, to show us where the vulnerabilities are,
1335.80s - 1337.80s |  to make these things stronger,
1337.80s - 1340.80s |  and put many eyes and prodding keyboards on it.
1340.80s - 1343.80s |  And it's why we want you to look at open source software stacks
1343.80s - 1346.80s |  that underpin all of these technologies
1346.80s - 1349.80s |  that are going to be critical to the success of the clean energy transition.
1349.80s - 1351.80s |  We want you looking at these.
1351.80s - 1354.80s |  We want your help making sure that they're secure and resilient
1354.80s - 1357.80s |  and able to get us to that future that we all deserve to live in.
1357.80s - 1360.80s |  So please take a look at them, find those holes,
1360.80s - 1362.80s |  and let us know how to make them better
1362.80s - 1364.80s |  and make the linchpin technologies
1364.80s - 1366.80s |  and the open source software that they live on
1366.80s - 1369.80s |  possible to deliver us that future we all want and deserve.
1369.80s - 1371.80s |  Thank you.


url: https://www.youtube.com/watch?v=dDFtkjYx0V8
title: DEF CON 32 - Behind the Badge:How we used hardware to make AV badge - Adam Batori, Robert Pafford
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
content:
{
  "webpage_url": "https://www.youtube.com/watch?v=dDFtkjYx0V8",
  "title": "DEF CON 32 - Behind the Badge:How we used hardware to make AV badge - Adam Batori, Robert Pafford",
  "description": "ADS-B aircraft tracking has long been done with Raspberry Pi\u2019s and SDRs. We set out to build our own receiver from the ground up, but without resorting to expensive and power-hungry SDR chips. Join us for a behind-the-scenes look as we walk through how we were able to (ab)use hardware to squeeze an entire Linux system, custom signal processing chain, and map visualizer into a chip that costs less than most microcontrollers.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 1262,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.00s - 4.24s | This text was transcribed using whisper model: large-v2

 All right. Thank you, everyone, for coming out. And apologies, there's a little delay,
4.24s - 11.04s |  as happens with these things. But we're going to go pretty fast. We have a lot to go over,
11.04s - 19.04s |  thanks in no part to our Silicon vendors, our supply chain, or DHL. But yeah, we're excited
19.04s - 24.08s |  to talk about behind the badge and a little bit on how we use and abuse hardware to create the
24.08s - 28.08s |  ADS-B receiver on a badge for the aerospace versions here. My name is Adam Latorre. This
28.08s - 35.36s |  is Robert Bradford. And let's get into it. So we'll start off with some theory and some
35.36s - 46.94s |  practice. But the theory of the badge is when, yeah, the idea we have for the badge is actually
46.94s - 51.74s |  one that Aerospace Village has had kind of in the back pocket for a while, which is it wouldn't be
52.38s - 58.38s |  super cool to do an ADS-B receiver on a badge, fully integrated and able to run without needing
58.38s - 63.34s |  a network connection from a service like FlightAware or anything that feeds community
63.34s - 69.90s |  crowdsource ADS-B. So for those of you that might not be aware, ADS-B, or Automatic Dependent
69.90s - 76.46s |  Surveillance Broadcast, is a protocol. It's a type of signal that's a very important aspect
76.46s - 81.66s |  of aviation safety. It is transmitted between airplanes, between ground stations, and in some
81.66s - 89.58s |  cases even with satellites that can transmit a whole host of messages between different stations.
90.14s - 94.22s |  The most relevant for us are things like call signs, flight numbers, AKO addresses,
95.58s - 100.78s |  altitude, headings, so information about planes that you can see flying overhead.
101.82s - 109.42s |  And while it's intended uses for safety and air traffic control, a common hobbyist and enthusiast
109.58s - 115.82s |  case is it's just cool to be able to see a map of all the planes and aircraft around you overhead
115.82s - 119.42s |  and be able to see what flight number it is, its heading, where it's going, flight plans.
120.46s - 125.42s |  And ADS-B itself can exist over multiple types of data links, but when we say ADS-B,
125.42s - 130.78s |  the most common physical medium that it's sent over is the MODIS downlink at 1090 megahertz.
131.42s - 136.62s |  And if you want more information on ADS-B, what it's used for, talk to the Aerospace Village.
137.50s - 142.86s |  But where we come in as like hardware design and badge designers is how do we actually,
142.86s - 146.30s |  we have this signal, we know what we want to receive, but how do we actually implement and
147.18s - 153.58s |  make a badge that can receive this signal? So the most common like enthusiast receivers
153.58s - 159.50s |  utilize SDRs or software-defined radios like the RTL-SDR. And because this was designed a long time
159.50s - 164.38s |  ago, the protocol and the modulation is actually fairly simple to demodulate and decode. It's
164.94s - 169.34s |  on-off keyed, which is effectively digital amplitude modulation. It's either on or off.
169.34s - 174.78s |  You're either getting RF or you are not on the 1090 megahertz. And the data bits themselves
174.78s - 179.66s |  are Manchester encoded, meaning that the data exists in the transitions between 1 and 0 or 0
179.66s - 187.82s |  and 1. Now to do this on a badge, if you want to do a so-called real SDR receiver, the chips that
187.82s - 195.10s |  require for that is expensive. They are like very high-end RF chipsets and it's way too expensive
195.10s - 201.50s |  to put on a badge. Think of something like a Hyper-RF, for example, as a proper SDR.
202.46s - 210.30s |  The SDRs like the RTL-SDR uses a DVB-T, which is a digital terrestrial broadcast television.
211.18s - 215.90s |  And they overdrive those chips to run faster than they're intended to, which lets you get
215.90s - 221.74s |  into that 1090 megahertz band and then receive it and decode it in software. One of the issues that
222.30s - 225.74s |  we found when we started looking to using one of these DVB-T tuner chips ourselves, though,
225.74s - 232.70s |  is that they are very power hungry. They are very power hungry, especially when
232.70s - 238.94s |  being overdriven to hit the 1090 megahertz band. And in addition to just getting really, really hot,
238.94s - 244.38s |  the battery life of the badge would be next to zero. So we had to come up with a new way to do it.
245.18s - 249.90s |  And the third major way of receiving ADS-B is the log amp architecture.
249.90s - 255.34s |  This uses a very fast RF power level meter, which converts the logarithmic received RF power
255.34s - 260.94s |  into a linear output voltage. And in this mode, it can act as an envelope detector
262.30s - 270.06s |  when filtered with some very tight 1090 megahertz saw filters. So the way that the architecture,
270.06s - 278.22s |  the receive chain works is that you get the entire RF spectrum coming in through your antenna
278.22s - 283.58s |  that gets amplified and filtered and amplified and filtered again through very tight 1090 megahertz
283.58s - 289.66s |  bandpass filters. So we can extract only the very specific slice of the spectrum that is centered at
289.66s - 295.74s |  1090 megahertz. And then because the signal that we are trying to demodulate is just on and off,
296.22s - 303.10s |  the RF power meter will let us know is it seeing no RF or is it seeing more RF. And that lets us
303.10s - 313.18s |  turn the 1090 megahertz ADS-B packets in the air into a two megahertz baseband level output.
314.46s - 321.90s |  And we actually used an amplifier and anti-aliasing filter chip from a composite video signal,
322.70s - 330.06s |  from a composite video receiver, because it is very cheap. If you want to buy an eighth order
330.06s - 335.74s |  Butterworth filter with multiple channels and power amplifiers and clamp diodes, well,
335.74s - 341.58s |  analog devices would love to charge you a lot of money for that. But no one uses composite
341.58s - 345.90s |  video anymore, right? But if you want this composite video amplifier with an eighth order
345.90s - 351.98s |  Butterworth filter implemented into it and multiple chains and an amplifier, well,
352.78s - 360.62s |  please take it. Who uses composite video? But the last step in this process is digitizing the
360.62s - 366.86s |  signal itself. Again, the common way of doing it is to put it into a fast analog to digital
366.86s - 374.78s |  converter, an ADC. But again, high performance RF intended ADCs are expensive. And
375.98s - 379.34s |  when trying to optimize design, the best chip is no chip.
382.14s - 386.78s |  So the SOC that we're using for the main Linux component of the badge is the Allwinner T113.
386.78s - 391.26s |  It has dual Cortex-A7s, and we'll get into some more of the specs a little bit later.
391.82s - 396.86s |  But it doesn't have any fast ADCs on board, at least nothing that's actually fast enough to
396.86s - 403.34s |  demodulate ADS-B. Well, it is intended actually for automotive video applications.
403.98s - 409.90s |  So it has multiple video inputs and outputs. And one of the supported video input modes is
409.90s - 417.26s |  composite video. Well, if you know your composite video trivia, the baseband signal has frequency
417.26s - 422.78s |  components that require at least a 27 mega sample ADC. And sure enough, if you look at the block
422.78s - 431.18s |  diagram we have in our data sheet, it says that on the left side next to the PGA is an ADC block,
431.18s - 440.32s |  because you must have a fast ADC to be able to digitize composite video. And it's a fast ADC,
440.32s - 447.04s |  but if I actually go back, you can see the ADC is not isolated. It's wrapped inside a bunch of
447.04s - 453.12s |  filters. You have the PGA, you have all the hardware blocks that are designed to demodulate
453.12s - 458.72s |  composite video. So you don't get raw samples from the ADC, you get pixels basically. So it
458.72s - 464.08s |  tries to find a lock, it tries to find H-sync, it tries to find V-sync. It has built-in filters to
464.08s - 471.28s |  do color correction, which means that as it stands, it could not receive ADS-B, it couldn't actually
472.16s - 475.68s |  get you samples because it would just always say, oh, I can't find a signal, I can't see a video
475.68s - 482.32s |  signal, and just do nothing. But the ADC itself is in the silicon. And as we like to say, we paid
482.32s - 487.44s |  for the whole silicon and we want to use the whole silicon. And well, we had to do some reverse
487.44s - 493.44s |  engineering on how to be able to disable these filters. And we were able to discover certain
493.44s - 500.40s |  undocumented registers, some undocumented registers in the all-owner chip itself that let you put it
500.40s - 506.24s |  into this special manufacturing test mode. See, making fast ADCs, the reason it's expensive
506.24s - 510.80s |  and isolation is that it's kind of hard to fabricate and then verify the harmonic performance
510.80s - 517.12s |  of. So the silicon manufacturer will put in these modes that let you basically bypass out
517.92s - 521.84s |  the actual video, the H-sync and V-sync blocks, because those would probably work,
521.84s - 527.04s |  but the ADC itself can then be isolated in the special test mode, which can get you the true
527.04s - 531.68s |  raw samples out. And then when you have the true raw samples, you can verify the performance.
531.68s - 537.76s |  So that's exactly what we want to be able to abuse this as a standalone, straightforward ADC.
538.96s - 545.76s |  And that's exactly what we did. We did some reverse engineering, we found the registers,
545.76s - 551.84s |  and when we put it into this test mode, as you can see from the trace, that is pulled from a
551.84s - 559.68s |  badge with the RF front end attached, that is the ADS-B preamble and the start of a data packet
559.68s - 566.88s |  being received as raw samples from the onboard ADC. And actually, I will go back. You see the
566.88s - 573.60s |  preamble pattern, the 101-101, and that's exactly what we're seeing on the output of our ADC.
574.56s - 579.20s |  And this was our proof of concept to say that, okay, we can actually do this. We can get away
579.20s - 585.60s |  with not using any external ADC or SDR chips or really anything intended to be used in this way,
585.60s - 594.82s |  except like the saw filters, and do it fully integrated on just the core Linux SoC. Now,
596.18s - 600.82s |  as I said, the specs of the badge itself, outside of just the RF, we are running full
600.98s - 607.94s |  mainline Linux 6.6. We thought it'd be really cool to bring basically a Linux dev kit on a board.
607.94s - 614.26s |  And since we have the power of our SoC to do the RF decoding, and we have to write a bunch of
614.26s - 617.06s |  software to manage the Wi-Fi and everything, we're like, hey, instead of writing all the
617.06s - 623.70s |  drivers ourselves, mainline Linux is out there, and it's great. Let's use it. Our display is a
623.70s - 632.10s |  40 by 40 circular display, which we got custom manufactured for us. A lot of people actually
632.10s - 638.42s |  thought it's like, it's not a smartwatch screen. We actually don't really know where it's from,
638.42s - 644.58s |  but when our display manufacturer said, hey, guys, we have these cool, we have the circular
644.58s - 648.90s |  displays you're talking about, and this 2.7-inch form factor, what do you think? We're like,
648.90s - 653.46s |  this is perfect. It looks like a radarscope. It looks like an oscilloscope. Let's go.
654.66s - 661.70s |  Outside of the ADC, on the core T113 SoC itself, we have the dual-core A7s running at 1.2 gigahertz
661.70s - 668.82s |  each, and that's the application processor cluster that is running Linux. And then another bonus
668.82s - 674.66s |  that we got on our silicon is the HiFi4 DSP, which we'll talk about a little bit more in a few
674.66s - 681.78s |  slides, but that's a DSP core that's designed to be an audio coprocessor that we are, again,
682.02s - 686.50s |  reprogramming outside the manufacturer's use case to actually do the demodulation,
686.50s - 695.22s |  Manchester decode, and ADS-B bit slicing. In the package, we have embedded 128 megs of DDR3
695.22s - 702.58s |  SD-RAM, 8 gigabytes of eMMC onboard storage, and some other RF implementations. We have GPS
702.58s - 708.18s |  and Wi-Fi, because why not? We're already going all out. We're already doing full custom RF and
709.06s - 713.46s |  printed PCB antennas. Let's go for broke. Let's add GPS. Let's add Wi-Fi.
715.46s - 717.54s |  So, that's all in theory.
718.98s - 722.50s |  Before that, I think there's a badge giveaway that's going to...
722.50s - 724.90s |  No, it's okay. I'll keep going.
724.90s - 725.70s |  Okay, okay.
727.78s - 732.66s |  So, now this is all what we had in theory. This is what came up with the designs,
732.66s - 736.98s |  and then we get it manufactured by our manufacturer, and then they come back,
736.98s - 740.34s |  and now we actually get to implement it, and go through all the crazy
741.46s - 745.30s |  systems, and actually do the reverse engineering, and make sure that we can actually get this ADS-B
745.30s - 750.90s |  receiver running inside of this badge. So, you'd think the most challenging part of this whole
750.90s - 757.06s |  design process would be the fully custom ADS-B receiver running with an ADC in an undocumented
757.06s - 761.70s |  test mode, and then piping it into an audio DSP, which was never designed with the goal of actually
761.70s - 769.14s |  doing ADS-B decoding. But that was actually the easiest part. The RF, Adam being a mad lad,
769.14s - 775.22s |  made a full zero to tri-band microwave RF in just four months. This is his first RF project.
778.74s - 783.14s |  And then the TV decoder code, we got it working after a night of debugging, and we actually had
783.14s - 788.66s |  a cool oscilloscope mode that we could actually read directly from the ADC in, and get it plotted
788.66s - 794.26s |  on our screen. And then we got the DSP code execution in a week, and then after that we did
794.26s - 798.74s |  a week for Linux kernel dev, and then a week for algorithms, and we got ADS-B. That was the easy
798.74s - 804.10s |  part. It was everything else that should have just worked that didn't, mainly which, if any of you
804.10s - 809.06s |  guys have ever worked with USB-C before, can probably understand why it's USB-C. And then,
809.06s - 814.66s |  of course, the AXP2585 battery management chip, which we will go into more detail later about the
814.66s - 821.46s |  whole experience with that. So, before we get into the more challenging parts, here's a quick
821.46s - 830.50s |  guide on running code on your HiFi4 DSP. So, the Allwinner T113, it has a HiFi4 DSP, and they
830.50s - 834.34s |  advertise it as, oh, you have a third core. But what they don't tell you is that they only give
834.34s - 838.98s |  you the firmware as like a blob that gets loaded in, and it's only for audio processing, because
838.98s - 843.86s |  it has an audio out, and it does all the codecs with that. And the mainline kernel doesn't even
844.82s - 851.78s |  touch the DSP. But it is its own CPU core. It can be programmed, and if you find the right resources,
851.78s - 857.22s |  you can actually program it. Because we're doing all of these ADS-B processing, we want to try and
857.22s - 861.22s |  get the maximum performance to get as high speed out as possible, so we can increase the sample
861.22s - 866.58s |  rate and have better performance. So, we wanted to do the full SIMD vectorization, and actually
866.58s - 872.34s |  use the real HiFi4 toolchain from the vendor, rather than using a lot of the open source ones
872.34s - 879.14s |  you might find with ESP32 running with GCC. So, if you find the Extensa toolchain, which needs to,
879.70s - 883.46s |  then you need to, you get the Extensa toolchain and compiler with the vendor tools,
883.46s - 888.90s |  but you also need to actually get the custom vendor IP block, which was used to generate that
888.90s - 894.34s |  exact silicon. The great part about HiFi4 is it can be exactly customized to the exact chip you
894.34s - 899.46s |  want to build. So, if you want to have all of these advanced vector units, you can add them in. If not,
899.46s - 903.30s |  you can remove them. You can have however many registers you want, and it's all configurable to
903.30s - 907.46s |  the silicon vendor, but that means that the compiler needs to know what it has available,
907.46s - 912.18s |  and the way they do that is a full blob, which has full Verilog for the chip that actually gets
912.18s - 917.14s |  produced, as just a giant zip file, and you load it all into the toolchain, and it figures out how
917.14s - 921.94s |  to program for your chip. So, once you find that, then you have to compare that with the exact
921.94s - 927.62s |  version of the Extensa toolchain that it was built with, and then you have to locate all the drivers
927.62s - 931.78s |  from Allwinner, and source them, and gather them up to actually do the interrupt controller, timers,
931.78s - 936.26s |  and mailbox, and then you just download the FreeRTOS port from GitHub, and you combine them
936.26s - 940.26s |  all together, and you can actually get one of the most stable development environments we've had on
940.26s - 945.30s |  this entire badge, where you just run Extensa Explorer, and it just works. So, that's kind of
945.30s - 953.94s |  the process for getting DSP. And now, actually, for Linux on the badge, we are, again, we mentioned
953.94s - 958.58s |  we're using mainline Linux, and that actually drastically sped up the dev time, where you don't
958.58s - 963.86s |  have to do, a lot of the drivers came pre-baked, you just have to configure them correctly. It just
963.86s - 969.06s |  works, but you have to figure out how to configure it, so a lot of the time, it's finding magical
969.06s - 973.86s |  incantations and device trees that you forget to set, that cause it to panic, all of that, and then
973.86s - 977.54s |  if you put all the things together, and you figure out that it should be working, but it's not,
977.54s - 981.22s |  then it's a bug, and then you spend three weeks doing advanced kernel debugging, figuring out why
981.22s - 987.70s |  your display is not working. Speaking of which, display trivia. Take a guess, which of these four
987.70s - 991.86s |  options caused the artifacting of the clock being messed up, you have too large of a back porch,
992.74s - 996.82s |  there's an unknown silicon bug that only happens when the Linux driver sets an undocumented bit,
996.82s - 1001.46s |  which just happens to exist in a sister chip, but is not on our system on chip,
1001.46s - 1004.82s |  or the display controller registers were initialized in the wrong order,
1004.82s - 1010.98s |  but they never tell you the right order. The answer is E, you didn't seat the cable properly
1010.98s - 1015.22s |  when you're trying to solve all the other previous ones, and you're trying to debug the issue above.
1016.10s - 1022.90s |  This is the silicon bug. So this was just a fun thing, and we spent three weeks trying to solve
1022.90s - 1027.46s |  this silicon bug right here, where actually the display would turn green, and it was because
1027.46s - 1032.98s |  they were setting some, the driver for the sister chip had a bit which they were setting, but it
1032.98s - 1038.66s |  caused this chip to glitch in a weird way, causing the MSB of that green channel to be set high,
1039.22s - 1044.02s |  but it only occurred on this one, and you have to go through all 10,000 lines of the display driver
1044.02s - 1048.58s |  and find the exact line you have to comment out which caused the display not to turn green.
1048.58s - 1051.06s |  But if you do that, then you have a working screen.
1053.94s - 1061.22s |  So here's a continuation of the meme. The AXV2585 has been the thing that has been battling us and
1061.22s - 1069.06s |  fighting us for the entire badge. So this chip, it's just a USB-C negotiator, battery charger,
1069.06s - 1072.82s |  BME, all-in-one. It's actually a very unique chip, because there's not that many that do
1072.82s - 1076.10s |  all of these. A lot of the time, you have to get several chips and stitch them together.
1076.66s - 1083.94s |  So there's no firmware. It's not like some embedded 8051 core or all that. It's just
1083.94s - 1089.70s |  basic I2C registers you need to configure. How difficult could it be to program? It's just flip
1089.70s - 1097.54s |  flops, right? There were several bugs that we found in the AXV2585, and all of them battled
1097.54s - 1101.78s |  us throughout development. From the first bring up, we've had battery detection, which says it
1101.78s - 1106.74s |  should try and detect if there's a battery and not try and charge it if it doesn't see one. But they
1106.74s - 1110.74s |  say it should always try and do that by default, but all of the chips we get actually are cleared,
1110.74s - 1115.14s |  and they assume a battery is present, causing weird instability until you program it in the
1115.14s - 1119.94s |  bootloader and in Linux. There's also fun things where if you get power or any sort of hardware
1119.94s - 1125.62s |  glitches, it causes very undefined results in the silicon, where certain registers stop working or
1125.62s - 1131.22s |  things stop writing. There's also the joys of USB Type-C, where we learned that if you plug it into
1131.22s - 1135.78s |  certain model MacBooks, instead of the MacBook charging the badge, the badge will try to charge
1135.78s - 1142.58s |  the MacBook, which does not work. There's also the biggest thing that actually delayed us a lot
1142.58s - 1146.90s |  right at DEF CON when we were trying to solve this, and we spent a big part of the time when
1146.90s - 1152.02s |  we were trying to get things ready, trying to debug why the actual IRQ pin to interrupt the
1152.02s - 1158.02s |  Linux kernel and say data is available, actually not being going low. And this was all due to a
1158.02s - 1162.74s |  certain manufacturing issue. It was not actually a bug in the chip or a configuration issue,
1162.74s - 1168.42s |  but one of the pins was not soldered correctly by the board manufacturer. It passed all visual
1168.42s - 1173.22s |  inspection, but one of the ground pins was not soldered well enough, and it got just enough of
1173.22s - 1179.06s |  a ground pin connection through the other ground pad that it worked enough, but not enough to have
1179.06s - 1184.82s |  a bunch of weird glitches and voltage dropping out and weird chip instability. So we have probably
1184.82s - 1191.78s |  this AXP2585. It's a great chip for the cost and everything, but the true cost for this chip is
1191.78s - 1197.86s |  really in the development hours of all these bugs trying to solve the USB-C issues and bring up and
1197.86s - 1202.58s |  try and figure out why the chip isn't booting. But if we wrangled it enough to actually get the
1202.58s - 1207.30s |  badge running and we have a stable system, just make sure you have a battery in when booting up
1207.30s - 1214.50s |  because BMU gremlins will come up without it because of instabilities. So yeah, that's it.
1216.02s - 1218.02s |  So yeah. All right.
1223.94s - 1226.90s |  All right. So yeah, thank you so much for joining us for this overview. I know it's
1227.86s - 1232.98s |  as you could see, we've been battling gremlins for untold amount of time. So everything is a
1232.98s - 1239.14s |  little bit rushed, but we have zero minutes. So if you have any questions, we will be more than
1239.14s - 1244.66s |  happy to chat after either here at the village. Basically, you can come find us. We'd love to chat
1244.66s - 1252.98s |  some more. And yeah, if you have a badge out there, tag us on the Aerospace Village Twitter.
1252.98s - 1261.46s |  We'd love to see where they travel to and what planes are picking up. And with that, thank you.


url: https://www.youtube.com/watch?v=YPcOwKtRuDQ
type: video
author: DEFCONConference
ingestion_date: 2024-11-09
transcription_model: large-v2
chunking_status: completed
title:
DEF CON 32 - Anyone can hack IoT- Beginner’s Guide to Hacking Your First IoT Device - Andrew Bellini

content:
{
  "webpage_url": "https://www.youtube.com/watch?v=YPcOwKtRuDQ",
  "title": "DEF CON 32 - Anyone can hack IoT- Beginner\u2019s Guide to Hacking Your First IoT Device - Andrew Bellini",
  "description": "Yes, anyone can hack IoT devices and I\u2019ll show you how! It doesn\u2019t matter if you\u2019re an experienced pen tester in other fields, completely new to cybersecurity or just IoT curious, by the end of this talk you\u2019ll have the knowledge to hack your first device. You might be thinking - but I thought IoT was complicated, required knowledge of hardware, and expensive tools. In this talk, I\u2019m here to dispel those myths by directly showing you the methodology, tools and tactics you can use to go and hack an IoT device today (or maybe when you get home). I\u2019ll cover what IoT devices are best for beginners, what tools you need (and don\u2019t need), how to build a small toolkit for less than $100, common tactics to get a foothold into IoT devices and how to find your first vulnerability or bug.",
  "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw",
  "duration": 3252,
  "channel": "DEFCONConference",
  "uploader": "DEFCONConference",
  "upload_date": "20241016"
}

0.21s - 5.89s | This text was transcribed using whisper model: large-v2

 Welcome everyone. My name is Andrew Bellini and I am here today to both
5.89s - 11.09s |  convince you and show you that anyone can hack IOT devices. So in the talk
11.09s - 14.33s |  today I'm hoping to both convince you that and I'm also going to walk you
14.33s - 19.11s |  through a methodology that you can go take home, buy a cheap consumer IOT
19.11s - 23.69s |  device and hopefully hack it. Before we get into the actual specifics of that I
23.69s - 28.65s |  actually just want to start with a really quick joke and that joke is the
28.65s - 34.25s |  S in IOT stands for security. Has anyone heard that joke before here? It's one
34.25s - 38.17s |  that I hear, yeah I see some people are hearing it. It's one that I hear tossed
38.17s - 42.69s |  around the cybersecurity community and usually when I hear that joke it's
42.69s - 47.41s |  actually by folks that don't work specifically in IOT or embedded security
47.41s - 52.29s |  but as someone who actually has a background working in industrial IOT
52.29s - 56.61s |  devices and embedded devices I won't say I'm not salty about it I'll actually put
56.61s - 63.33s |  my hand up and be the first to say that it is a well-deserved joke. So the thing
63.33s - 66.85s |  about that joke is and we can all you know have a laugh at IOT devices and
66.85s - 71.49s |  their lack of security but the reality is if you you know check out and look
71.49s - 75.93s |  at how many estimates for IOT devices there are connected in the world right
75.93s - 80.17s |  now you'll see greater than 15 billion you know estimates that's almost two per
80.17s - 86.21s |  person of IOT devices and in addition to that we're expecting there to be a big
86.25s - 90.17s |  surge of IOT devices because of AI and machine learning how they're going to be
90.17s - 94.85s |  used for edge devices and it's estimated looking at the projections there could
94.85s - 101.21s |  be 30 million by or 30 billion sorry by the end of the decade so that is a lot
101.21s - 105.05s |  of things to secure and these are everywhere so it's not like they're just
105.05s - 109.97s |  in our households from you know smart cameras to even smart toilets these are
109.97s - 114.13s |  also in critical infrastructure they're in our cars they're essentially
114.13s - 120.22s |  everywhere nowadays so one of the things that I kind of thought when I was
120.22s - 124.18s |  starting to get interested in IOT security is there's so many devices and
124.18s - 128.74s |  in addition to that there's this agreed-upon kind of thing in the security
128.74s - 133.46s |  community that IOT devices are not secure so I figured there would be a lot
133.46s - 138.58s |  of people doing IOT hacking and the cyber criminals are definitely taking
138.58s - 142.78s |  advantage of this they love finding vulnerabilities and IOT devices and
142.78s - 146.98s |  adding them to their botnets or using them for initial access but my
146.98s - 150.66s |  experience was in the ethical hacking community when I started meeting hackers
150.66s - 155.10s |  and things like that and asking them if they hack IOT devices a lot of times the
155.10s - 159.70s |  answer was no and that was kind of reaffirmed today too I've had a booth
159.70s - 162.70s |  here where we've been doing IOT hacking and I had mostly beginners who had never
162.70s - 168.42s |  done it and it was awesome to teach them that so one of the things that you know
168.42s - 171.82s |  I when I ask people why aren't you doing IOT hacking there's a few
171.82s - 176.50s |  misconceptions that I hear about it and I just want to try and dispel some of
176.50s - 180.82s |  those so the very first one is that it's too expensive so you need to buy
180.82s - 185.02s |  expensive gear you need like you know an oscilloscope or like a microscope or
185.02s - 189.30s |  expensive tools to get into it when you're starting out and this is a
189.30s - 194.18s |  reality you're probably going to need to buy the devices you want to hack on and
194.18s - 199.02s |  then addition there was really a large lack of affordable training when I was
199.02s - 203.14s |  looking to learn even you know five years back it was like $5,000 for a
203.14s - 208.66s |  course a lot of them were in person and then the second misconception I hear is
208.66s - 212.10s |  that it's very complicated you need to like have an engineering degree you need
212.10s - 217.02s |  to know about electronics you need about hardware circuits all of that stuff you
217.02s - 220.50s |  need to know about special protocols in addition to just the you know normal
220.50s - 225.78s |  things that you need to know about hacking and in my opinion you know some
225.78s - 228.90s |  of these are true there is some truth to it but I actually think there are ways
228.90s - 234.54s |  that you can actually learn to hack IOT devices commercial IOT devices off the
234.54s - 238.10s |  shelf without spending that much money and there is a lot of great resources to
238.10s - 243.42s |  learn how to do it for free or for very limited amounts of money okay so I've
243.42s - 246.74s |  been chatting for a little bit I just wanted to give a quick intro to who I
246.74s - 252.14s |  am and why I know a little bit about IOT and IOT security so my name again is
252.14s - 257.30s |  Andrew Bellini I go by digital Andrew on the socials my background is actually in
257.30s - 261.62s |  electrical engineering so before I got into cybersecurity I did a lot of work
261.62s - 266.10s |  actually designing embedded devices and industrial IOT devices so that's a
266.10s - 269.74s |  little bit where I learned about it not specifically in security but just
269.74s - 275.10s |  actually you know designing the devices that we use I now work as a content
275.10s - 280.30s |  creator at TCM security so there I am the creator of our IOT hacking course
280.30s - 284.90s |  it's a beginners IOT hacking course and I also created our practical junior IOT
284.90s - 288.62s |  tester certification and if you do want to link up with me you want a copy of
288.62s - 291.86s |  these slides you want to see what I'm working on I got lots of free blog
291.86s - 297.67s |  resources or anything like that check out my website so a little bit of
297.67s - 302.07s |  motivation for this talk I have one specific goal and that is to provide you
302.07s - 307.71s |  with a methodology specific tools and knowledge to vine vulnerabilities aka
307.71s - 313.35s |  hack in commercial IOT devices and I have a couple messages here from some of my
313.35s - 316.99s |  previous students just to give you some motivation and also proof that this
316.99s - 320.59s |  methodology works so I had one student he actually just messaged me a couple
320.59s - 324.87s |  weeks before Defcon I was super excited to see this I didn't know him before but
324.87s - 328.65s |  he said I took I took your course and he had you know chatting with him I he had
328.65s - 333.39s |  never done any IOT hacking he took my suggestion he went and got a cheap smart
333.39s - 337.95s |  camera off Amazon and he actually was able to find three vulnerabilities in it
337.95s - 340.95s |  got in touch with the vendor and he's got three CVS coming so super excited
340.95s - 343.99s |  for about that and then there was another message this person didn't want
343.99s - 346.91s |  me to put their name up but he he took my course as well and then he bought a
346.91s - 351.63s |  cheap router and he found a remote code execution vulnerability in it and I just
351.63s - 355.67s |  was chatting with him about how he could submit that to a CNA because the vendor
355.67s - 360.62s |  didn't want to talk to him about it but how he found a vulnerability so this
360.62s - 365.06s |  chat is for everyone of course if you're here I'm glad you're here if you are if
365.06s - 369.98s |  you're new to IOT or you're IOT curious as I say this talk is specifically
369.98s - 374.22s |  catered to people who are new or just curious about IOT and it's going to
374.22s - 380.58s |  assume you have limited or no experience with IOT or embedded systems so it's a
380.58s - 383.94s |  really quick agenda of what we're in for today we'll start with some really
383.94s - 387.62s |  quickly safety and and legal considerations we'll then talk about
387.62s - 391.90s |  what device you should actually pick if you're getting started on so if you want
391.90s - 394.62s |  to go home and buy something off Amazon what you should look for if you're gonna
394.62s - 398.66s |  go dumpster diving for example we'll then talk about how you can build out an
398.66s - 401.94s |  affordable toolkit and what stuff you should buy or what's up you should avoid
401.94s - 406.02s |  and how to not you know break the bank doing this then I'm going to take a look
406.02s - 410.22s |  at locating using and abusing hardware interfaces we'll then talk about
410.22s - 413.82s |  acquiring firmware and then after that we get our hands on the firmware we'll
413.82s - 417.94s |  talk about analyzing and reversing engineering it so just a really quick
417.94s - 421.02s |  staying out of trouble this is kind of like the golden rule of ethical hacking
421.02s - 425.14s |  in my opinion only test devices that you're authorized to and then this is my
425.18s - 429.02s |  personal suggestion since I am giving a talk about potentially how to go out and
429.02s - 433.78s |  find CVs and IOT devices but I always recommend being ethical and following
433.78s - 438.90s |  responsible disclosure if you do find things unfortunately for a lot of IOT
438.90s - 442.38s |  devices they don't have bug bounty programs but they do have responsible
442.38s - 446.34s |  disclosure so you can at least report it get some credit and get a CV that way or
446.34s - 449.94s |  something so last one's up to you but you know I would implore you to go that
449.94s - 454.38s |  route if you find something okay so I did want to just give a little chat
454.38s - 458.02s |  about staying safe because sometimes I give workshops or things like that and
458.02s - 461.42s |  I teach people about IOT and hardware hacking and they're a little bit nervous
461.42s - 465.78s |  about opening up a device and working on the hardware of it so the first thing I
465.78s - 471.86s |  will say is IOT hacking is in itself very inherently safe so hardware hacking
471.86s - 476.74s |  on commercial IOT devices and that's really if you just only follow one basic
476.74s - 480.02s |  rule you'll be fine and that rule is that you should never work on anything
480.02s - 483.26s |  high voltage so when you open up the device you're working on it most of
483.26s - 487.70s |  these devices are going to be like 12 volts 9 volts 3.3 volts 5 volts operating
487.70s - 491.50s |  voltage all of those are for the most part safe to work on you probably won't
491.50s - 495.06s |  even feel it if you touch it the voltage from our walls and our house and stuff
495.06s - 499.06s |  that stuff can really hurt you so just stay away from that stuff just work
499.06s - 503.58s |  inside your device you'll be fine never use any damage or modified power
503.58s - 506.54s |  supplies because that's how we can accidentally introduce those higher
506.54s - 510.62s |  voltages into the device damage our device ourselves and then this last one
510.62s - 514.86s |  is more about keeping your devices safe but when I give workshops I see people
514.86s - 518.62s |  doing this all the time this is the most common way to brick or fry your device
518.62s - 521.82s |  but if you have it open and you're working on it then that's not how the
521.82s - 526.74s |  manufacturer intended you to be using it and if you're plugging in clips or wires
526.74s - 529.94s |  or things like that if you have it powered on it's easy to bridge
529.94s - 533.42s |  something and do a short circuit and that's the easiest way that I see people
533.42s - 536.36s |  who are learning fry their device so it's just really good practice if
536.36s - 540.96s |  you're not using it turn it off plug anything in you need then turn it on
540.96s - 543.64s |  when you're done and if you need to unclip it you power it off then you work
543.64s - 547.08s |  on it and it's easy to forget I'm always walking around my workshops warning
547.08s - 551.00s |  people of that last thing I just want to give a really quick shout out to because
551.00s - 555.28s |  people have gotten seriously injured from this or hurt doing this you aren't
555.28s - 557.92s |  really gonna counter these and IOT devices but if you take your hardware
557.92s - 560.60s |  hacking skills that you learn from this to other things I have larger power
560.60s - 564.76s |  supplies is watch out for large capacitors because these can actually
564.76s - 568.92s |  pack a punch as far as the amount of energy they store and also some people
568.92s - 572.88s |  don't realize but when you unplug these devices or capacitors from the wall they
572.88s - 575.96s |  can hold their charge for quite a while so you may think you're safe but they
575.96s - 580.20s |  can zap you this is not common in pretty much all IOT devices but I just say this
580.20s - 583.36s |  because a lot of people have this misconception if it's unplugged it's
583.36s - 588.28s |  safe but if there's large capacitors that's not the case okay so now that
588.28s - 592.04s |  we've got all of the preamble and everything out of the way we can get on
592.04s - 596.24s |  to you know kind of my methodology for how you can go home get a cheap consumer
596.24s - 600.08s |  IOT device and hack it so the first thing to do is actually to pick the
600.08s - 605.36s |  right target if you're learning so I always suggest the cheaper the better
605.36s - 608.80s |  when you're starting to learn and there's a couple reasons for this the
608.80s - 612.40s |  first one is and this isn't always the case but usually you get what you pay
612.40s - 617.80s |  for in terms of security and also hardware security so on cheaper devices
617.80s - 621.40s |  you generally won't run into limitations on the hardware where the
621.40s - 626.08s |  debug ports are locked down or the firmware is encrypted and then the
626.08s - 629.16s |  second one which kind of goes with my second point here is I never hack
629.16s - 634.00s |  anything that I don't mind bricking or destroying and if it's a cheap device
634.00s - 637.56s |  then you're not gonna be as concerned or upset if you fry it and you know I'll
637.56s - 641.36s |  raise my hand and say I still you know fry or brick devices it happens I've
641.36s - 644.52s |  been hardware hacking for a long time and it still happens and if you're a
644.52s - 648.28s |  follower of Joe Grand for example probably one of the most famous hardware
648.28s - 652.20s |  hackers he gave a talk a few DEF CONs ago he literally he literally just
652.20s - 656.52s |  talked about all of the devices that he had bricked over the years so it happens
656.52s - 660.96s |  to all of us if you're looking for a specific type of device my suggestion is
660.96s - 665.20s |  to go with cheap routers or cheap smart cameras they're great to start on they
665.20s - 668.12s |  usually have vulnerabilities that you can find and also more importantly they
668.12s - 674.20s |  almost always run embedded Linux which in my opinion is a much easier type of
674.36s - 677.44s |  device to hack on when you're learning than something with a microcontroller
677.44s - 682.24s |  like ESP 32 or STM 32 that's gonna be running an RTOS those are a little bit
682.24s - 685.56s |  more advanced or harder when you're getting started and I will give another
685.56s - 690.56s |  shout out to a dumpster diving so on my on this picture here this is one of many
690.56s - 694.48s |  bins I have at my house are just full of old devices and I just kind of put it
694.48s - 698.10s |  out into the universe like my friends and family know that I'm this dude that
698.10s - 701.92s |  likes hacking weird electronic stuff so if they're throwing away their router or
701.92s - 706.60s |  camera then they ask me or I find them in like disposal bins or whatever I
706.60s - 709.56s |  can't resist so it's a great way to learn though because usually these
709.56s - 712.60s |  devices work fine people are just they're obsolete or whatever but they
712.60s - 717.16s |  don't have to worry about breaking them or anything okay so once we've got a
717.16s - 720.40s |  device hopefully it's a smart camera or a router or something we've got to
720.40s - 725.48s |  acquire a little bit of gear to go along with this methodology so I've got a
725.48s - 727.96s |  couple of rules for that the first one is we don't want to break the bank when
727.96s - 731.00s |  we're starting out you might not know if you want to do it or not we don't want
731.00s - 736.48s |  this to be a limitation I also generally find that gear for IOT
736.48s - 740.88s |  hacking follows the 80-20 rule so if you're not familiar with this with this
740.88s - 747.14s |  rule it's kind of the idea that for any given input that's 20% of the inputs are
747.14s - 751.00s |  responsible actually for 80% of the outputs and I find that to be true with
751.00s - 754.52s |  IOT hacking tools you need to get a few of them and they'll do most of the heavy
754.52s - 758.68s |  lifting and then you'll need to acquire the more specialized expensive tools for
758.68s - 764.20s |  specific tasks sure at this point everyone's seen a lot of the meme of
764.20s - 767.84s |  this Turkish shooter guy and I just wanted to demonstrate this I was kind of
767.84s - 771.52s |  poking fun last week and like the IOT and hardware hacking community about how
771.52s - 774.88s |  we all like to acquire gear and I'll be the first one to say like I'm addicted
774.88s - 778.64s |  to buying gear I've got all the stuff in the left-hand side of this picture but
778.64s - 781.20s |  really when you're starting out with cheaper devices you can probably get away
781.20s - 787.70s |  with literally two things and spend ten dollars okay so the first piece of
787.70s - 790.86s |  equipment that you should get if you don't have one already is a digital
790.86s - 795.18s |  multimeter this is like the Swiss RB knife of electronics it can do things
795.18s - 799.98s |  like measuring voltage current resistance do continuity testing mostly
799.98s - 804.46s |  we will use this for verifying voltage levels and also we can actually use it
804.46s - 808.22s |  to find a lot of common debug ports without special equipment we can
808.22s - 812.98s |  actually you know ID those and then do further investigation into those ports
812.98s - 818.06s |  you can literally spend $5 on this this yellow one on here that's $5 I got this
818.18s - 822.18s |  off Aliexpress I've used it in my workshops before I mean I wouldn't use
822.18s - 825.70s |  it for like commercial QA testing or anything but as far as learning IOT
825.70s - 830.22s |  hacking getting started it's not bad I have five to a hundred dollars listed
830.22s - 833.22s |  here I wouldn't recommend spending more than a hundred dollars but you can but
833.22s - 838.96s |  your $5 one honestly it's not that bad the second piece of equipment you'll
838.96s - 845.36s |  need is a USB to X adapter and by X I mean the protocols that our IOT devices
845.36s - 848.88s |  are going to be talking at the hardware level so these are where those like
848.88s - 854.20s |  debug and test ports come into play the most common ones are UART SPI or so
854.20s - 860.56s |  you'll sometimes you're referred to a spy I2C JTAG and SWD the most common one
860.56s - 864.68s |  you'll actually see and what we're gonna be focusing on is UART so you can just
864.68s - 868.64s |  go and get this $2 one and that will work for this methodology you get these
868.64s - 872.72s |  off Aliexpress Amazon sometimes come like a pack of four for $10 you get in
872.72s - 877.28s |  250 so if you just want to go the cheap route you just buy this $2 one you'll be
877.28s - 881.52s |  fine if you kind of want a future proof and you actually want a tool to work
881.52s - 885.60s |  into I always recommend the Tigard board I really like their board and they have
885.60s - 888.92s |  good training that's free that goes along with how to use it and it's gonna
888.92s - 892.00s |  talk all of these common protocols actually so it'll do UART for you and
892.00s - 897.16s |  then when you know if you need to jump up to something JTAG SWD or I2C
897.16s - 901.48s |  then you can use this as well okay so the last this is the last thing that's
901.48s - 905.04s |  gonna be in our toolkit is some sort of flash programmer you can get these in
905.04s - 910.20s |  all varying different levels but this is a cheap one for $10 and we will use
910.20s - 914.96s |  these to mainly extract the firmware off the device if we can't get it from other
914.96s - 919.96s |  methods so most of the cheap IOT devices I see and why I'm suggesting these
919.96s - 925.84s |  routers and cameras they all use the same like standard SPI flash chip 8 pin
925.84s - 929.82s |  so you can use a flash programmer generic one like this to read it if you
929.82s - 932.92s |  did get the Tigard you don't even need to get one of these you can just use the
932.92s - 936.92s |  the SPI connection on that and honestly you might not even need this so it might
936.92s - 940.04s |  mean before you were seeing us we got the firmware from the vendor then you
940.04s - 944.96s |  don't even need a flash programmer you can just download it all right so we got
944.96s - 948.08s |  all our stuff we picked the device we've got our gear we're ready to start
948.08s - 952.20s |  hacking the first thing we're gonna take a look at is abusing debug ports and
952.20s - 958.28s |  hardware interfaces so for the most part IOT and embedded devices they don't have
958.28s - 962.52s |  any keyboard or mouse input they don't have a monitor they just kind of do
962.52s - 965.88s |  something and if they're not doing that thing right then when you're designing
965.88s - 971.36s |  it and as a designer your debug and test interfaces these are like your only link
971.36s - 974.84s |  to that device to see what's going on what's going wrong what's happening
974.84s - 980.24s |  making sure things are going properly so what happens in R&D of the cheap devices
980.24s - 983.92s |  a lot of times is they will use these throughout the R&D design process we'll
983.92s - 986.68s |  get to the end device will be ready to go and they don't want to do another
986.68s - 990.84s |  revision of hardware and things like that or maybe firmware so they'll just
990.84s - 995.28s |  leave these on the board open like they were when they were testing in addition
995.28s - 998.40s |  a lot of times they're actually used in production devices for things like
998.40s - 1003.48s |  debugging doing logging QA testing and possibly even flashing memory or things
1003.48s - 1008.84s |  like that the most two common ones I see are UART and JTAG we're just gonna be
1008.84s - 1014.14s |  focusing on UART because on the majority of cheap consumer IOT devices that's the
1014.14s - 1020.12s |  most present one and I almost always see UART that you can use and abuse so this
1020.12s - 1024.04s |  talk is like the no BS no filler version of it so I'm not even gonna
1024.04s - 1027.20s |  really teach you about what the UART protocol is only the things that you
1027.20s - 1031.44s |  need to know to hack it it stands for universal asynchronous receiver
1031.44s - 1034.92s |  transmitter that just basically means there's no clock and there's two lines
1034.92s - 1039.92s |  one one for receiving and one for transmitting on it's a very old and
1039.92s - 1043.64s |  common protocol for electrical communication it's a little bit more
1043.64s - 1047.68s |  complicated than this but this the the basics of it is it literally just talks
1047.84s - 1053.52s |  binary with voltage so it sends plus 3.3 volts or 5 volts for one zero volts for
1053.52s - 1057.48s |  a zero and I got a little picture here of a capture if you're curious but
1057.48s - 1062.04s |  that's literally all you need to know about it for the as far as hacking it on
1062.04s - 1067.84s |  it so getting connection to a device as you are if you're doing like a pen test
1067.84s - 1070.96s |  or something that would be a finding but for the most part the manufacturers
1070.96s - 1076.20s |  don't actually care specifically about that however actually getting access to
1076.20s - 1081.20s |  the UART will make it a lot easier for us to be able to find vulnerabilities
1081.20s - 1084.72s |  like something that could be exploited from the web it's gonna make us a lot
1084.72s - 1089.52s |  easier to find those and the reason for that is we can view the devices logging
1089.52s - 1093.76s |  so that's probably the most important thing in embedded devices there's
1093.76s - 1098.24s |  usually not a lot of storage and they'll maybe be almost no actual writable
1098.24s - 1101.88s |  storage that we have so there's no place to store logs so instead we're just
1101.88s - 1107.28s |  going to dump that all out to UART in addition if we are encountering embedded
1107.28s - 1111.04s |  Linux then usually we can actually use the UART connection to get a shell into
1111.04s - 1115.40s |  the device we can do further enumeration that way sometimes we can access the
1115.40s - 1118.48s |  bootloader which is responsible for it actually brings up the device and if we
1118.48s - 1121.48s |  can get into the bootloader we can do things like dump the firmware see
1121.48s - 1125.32s |  environment variables and so yeah getting you art is a great thing
1125.32s - 1129.48s |  especially for the logging you can see in the picture here I'm just looking at
1129.48s - 1132.12s |  some of the boot logs and there's actually quite a bit of detailed
1132.12s - 1139.23s |  versioning information that we can see already so once you start using you art
1139.23s - 1142.59s |  and this happens to me like when I see a board it's very very easy to start
1142.59s - 1147.03s |  picking them out like whenever I see a PCB now just subconsciously I'm like oh
1147.03s - 1151.75s |  that's you are I can see it so I start looking for them and once you start
1151.75s - 1156.11s |  noticing a few characteristics you'll be able to ID them so generally for full
1156.11s - 1160.43s |  duplex you art so this means that you got two devices your IOT device and then
1160.43s - 1163.99s |  maybe your computer that has your adapter they're talking to they're both
1163.99s - 1167.99s |  talking to each other that means there's going to be a transmit line which you'll
1167.99s - 1172.31s |  see abbreviated always as TX a receive line abbreviated as RX and a ground
1172.31s - 1176.19s |  sometimes you'll see a VCC and I'm just calling that out because if you see four
1176.19s - 1179.87s |  pins for our hacking purposes you can just ignore the VCC we don't we don't
1179.87s - 1184.87s |  even need to use it so unfortunately they won't always make it as easy like
1184.87s - 1189.55s |  in this example here they've gone so nice as to label them for us and all the
1189.55s - 1192.95s |  hardware hackers but they won't always make it this easy sometimes you'll have
1192.95s - 1198.27s |  test pads like the ones here on this black circle PCB this is a camera that I
1198.27s - 1202.31s |  was hacking and you'll notice there's only two pins together but seeing those
1202.31s - 1205.11s |  two pins together and close to the processor I thought that they might be
1205.11s - 1208.95s |  you art and then I just picked up a ground elsewhere and then we got another
1208.95s - 1213.27s |  router here where they've got a connector here for you art and it's not
1213.27s - 1216.19s |  labeled but you know as soon as you see those pins together like that it's a
1216.19s - 1220.83s |  good indication that it's some sort of test interface so this is where we're
1220.83s - 1225.27s |  gonna pull out our DMM and we can use like our $5 DMM to actually pick up you
1225.27s - 1229.15s |  art so what we're going to do is we're gonna take advantage of the fact that
1229.15s - 1233.63s |  you art is extremely chatty on boot up so if you've ever booted up like your
1233.63s - 1237.03s |  Linux computer even or some Windows ones and you see all the stuff come and
1237.03s - 1241.27s |  scrolling through the screen telling you all those boot log information well
1241.27s - 1244.83s |  embedded Linux is the same and that's going to happen on the you art as well
1244.83s - 1248.55s |  and we can take advantage of that so what we can do is use our multimeter put
1248.55s - 1253.23s |  it on the volts DC setting and measure our the pins of interest so if we think
1253.23s - 1257.71s |  there might be a you are pin we'll just measure that from that from that
1257.71s - 1261.35s |  connector whatever it is to ground and then after we're doing that we'll power
1261.35s - 1264.23s |  on the device so I always like to have a power bar in my workstation that has a
1264.23s - 1268.79s |  button it makes it a lot easier and what you're looking for is a fluctuating
1268.79s - 1272.07s |  voltage after that boot up you'll usually be like a couple seconds after
1272.07s - 1276.59s |  take a second for like the initial bootloader to load things up and then
1276.59s - 1281.03s |  you'll start to see a bunch of voltage hopping up and down you won't see it go
1281.03s - 1285.35s |  like 0 to 3.3 volts or 0 to 5 volts because it's gonna be too fast for our
1285.35s - 1289.63s |  multimeter to read that so instead what you'll see is more of an average voltage
1289.63s - 1293.63s |  kind of moving around a lot of times these devices operate at 3.3 volts so
1293.63s - 1298.07s |  you'll see like 1.5 to 2.7 volts and you'll see that moving up and down so if
1298.07s - 1301.63s |  you see that that's a really indication I should look further at this port it's
1301.63s - 1306.27s |  probably transmitting something if you just power on the device and do this you
1306.27s - 1309.39s |  probably won't see anything because it's not going to be as chatty it'll maybe
1309.39s - 1312.83s |  just send a couple messages and it'll be really hard to even see those blips of
1312.83s - 1317.75s |  voltage you got to do it right at startup okay so we found this port we've
1317.75s - 1321.11s |  identified it the next thing we're going to do is we can just it's as easy as we
1321.11s - 1325.15s |  can just plug it into our computer basically we use our UART to USB bridge
1325.15s - 1329.07s |  adapter plug that into our computer the only thing you need to keep in mind for
1329.07s - 1333.15s |  it is it's really easy to put like names together so you want to put TX to
1333.15s - 1337.43s |  TX but the way that it works is one device is TX goes to the other ones RX
1337.43s - 1341.99s |  and vice versa so you just need to cross those lines grounds go to ground ignore
1341.99s - 1346.03s |  the VCC you're all good so just for reference I got a little picture here if
1346.03s - 1348.51s |  you're looking at the slides later but that's the pin out that you would
1348.51s - 1353.51s |  usually take so unfortunately sometimes they won't make it that easy they won't
1353.51s - 1356.51s |  put the header pin on there won't be through-hole connectors so what do we do
1356.51s - 1360.51s |  in that scenario the best option is to solder so hopefully you're hanging out
1360.51s - 1364.59s |  at the soldering skill station but if not there's there's ways we can get
1364.59s - 1368.63s |  around that so if you are lucky enough to have through-hole connectors like we
1368.63s - 1372.87s |  did I showed in the one router the best way to do that is to actually attach
1372.87s - 1377.31s |  some header pins to it and if you don't have those there's lots of clips clamps
1377.31s - 1382.03s |  adapters and things like that where you can buy more specific to your device
1382.03s - 1385.03s |  Google's your friend here and they're really not that expensive so just go out
1385.03s - 1388.79s |  and take a look at your different options and like just to show you if you
1388.79s - 1392.07s |  don't want to do soldering here's two things I've done in a pinch and shown in
1392.07s - 1395.91s |  classes where you can get away with generally with through-hole connectors
1395.91s - 1400.25s |  they'll actually be like connectivity that goes through the actual pin so if
1400.25s - 1403.51s |  you put a little pressure on what you're putting through it so kind of lean to
1403.51s - 1406.87s |  the left or right that'll be enough to get good contact I did it here with a
1406.87s - 1411.15s |  twist tie or that's some some sticky tack and obviously soldering is your
1411.31s - 1415.11s |  option but I don't want that to be a barrier to you know hacking IOT if you
1415.11s - 1419.51s |  don't have a soldering iron or to solder so this can be done in a pinch if you're
1419.51s - 1423.03s |  running on a Linux host I mostly just included these commands here for people
1423.03s - 1426.81s |  that are gonna be taking these slides afterwards but all we need to do to
1426.81s - 1431.47s |  actually get a shell or connect to the device is we need to just check and see
1431.47s - 1435.23s |  what the device ID is for our USB to UART adapter so we can do that with this
1435.23s - 1440.31s |  command and you'll get the device ID back it'll most likely be TTY USB 0 but
1440.31s - 1444.79s |  it could be 1 2 3 and then we can just launch a terminal emulator and use that
1444.79s - 1449.11s |  to get a UART connection when you're starting out I suggest using screen
1449.11s - 1453.39s |  because it's the easiest one there's lots of other ones Pico com minicom putty
1453.39s - 1457.43s |  if you're on Windows they're all fine but screen in my opinion is the easiest
1457.43s - 1462.11s |  one it requires very little setup the only two arguments you need is that USB
1462.11s - 1466.15s |  device ID that I showed before and then you'll notice the last thing here I've
1466.15s - 1471.35s |  got a number 115,200 that is the baud rate or speed that the UART is
1471.35s - 1476.43s |  communicating at and since this is an OBS no filler talk I'm not even
1476.43s - 1482.43s |  explain what baud rate is on 99% of IOT devices I see it is 115,200 so you can
1482.43s - 1486.23s |  just use that if it's not it's probably 9600 and if it's not that you're
1486.23s - 1490.95s |  probably doing something wrong there is also a very common list on Wikipedia you
1490.95s - 1498.45s |  can look out of other ones but it's pretty much gonna be 115,200 okay so if
1498.45s - 1500.85s |  everything worked with your connection you got screen running you power on
1500.85s - 1505.29s |  device you should start to actually now see those boot logs that we saw with our
1505.29s - 1510.25s |  multimeter actually start streaming through and do not discount the
1510.25s - 1513.61s |  importance of actually reading through those boot logs and seeing what they are
1513.61s - 1517.05s |  telling you they're gonna give you lots of versioning information that could be
1517.05s - 1520.77s |  enough to even find a vulnerability on its own seeing that it's using you know
1520.77s - 1524.41s |  underlying libraries or things like that that are outdated and someone's
1524.41s - 1527.77s |  already done the legwork and found a vulnerability in those will also give
1527.77s - 1531.61s |  you details in this one for example near the bottom showing all the partition
1531.61s - 1536.45s |  details about the flash EEPROM that's on it and that's gonna make it a lot
1536.45s - 1541.13s |  easier for us later to identify the different parts of the firmware after
1541.13s - 1544.37s |  the bootloader goes through and you know it's done streaming through the text you
1544.37s - 1548.09s |  can hit enter and a lot of times on cheap IOT devices that can be enough to
1548.09s - 1551.21s |  just get a shell they don't lock them down with a password or anything so then
1551.21s - 1555.37s |  we'll be in a root shell generally an embedded Linux everything just runs as
1555.37s - 1558.89s |  root there's no like least privileges or anything you'll just get a root shell
1558.89s - 1562.85s |  again like in the manufacturers they're not as concerned about this as being a
1562.85s - 1566.33s |  specific vulnerability so I wouldn't recommend reporting this or anything
1566.33s - 1569.93s |  because they already know about it they just don't necessarily care but we're
1569.93s - 1574.01s |  gonna abuse that to find something they do care about the majority of the
1574.01s - 1576.49s |  routers and smart cameras they're running embedded Linux so that's where
1576.49s - 1581.57s |  this is gonna make it easier to get that shell okay so I always mention this
1581.57s - 1585.29s |  because you know in cybersecurity I feel like we all want to get a shell everyone
1585.29s - 1588.73s |  loves getting shells and sometimes that's like the end all of what we're
1588.73s - 1592.37s |  doing if we're doing like web app or you know other different types of network
1592.37s - 1597.21s |  pen testing but for us actually connecting to the UART it's more
1597.21s - 1599.85s |  important for us to see the logging that's actually what we're more
1599.85s - 1604.05s |  we're more interested in or at least I am so if you don't get a shell that's
1604.05s - 1608.09s |  okay if you're not able to get in that's fine so sometimes there'll be a
1608.09s - 1612.05s |  password if there is there's ways around that we can maybe get the hash from the
1612.05s - 1615.85s |  firmware or Google it but even if you can't get a shell that's okay the way
1615.85s - 1619.13s |  that you are it works is like you don't need to authenticate or log in it's a
1619.13s - 1623.49s |  very like low-level protocol it's just going to stream those logging bits out
1623.49s - 1626.85s |  to you no matter what you don't need to log in or anything like that you can
1626.85s - 1631.21s |  still see the logging unless the device like sinks or tanks the UART which most
1631.21s - 1635.21s |  don't so I got just got some pictures here showing some interesting things I
1635.21s - 1639.21s |  see in logs one of them here is just showing the location of RSA keys as it's
1639.21s - 1643.37s |  setting up drop arrow it's common SSH protocol and then the other two ones are
1643.37s - 1648.29s |  interesting logging details about when I was actually interacting with the device
1648.29s - 1653.41s |  and showing what could potentially be command injection or one is just showing
1653.41s - 1659.01s |  how it sets up and saves the pre-shared keys and SS IDs for a router so if you
1659.01s - 1662.17s |  are lucky enough to get a shell I mean I was saying it's not as important but it
1662.17s - 1666.97s |  is always nice to get one we'll be good hackers then and do our enumeration so
1666.97s - 1671.45s |  start poking around best places to actually start looking are the Etsy
1671.45s - 1674.21s |  folders and the VAR folders those are probably some of the places where you'll
1674.21s - 1679.05s |  find like interesting configuration details and things like that some some
1679.05s - 1682.89s |  really quick wins are things I look for is their passwords hard-coded keys is
1682.89s - 1686.97s |  their endpoints that maybe they don't want to expose or that we could see
1686.97s - 1690.29s |  that's reaching out into the back end and of course a lot of times you'll have
1690.29s - 1693.85s |  like things like PS or net stat so you can see what processes are running and
1693.85s - 1696.53s |  what network connections are going out so that can give us a little bit of a
1696.53s - 1704.36s |  lay of the land around the device okay so at this point you know we've got our
1704.36s - 1707.04s |  device we've got our equipment we use our equipment to find our debug
1707.04s - 1711.68s |  interface what's the next step that's going to be to get our hands on the
1711.68s - 1715.84s |  firmware and in my opinion this is where my favorite part starts and where we can
1715.84s - 1720.20s |  start having some fun and find some vulnerabilities if you're not familiar
1720.20s - 1723.84s |  with what firmware is this essentially the software that is running on the
1723.84s - 1727.68s |  device and kind of call it firmware and differentiate it from software and that
1727.68s - 1731.44s |  it's kind of designed specifically for that device so that that device can
1731.44s - 1734.48s |  fulfill one function it's not really changing you're not going to like
1734.48s - 1738.12s |  install any software or anything on your router or smart camera we just get that
1738.12s - 1743.04s |  one piece of firmware in embedded Linux that we're talking about today the
1743.04s - 1747.40s |  firmware is generally comprised of four main parts we've got the boot loader
1747.40s - 1750.88s |  that's responsible for actually like bringing up the device on boot up loading
1750.88s - 1754.20s |  up the kernel we've got then got the Linux kernel itself that's going to be
1754.20s - 1759.08s |  one partition we then got the root file system so that's actually where all of
1759.08s - 1762.68s |  the interesting stuff is that make the device do what it's going to do all of
1762.68s - 1768.52s |  the binary scripts configuration documents all of that stuff is going to
1768.52s - 1772.16s |  be in the root file system well then possibly also have some sort of
1772.16s - 1776.28s |  partition where we can store a little bit of writable data so we'll generally
1776.28s - 1778.68s |  want to hunt for this as well because that's where you're going to find things
1778.68s - 1783.12s |  like passwords that users configured or like the maybe pre-shared key for their
1783.12s - 1786.60s |  wireless or all that kind of stuff so a lot of times you'll see that at the end
1786.60s - 1792.32s |  of the flash memory the root file system has the most goodies though by far so
1792.32s - 1796.00s |  that's all we're going to focus on today you can find vulnerabilities in the
1796.00s - 1798.68s |  other places in the boot loader and kernel but when you're starting out
1798.68s - 1802.12s |  we'll just look at the root file system and its contents and that's honestly
1802.12s - 1807.84s |  that where you'll find the majority of vulnerabilities anyway so there's three
1807.84s - 1811.16s |  main ways that I usually get my hands on the firmware there are a few other ones
1811.16s - 1817.00s |  that are more complicated but the easiest one is a lot of cheap IOT
1817.00s - 1821.64s |  manufacturers they just put their firmware available on the Internet from
1821.64s - 1825.44s |  the vendor to download the reason for this is that unfortunately they don't
1825.44s - 1830.16s |  put any type of update mechanisms into their device so they kind of pass that
1830.16s - 1834.96s |  responsibility down on to the end users if there is security patching or things
1834.96s - 1838.72s |  like that to go and hey make sure you go to our website check it every day
1838.72s - 1842.80s |  download the firmware and then put it on the device yourself which I think
1842.80s - 1846.60s |  unfortunately I would say like 99% of users don't do but to fulfill that
1846.60s - 1850.92s |  obligation they put the firmware on their website on the support page and
1850.92s - 1854.04s |  you can just google and find it and I love that because it's super easy to get
1854.04s - 1857.72s |  our hands on the firmware and if you do that then you can even do IOT hacking
1857.72s - 1861.72s |  for free you don't even need any gear you just download the firmware the
1861.72s - 1865.76s |  second way is if you did get a UART shell I would say like 90% of the
1865.76s - 1871.00s |  devices I see they have TFTP on them so it's trivial file transfer protocol this
1871.00s - 1875.48s |  is there because it's actually baked into the functionality of a lot of those
1875.48s - 1879.16s |  update mechanisms so if you have like a web app or a browser or something and
1879.16s - 1882.36s |  allows you to do a firmware update through that in the back end it uses
1882.36s - 1887.00s |  TFTP but we can you know abuse that or borrow it to set up our own TFTP server
1887.00s - 1890.68s |  and then we can just bring back files of interest or if we're patient enough
1890.68s - 1894.64s |  we can just bring the whole root file system back to our device over that and
1894.64s - 1897.98s |  then we don't even really need to worry about dumping the firmware and then the
1897.98s - 1901.36s |  last one which sometimes you'll need to do is you'll just dump the firmware off
1901.36s - 1907.04s |  of the device so in these cheap commercial IOT devices I'm suggesting
1907.04s - 1913.84s |  getting starting on they almost always use a 8 pin spy flash chip and these
1913.84s - 1919.16s |  always follow the same pin out and we can use our flash raw or our flash
1919.16s - 1922.76s |  reader that I suggested getting or the TiGuard to really do a really quick read
1922.76s - 1925.92s |  of these and we don't even need to usually take them off of the device you
1925.92s - 1931.28s |  can just read them in device in circuit and the way to do that is I generally
1931.28s - 1934.64s |  recommend using flash ROMs free open source software that's great for
1934.64s - 1939.40s |  interacting with flash chips so again command here for reference if you're
1939.40s - 1944.08s |  just wanting to follow along later but if you get a ch341 a programmer which is
1944.08s - 1948.68s |  that $10 one that I recommended from the start then you can just run this command
1948.68s - 1952.28s |  after you put the clip on and it's as easy as that there's also other test
1952.28s - 1956.48s |  clips you can do to use it but it's pretty straightforward it lists the
1956.48s - 1960.16s |  different pins that match the pins on the chip you can just google standard
1960.16s - 1964.20s |  SPI 8 pin flash and you'll see all of the pins there's six of them that you
1964.20s - 1968.16s |  need to use out of the eight pins just a heads up so if you did get the TiGuard
1968.16s - 1977.68s |  you can do this with the TiGuard okay so we've all this basically everything
1977.68s - 1982.64s |  we've been doing up until this point now has been to set us up for successful
1982.64s - 1988.36s |  reverse engineering of the internals of the device to figure out what's going on
1988.36s - 1993.66s |  and to hopefully find some vulnerabilities so that's what we're
1993.66s - 1997.76s |  going to be taking a look at now and so one thing you can do too if you don't
1997.76s - 2002.36s |  want to spend any money is you just can go and find the firmware for download
2002.36s - 2006.40s |  and then you can do the majority of these steps as well and then you haven't
2006.40s - 2010.68s |  even spent a dollar or you could also try and emulate the firmware as well
2010.68s - 2012.96s |  it's not something we're going into today but I just want to give that a
2012.96s - 2016.04s |  call out like if you can't get your hands on a device you don't want to
2016.04s - 2019.52s |  spend any money you just kind of want to get started you can do it for free just
2019.52s - 2023.64s |  get your firmware try and reverse engineer it and emulation is your friend
2023.64s - 2029.47s |  okay so the first thing we do once we get our hands on the firmware is it's
2029.47s - 2033.11s |  generally going to be in like a kind of like a blob format so generally it's
2033.11s - 2037.71s |  going to be in like a dot bin file or binary file or maybe a hex file possibly
2037.71s - 2042.03s |  a dot IMG but it's not going to be probably readable for us at that point
2042.03s - 2046.19s |  so we need to go ahead and actually unpack that firmware into the different
2046.19s - 2049.99s |  sections and files that are actually in there that we'll be able to interact
2049.99s - 2053.95s |  with better so the very first thing we do is cross our fingers that it's not
2053.95s - 2057.91s |  encrypted so again this is why I'm recommending when you're starting out go
2057.91s - 2061.87s |  for those cheaper devices because most likely they're not going to use
2061.87s - 2066.91s |  encryption for their firmware because it costs money both in software development
2066.91s - 2070.31s |  and R&D but also you're most likely going to need to spend a little bit more
2070.31s - 2076.83s |  on hardware to actually rely on that to handle that decryption at the startup if
2076.83s - 2080.39s |  you do come across encrypted firmware and you're just getting started my
2080.39s - 2085.11s |  suggestion would be just save that device for later down the road it's not
2085.11s - 2088.79s |  like it can't be defeated there's lots of attacks and things like that that we
2088.79s - 2093.87s |  can do to try and defeat the encryption and find the keys when the obviously
2093.87s - 2096.71s |  when it's booting up it's going to need to actually do that decryption and we
2096.71s - 2099.79s |  can possibly read the keys but it's a little bit more of an advanced topic so
2099.79s - 2102.87s |  I'd save that for down the road after you've done a few and go and find
2102.87s - 2106.99s |  another device and see if you can make sure that its device is not encrypted so
2106.99s - 2110.43s |  how do we check if it's encrypted and also how do we get the contents of that
2110.43s - 2115.95s |  we will use a utility called binwalk so there's a bunch of tools to do this in
2115.95s - 2120.47s |  various ones and you can take a manual approach but the easiest way and is to
2120.47s - 2126.11s |  just go ahead and use binwalk if we pass it two options the capital M and the E
2126.11s - 2130.35s |  it will just recursively go through and anything it identifies that it can pick
2130.35s - 2136.19s |  up as a file type that it knows it will try and uncompress that or unzip it or
2136.19s - 2140.03s |  whatever until it gets down to the actual it knows the file types whether
2140.03s - 2146.43s |  that's a binary file shared object XML whatever and the E is telling us to
2146.43s - 2149.43s |  extract it actually so if you just run binwalk without any commands it'll
2149.43s - 2152.91s |  actually just tell you what it sees and then if you pass in the E it'll go ahead
2152.91s - 2157.07s |  and try and actually break those down so awesome tool it does a lot of the leg
2157.07s - 2161.51s |  work for us alternatively we saw that we had those different partitions already
2161.51s - 2165.67s |  actually listed out for us in the boot log so you can use DD as well if you
2165.67s - 2169.19s |  want a manual approach just to carve it up and sometimes you have to but binwalk
2169.19s - 2176.28s |  is your friend it most it works most of the time okay so this is where the fun
2176.28s - 2180.44s |  starts so now that we've got the firmware we're going to go and actually
2180.44s - 2185.00s |  focus on the root file system and see what we can find so some really low
2185.00s - 2188.80s |  hanging fruit is just to look for the configuration files and poke through
2188.80s - 2194.84s |  those see if we can find anything that shouldn't be in there so a lot of times
2194.84s - 2198.48s |  when I'm teaching IOT hacking people are surprised to see but the most popular
2198.48s - 2201.80s |  the best tools I think are just some of the really easy basic Linux tools like
2201.80s - 2207.32s |  find strings and grep they go a long way with IOT hacking and we can use find
2207.32s - 2212.60s |  with the dash name argument and I like to just do like star dot extension so
2212.60s - 2217.96s |  I'll do star dot XML start out text start out JSON and I'll just go through
2217.96s - 2221.28s |  that and read through those documents a lot of times see XML and sometimes they
2221.28s - 2225.20s |  have interesting details in there that's some low-hanging fruits we can also use
2225.20s - 2230.08s |  strings so this is a tip that I teach if you use strings with a dash F the
2230.08s - 2234.24s |  dash F tack on it it'll bring back the file name that's attached to that string
2234.24s - 2238.04s |  and then we can run strings over like a whole file system or a whole group of
2238.04s - 2241.88s |  files and if we and then we can pipe that into grep and look for things like
2241.88s - 2247.64s |  password API key all of those things sometimes I'll look for like calm for
2247.64s - 2252.20s |  example or various TLDs just to see if we can find any endpoints and that can
2252.20s - 2255.76s |  just be an easy win as well using strings and piping it into grep it's one
2255.76s - 2262.94s |  of my favorite tricks when IOT hacking is to to do that the next thing we'll
2262.94s - 2266.76s |  take a look at that is like pretty easy because same with the the readable files
2266.76s - 2271.24s |  all of the scripts so a lot of times since embedded Linux is gonna be bash or
2271.24s - 2275.24s |  sh scripts you don't need to decompile them you can just take a look at them
2275.24s - 2278.68s |  read through them a lot of times the developers will put really nice comments
2278.68s - 2281.40s |  in there telling you what they're doing because they're being good developers
2281.40s - 2284.12s |  and putting comments and things like that it's funny I've seen like even
2284.12s - 2287.44s |  things like people's emails or like you know maybe if you find a problem with
2287.44s - 2291.76s |  this email me at this email or things like that but the one scripts that I
2291.76s - 2295.44s |  always suggest and you should look at right when you're getting started with a
2295.44s - 2301.20s |  device and looking at it are the RCS scripts so most IOT devices use a tool
2301.20s - 2306.12s |  called busy box which is a way to actually combine all of the binaries
2306.12s - 2311.28s |  into one binary to shrink them down and then they use their init process and the
2311.28s - 2317.60s |  way that busy box works is it runs all of the RCS scripts in Etsy slash init.d
2317.60s - 2321.68s |  so after the boot loaders finished and Linux is done it hands off to the busy
2321.68s - 2326.08s |  box init system and then it calls all of the scripts in there that start with RCS
2326.08s - 2330.76s |  and it does them in alphanumeric order so it'll go like RCS 1 2 or if you have
2330.76s - 2335.32s |  like sometimes you see like 1 and it tells you what they're doing and these
2335.32s - 2337.96s |  scripts are great because they're responsible for actually setting up the
2337.96s - 2342.36s |  device past Linux for what it actually does so if it's a camera or router then
2342.36s - 2346.04s |  it's probably going to you know bring up binaries or things like that to actually
2346.04s - 2349.68s |  do what the device does or sometimes they'll even reach out to like back-end
2349.68s - 2353.96s |  infra or cloud infra to let it know it's up or pass back information and again
2353.96s - 2357.20s |  these are human readable like they're just bash scripts so no decompiling no
2357.20s - 2361.32s |  real reverse engineering and another tip too is if you're not familiar with bash
2361.32s - 2365.88s |  like honestly chat GPT is really great at breaking down what bash scripts are
2365.88s - 2369.16s |  so you can just copy and paste these directly out of the firmware into our
2369.16s - 2372.88s |  friend chat GPT and it can help you out and tell you what's going on as well
2372.88s - 2376.16s |  yeah I frequently don't really find specific vulnerabilities in here
2376.16s - 2379.24s |  sometimes you'll find things that shouldn't be in there but the most of
2379.24s - 2382.20s |  the reason is just to get a lay of the land and it'll tell you about like
2382.20s - 2389.08s |  what's going on what binaries are being executed things like that okay so now
2389.08s - 2393.20s |  we're at in my opinion the most fun part and kind of like everything even the
2393.20s - 2396.14s |  other stuff before that has been leading up to setting ourselves up to be
2396.14s - 2401.10s |  successful at reverse engineering the binaries and libraries that are on the
2401.10s - 2405.26s |  device so this is where you're honestly most likely to find some sort of
2405.26s - 2410.10s |  vulnerability that you're going to report and the one complicated or thing
2410.10s - 2414.18s |  that I see people get stuck with on this is where do we actually start it's quite
2414.18s - 2418.58s |  possible there's dozens to hundreds to maybe a thousand different libraries and
2418.58s - 2423.38s |  binaries on the device it takes a lot of time to reverse engineer and understand
2423.38s - 2429.27s |  these so which one do we pick and how do we start so the easiest way to
2429.27s - 2433.67s |  actually do this is to avoid a needle in a haystack situation is to go with like
2433.67s - 2437.59s |  a forward down approach and this is what I teach or the methodology I teach when
2437.59s - 2442.03s |  people are starting and that is to start with the custom binaries and libraries
2442.03s - 2445.95s |  that are actually unique to the device so a lot of the libraries and binaries
2445.95s - 2449.67s |  are going to be Linux stuff so if you're familiar with using Linux you might be
2449.67s - 2453.73s |  able to just discount quite a few of these but if you're not or sometimes it
2453.73s - 2457.25s |  could be hard to tell especially with libraries did you know are these open
2457.25s - 2461.09s |  source Linux things that do Linux or C stuff or are these ones that the
2461.09s - 2465.49s |  designers of this device have actually created so then we run into the problem
2465.49s - 2468.33s |  is how do we know they're custom and after you start to do this for quite a
2468.33s - 2470.89s |  while you will start to pick out the names and stuff and go like oh yeah
2470.89s - 2475.25s |  that's that's a custom one but if we don't then the thing that I suggest to
2475.25s - 2480.37s |  do is to interact with a device and then follow that logging and trace that
2480.49s - 2485.77s |  logging down to the underlying binaries and functions and this is in my opinion
2485.77s - 2491.93s |  the easiest way when you're starting to actually find vulnerabilities so here in
2491.93s - 2497.01s |  this picture I've got an example so this is a common router here that that I like
2497.01s - 2500.85s |  to hack on and I went to the web browser of it so just like most routers it's got
2500.85s - 2505.65s |  a web browser where you can go on do lots of stuff set the pre-shared key set
2505.65s - 2511.21s |  what type of WPA2 WAP or whatever you know set all that stuff it's got a
2511.21s - 2514.53s |  bunch of utilities for some reason it's got a ping test thing you can make the
2514.53s - 2518.45s |  router ping other stuff so in this example I'm just playing around with
2518.45s - 2522.45s |  that because I kind of suspected that it might be you know doing bad things when
2522.45s - 2528.17s |  we try and ping stuff and so I wanted to find the underlying binary or function
2528.17s - 2532.01s |  or library that's actually responsible for that so what I do is I just go and
2532.01s - 2536.05s |  play with all the functionality if there's something that you can do on the
2536.05s - 2539.85s |  device to make it do something I do that and I don't specifically do that like
2539.85s - 2543.33s |  trying injections or anything I just when I'm starting out just use the
2543.33s - 2548.09s |  device how it's supposed to be used and I'll take a look at the logging and a
2548.09s - 2551.85s |  lot of times the logging will be very verbose in IOT devices when you're
2551.85s - 2556.05s |  interacting with things and then we can actually trace that logging back then to
2556.05s - 2560.17s |  the underlying binaries or libraries so in this device and I actually see this
2560.17s - 2563.93s |  in a decent amount of IOT devices they were nice enough to even just put the
2563.93s - 2568.97s |  the function that's actually calling that it's actually being called when you
2568.97s - 2572.37s |  try and run this ping test they put it in square brackets that's their like
2572.37s - 2577.85s |  logging nomenclature or whatever so it was called util underscore exec system
2577.85s - 2581.29s |  so I saw this immediately and if you're familiar with like you know web pen
2581.29s - 2584.09s |  testing or something like that immediately looked like it was making a
2584.09s - 2587.09s |  system call to me and then they put a bunch of details in it like they
2587.09s - 2590.93s |  actually give us how the command is being formatted so I didn't get to put
2590.93s - 2593.97s |  the whole thing because I was running a out of room but if you can't see it it
2593.97s - 2599.09s |  literally says oil start paying command is IP ping dash C and it gives the whole
2599.09s - 2603.81s |  details and in that you can actually see the IP address that we put in so
2603.81s - 2606.93s |  definitely is kind of like giving us a hint that there's possible command
2606.93s - 2613.04s |  injection or something we should look at deeper there okay so now we have an idea
2613.04s - 2616.90s |  that that function that util underscore exec system is of interest to us it
2616.90s - 2621.26s |  could be a potential injection point and what we should do is you know on the
2621.26s - 2624.54s |  past page or like when we're doing that like I will interact with everything I
2624.54s - 2628.90s |  can and take a note of where all the logging is happening what binaries and
2628.90s - 2632.62s |  functions that logging is coming from we'll just go back to our good friend
2632.62s - 2637.14s |  strings piping into grep one of my favorite tools for IOT hacking and we
2637.14s - 2641.92s |  can grep on that function name so a lot of times in less expensive IOT vices
2641.92s - 2645.34s |  again they're making it easier for us they don't strip binaries and things
2645.34s - 2648.58s |  like that so the function names will just end up compile in the compiled
2648.58s - 2653.46s |  binaries and libraries so we can just pipe that into grep and put the function
2653.46s - 2657.70s |  name in so in this example here I did that for a util exec system however what
2657.70s - 2661.38s |  if they do strip it well if we just go back one page here you can see the
2661.38s - 2665.26s |  printout here it kind of follows a format it says oil start paying command
2665.26s - 2669.86s |  is and then gives the command so that's a string that's actually in there too
2669.86s - 2673.02s |  and they're probably not going to obfuscate it it's not malware so we can
2673.02s - 2678.30s |  also just pipe common strings that we see so in this example I kind of thought
2678.30s - 2681.82s |  it was using like a print app or sprint app or something like that so we look
2681.82s - 2686.46s |  for a command is and we get the same hit you can see here that actual string how
2686.46s - 2690.42s |  it is in that binary is percent s command is percent s so it's using that
2690.42s - 2693.86s |  formatting so even if they do strip the function names there's still ways to get
2693.86s - 2701.29s |  around it and find those underlying binaries and libraries okay so now that
2701.29s - 2706.29s |  we've got our function name we know that it's in that so if I just go back
2706.29s - 2709.89s |  and this one for example we see the hit because we use dash F it's in this lib
2709.89s - 2715.21s |  CMM dot SO so that is a custom library that the makers of this router in this
2715.21s - 2719.45s |  example wrote that has the majority of the functionality of that router baked
2719.45s - 2726.37s |  into it we can pop that into Ghidra and start decompiling it so one of the
2726.37s - 2730.25s |  things that I find when I'm teaching IOT hacking or in my workshops is like this
2730.25s - 2733.09s |  is the point where people usually get a little bit overwhelmed if they're not
2733.09s - 2737.09s |  familiar with reverse engineering and it starts to look quite complicated because
2737.09s - 2742.13s |  the output of Ghidra can be very verbose when it decompiles it it is in my
2742.13s - 2746.53s |  opinion a little bit more complex than just looking at regular C code so it can
2746.53s - 2749.69s |  be a little like discouraging and I see some people are like okay I can't do
2749.69s - 2753.65s |  this I'm intimidated by it but I have a few tips that I think can make it a lot
2753.65s - 2757.61s |  easier for you to understand and read the output in here and still find
2757.61s - 2760.77s |  vulnerabilities even if you don't understand what the heck is going on and
2760.77s - 2765.53s |  most of it doesn't make sense so the very first thing I always say and is
2765.53s - 2769.61s |  because people who are in cybersecurity and have had a little bit of intro to
2769.61s - 2773.25s |  Ghidra or reverse engineering is it's usually looking at malware and this is
2773.25s - 2778.01s |  not malware so with malware usually good malware authors or majority of them are
2778.01s - 2781.01s |  going to try and obfuscate what they're doing make it confusing for reverse
2781.01s - 2784.05s |  engineering they're not going to use print statements if they have strings
2784.09s - 2788.33s |  they're going to obfuscate those strings they're very hard to see instead for our
2788.33s - 2793.01s |  IOT devices we have developers who are trying to be good helpful developers and
2793.01s - 2797.45s |  write very clean readable code so that it's easy for someone else to pick up
2797.45s - 2801.45s |  after them if someone's reading their code it's going to be testable debuggable
2801.45s - 2806.49s |  doing all those good things that developers do and also in IOT devices we
2806.49s - 2811.21s |  do a lot of printing out to UART to tell what's going on so that we can
2811.21s - 2815.29s |  actually do almost debugging through print statements in a production device
2815.29s - 2820.53s |  which is nice it makes it really easy for us to then go and trace those back
2820.53s - 2824.61s |  so one of the first things I always suggest with that in mind is to take a
2824.61s - 2829.69s |  look at the print statements and let those guide you to what is going on of
2829.69s - 2832.85s |  course you can't always trust print statements if you're a programmer you
2832.85s - 2835.69s |  know that it's not the best to always trust comments or print statements but
2835.69s - 2838.57s |  when you're getting started reverse engineering I think it's okay just read
2838.57s - 2842.69s |  the print statements the very first one that I have here that's in red it's just
2842.69s - 2845.61s |  actually that print statement that we saw in the logging so it helps us
2845.61s - 2850.17s |  confirm that we're in the right spot and then if you look down at line 32 it
2850.17s - 2852.89s |  might be a little hard to read but essentially what it's saying there is
2852.89s - 2856.61s |  it's just saying system fork failed and this we don't care about that it's not
2856.61s - 2861.21s |  important to us but if you look at the program flow and the if statements well
2861.21s - 2864.73s |  now you know what that program flow does it just checks if a system fork failed
2864.73s - 2871.53s |  because before that it says you know if local 234 equals F F F F F F well if I
2871.53s - 2874.85s |  saw that I have no idea what it was is it integral to the thing well if you
2874.85s - 2877.29s |  look at the print statement it tells you exactly what it is you can just ignore
2877.29s - 2881.33s |  that the second thing you can do with print statements that makes your life a
2881.33s - 2885.81s |  lot easier is a lot of times they'll be like print F's or sprint F's and if
2885.81s - 2890.41s |  you're not familiar with how those work essentially we have a slot holder for a
2890.41s - 2893.53s |  variable that we're going to pass into that print statement and then the print
2893.53s - 2897.21s |  statement basically tells you what that's what that variable is so in this
2897.21s - 2902.13s |  top example here we have the percent command is percent and then we have two
2902.13s - 2905.61s |  variables passed in that you know we wouldn't know what they were once param
2905.61s - 2909.21s |  one and once underscore underscore s well if we look and you know we just go
2909.21s - 2912.01s |  back a couple to that print statement well the first one this is that
2912.01s - 2915.89s |  identifier OAL underscore start ping command so we know maybe that's like
2915.89s - 2920.05s |  some sort of identifier and then the second one though now we know of our
2920.05s - 2924.93s |  interest well that's the actual string that we manipulate that we can pass the
2924.93s - 2929.81s |  IP address in and because of that sprint F or that print F function well now we
2929.81s - 2932.69s |  know that underscore underscore s variable we know what it is and that's
2932.69s - 2938.01s |  just through those print commands the next thing I'll call out or that's kind
2938.01s - 2941.25s |  of like the final thing that we've been working towards is to just start getting
2941.25s - 2948.01s |  used to seeing unsafe things being done so that the easiest one to actually find
2948.01s - 2952.25s |  is system command so you can see that's in the second square there we have a
2952.25s - 2954.97s |  system command and if you're not familiar with that when you're
2954.97s - 2959.21s |  programming C essentially that's a way for you to just pass down to Linux to
2959.21s - 2963.05s |  say like hey I want you to run this like shell command so it's essentially the
2963.05s - 2965.93s |  same as if you know you're at the terminal and you type in if you have a
2965.93s - 2969.29s |  shell whatever you pass in the system it's the same way so if you're not
2969.29s - 2973.37s |  already thinking this like this is an extremely dangerous thing to do in your
2973.37s - 2977.25s |  programming if you're using user variables and especially if you're not
2977.25s - 2981.85s |  going to be sanitizing those variables so in this one for example this util
2981.85s - 2985.17s |  underscore exec system function that they've written to make it easier to do
2985.17s - 2992.21s |  system calls it does no sanitization or checking however in this example the
2992.21s - 2998.03s |  caller of that that actually initially takes in that IP address well it does do
2998.03s - 3003.57s |  the sanitization but if you look on this device for example there are about 500
3003.57s - 3008.73s |  calls to this util underscore exec system and the person that wrote that
3008.73s - 3011.81s |  function this util underscore exec system that knows okay I need to
3011.81s - 3015.77s |  sanitize my inputs further down the chain they might not be the same ones
3015.77s - 3019.93s |  writing the code so you can actually see how it can happen to slip through where
3019.93s - 3024.09s |  user supplied input gets into a system call so that's one of the easiest things
3024.09s - 3028.87s |  when you're starting out is to just go interact with the device chase down the
3028.87s - 3032.97s |  inputs that you do because you know and see where do they end up in the code and
3032.97s - 3036.43s |  if they end up in a system call then I really need to look into this deeper and
3036.43s - 3041.75s |  see if there's a way that I can do some sort of command injection so of course
3041.75s - 3045.11s |  what's next after we know this well we keep interacting with the device and
3045.11s - 3049.07s |  tracing the logging back to the binaries or libraries so of course there's other
3049.07s - 3051.99s |  ways to approach this you could just start with the library and look at all
3051.99s - 3054.95s |  the system calls and go backwards but when you're getting started I think it's
3054.95s - 3057.83s |  a lot easier to understand and conceptualize and not get lost in
3057.83s - 3062.27s |  Ghidra to try and start at the source which is how we interact with it and we
3062.27s - 3066.43s |  know that there's like an injection point there and then see if that
3066.43s - 3071.03s |  actually filters down to something so don't just use web browsers like a lot
3071.03s - 3075.35s |  of IOT apps they have a mobile or IOT devices they have a mobile app so we can
3075.35s - 3078.43s |  go use that mobile app like do everything in the mobile app do all the
3078.43s - 3082.15s |  setup check all of that because it's gonna be like a lot of times one of
3082.15s - 3085.87s |  those lesser used places where there's some obscure setting or something you
3085.87s - 3089.87s |  can set do all of that and see what logging you can get and trace that back
3089.87s - 3093.23s |  and see where it goes like one example I found where I was able to crash a
3093.23s - 3098.31s |  device is it was a camera and if you wanted to pair it to your mobile app you
3098.31s - 3101.95s |  put the QR code up to the camera and you compare it to the mobile app and I was
3101.95s - 3105.43s |  never able to like get any buffer overflow or anything but I was able to
3105.43s - 3110.03s |  crash the camera by doing like a malformed QR code so just be creative if
3110.03s - 3113.67s |  there's cloud like somewhere you can sign up in the cloud and then interact
3113.67s - 3117.55s |  with your device do that like usually there's a free 30 days or something and
3117.55s - 3120.71s |  you know we're not actually pen testing the cloud thing we don't want to be like
3120.71s - 3124.51s |  trying to break that but just interact with it how you're supposed to and see
3124.51s - 3129.25s |  how that filters down into the device and then what we're looking for is when
3129.25s - 3132.61s |  you're starting out there's two main things I suggest to look for so the
3132.61s - 3137.35s |  first one is what we already looked at does it end up in an unvalidated or
3137.35s - 3143.07s |  unsanitized system call and like if you look at this router and go back and look
3143.07s - 3147.23s |  at the CVS for this one that I'm showing or lots of IOT devices you'll see lots
3147.23s - 3151.75s |  of command injections being done because in cheap IOT devices they want
3151.75s - 3154.95s |  to save money they don't want to write their own functionality it's way easier
3154.95s - 3159.83s |  to just use the built-in stuff in Linux and just hand it off to a system call so
3159.83s - 3163.27s |  it's not like these don't exist you can definitely find them the second one
3163.27s - 3167.71s |  that's probably a little bit more common but a little bit harder to find and
3167.71s - 3173.27s |  abuse is if it gets your input user input gets put into an unsafe C
3173.27s - 3177.43s |  function so there's a few examples of those are mem copy string copy string
3177.43s - 3182.51s |  cat print F that next one supposed to be sprint F get scan F so essentially what
3182.51s - 3185.67s |  these are doing though is they're going to be copying your data into some sort
3185.67s - 3190.11s |  of buffer and again memory is limited on IOT devices so we're always trying to be
3190.11s - 3194.43s |  kind of stingy with our buffers and a lot of times if you're not if you're not
3194.43s - 3198.87s |  sanitizing or validating those inputs then it can end up in a buffer where we
3198.87s - 3203.63s |  can overflow it and you know at the worst case buffer overflow or maybe just
3203.63s - 3207.27s |  crash the device and have some sort of denial of service so I could give a
3207.27s - 3210.39s |  whole another talk then about where to go from that from here and how to
3210.39s - 3215.39s |  actually then abuse these are actually exploit buffer overflows but if you do
3215.39s - 3219.11s |  get this far and you find this and like you'll be able to maybe crash the device
3219.11s - 3223.59s |  or get some seg faults or something then send me a message or just go out and do
3223.59s - 3227.35s |  some further research and there's a lot of great resources then for how to
3227.43s - 3232.19s |  identify these buffer overflows so that's where I'll end today I just want
3232.19s - 3235.35s |  to wrap up with a thank you thanks everyone for coming I hope you learned
3235.35s - 3239.75s |  something I hope you go home and go buy a cheap IOT device when you get home
3239.75s - 3244.51s |  hack it if you do let me know I love to hear when people hack it and if you want
3244.51s - 3248.71s |  a copy of these slides stay in touch with me link up resources anything you
3248.71s - 3252.75s |  can reach me at andrewbellini.com thanks everyone


