# MediaChunks

chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=zBP2deuPQTg", "title": "DEF CON 32 -Your Smartcard is Dumb A Brief History of Hacking Access Control Systems - Chad Shortman", "description": "Have you ever wondered how those little boxes that you tap your card to open doors work? What are they reading on the card? How do they ultimately unlock the door? And, are they even secure? In this talk, we will answer all of those questions and more. We will walk through how access-control systems, in general, work, and dig into the details of the most popular systems. Fortunately for the entertainment value of this talk, there be dragons in our doors. We will walk through some of the most high-profile attacks in detail and then dive into some more fundamental flaws with how the systems are designed. All of these discussions will be accompanied with live demos and first hand experience. After this talk, you will look at the world, especially doors, differently -- weaknesses everywhere! My hope is that we can all learn from past mistakes and create a more secure and less frustrating tomorrow together", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 3201, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 4.70s | This text was transcribed using whisper model: large-v2 All right, let's kick this thing off. So I found out today. This was not an hacker tracker 4.92s - 9.60s | So everybody in here must read the old ink version of the schedule 9.60s - 15.80s | So thank you for reading the old paper version and showing up today. We're gonna learn how to break into buildings 16.44s - 20.00s | Plain and clear why do I like breaking into buildings? 20.00s - 22.32s | I've actually never broken into a building for context 22.32s - 28.20s | But when you can do a computer exploit and it touches the real world that has always been the ultimate for me 28.20s - 31.68s | So I played CTF for a long time done a lot of binary exploitation 32.08s - 39.28s | But seeing a pound sign pop up on your screen versus seeing a door unlock is a very different adrenaline hit. So 40.04s - 41.16s | let's 41.16s - 43.16s | go back through the history and 44.08s - 49.24s | See all the different ways you can break into buildings with laptops. So first we'll go over access control one-on-one


chunk_text:
using whisper model: large-v2 All right, let's kick this thing off. So I found out today. This was not an hacker tracker 4.92s - 9.60s | So everybody in here must read the old ink version of the schedule 9.60s - 15.80s | So thank you for reading the old paper version and showing up today. We're gonna learn how to break into buildings 16.44s - 20.00s | Plain and clear why do I like breaking into buildings? 20.00s - 22.32s | I've actually never broken into a building for context 22.32s - 28.20s | But when you can do a computer exploit and it touches the real world that has always been the ultimate for me 28.20s - 31.68s | So I played CTF for a long time done a lot of binary exploitation 32.08s - 39.28s | But seeing a pound sign pop up on your screen versus seeing a door unlock is a very different adrenaline hit. So 40.04s - 41.16s | let's 41.16s - 43.16s | go back through the history and 44.08s - 49.24s | See all the different ways you can break into buildings with laptops. So first we'll go over access control one-on-one 49.24s - 55.76s | I'll just explain how these systems work. That's step one. What a smart card is. This is actually a pretty overloaded word 56.76s - 59.44s | Everything looks like a smart card is just a piece of plastic with some 60.12s - 64.88s | microcontrollers in it and then I'll go over all of the attacks that we've seen come out over the last couple decades and 65.32s - 68.36s | Then some food for thought on what the future might look like 69.52s - 74.68s | So if you look at a typical access control system, there's only a couple of components 74.68s - 80.08s | This is the most complicated system you would ever see on the left side. You'll see that there's a door reader 80.08s - 82.92s | this is the little box you tap your card to and it goes boop and 83.56s - 86.00s | Green or red or blue or whatever color it turns 86.48s - 92.18s | That then has a couple of wires that run all the way to the secure side into a controller board 92.28s - 94.64s | That will ultimately make the yes-no decision


chunk_text:
49.24s - 55.76s | I'll just explain how these systems work. That's step one. What a smart card is. This is actually a pretty overloaded word 56.76s - 59.44s | Everything looks like a smart card is just a piece of plastic with some 60.12s - 64.88s | microcontrollers in it and then I'll go over all of the attacks that we've seen come out over the last couple decades and 65.32s - 68.36s | Then some food for thought on what the future might look like 69.52s - 74.68s | So if you look at a typical access control system, there's only a couple of components 74.68s - 80.08s | This is the most complicated system you would ever see on the left side. You'll see that there's a door reader 80.08s - 82.92s | this is the little box you tap your card to and it goes boop and 83.56s - 86.00s | Green or red or blue or whatever color it turns 86.48s - 92.18s | That then has a couple of wires that run all the way to the secure side into a controller board 92.28s - 94.64s | That will ultimately make the yes-no decision 94.68s - 100.60s | So it's gonna compare that number to some database and say does this person have access if it does it opens the door 101.00s - 106.48s | For security reasons if you're using a mag lock, which is just an electromagnet 106.48s - 111.04s | You'll plug it into 12 or 24 volts that electromagnet will hold the door shut 111.72s - 115.36s | There's a problem here though that if you're on the inside of that building 115.52s - 119.88s | You cannot get out unless you can pull harder than a let that electromagnet 119.88s - 124.28s | Which is typically like 1,500 kilograms for a cheap one and they go way up 124.72s - 129.84s | So in the event of a fire you need a button that you can push to cut the power 130.32s - 134.88s | This actually was not deployed. Well on the initial ones a lot of people burned to death 134.88s - 139.36s | So this is like fire marshal enforced now every door that has an electromagnetic lock 139.60s - 146.12s | Will have a motion sensor and an exit button for egress and by law


chunk_text:
94.68s - 100.60s | So it's gonna compare that number to some database and say does this person have access if it does it opens the door 101.00s - 106.48s | For security reasons if you're using a mag lock, which is just an electromagnet 106.48s - 111.04s | You'll plug it into 12 or 24 volts that electromagnet will hold the door shut 111.72s - 115.36s | There's a problem here though that if you're on the inside of that building 115.52s - 119.88s | You cannot get out unless you can pull harder than a let that electromagnet 119.88s - 124.28s | Which is typically like 1,500 kilograms for a cheap one and they go way up 124.72s - 129.84s | So in the event of a fire you need a button that you can push to cut the power 130.32s - 134.88s | This actually was not deployed. Well on the initial ones a lot of people burned to death 134.88s - 139.36s | So this is like fire marshal enforced now every door that has an electromagnetic lock 139.60s - 146.12s | Will have a motion sensor and an exit button for egress and by law it has to be one motion 146.24s - 150.96s | So if you hit the exit button, that needs to be all you do or a strike a big bar 151.36s - 156.08s | So that comes into play quite a bit when you see some of the attacks and how to bypass these 157.08s - 161.32s | So if we take away all the fluffy words and just look at what this is 161.32s - 165.20s | It's an Arduino project at any high school or middle school student could build 165.88s - 167.88s | There's just three relays 168.16s - 169.80s | Ultimately there's one that matters 169.80s - 175.20s | so on the secure side if that relay trips the power is either turned off or on and 175.60s - 177.60s | The door will unlock on 177.92s - 185.36s | The readers side there's just a little microcontroller that is going to do something over RF and then send a number out 185.76s - 186.72s | over weekend 186.72s - 193.88s | Which is this unencrypted two-wire protocol that has a data zero line to encode the number zero and a data one line to encode


chunk_text:
it has to be one motion 146.24s - 150.96s | So if you hit the exit button, that needs to be all you do or a strike a big bar 151.36s - 156.08s | So that comes into play quite a bit when you see some of the attacks and how to bypass these 157.08s - 161.32s | So if we take away all the fluffy words and just look at what this is 161.32s - 165.20s | It's an Arduino project at any high school or middle school student could build 165.88s - 167.88s | There's just three relays 168.16s - 169.80s | Ultimately there's one that matters 169.80s - 175.20s | so on the secure side if that relay trips the power is either turned off or on and 175.60s - 177.60s | The door will unlock on 177.92s - 185.36s | The readers side there's just a little microcontroller that is going to do something over RF and then send a number out 185.76s - 186.72s | over weekend 186.72s - 193.88s | Which is this unencrypted two-wire protocol that has a data zero line to encode the number zero and a data one line to encode 193.88s - 195.32s | the number one 195.32s - 197.86s | Once it gets the other side decision is made 198.60s - 205.24s | the other two things are also just relays the exit button when you hit it, it's just gonna cut the power and 205.96s - 213.36s | The motion sensor again when you wave at it, it just touches a relay. These are either normally closed or normally open 213.88s - 216.28s | We getting those relays a chip the door will unlock 217.28s - 224.76s | So let's look at some of the worst relay fails in honor of the Olympics. This is not a running relay 224.76s - 226.76s | We're talking about though. This is an electronic relay 227.12s - 230.12s | I'm going to gamble that the internet works and show you 230.76s - 235.76s | How you can trip these relays and not so sophisticated ways. We'll get to interesting 236.28s - 240.88s | Computer hacks later, but you can see here in this video. The exit button is on the left 241.28s - 244.48s | You get yourself a nice sturdy piece of metal 245.04s - 250.80s | Shove that thing


chunk_text:
193.88s - 195.32s | the number one 195.32s - 197.86s | Once it gets the other side decision is made 198.60s - 205.24s | the other two things are also just relays the exit button when you hit it, it's just gonna cut the power and 205.96s - 213.36s | The motion sensor again when you wave at it, it just touches a relay. These are either normally closed or normally open 213.88s - 216.28s | We getting those relays a chip the door will unlock 217.28s - 224.76s | So let's look at some of the worst relay fails in honor of the Olympics. This is not a running relay 224.76s - 226.76s | We're talking about though. This is an electronic relay 227.12s - 230.12s | I'm going to gamble that the internet works and show you 230.76s - 235.76s | How you can trip these relays and not so sophisticated ways. We'll get to interesting 236.28s - 240.88s | Computer hacks later, but you can see here in this video. The exit button is on the left 241.28s - 244.48s | You get yourself a nice sturdy piece of metal 245.04s - 250.80s | Shove that thing through the door and you just click that relay bang. You're in this is 251.36s - 257.56s | Let's we'll keep going up in complexity. This is probably the least advanced way to trip one of those relays 258.64s - 260.96s | So I call this the hook key 261.56s - 267.84s | There's also the magnet key. So if you're aware of the internal mechanics in a relay 267.84s - 275.04s | It's just two pieces of metal like this you touch them together. The connection is made you separate them. The connection is not made 275.48s - 277.48s | so some of these 277.64s - 280.12s | This is the locksmith lock picking lawyer 280.88s - 282.88s | You hit the pin pad the door unlocks 283.24s - 289.12s | You can literally take a magnet touch it to where the relay is and it just clicks the relay 289.40s - 296.36s | So if you buy this system put on the outside of your building anyone can just come up with a magnet click clack click clack 298.16s - 300.16s | Click the relay on 300.48s - 306.72s | So don't do that when you install these


chunk_text:
through the door and you just click that relay bang. You're in this is 251.36s - 257.56s | Let's we'll keep going up in complexity. This is probably the least advanced way to trip one of those relays 258.64s - 260.96s | So I call this the hook key 261.56s - 267.84s | There's also the magnet key. So if you're aware of the internal mechanics in a relay 267.84s - 275.04s | It's just two pieces of metal like this you touch them together. The connection is made you separate them. The connection is not made 275.48s - 277.48s | so some of these 277.64s - 280.12s | This is the locksmith lock picking lawyer 280.88s - 282.88s | You hit the pin pad the door unlocks 283.24s - 289.12s | You can literally take a magnet touch it to where the relay is and it just clicks the relay 289.40s - 296.36s | So if you buy this system put on the outside of your building anyone can just come up with a magnet click clack click clack 298.16s - 300.16s | Click the relay on 300.48s - 306.72s | So don't do that when you install these systems make sure the relay is on the inside of the building not the outside 307.48s - 309.48s | And then there's the motion sensor 309.96s - 311.00s | so 311.00s - 313.40s | For obvious reasons when there's motion 313.40s - 320.60s | It's going to trigger if you vape it turns out the smoke in your vape for most of these motion sensors is 321.00s - 322.32s | thick enough 322.32s - 329.52s | That it will actually trip the motion sensor and you can just blow smoke through the crack and walk right through the door 330.00s - 333.16s | So we'll call these the very unsophisticated 334.12s - 336.20s | Uninteresting why the hell did I come to this talk? 336.72s - 338.84s | Hacks there are much more 339.80s - 341.80s | fun ways to do this 342.08s - 347.88s | Just to note when you're looking at these systems, so there's the electromagnets that are just huge chunky electromagnets over the top 348.32s - 349.92s | There's also electric strikes 349.92s - 353.64s | so these are solenoids that are gonna have a pin that by and it's 354.16s - 359.08s | Unpowered position


chunk_text:
systems make sure the relay is on the inside of the building not the outside 307.48s - 309.48s | And then there's the motion sensor 309.96s - 311.00s | so 311.00s - 313.40s | For obvious reasons when there's motion 313.40s - 320.60s | It's going to trigger if you vape it turns out the smoke in your vape for most of these motion sensors is 321.00s - 322.32s | thick enough 322.32s - 329.52s | That it will actually trip the motion sensor and you can just blow smoke through the crack and walk right through the door 330.00s - 333.16s | So we'll call these the very unsophisticated 334.12s - 336.20s | Uninteresting why the hell did I come to this talk? 336.72s - 338.84s | Hacks there are much more 339.80s - 341.80s | fun ways to do this 342.08s - 347.88s | Just to note when you're looking at these systems, so there's the electromagnets that are just huge chunky electromagnets over the top 348.32s - 349.92s | There's also electric strikes 349.92s - 353.64s | so these are solenoids that are gonna have a pin that by and it's 354.16s - 359.08s | Unpowered position is stuck down in the hole and then when you power it it pulls the solenoid out 359.20s - 361.20s | These are far better for 361.68s - 366.92s | Various reasons you can't get locked into your building and die. They're a little harder to trip 366.92s - 371.16s | You know, you can't vape into these and have them, you know, pull a solenoid up 371.68s - 377.20s | So if you're given an option you're installing these anytime you can put an electric strike. So 378.24s - 380.24s | Now let's look at smart cards 381.12s - 387.04s | First we need to answer the question. What do I mean by smart card? There's really I think three different forms 387.04s - 392.24s | You'll see there's the ones that look like our credit cards that have these little pads on them 392.52s - 398.48s | There's ones that are just pieces of plastic that do some RF stuff and then there's ones with the mag stripe on the back 399.64s - 400.80s | so 400.80s - 403.80s | These are all very very different technologies 403.80s - 409.44s | the end goal of all of this


chunk_text:
is stuck down in the hole and then when you power it it pulls the solenoid out 359.20s - 361.20s | These are far better for 361.68s - 366.92s | Various reasons you can't get locked into your building and die. They're a little harder to trip 366.92s - 371.16s | You know, you can't vape into these and have them, you know, pull a solenoid up 371.68s - 377.20s | So if you're given an option you're installing these anytime you can put an electric strike. So 378.24s - 380.24s | Now let's look at smart cards 381.12s - 387.04s | First we need to answer the question. What do I mean by smart card? There's really I think three different forms 387.04s - 392.24s | You'll see there's the ones that look like our credit cards that have these little pads on them 392.52s - 398.48s | There's ones that are just pieces of plastic that do some RF stuff and then there's ones with the mag stripe on the back 399.64s - 400.80s | so 400.80s - 403.80s | These are all very very different technologies 403.80s - 409.44s | the end goal of all of this is to take stuff from our digital world and encode it somehow and a 409.44s - 413.32s | Physical piece of plastic that fits in our wallet and is the same size as our driver's license 414.52s - 416.52s | so if we look at a mag stripe 417.76s - 424.32s | This one normally like fascinates people that stuff that is stored on the magnetic strip of your credit card is 424.64s - 430.64s | Exactly the data that is printed on the front of your credit card. It is just a way to encode 431.40s - 436.36s | ASCII text effectively in a magnetic form. There is no security involved 436.36s - 441.60s | There is no encryption if you want to clone some mag stripe cards. We have them over in the physical security village 441.76s - 444.56s | This was like, you know attempt number one at hey 444.56s - 448.64s | We're gonna use a physical thing to interface with a digital world. There is 449.52s - 454.00s | Nothing interesting or sophisticated there other than some physics with like magnetic poles 454.76s - 456.76s | Not smart at all 457.52s - 459.52s | Then


chunk_text:
is to take stuff from our digital world and encode it somehow and a 409.44s - 413.32s | Physical piece of plastic that fits in our wallet and is the same size as our driver's license 414.52s - 416.52s | so if we look at a mag stripe 417.76s - 424.32s | This one normally like fascinates people that stuff that is stored on the magnetic strip of your credit card is 424.64s - 430.64s | Exactly the data that is printed on the front of your credit card. It is just a way to encode 431.40s - 436.36s | ASCII text effectively in a magnetic form. There is no security involved 436.36s - 441.60s | There is no encryption if you want to clone some mag stripe cards. We have them over in the physical security village 441.76s - 444.56s | This was like, you know attempt number one at hey 444.56s - 448.64s | We're gonna use a physical thing to interface with a digital world. There is 449.52s - 454.00s | Nothing interesting or sophisticated there other than some physics with like magnetic poles 454.76s - 456.76s | Not smart at all 457.52s - 459.52s | Then came the prox cards 459.76s - 466.48s | These you literally just emanate radio waves at them. They can be passively powered which is really cool 466.48s - 472.36s | So the the radio waves actually give them the power they need to power on and then they respond with a number 472.56s - 474.40s | You can actually 474.40s - 478.44s | Hack these things with AM radios. I have like a little kit when my sister was like five 478.44s - 483.48s | We were playing around and like emulating these kind of smart cards. They are not encrypted 483.48s - 487.88s | There is nothing really interesting from a cryptography standpoint going on there 488.08s - 493.56s | The only thing to figure out is how they encode the data that coming back. Is it amplitude shift keying? 493.56s - 496.80s | Is it phase shift keying? How are they encoding the radio frequency? 497.60s - 498.64s | At the end of the day 498.64s - 505.38s | It is just a number and that number is typically printed on the card just to add to the security of the whole situation 505.56s - 508.40s | These


chunk_text:
came the prox cards 459.76s - 466.48s | These you literally just emanate radio waves at them. They can be passively powered which is really cool 466.48s - 472.36s | So the the radio waves actually give them the power they need to power on and then they respond with a number 472.56s - 474.40s | You can actually 474.40s - 478.44s | Hack these things with AM radios. I have like a little kit when my sister was like five 478.44s - 483.48s | We were playing around and like emulating these kind of smart cards. They are not encrypted 483.48s - 487.88s | There is nothing really interesting from a cryptography standpoint going on there 488.08s - 493.56s | The only thing to figure out is how they encode the data that coming back. Is it amplitude shift keying? 493.56s - 496.80s | Is it phase shift keying? How are they encoding the radio frequency? 497.60s - 498.64s | At the end of the day 498.64s - 505.38s | It is just a number and that number is typically printed on the card just to add to the security of the whole situation 505.56s - 508.40s | These were never intended as a high security thing yet 508.40s - 510.40s | If you go to most enterprises on earth 510.84s - 517.28s | Including the one my wife works at they still use these exact cards today as does the high-rise that my company is in in 517.60s - 521.40s | Downtown Houston. It's it's a bummer. Like I saw her come home first day of work 521.40s - 526.16s | Like why like I know where you work. Don't do that. Do you have sensitive stuff? 527.00s - 528.60s | so 528.60s - 535.68s | Then came along the near-field communication cards NFC or high-frequency cards. These run at 13.5 6 megahertz 535.76s - 542.36s | These do have cryptography on them the way to think of the cryptography on all of these is as a memory card 542.48s - 545.28s | There is a symmetric key that is on the card 545.28s - 548.76s | And if you have it, you can read and write to that card 548.76s - 555.20s | And if you don't you cannot so there is one key that will let you read and write data from these cards 555.88s -


chunk_text:
were never intended as a high security thing yet 508.40s - 510.40s | If you go to most enterprises on earth 510.84s - 517.28s | Including the one my wife works at they still use these exact cards today as does the high-rise that my company is in in 517.60s - 521.40s | Downtown Houston. It's it's a bummer. Like I saw her come home first day of work 521.40s - 526.16s | Like why like I know where you work. Don't do that. Do you have sensitive stuff? 527.00s - 528.60s | so 528.60s - 535.68s | Then came along the near-field communication cards NFC or high-frequency cards. These run at 13.5 6 megahertz 535.76s - 542.36s | These do have cryptography on them the way to think of the cryptography on all of these is as a memory card 542.48s - 545.28s | There is a symmetric key that is on the card 545.28s - 548.76s | And if you have it, you can read and write to that card 548.76s - 555.20s | And if you don't you cannot so there is one key that will let you read and write data from these cards 555.88s - 557.84s | Otherwise, I 557.84s - 561.16s | Colloquially call them dumb cards there. They're not doing anything sophisticated 561.16s - 566.16s | They're just memory cards, but they are better than the mag stripes and the prox cards 567.00s - 568.32s | so 568.32s - 570.40s | There's gonna be a shared key, which 571.36s - 575.96s | That screen still looks like it's on so there's gonna be a key on the card and a key on the reader 576.24s - 579.16s | So for the reader to read the card, it needs another key 580.60s - 584.84s | Which you can kind of see where this is going if I'm deploying, you know a million of these 585.20s - 589.28s | That means that that key has to be on all of the readers and all 1 million cards 591.60s - 596.00s | Now we look at what is actually considered a smart card 596.00s - 601.40s | So our credit cards that look like this with the little chip. These are actually little 602.24s - 609.56s | Microprocessors, they're not microcontrollers. They actually run Java OS. They have a CPU. They have memory 609.72s - 612.68s


chunk_text:
557.84s | Otherwise, I 557.84s - 561.16s | Colloquially call them dumb cards there. They're not doing anything sophisticated 561.16s - 566.16s | They're just memory cards, but they are better than the mag stripes and the prox cards 567.00s - 568.32s | so 568.32s - 570.40s | There's gonna be a shared key, which 571.36s - 575.96s | That screen still looks like it's on so there's gonna be a key on the card and a key on the reader 576.24s - 579.16s | So for the reader to read the card, it needs another key 580.60s - 584.84s | Which you can kind of see where this is going if I'm deploying, you know a million of these 585.20s - 589.28s | That means that that key has to be on all of the readers and all 1 million cards 591.60s - 596.00s | Now we look at what is actually considered a smart card 596.00s - 601.40s | So our credit cards that look like this with the little chip. These are actually little 602.24s - 609.56s | Microprocessors, they're not microcontrollers. They actually run Java OS. They have a CPU. They have memory 609.72s - 612.68s | They have non-volatile storage. They have you know 613.52s - 618.24s | Dedicated crypto units and they can do public key cryptography. So these are actually 619.00s - 623.84s | Smart in the sense that we would hope they are and do proper security things 625.44s - 629.88s | With the asymmetric encryption, this is much better than the symmetric key encryption 629.88s - 631.00s | It means if you break my card 631.00s - 636.16s | You only get my private key and you're not going to take down my whole company and be able to clone every employee's card 637.76s - 641.20s | Which is very good for the scalability point 641.60s - 647.80s | And I put this diagram there because I think it's interesting that I didn't realize this till I started hacking smart cards in my 647.80s - 650.52s | Career that these really are just little embedded 651.44s - 653.12s | systems like I 653.12s - 657.60s | There's far more sophisticated stuff in there than I thought and you can kind of see the overlap 657.60s - 659.72s | You have contact cards that speak one protocol 659.88s - 663.92s | You


chunk_text:
| They have non-volatile storage. They have you know 613.52s - 618.24s | Dedicated crypto units and they can do public key cryptography. So these are actually 619.00s - 623.84s | Smart in the sense that we would hope they are and do proper security things 625.44s - 629.88s | With the asymmetric encryption, this is much better than the symmetric key encryption 629.88s - 631.00s | It means if you break my card 631.00s - 636.16s | You only get my private key and you're not going to take down my whole company and be able to clone every employee's card 637.76s - 641.20s | Which is very good for the scalability point 641.60s - 647.80s | And I put this diagram there because I think it's interesting that I didn't realize this till I started hacking smart cards in my 647.80s - 650.52s | Career that these really are just little embedded 651.44s - 653.12s | systems like I 653.12s - 657.60s | There's far more sophisticated stuff in there than I thought and you can kind of see the overlap 657.60s - 659.72s | You have contact cards that speak one protocol 659.88s - 663.92s | You have contactless cards and then you have the dual interface cards 663.92s - 669.92s | Which almost all credit cards are today you can tap to pay or you can shove that thing, you know into the the credit card reader 670.52s - 673.88s | And if you look at the specs, you know, they're 1k mbit flash 673.88s - 681.64s | There's an EEPROM that speaks I square seed and spy and spy they have segmented memory with a 64 kbit EEPROM like 682.36s - 684.64s | Pretty decent specs for a credit card 685.20s - 691.14s | If the way they work is if you look at those pads only 691.26s - 696.62s | Formatter you have your power in your ground to power the little computer on you drive the clock externally 696.62s - 701.46s | Which is interesting from a glitching perspective. So you have a you control both the voltage and the clock 701.46s - 704.70s | And then you just have a single pin for IO 704.70s - 710.22s | So as you're driving the clock use that IO to read and write commands and application data units 710.50s - 717.42s | so a


chunk_text:
have contactless cards and then you have the dual interface cards 663.92s - 669.92s | Which almost all credit cards are today you can tap to pay or you can shove that thing, you know into the the credit card reader 670.52s - 673.88s | And if you look at the specs, you know, they're 1k mbit flash 673.88s - 681.64s | There's an EEPROM that speaks I square seed and spy and spy they have segmented memory with a 64 kbit EEPROM like 682.36s - 684.64s | Pretty decent specs for a credit card 685.20s - 691.14s | If the way they work is if you look at those pads only 691.26s - 696.62s | Formatter you have your power in your ground to power the little computer on you drive the clock externally 696.62s - 701.46s | Which is interesting from a glitching perspective. So you have a you control both the voltage and the clock 701.46s - 704.70s | And then you just have a single pin for IO 704.70s - 710.22s | So as you're driving the clock use that IO to read and write commands and application data units 710.50s - 717.42s | so a PD use you're gonna send commands you can actually send like admin commands and install Java applets and 717.82s - 719.82s | manipulate the operating system or 720.42s - 724.46s | You know unauthenticated commands that are just gonna query this thing for a challenge response 725.74s - 727.10s | so I 727.10s - 733.58s | Got my doctorate in embedded system security where I was glitching and doing all sorts of crazy things that break into embedded systems 733.82s - 740.66s | So smart cards have always fascinated me because they actually do a very very good job at physical attacks 740.94s - 745.38s | So it's common that you would drop your credit card and somebody could pick it up, right? 745.58s - 750.10s | They can still go make payments, but actually extracting that key cloning cards is a big deal 750.70s - 756.94s | So they actually lay if you look at the IC and delid it between every single layer of logic 756.94s - 759.86s | There is a layer of mesh. That is a destroy 760.90s - 764.50s | Mechanism if that is tampered and you break a single one of those traces 764.50s


chunk_text:
PD use you're gonna send commands you can actually send like admin commands and install Java applets and 717.82s - 719.82s | manipulate the operating system or 720.42s - 724.46s | You know unauthenticated commands that are just gonna query this thing for a challenge response 725.74s - 727.10s | so I 727.10s - 733.58s | Got my doctorate in embedded system security where I was glitching and doing all sorts of crazy things that break into embedded systems 733.82s - 740.66s | So smart cards have always fascinated me because they actually do a very very good job at physical attacks 740.94s - 745.38s | So it's common that you would drop your credit card and somebody could pick it up, right? 745.58s - 750.10s | They can still go make payments, but actually extracting that key cloning cards is a big deal 750.70s - 756.94s | So they actually lay if you look at the IC and delid it between every single layer of logic 756.94s - 759.86s | There is a layer of mesh. That is a destroy 760.90s - 764.50s | Mechanism if that is tampered and you break a single one of those traces 764.50s - 769.20s | It actually will self-destruct the card by deleting all of the sensitive material 769.60s - 774.34s | They also have to have brownout detection because you're controlling the voltage externally 774.62s - 781.70s | There are glitching attacks you can do on embedded systems where while they are doing computation you can brown the voltage out 781.70s - 785.14s | So that means you're gonna take it from your positive 5 volts to negative 5 volts 785.38s - 789.90s | That can make your D flip-flops go crazy and you can have an if statement 790.14s - 793.90s | Evaluate to true that otherwise should have been false or vice versa 795.30s - 802.82s | They also because you're controlling power clock all of these things you have to program the logic very specially 803.10s - 807.78s | So one of these two statements on the right is correct in 808.66s - 814.42s | An embedded system standpoint if you're writing this for a computer software, they're both probably fine 814.94s - 820.70s | But these this is the code to check the pin when I'm entering the pin to say unlock my debit card 821.10s -


chunk_text:
- 769.20s | It actually will self-destruct the card by deleting all of the sensitive material 769.60s - 774.34s | They also have to have brownout detection because you're controlling the voltage externally 774.62s - 781.70s | There are glitching attacks you can do on embedded systems where while they are doing computation you can brown the voltage out 781.70s - 785.14s | So that means you're gonna take it from your positive 5 volts to negative 5 volts 785.38s - 789.90s | That can make your D flip-flops go crazy and you can have an if statement 790.14s - 793.90s | Evaluate to true that otherwise should have been false or vice versa 795.30s - 802.82s | They also because you're controlling power clock all of these things you have to program the logic very specially 803.10s - 807.78s | So one of these two statements on the right is correct in 808.66s - 814.42s | An embedded system standpoint if you're writing this for a computer software, they're both probably fine 814.94s - 820.70s | But these this is the code to check the pin when I'm entering the pin to say unlock my debit card 821.10s - 823.30s | Does anybody have an inkling of? 824.46s - 826.46s | Which one is better than the other? 827.14s - 835.86s | We think number two is better 836.62s - 838.74s | Correct number two is better 839.14s - 846.30s | So the reason that number one would fall vulnerable on a smart card is because you can do side channel analysis to actually see 846.30s - 849.54s | if that if statement evaluated to true or false and 850.06s - 855.50s | What you can do in this attack is that if you believe it evaluated to false you cut the power 855.82s - 860.74s | Immediately before it has time to increment the counter and write that to the non-volatile storage 861.74s - 864.74s | Which means you could then brute-force this with unlimited tries 864.86s - 870.34s | Whereas if you increment the counter before you do the check you can still limit it to 10 or you know 870.34s - 872.34s | 15 pin attempts, whatever you have 872.86s - 875.38s | The awesome part is on these smart cards 875.38s - 881.22s | This is all actually they've thought about a lot of this


chunk_text:
823.30s | Does anybody have an inkling of? 824.46s - 826.46s | Which one is better than the other? 827.14s - 835.86s | We think number two is better 836.62s - 838.74s | Correct number two is better 839.14s - 846.30s | So the reason that number one would fall vulnerable on a smart card is because you can do side channel analysis to actually see 846.30s - 849.54s | if that if statement evaluated to true or false and 850.06s - 855.50s | What you can do in this attack is that if you believe it evaluated to false you cut the power 855.82s - 860.74s | Immediately before it has time to increment the counter and write that to the non-volatile storage 861.74s - 864.74s | Which means you could then brute-force this with unlimited tries 864.86s - 870.34s | Whereas if you increment the counter before you do the check you can still limit it to 10 or you know 870.34s - 872.34s | 15 pin attempts, whatever you have 872.86s - 875.38s | The awesome part is on these smart cards 875.38s - 881.22s | This is all actually they've thought about a lot of this because it's used for financial transactions in the EU, especially 881.94s - 886.34s | So I read the whole book on smart card security and these were the highlights that I thought were 887.06s - 889.06s | particularly interesting of security done well 889.90s - 891.66s | So 891.66s - 894.58s | Before we go break all these why did we even build these in the first place? 895.06s - 898.34s | The real problem is that physical keys are one-to-one 898.34s - 902.74s | There's one key that opens one door if I want 1,000 people to open that one door 902.74s - 908.50s | They all have the exact same key and if one of those 1,000 people is bad and I have to fire them 908.50s - 910.50s | I now have to give out 911.06s - 913.06s | 999 913.06s - 915.06s | 9999 new keys and rekey that door 915.18s - 921.02s | So in enterprise this sucks smart cards can be one-to-many you can have many different 921.74s - 923.74s | Credentials that get into the same door 923.82s - 929.90s | It used to be really complicated to carry a full computer in


chunk_text:
because it's used for financial transactions in the EU, especially 881.94s - 886.34s | So I read the whole book on smart card security and these were the highlights that I thought were 887.06s - 889.06s | particularly interesting of security done well 889.90s - 891.66s | So 891.66s - 894.58s | Before we go break all these why did we even build these in the first place? 895.06s - 898.34s | The real problem is that physical keys are one-to-one 898.34s - 902.74s | There's one key that opens one door if I want 1,000 people to open that one door 902.74s - 908.50s | They all have the exact same key and if one of those 1,000 people is bad and I have to fire them 908.50s - 910.50s | I now have to give out 911.06s - 913.06s | 999 913.06s - 915.06s | 9999 new keys and rekey that door 915.18s - 921.02s | So in enterprise this sucks smart cards can be one-to-many you can have many different 921.74s - 923.74s | Credentials that get into the same door 923.82s - 929.90s | It used to be really complicated to carry a full computer in your pocket as you can see the modern smart cards are actually little 929.90s - 931.90s | mini computers our smartphones are 932.14s - 934.14s | really big fast computers and 934.42s - 938.42s | You can put a picture on them. This should not be you know ignored 938.42s - 943.86s | It is nice that when you come to conferences and things there is something around everyone's neck that indicates 943.90s - 946.82s | They are meant to be here and should not be escorted out 947.02s - 954.48s | So even all the security and stuff aside the fact that people have things hanging around the neck that says that they belong is actually 954.48s - 956.06s | valuable 956.06s - 959.70s | Enough with all that fluffy stuff. Let's go through some exploits. That's why I write DEF CON 960.42s - 961.66s | so 961.66s - 967.22s | When you're doing a vulnerability assessment you first want to ask yourself. What's the goal right? What's the worst that can happen? 967.62s - 970.22s | So we could use a card without someone's permission 970.22s - 973.86s | I could you know, swipe it out of your


chunk_text:
your pocket as you can see the modern smart cards are actually little 929.90s - 931.90s | mini computers our smartphones are 932.14s - 934.14s | really big fast computers and 934.42s - 938.42s | You can put a picture on them. This should not be you know ignored 938.42s - 943.86s | It is nice that when you come to conferences and things there is something around everyone's neck that indicates 943.90s - 946.82s | They are meant to be here and should not be escorted out 947.02s - 954.48s | So even all the security and stuff aside the fact that people have things hanging around the neck that says that they belong is actually 954.48s - 956.06s | valuable 956.06s - 959.70s | Enough with all that fluffy stuff. Let's go through some exploits. That's why I write DEF CON 960.42s - 961.66s | so 961.66s - 967.22s | When you're doing a vulnerability assessment you first want to ask yourself. What's the goal right? What's the worst that can happen? 967.62s - 970.22s | So we could use a card without someone's permission 970.22s - 973.86s | I could you know, swipe it out of your back pocket. I 974.46s - 978.66s | Can clone the smart card or I can subvert the need for it all together 978.98s - 984.62s | So we already saw at the beginning some of the ways that you can just completely ignore the card 984.62s - 986.50s | If you go to the physical security village 986.50s - 992.38s | they have many many many more ways to get into buildings that have nothing to do with computer science and 993.18s - 998.22s | Using the card without a person's permission is not particularly interesting because you're just stealing the card 998.26s - 1002.74s | There are ways that there are some smart cards that will have like biometrics built into them 1003.30s - 1008.22s | You know other things like that. We're gonna specifically focus on cloning the smart cards 1009.74s - 1013.50s | So the way it works when you have a good, you know 1013.86s - 1021.78s | One of the dumb cards the 13.5 megahertz 5 6 megahertz cards. There's gonna be two keys that really have to 1022.38s - 1024.94s | Work together to store this credential 1024.94s - 1029.46s | So there's me


chunk_text:
back pocket. I 974.46s - 978.66s | Can clone the smart card or I can subvert the need for it all together 978.98s - 984.62s | So we already saw at the beginning some of the ways that you can just completely ignore the card 984.62s - 986.50s | If you go to the physical security village 986.50s - 992.38s | they have many many many more ways to get into buildings that have nothing to do with computer science and 993.18s - 998.22s | Using the card without a person's permission is not particularly interesting because you're just stealing the card 998.26s - 1002.74s | There are ways that there are some smart cards that will have like biometrics built into them 1003.30s - 1008.22s | You know other things like that. We're gonna specifically focus on cloning the smart cards 1009.74s - 1013.50s | So the way it works when you have a good, you know 1013.86s - 1021.78s | One of the dumb cards the 13.5 megahertz 5 6 megahertz cards. There's gonna be two keys that really have to 1022.38s - 1024.94s | Work together to store this credential 1024.94s - 1029.46s | So there's me one an authentication key an in-transit key that lets you read and write data 1029.46s - 1033.14s | And then you can also encrypt the data at rest on the card 1033.50s - 1039.86s | So if my employee credential is 1 2 3 3 4 5 6 8 9 0 I will encrypt that while it's on the card 1039.86s - 1046.78s | And then I will also have effectively a key that encrypts the in transit that lets me even talk to the card 1047.46s - 1053.74s | It doesn't matter what the key for the encryption on the card is if I'm just going to clone it outright 1054.02s - 1061.98s | So that is worth noting because one of the fixes I'll explain later. They fixed the in the in transit key or sorry 1062.46s - 1066.78s | Yeah, they changed the in transit key, but it didn't actually fix the problem 1068.26s - 1074.18s | So the whole goal of this when we're trying to break into buildings with laptops is just find that dang key 1074.18s - 1077.78s | whatever the key is that lets me read and write data from the cards is


chunk_text:
one an authentication key an in-transit key that lets you read and write data 1029.46s - 1033.14s | And then you can also encrypt the data at rest on the card 1033.50s - 1039.86s | So if my employee credential is 1 2 3 3 4 5 6 8 9 0 I will encrypt that while it's on the card 1039.86s - 1046.78s | And then I will also have effectively a key that encrypts the in transit that lets me even talk to the card 1047.46s - 1053.74s | It doesn't matter what the key for the encryption on the card is if I'm just going to clone it outright 1054.02s - 1061.98s | So that is worth noting because one of the fixes I'll explain later. They fixed the in the in transit key or sorry 1062.46s - 1066.78s | Yeah, they changed the in transit key, but it didn't actually fix the problem 1068.26s - 1074.18s | So the whole goal of this when we're trying to break into buildings with laptops is just find that dang key 1074.18s - 1077.78s | whatever the key is that lets me read and write data from the cards is 1078.30s - 1084.30s | Game over for that security system because now I can walk up next to anybody and just outright clone 1084.50s - 1088.78s | Employee IDs and in the case that I also know the at-rest key 1088.78s - 1092.54s | I can just fabricate whatever keys I want and if it's printed on the badge 1092.54s - 1099.14s | I can just read someone's ID badge walking by and then go become them and just go in whatever door 1099.14s - 1101.14s | I know they can go into 1101.94s - 1103.26s | So 1103.26s - 1105.42s | How are these attacks done? These are 1106.62s - 1113.78s | Almost all exclusively physical attacks on the cards and their readers first this one on the my fair classic 1113.78s - 1116.06s | So this was the most prolific card 1117.06s - 1121.22s | Early in the smart card era. This was used for everything public transit 1121.62s - 1125.38s | Cash cards, so you'd actually store money in the value on the card 1125.74s - 1129.18s | So breaking these was a really big deal in the research world 1129.70s - 1136.02s | There were a


chunk_text:
1078.30s - 1084.30s | Game over for that security system because now I can walk up next to anybody and just outright clone 1084.50s - 1088.78s | Employee IDs and in the case that I also know the at-rest key 1088.78s - 1092.54s | I can just fabricate whatever keys I want and if it's printed on the badge 1092.54s - 1099.14s | I can just read someone's ID badge walking by and then go become them and just go in whatever door 1099.14s - 1101.14s | I know they can go into 1101.94s - 1103.26s | So 1103.26s - 1105.42s | How are these attacks done? These are 1106.62s - 1113.78s | Almost all exclusively physical attacks on the cards and their readers first this one on the my fair classic 1113.78s - 1116.06s | So this was the most prolific card 1117.06s - 1121.22s | Early in the smart card era. This was used for everything public transit 1121.62s - 1125.38s | Cash cards, so you'd actually store money in the value on the card 1125.74s - 1129.18s | So breaking these was a really big deal in the research world 1129.70s - 1136.02s | There were a couple professors at UVA that actually delidded the chip they dissolved it in acid and went layer by layer 1137.02s - 1143.90s | Delidding this chip and taking really high-resolution pictures that you see here of the actual ASIC 1144.18s - 1148.14s | Like the the circuitry of the IC and then they applied 1149.10s - 1155.26s | Image recognition to all of these images to reverse engineer the algorithm that was encoded in that chip 1155.26s - 1158.46s | And then from there, we're able to start analyzing 1158.70s - 1165.14s | You know doing like crypt analysis to figure out if there are any vulnerabilities in the cryptography on these my fair classics 1165.82s - 1169.58s | spoiler alert, yes, there was my fair classic at this point is 1170.50s - 1174.50s | Quite broken anybody with a flipper zero can just go to RFID read 1174.78s - 1181.30s | Put it up to the back of the flipper zero or to the back of the card and it will run some version of this 1181.30s - 1183.34s | Program I wasn't involved in the porting of it 1183.34s - 1185.46s | But mostly a user of all


chunk_text:
couple professors at UVA that actually delidded the chip they dissolved it in acid and went layer by layer 1137.02s - 1143.90s | Delidding this chip and taking really high-resolution pictures that you see here of the actual ASIC 1144.18s - 1148.14s | Like the the circuitry of the IC and then they applied 1149.10s - 1155.26s | Image recognition to all of these images to reverse engineer the algorithm that was encoded in that chip 1155.26s - 1158.46s | And then from there, we're able to start analyzing 1158.70s - 1165.14s | You know doing like crypt analysis to figure out if there are any vulnerabilities in the cryptography on these my fair classics 1165.82s - 1169.58s | spoiler alert, yes, there was my fair classic at this point is 1170.50s - 1174.50s | Quite broken anybody with a flipper zero can just go to RFID read 1174.78s - 1181.30s | Put it up to the back of the flipper zero or to the back of the card and it will run some version of this 1181.30s - 1183.34s | Program I wasn't involved in the porting of it 1183.34s - 1185.46s | But mostly a user of all these great tools 1185.46s - 1190.74s | But this is what it looked like way back in the day in your terminal window now, it's a very awesome 1191.14s - 1198.30s | You know handheld little device, but you can effectively brute force all of those keys break the keys back to being a talk 1198.30s - 1201.50s | Once you have the key it's game over you tap any card you're reading and writing 1202.70s - 1204.38s | You can again come over to our booth 1204.38s - 1210.26s | There's still hotel key cards and public transit cards and things today that are still using my for classic 1211.26s - 1215.06s | So in the enterprise environment, there's 1215.66s - 1216.74s | HID 1216.74s - 1218.74s | dominated they were by far the 1219.22s - 1220.38s | monopolist in 1220.38s - 1226.02s | You know enterprise access control this thing on the left probably looks very familiar to most of you 1226.02s - 1232.62s | You have to they're all around this conference. You've seen them probably in tons of buildings airports financial institutions, whatever 1232.62s - 1234.62s | Every elevator here has one of these 1235.46s -


chunk_text:
these great tools 1185.46s - 1190.74s | But this is what it looked like way back in the day in your terminal window now, it's a very awesome 1191.14s - 1198.30s | You know handheld little device, but you can effectively brute force all of those keys break the keys back to being a talk 1198.30s - 1201.50s | Once you have the key it's game over you tap any card you're reading and writing 1202.70s - 1204.38s | You can again come over to our booth 1204.38s - 1210.26s | There's still hotel key cards and public transit cards and things today that are still using my for classic 1211.26s - 1215.06s | So in the enterprise environment, there's 1215.66s - 1216.74s | HID 1216.74s - 1218.74s | dominated they were by far the 1219.22s - 1220.38s | monopolist in 1220.38s - 1226.02s | You know enterprise access control this thing on the left probably looks very familiar to most of you 1226.02s - 1232.62s | You have to they're all around this conference. You've seen them probably in tons of buildings airports financial institutions, whatever 1232.62s - 1234.62s | Every elevator here has one of these 1235.46s - 1240.46s | These use symmetric keys, right so we go back to how would you deploy a system like this? 1241.22s - 1246.06s | Every single one of these on earth that is sold has the exact same symmetric key 1246.42s - 1250.26s | Every single card every single reader has the exact same key 1250.26s - 1256.62s | So they've sold millions of these to many different buildings one of which we are standing in today with the same key 1257.02s - 1262.18s | So that would be absolutely terrible if that one key got leaked 1263.18s - 1270.02s | It took a while actually to get this key they did pretty good security nobody dissolved the cards in acid 1270.66s - 1276.62s | Didn't anything like that back in 2010 below. She Marriac was looking at the back of one of these readers 1276.62s - 1283.78s | I think is the rw40 said hey that looks a lot like the pin header on my pick my pick kit my pick microcontroller 1284.62s - 1290.06s | turns out the way they secured this system was by flipping pin 1 and pin 3 because 1290.18s - 1296.46s | You know


chunk_text:
1240.46s | These use symmetric keys, right so we go back to how would you deploy a system like this? 1241.22s - 1246.06s | Every single one of these on earth that is sold has the exact same symmetric key 1246.42s - 1250.26s | Every single card every single reader has the exact same key 1250.26s - 1256.62s | So they've sold millions of these to many different buildings one of which we are standing in today with the same key 1257.02s - 1262.18s | So that would be absolutely terrible if that one key got leaked 1263.18s - 1270.02s | It took a while actually to get this key they did pretty good security nobody dissolved the cards in acid 1270.66s - 1276.62s | Didn't anything like that back in 2010 below. She Marriac was looking at the back of one of these readers 1276.62s - 1283.78s | I think is the rw40 said hey that looks a lot like the pin header on my pick my pick kit my pick microcontroller 1284.62s - 1290.06s | turns out the way they secured this system was by flipping pin 1 and pin 3 because 1290.18s - 1296.46s | You know nobody on earth would ever dream of flipping pin 1 and 3 pin 3 on their pick kit 1296.58s - 1300.18s | So he just swapped pins 1 and pin 3 1301.02s - 1302.54s | Plugged it in 1302.54s - 1310.10s | Great. We're debugging it. There is a security feature on pick though where you can't just read memory that would be catastrophic and extremely dumb 1310.10s - 1315.62s | They did not do that this particular one though had a vulnerability where you could wipe 1316.14s - 1318.02s | individual sectors and 1318.02s - 1322.82s | Write data to individual sectors. So the way this should work is I'm gonna write new firmware 1322.82s - 1325.70s | I have to wipe the whole firmware and write my own custom firmware 1326.30s - 1332.06s | With this little subtlety you could erase sector 0 write code in there 1332.06s - 1336.82s | That would dump sectors 1 through n and then take another sacrificial reader 1337.54s - 1342.70s | Delete sectors 1 through n and write code in all of those that would dump sector 0 1342.94s - 1349.06s | So by sacrificing two of these you now put


chunk_text:
nobody on earth would ever dream of flipping pin 1 and 3 pin 3 on their pick kit 1296.58s - 1300.18s | So he just swapped pins 1 and pin 3 1301.02s - 1302.54s | Plugged it in 1302.54s - 1310.10s | Great. We're debugging it. There is a security feature on pick though where you can't just read memory that would be catastrophic and extremely dumb 1310.10s - 1315.62s | They did not do that this particular one though had a vulnerability where you could wipe 1316.14s - 1318.02s | individual sectors and 1318.02s - 1322.82s | Write data to individual sectors. So the way this should work is I'm gonna write new firmware 1322.82s - 1325.70s | I have to wipe the whole firmware and write my own custom firmware 1326.30s - 1332.06s | With this little subtlety you could erase sector 0 write code in there 1332.06s - 1336.82s | That would dump sectors 1 through n and then take another sacrificial reader 1337.54s - 1342.70s | Delete sectors 1 through n and write code in all of those that would dump sector 0 1342.94s - 1349.06s | So by sacrificing two of these you now put all of that together and you have the complete firmware 1349.62s - 1352.70s | Dumped on your computer that you can now analyze with IDA Pro 1353.54s - 1356.42s | They stored everything in PIC memory 1356.94s - 1362.30s | Including those keys they weren't stored off chip and some sort of secure RAM or anything like that 1362.82s - 1368.58s | So once you reverse engineer this go through lo and behold the keys just pop right out at you 1369.14s - 1374.30s | That's game over since these are symmetric keys now when you go to clone an HID card 1374.30s - 1379.10s | There is no brute brute forcing going on. You just read the freaking card 1379.46s - 1382.58s | They did add an I class SE 1382.58s - 1386.90s | So if you're in the industry and you see this on the back your card the SE I 1387.50s - 1393.38s | Think stands for secure encryption or something like that, but they did encrypt the data at rest on the card 1393.94s - 1396.14s | So it used to be you'd use this key 1396.14s - 1403.30s | You just read the the credential


chunk_text:
all of that together and you have the complete firmware 1349.62s - 1352.70s | Dumped on your computer that you can now analyze with IDA Pro 1353.54s - 1356.42s | They stored everything in PIC memory 1356.94s - 1362.30s | Including those keys they weren't stored off chip and some sort of secure RAM or anything like that 1362.82s - 1368.58s | So once you reverse engineer this go through lo and behold the keys just pop right out at you 1369.14s - 1374.30s | That's game over since these are symmetric keys now when you go to clone an HID card 1374.30s - 1379.10s | There is no brute brute forcing going on. You just read the freaking card 1379.46s - 1382.58s | They did add an I class SE 1382.58s - 1386.90s | So if you're in the industry and you see this on the back your card the SE I 1387.50s - 1393.38s | Think stands for secure encryption or something like that, but they did encrypt the data at rest on the card 1393.94s - 1396.14s | So it used to be you'd use this key 1396.14s - 1403.30s | You just read the the credential off and you could write arbitrary credentials with the SE. They did use AES. That's good 1403.30s - 1408.06s | They used a known algorithm to encrypt the blob on the card, but you can still clone it outright 1408.18s - 1412.40s | So if I want to become you I just tap your card. I take your blob. I put on my card. Boom. I'm you 1413.14s - 1419.38s | They also had a version that they would upsell you on called HID elite class 1419.74s - 1423.22s | So what elite class would do is it would just change that standard key? 1423.22s - 1426.90s | That's on every door on earth for your organization 1426.90s - 1432.78s | They would give you an organization specific key and then your cards your employees would use a different key 1432.78s - 1434.78s | So people couldn't come up and clone it 1434.98s - 1436.98s | Sounds good 1436.98s - 1440.38s | Unfortunately, the firmware at this point is you know, it's not open sourced 1440.38s - 1443.18s | But it's out there if you know the right people and know where to look 1443.62s - 1447.70s | There were


chunk_text:
off and you could write arbitrary credentials with the SE. They did use AES. That's good 1403.30s - 1408.06s | They used a known algorithm to encrypt the blob on the card, but you can still clone it outright 1408.18s - 1412.40s | So if I want to become you I just tap your card. I take your blob. I put on my card. Boom. I'm you 1413.14s - 1419.38s | They also had a version that they would upsell you on called HID elite class 1419.74s - 1423.22s | So what elite class would do is it would just change that standard key? 1423.22s - 1426.90s | That's on every door on earth for your organization 1426.90s - 1432.78s | They would give you an organization specific key and then your cards your employees would use a different key 1432.78s - 1434.78s | So people couldn't come up and clone it 1434.98s - 1436.98s | Sounds good 1436.98s - 1440.38s | Unfortunately, the firmware at this point is you know, it's not open sourced 1440.38s - 1443.18s | But it's out there if you know the right people and know where to look 1443.62s - 1447.70s | There were some researchers Flavio Garcia a couple other folks 1448.26s - 1452.50s | Looked at this algorithm and found that there was actually a vulnerability in the way 1452.74s - 1457.78s | That the elite keys were derived and they were able to go up to an elite key reader 1458.38s - 1461.46s | Send I think it was seven failed attempts of 1462.34s - 1465.90s | Cards that wouldn't register at all the back end. It would never spit them out 1465.90s - 1470.36s | They were total failed transactions and then offline you could brute force the elite key 1470.62s - 1473.04s | So even if you paid to upgrade to the elite key 1473.44s - 1477.48s | Somebody's had to walk by one of your readers tap their proxmark. Boom 1477.48s - 1481.80s | Now they have the key and we're back to where we started just clone and employee IDs 1482.20s - 1484.88s | This was like, I don't know at least in my career 1484.88s - 1492.08s | This is like the coolest like heyday couple of years and breaking into the RFID things and all these papers are published 1492.08s - 1496.96s | I'm like


chunk_text:
some researchers Flavio Garcia a couple other folks 1448.26s - 1452.50s | Looked at this algorithm and found that there was actually a vulnerability in the way 1452.74s - 1457.78s | That the elite keys were derived and they were able to go up to an elite key reader 1458.38s - 1461.46s | Send I think it was seven failed attempts of 1462.34s - 1465.90s | Cards that wouldn't register at all the back end. It would never spit them out 1465.90s - 1470.36s | They were total failed transactions and then offline you could brute force the elite key 1470.62s - 1473.04s | So even if you paid to upgrade to the elite key 1473.44s - 1477.48s | Somebody's had to walk by one of your readers tap their proxmark. Boom 1477.48s - 1481.80s | Now they have the key and we're back to where we started just clone and employee IDs 1482.20s - 1484.88s | This was like, I don't know at least in my career 1484.88s - 1492.08s | This is like the coolest like heyday couple of years and breaking into the RFID things and all these papers are published 1492.08s - 1496.96s | I'm like implementing the stuff as they're publishing it like emailing these guys like oh my god 1496.96s - 1502.28s | Like I can't believe this works. Is this a typo? Is this algorithm real and then yes, it's all real 1502.28s - 1506.32s | I've like wrote these on proxmarks. I wrote a version of Python wrote a version C 1506.32s - 1509.32s | And now that's all been ported to the flipper zero 1509.32s - 1514.40s | I think the guy who ported it was hanging out and the RFID village actually one of the co-authors. So like 1515.60s - 1517.88s | It's awesome like crazy stuff 1519.00s - 1522.08s | Totally works and people are literally flipping out these days 1522.08s - 1523.88s | This used to be something that like 1523.88s - 1528.60s | Do you know there was a small group of us that knew about these things and we come to DEF CON like hey 1528.60s - 1531.64s | You know talk about these exploits. We had email threads going back and forth 1532.20s - 1533.24s | Now it is 1533.24s - 1539.76s | Everybody here is walking around with one of these things on their


chunk_text:
implementing the stuff as they're publishing it like emailing these guys like oh my god 1496.96s - 1502.28s | Like I can't believe this works. Is this a typo? Is this algorithm real and then yes, it's all real 1502.28s - 1506.32s | I've like wrote these on proxmarks. I wrote a version of Python wrote a version C 1506.32s - 1509.32s | And now that's all been ported to the flipper zero 1509.32s - 1514.40s | I think the guy who ported it was hanging out and the RFID village actually one of the co-authors. So like 1515.60s - 1517.88s | It's awesome like crazy stuff 1519.00s - 1522.08s | Totally works and people are literally flipping out these days 1522.08s - 1523.88s | This used to be something that like 1523.88s - 1528.60s | Do you know there was a small group of us that knew about these things and we come to DEF CON like hey 1528.60s - 1531.64s | You know talk about these exploits. We had email threads going back and forth 1532.20s - 1533.24s | Now it is 1533.24s - 1539.76s | Everybody here is walking around with one of these things on their neck with the ability to just walk into pretty much any door 1539.76s - 1544.68s | They run if they find the correct employee and kind of just nudge into them correctly. So 1545.56s - 1547.56s | It is a pretty strange 1548.52s - 1553.32s | Time to be in this world and that's why we're hosting at the physical security village now 1553.44s - 1555.72s | The decades leading up to the flipper zero 1555.72s - 1558.32s | I'm like, you know, this probably isn't the right time to talk about this 1558.32s - 1561.84s | Like this is a pretty bad exploit, but now that it's commoditized 1562.52s - 1564.32s | Hey come play with it 1564.32s - 1570.60s | So the implications of this are actually huge most of the employee badges on like the world's largest companies 1570.60s - 1571.44s | I still 1571.44s - 1577.80s | today walk around and have friends and I'm always looking at people's IDs and trying to clone everything and I have like way way too 1577.80s - 1581.48s | Many oh my god moments given that this key was leaked back in 2010 1581.76s - 1583.76s | Like there


chunk_text:
neck with the ability to just walk into pretty much any door 1539.76s - 1544.68s | They run if they find the correct employee and kind of just nudge into them correctly. So 1545.56s - 1547.56s | It is a pretty strange 1548.52s - 1553.32s | Time to be in this world and that's why we're hosting at the physical security village now 1553.44s - 1555.72s | The decades leading up to the flipper zero 1555.72s - 1558.32s | I'm like, you know, this probably isn't the right time to talk about this 1558.32s - 1561.84s | Like this is a pretty bad exploit, but now that it's commoditized 1562.52s - 1564.32s | Hey come play with it 1564.32s - 1570.60s | So the implications of this are actually huge most of the employee badges on like the world's largest companies 1570.60s - 1571.44s | I still 1571.44s - 1577.80s | today walk around and have friends and I'm always looking at people's IDs and trying to clone everything and I have like way way too 1577.80s - 1581.48s | Many oh my god moments given that this key was leaked back in 2010 1581.76s - 1583.76s | Like there are so many 1583.76s - 1590.12s | Organizations either have the prox cards with no encryption at all or still have these standard i-class cards like in use 1590.12s - 1595.32s | There was a brand new building that was built. I was a tenant there for like six months and on day one 1595.32s - 1600.28s | I just like cloned the card. They gave me and started walking through doors. I'm like, this is 1600.92s - 1605.48s | Why in 2024 did we just build this and buy this technology? 1606.36s - 1610.52s | There's so there's still security theater though. So this actually is interesting 1610.52s - 1615.96s | There is something to be said about like keeping the honest people honest and like as long as it looks good on paper 1616.40s - 1617.44s | You know 1617.44s - 1620.74s | You have all these security audits and sock twos and things like that 1620.74s - 1625.96s | They're like you do have to do these things and it is not highly publicized that this is out there 1625.96s - 1632.56s | It's highly publicized at DEF CON but outside of this, you know, there's not


chunk_text:
are so many 1583.76s - 1590.12s | Organizations either have the prox cards with no encryption at all or still have these standard i-class cards like in use 1590.12s - 1595.32s | There was a brand new building that was built. I was a tenant there for like six months and on day one 1595.32s - 1600.28s | I just like cloned the card. They gave me and started walking through doors. I'm like, this is 1600.92s - 1605.48s | Why in 2024 did we just build this and buy this technology? 1606.36s - 1610.52s | There's so there's still security theater though. So this actually is interesting 1610.52s - 1615.96s | There is something to be said about like keeping the honest people honest and like as long as it looks good on paper 1616.40s - 1617.44s | You know 1617.44s - 1620.74s | You have all these security audits and sock twos and things like that 1620.74s - 1625.96s | They're like you do have to do these things and it is not highly publicized that this is out there 1625.96s - 1632.56s | It's highly publicized at DEF CON but outside of this, you know, there's not big signs like your HID reader key was leaked in 2010 1632.76s - 1634.76s | What version are you running? 1634.84s - 1638.68s | And it's just a absolute headache for admins like that 1638.68s - 1640.68s | Now you don't know if your keys have been cloned 1640.68s - 1645.64s | Upgrading these is a huge hassle because this is your whole infrastructure. These readers aren't cheap 1645.64s - 1651.60s | They're like they can go up like $1,500 a piece not to mention the labor of ripping one out and rewiring it 1653.44s - 1655.44s | so 1655.56s - 1662.52s | Just to take a step back though, the only common feature here is bad implementation like trying to roll your own crypto 1663.12s - 1665.12s | you know doing things that 1666.08s - 1669.88s | In the grand scheme you'd look back and say that was a terrible decision 1669.88s - 1675.04s | I wasn't there making the decision and normally you don't realize it at the time like, you know 1675.04s - 1681.12s | Encoding strings that ended null bytes at the time you're writing see what could go wrong and now we have buffer overflows


chunk_text:
big signs like your HID reader key was leaked in 2010 1632.76s - 1634.76s | What version are you running? 1634.84s - 1638.68s | And it's just a absolute headache for admins like that 1638.68s - 1640.68s | Now you don't know if your keys have been cloned 1640.68s - 1645.64s | Upgrading these is a huge hassle because this is your whole infrastructure. These readers aren't cheap 1645.64s - 1651.60s | They're like they can go up like $1,500 a piece not to mention the labor of ripping one out and rewiring it 1653.44s - 1655.44s | so 1655.56s - 1662.52s | Just to take a step back though, the only common feature here is bad implementation like trying to roll your own crypto 1663.12s - 1665.12s | you know doing things that 1666.08s - 1669.88s | In the grand scheme you'd look back and say that was a terrible decision 1669.88s - 1675.04s | I wasn't there making the decision and normally you don't realize it at the time like, you know 1675.04s - 1681.12s | Encoding strings that ended null bytes at the time you're writing see what could go wrong and now we have buffer overflows forever 1681.12s - 1685.76s | So the design process I'm sure never dreamed that it would get to the point where my god 1685.76s - 1688.92s | There's too many of these on earth and every building can be walked into 1689.72s - 1694.28s | But otherwise the smart card community as a whole has really crushed it 1694.28s - 1701.60s | I mean to attack like the DoD CAC or a modern credit card is actually pretty complicated 1701.76s - 1706.72s | You'll see attacks here kind of few and far between the last one. I remember those quite notable 1707.72s - 1714.32s | When I was in the smart card hacking world, there's somebody who found that on SIM cards. They use triple DES to authenticate and 1714.92s - 1719.08s | I remember going through this with my colleague and I'm like man everything actually does look fine 1719.08s - 1725.80s | It looks totally shady. But if anyone use single key DES instead of like the triple keys on triple DES 1725.80s - 1727.32s | This would be catastrophic 1727.32s - 1730.64s | There was a talk at DEF CON that was like hey every SIM card


chunk_text:
forever 1681.12s - 1685.76s | So the design process I'm sure never dreamed that it would get to the point where my god 1685.76s - 1688.92s | There's too many of these on earth and every building can be walked into 1689.72s - 1694.28s | But otherwise the smart card community as a whole has really crushed it 1694.28s - 1701.60s | I mean to attack like the DoD CAC or a modern credit card is actually pretty complicated 1701.76s - 1706.72s | You'll see attacks here kind of few and far between the last one. I remember those quite notable 1707.72s - 1714.32s | When I was in the smart card hacking world, there's somebody who found that on SIM cards. They use triple DES to authenticate and 1714.92s - 1719.08s | I remember going through this with my colleague and I'm like man everything actually does look fine 1719.08s - 1725.80s | It looks totally shady. But if anyone use single key DES instead of like the triple keys on triple DES 1725.80s - 1727.32s | This would be catastrophic 1727.32s - 1730.64s | There was a talk at DEF CON that was like hey every SIM card for this entire 1730.92s - 1735.48s | manufacturer only uses a single key and they were just root SIM cards like crazy because 1735.72s - 1739.84s | SIM cards are these cards if you just cut more plastic off and shove it in a phone 1740.24s - 1746.12s | But the security of these at the at its core is actually quite good if implemented well 1747.00s - 1748.32s | so 1748.36s - 1752.60s | Okay, Chad, we have these ultra secure cards. Why don't we have more of them then? 1752.60s - 1754.60s | Why don't I have one for my credit card? 1754.80s - 1760.56s | They don't scale well at all. Like they were intended to have a bunch of applets. We'd all have one card 1760.56s - 1765.60s | I'd have my Chad card and it has my bank ID and my gym pass and my employee ID 1765.92s - 1771.40s | But the security architecture in this Java OS has almost no isolation and it's pretty terrible 1771.48s - 1777.96s | So you can't trust that Gold's Gym had the same security standards as Bank of America to throw those in the same 1778.32s -


chunk_text:
for this entire 1730.92s - 1735.48s | manufacturer only uses a single key and they were just root SIM cards like crazy because 1735.72s - 1739.84s | SIM cards are these cards if you just cut more plastic off and shove it in a phone 1740.24s - 1746.12s | But the security of these at the at its core is actually quite good if implemented well 1747.00s - 1748.32s | so 1748.36s - 1752.60s | Okay, Chad, we have these ultra secure cards. Why don't we have more of them then? 1752.60s - 1754.60s | Why don't I have one for my credit card? 1754.80s - 1760.56s | They don't scale well at all. Like they were intended to have a bunch of applets. We'd all have one card 1760.56s - 1765.60s | I'd have my Chad card and it has my bank ID and my gym pass and my employee ID 1765.92s - 1771.40s | But the security architecture in this Java OS has almost no isolation and it's pretty terrible 1771.48s - 1777.96s | So you can't trust that Gold's Gym had the same security standards as Bank of America to throw those in the same 1778.32s - 1783.76s | Memory space. So now I need one card for everything and if I'm using them to log into websites now 1783.76s - 1786.52s | We're talking a huge freaking nightmare, right? 1786.52s - 1790.08s | I'm gonna have a Rolodex of 800 cards coming in here trying to log into a site 1790.72s - 1797.08s | They also require extra hardware, which people don't love so like for me to log into this computer the smart card 1797.08s - 1801.56s | I need some little dongle thing that I'm gonna plug into and then for all you know 1801.56s - 1807.16s | Your wallets are just gonna be crazy fat and they have no user interface. This one is actually pretty relevant 1807.36s - 1811.48s | So going back to the first attack of being able to use someone else's card 1811.84s - 1815.48s | If you drop your smart card someone else picks it up. They become you instantly 1815.48s - 1819.48s | There's no way to verify that if you had a user interface on there 1819.48s - 1820.92s | Even with just as you know 1820.92s - 1827.28s | Four digit pin you could pretty


chunk_text:
1783.76s | Memory space. So now I need one card for everything and if I'm using them to log into websites now 1783.76s - 1786.52s | We're talking a huge freaking nightmare, right? 1786.52s - 1790.08s | I'm gonna have a Rolodex of 800 cards coming in here trying to log into a site 1790.72s - 1797.08s | They also require extra hardware, which people don't love so like for me to log into this computer the smart card 1797.08s - 1801.56s | I need some little dongle thing that I'm gonna plug into and then for all you know 1801.56s - 1807.16s | Your wallets are just gonna be crazy fat and they have no user interface. This one is actually pretty relevant 1807.36s - 1811.48s | So going back to the first attack of being able to use someone else's card 1811.84s - 1815.48s | If you drop your smart card someone else picks it up. They become you instantly 1815.48s - 1819.48s | There's no way to verify that if you had a user interface on there 1819.48s - 1820.92s | Even with just as you know 1820.92s - 1827.28s | Four digit pin you could pretty much mitigate that attack a four digit pin with some throttling or some, you know 1827.28s - 1834.72s | Threshold of five attempts anyone who picked up that card would be doomed, but these are passively powered so you can't have interfaces 1835.48s - 1836.68s | So 1836.68s - 1841.80s | This is the research question. I've asked myself my whole career like can we do better? 1841.80s - 1844.56s | I hate passwords smart cards things in my pocket and 1846.44s - 1848.36s | This was back in 1848.36s - 1850.40s | God, I don't know 2009 1850.60s - 1856.12s | I'm like, why don't we use iPhones when they were new and everyone's like no one will ever take their iPhone to work 1856.32s - 1859.04s | It's a terrible idea. The security on them was bad at the time 1859.68s - 1861.84s | But I really do think we're at a point where 1862.88s - 1864.36s | smartphones 1864.36s - 1869.48s | Can kind of completely eliminate smart cards over the next 10 20 30 years 1869.68s - 1873.36s | So they actually already put smart cards in every single smartphone today 1873.48s - 1876.80s | So


chunk_text:
much mitigate that attack a four digit pin with some throttling or some, you know 1827.28s - 1834.72s | Threshold of five attempts anyone who picked up that card would be doomed, but these are passively powered so you can't have interfaces 1835.48s - 1836.68s | So 1836.68s - 1841.80s | This is the research question. I've asked myself my whole career like can we do better? 1841.80s - 1844.56s | I hate passwords smart cards things in my pocket and 1846.44s - 1848.36s | This was back in 1848.36s - 1850.40s | God, I don't know 2009 1850.60s - 1856.12s | I'm like, why don't we use iPhones when they were new and everyone's like no one will ever take their iPhone to work 1856.32s - 1859.04s | It's a terrible idea. The security on them was bad at the time 1859.68s - 1861.84s | But I really do think we're at a point where 1862.88s - 1864.36s | smartphones 1864.36s - 1869.48s | Can kind of completely eliminate smart cards over the next 10 20 30 years 1869.68s - 1873.36s | So they actually already put smart cards in every single smartphone today 1873.48s - 1876.80s | So if you take that exact chip that I'm telling you that's in the SIM card 1876.80s - 1879.84s | That's in your credit card take all the plastic off of it 1880.16s - 1884.60s | It's called a secure element and it is soldered on the motherboard of every single person's phone in here today 1884.76s - 1887.72s | And when you do tap-to-pay, that's where you're interacting with 1888.36s - 1891.32s | Everything is stored in that secure element. In fact all of the initial 1891.88s - 1897.64s | NFC stuff implemented on phones. They kind of had a hybrid chip that would do NFC plus the secure element 1897.64s - 1902.56s | They're just taking everything they knew from a smart card trying to put in a phone so that you can do your digital payments 1903.08s - 1906.40s | The other interesting thing that has unfolded on phones 1907.12s - 1909.28s | Every modern arm processor on earth 1909.28s - 1915.52s | Even the embedded processors have something in there called a trusted execution environment an arms version. They call it trust zone 1916.12s - 1919.60s | So when the phone boots it boots into a secure


chunk_text:
if you take that exact chip that I'm telling you that's in the SIM card 1876.80s - 1879.84s | That's in your credit card take all the plastic off of it 1880.16s - 1884.60s | It's called a secure element and it is soldered on the motherboard of every single person's phone in here today 1884.76s - 1887.72s | And when you do tap-to-pay, that's where you're interacting with 1888.36s - 1891.32s | Everything is stored in that secure element. In fact all of the initial 1891.88s - 1897.64s | NFC stuff implemented on phones. They kind of had a hybrid chip that would do NFC plus the secure element 1897.64s - 1902.56s | They're just taking everything they knew from a smart card trying to put in a phone so that you can do your digital payments 1903.08s - 1906.40s | The other interesting thing that has unfolded on phones 1907.12s - 1909.28s | Every modern arm processor on earth 1909.28s - 1915.52s | Even the embedded processors have something in there called a trusted execution environment an arms version. They call it trust zone 1916.12s - 1919.60s | So when the phone boots it boots into a secure world 1919.88s - 1926.92s | That is your first stage bootloader in there is where you're supposed to keep only your most sacred secrets and code 1927.28s - 1932.28s | So your cryptographic keys anything you use for authentication payments secure world 1932.48s - 1939.64s | Then you create a sandbox called the non secure world and that's where you let iOS and Android and the operating systems play 1940.08s - 1945.28s | So now if iOS gets totally rooted 100% rooted exploited 1945.28s - 1948.20s | They still cannot touch the code in the secure world 1948.48s - 1952.40s | So if you've ever played around with your Android phone, it tells you to push the physical button 1952.76s - 1956.16s | That's because that code is I don't work for Google 1956.16s - 1961.44s | But it's very likely running in the secure world and they're getting the interface from the physical button 1961.60s - 1966.52s | Nobody to date has written a driver for all of the touchscreen all the graphics in the secure world 1966.68s - 1969.64s | But you can securely detect yes 1969.80s - 1974.88s | Somebody's physically hitting this button and wants to


chunk_text:
world 1919.88s - 1926.92s | That is your first stage bootloader in there is where you're supposed to keep only your most sacred secrets and code 1927.28s - 1932.28s | So your cryptographic keys anything you use for authentication payments secure world 1932.48s - 1939.64s | Then you create a sandbox called the non secure world and that's where you let iOS and Android and the operating systems play 1940.08s - 1945.28s | So now if iOS gets totally rooted 100% rooted exploited 1945.28s - 1948.20s | They still cannot touch the code in the secure world 1948.48s - 1952.40s | So if you've ever played around with your Android phone, it tells you to push the physical button 1952.76s - 1956.16s | That's because that code is I don't work for Google 1956.16s - 1961.44s | But it's very likely running in the secure world and they're getting the interface from the physical button 1961.60s - 1966.52s | Nobody to date has written a driver for all of the touchscreen all the graphics in the secure world 1966.68s - 1969.64s | But you can securely detect yes 1969.80s - 1974.88s | Somebody's physically hitting this button and wants to do this thing that is being requested of me 1975.08s - 1979.44s | But not just being used by malware or some proximity trying to read your phone 1980.80s - 1982.12s | so 1982.12s - 1987.64s | the future that I am hoping for and literally bet my career on is that 1987.88s - 1993.92s | We can put all of this cool security that we've learned to the smart car world into these phones that we already carry 1993.92s - 2000.76s | And you get really amazing interactions because these can interact with everything they can interact with the smart card readers 2000.76s - 2006.00s | We already have our computers each other and then we can replace everything in our wallet with these phones 2006.36s - 2008.40s | And once you have a private key store 2008.40s - 2009.24s | So, you know 2009.24s - 2014.76s | we can do something more akin to what they wanted to do with the applets where we actually can store multiple different credentials in here and 2014.76s - 2021.24s | I could have my gym pass next to my Bank of America card next to my DEF CON badge or whatever


chunk_text:
do this thing that is being requested of me 1975.08s - 1979.44s | But not just being used by malware or some proximity trying to read your phone 1980.80s - 1982.12s | so 1982.12s - 1987.64s | the future that I am hoping for and literally bet my career on is that 1987.88s - 1993.92s | We can put all of this cool security that we've learned to the smart car world into these phones that we already carry 1993.92s - 2000.76s | And you get really amazing interactions because these can interact with everything they can interact with the smart card readers 2000.76s - 2006.00s | We already have our computers each other and then we can replace everything in our wallet with these phones 2006.36s - 2008.40s | And once you have a private key store 2008.40s - 2009.24s | So, you know 2009.24s - 2014.76s | we can do something more akin to what they wanted to do with the applets where we actually can store multiple different credentials in here and 2014.76s - 2021.24s | I could have my gym pass next to my Bank of America card next to my DEF CON badge or whatever 2022.24s - 2026.00s | So I quit my job in academia or I 2026.40s - 2032.84s | Declined all my professorship offers and what I've built since is a company called authenticate where we actually do that 2032.84s - 2037.92s | We have a an app that can talk to doors door readers. It all uses 2038.44s - 2043.46s | Asymmetric encryption uses all the good stuff. We can also talk to computers SSH and servers 2044.16s - 2049.60s | Websites, you name it. You can use that credential for all sorts of different protocols. So I 2050.56s - 2054.72s | Would now welcome any questions about breaking into buildings or maybe 2055.16s - 2061.96s | Securing buildings if you're into that as I've since switched my career to go from I don't know the fun side to the not fun 2061.96s - 2065.60s | Side of trying to patch all of these holes that I just showed you 2066.28s - 2068.28s | So thank you for attending 2076.24s - 2077.84s | question 2077.84s - 2081.06s | And I think on time I am very early 2081.76s - 2082.88s | so 2082.88s - 2084.08s | there's 2084.08s - 2097.36s |


chunk_text:
2022.24s - 2026.00s | So I quit my job in academia or I 2026.40s - 2032.84s | Declined all my professorship offers and what I've built since is a company called authenticate where we actually do that 2032.84s - 2037.92s | We have a an app that can talk to doors door readers. It all uses 2038.44s - 2043.46s | Asymmetric encryption uses all the good stuff. We can also talk to computers SSH and servers 2044.16s - 2049.60s | Websites, you name it. You can use that credential for all sorts of different protocols. So I 2050.56s - 2054.72s | Would now welcome any questions about breaking into buildings or maybe 2055.16s - 2061.96s | Securing buildings if you're into that as I've since switched my career to go from I don't know the fun side to the not fun 2061.96s - 2065.60s | Side of trying to patch all of these holes that I just showed you 2066.28s - 2068.28s | So thank you for attending 2076.24s - 2077.84s | question 2077.84s - 2081.06s | And I think on time I am very early 2081.76s - 2082.88s | so 2082.88s - 2084.08s | there's 2084.08s - 2097.36s | Plenty of time for questions. Has anybody broken into the cat card? 2098.40s - 2102.68s | That's one of those questions where even if I knew the answer I couldn't tell you 2105.20s - 2110.96s | There is a library that we published when I used to work in Lincoln Laboratory called LL smart card 2110.96s - 2114.80s | if you want to pull that on github and play with it, it gives you a 2115.52s - 2122.52s | Decent interface in Python to like fuzz smart card interfaces over both the contact and contactless interface. So 2123.16s - 2128.56s | If you want to look for yourself and plug some cards in it's and I I think we have some templates on there for like 2128.56s - 2131.74s | A visa card and a cat card objects like basic interactions with it 2158.64s - 2163.48s | What how well do trust execution environments stand up against physical attacks? 2164.28s - 2170.16s | Is that a downgrade from smart cards that have all of these physical anti tamper in there? The answer is 2171.36s - 2174.72s | Yes, there are some side channel attacks and things have been published on


chunk_text:
Plenty of time for questions. Has anybody broken into the cat card? 2098.40s - 2102.68s | That's one of those questions where even if I knew the answer I couldn't tell you 2105.20s - 2110.96s | There is a library that we published when I used to work in Lincoln Laboratory called LL smart card 2110.96s - 2114.80s | if you want to pull that on github and play with it, it gives you a 2115.52s - 2122.52s | Decent interface in Python to like fuzz smart card interfaces over both the contact and contactless interface. So 2123.16s - 2128.56s | If you want to look for yourself and plug some cards in it's and I I think we have some templates on there for like 2128.56s - 2131.74s | A visa card and a cat card objects like basic interactions with it 2158.64s - 2163.48s | What how well do trust execution environments stand up against physical attacks? 2164.28s - 2170.16s | Is that a downgrade from smart cards that have all of these physical anti tamper in there? The answer is 2171.36s - 2174.72s | Yes, there are some side channel attacks and things have been published on T's 2175.20s - 2180.48s | The way you would implement this is really to couple the T with a secure element though 2180.56s - 2185.00s | So you would keep all of your keying infrastructure in the secure element 2185.00s - 2187.76s | So all of your digital signatures all of the cryptography 2188.00s - 2192.80s | Everything is done in the secure element that has all of this physical anti tamper and side channel 2193.20s - 2196.34s | You know defenses built in and you really need the T 2197.00s - 2199.64s | Specifically for like a trusted user interaction 2199.76s - 2203.80s | So you really want the T to like disable all of the you know 2204.12s - 2212.32s | Accelerometers and side channels and then anything that's mildly sensitive interacting with the secure element, but the computation itself 2212.92s - 2214.92s | should not be in 2215.48s - 2217.48s | The T because you know 2217.48s - 2219.04s | You don't want like RSA side channels 2219.04s - 2224.76s | The one thing that I focused a lot of my PhD on on the T security in particular was glitching attacks 2224.76s - 2231.04s | So


chunk_text:
T's 2175.20s - 2180.48s | The way you would implement this is really to couple the T with a secure element though 2180.56s - 2185.00s | So you would keep all of your keying infrastructure in the secure element 2185.00s - 2187.76s | So all of your digital signatures all of the cryptography 2188.00s - 2192.80s | Everything is done in the secure element that has all of this physical anti tamper and side channel 2193.20s - 2196.34s | You know defenses built in and you really need the T 2197.00s - 2199.64s | Specifically for like a trusted user interaction 2199.76s - 2203.80s | So you really want the T to like disable all of the you know 2204.12s - 2212.32s | Accelerometers and side channels and then anything that's mildly sensitive interacting with the secure element, but the computation itself 2212.92s - 2214.92s | should not be in 2215.48s - 2217.48s | The T because you know 2217.48s - 2219.04s | You don't want like RSA side channels 2219.04s - 2224.76s | The one thing that I focused a lot of my PhD on on the T security in particular was glitching attacks 2224.76s - 2231.04s | So the one thing you can do when you're booting into secure world is if you can glitch at just the right time 2231.04s - 2233.04s | This is actually how the Xbox one was hacked 2233.24s - 2234.56s | I love it 2234.56s - 2238.44s | I if that person is here introduce me to them so I can like hug them and give them a high-five 2238.92s - 2241.36s | but they actually you're able to glitch it and 2242.32s - 2245.32s | Skip the part where you would then put everything in non secure world 2245.40s - 2250.40s | So then you could have unfettered access to the secure element and start doing crazier attacks 2250.76s - 2252.48s | So I actually looked 2252.48s - 2259.00s | Extensively into how to write glitching resistant code in software only with a clang pass. We published a paper on it 2259.00s - 2261.60s | I wanted to call it glitch glitch, please 2262.12s - 2268.52s | In honor of bitch, please, but academics don't have the same sense of humor that I do. So I had to change it to 2269.28s - 2271.76s | Glitching demystified or something far more


chunk_text:
the one thing you can do when you're booting into secure world is if you can glitch at just the right time 2231.04s - 2233.04s | This is actually how the Xbox one was hacked 2233.24s - 2234.56s | I love it 2234.56s - 2238.44s | I if that person is here introduce me to them so I can like hug them and give them a high-five 2238.92s - 2241.36s | but they actually you're able to glitch it and 2242.32s - 2245.32s | Skip the part where you would then put everything in non secure world 2245.40s - 2250.40s | So then you could have unfettered access to the secure element and start doing crazier attacks 2250.76s - 2252.48s | So I actually looked 2252.48s - 2259.00s | Extensively into how to write glitching resistant code in software only with a clang pass. We published a paper on it 2259.00s - 2261.60s | I wanted to call it glitch glitch, please 2262.12s - 2268.52s | In honor of bitch, please, but academics don't have the same sense of humor that I do. So I had to change it to 2269.28s - 2271.76s | Glitching demystified or something far more lame 2271.76s - 2278.52s | But we did show that in software only you can actually do an LLVM pass and make your code 2279.12s - 2285.24s | Glitching resistant for all practical purposes on your bootloader to keep the the T code at least in the secure world where it belongs 2285.92s - 2316.06s | So how effective are the RFID blocking badge holders and little sleeves that they get you? 2317.30s - 2322.78s | They're very effective that like when I was doing this research that was actually my number one thing 2322.78s - 2328.94s | I recommended to everybody and probably got the most enemies from cuz I'm like, hey these things are annoying 2328.94s - 2334.90s | But they absolutely work and like I work here. I'm trying to protect, you know the stuff we're doing 2335.06s - 2340.74s | So my favorite ones they have these badge holders that are plastic and they're spring-loaded 2340.74s - 2343.46s | You can put your ID in them that has a Faraday cage in the back 2343.50s - 2349.98s | but then you can flip the plastic up tap your badge and flip it back because otherwise you're


chunk_text:
lame 2271.76s - 2278.52s | But we did show that in software only you can actually do an LLVM pass and make your code 2279.12s - 2285.24s | Glitching resistant for all practical purposes on your bootloader to keep the the T code at least in the secure world where it belongs 2285.92s - 2316.06s | So how effective are the RFID blocking badge holders and little sleeves that they get you? 2317.30s - 2322.78s | They're very effective that like when I was doing this research that was actually my number one thing 2322.78s - 2328.94s | I recommended to everybody and probably got the most enemies from cuz I'm like, hey these things are annoying 2328.94s - 2334.90s | But they absolutely work and like I work here. I'm trying to protect, you know the stuff we're doing 2335.06s - 2340.74s | So my favorite ones they have these badge holders that are plastic and they're spring-loaded 2340.74s - 2343.46s | You can put your ID in them that has a Faraday cage in the back 2343.50s - 2349.98s | but then you can flip the plastic up tap your badge and flip it back because otherwise you're like in this fight every morning trying 2349.98s - 2351.98s | To like slide it out of this stupid metal thing 2352.34s - 2355.22s | They're not cheap. So they're hard to do at scale 2355.22s - 2360.70s | but I don't know they bought me one because I guess I exposed all this stuff and 2361.38s - 2365.62s | They were not happy with me, but happy enough to get me the fancy one 2365.86s - 2369.18s | But they totally work like RFID wallets and stuff 2369.18s - 2375.66s | I guess the one thing I didn't mention here the one attack that can pretty much never be protected against and smart cards 2375.66s - 2380.58s | It's called the relay attack. So this is where I would come near you with a software-defined radio 2380.58s - 2388.22s | I would touch somewhere near your card and I my friend anywhere on earth with another software-defined radio that just re-emits back and forth 2388.46s - 2394.98s | So there's almost no way to defend against that unless you have some like capacitive touch on the smart card that would stop it 2395.46s - 2397.92s | And that's really


chunk_text:
like in this fight every morning trying 2349.98s - 2351.98s | To like slide it out of this stupid metal thing 2352.34s - 2355.22s | They're not cheap. So they're hard to do at scale 2355.22s - 2360.70s | but I don't know they bought me one because I guess I exposed all this stuff and 2361.38s - 2365.62s | They were not happy with me, but happy enough to get me the fancy one 2365.86s - 2369.18s | But they totally work like RFID wallets and stuff 2369.18s - 2375.66s | I guess the one thing I didn't mention here the one attack that can pretty much never be protected against and smart cards 2375.66s - 2380.58s | It's called the relay attack. So this is where I would come near you with a software-defined radio 2380.58s - 2388.22s | I would touch somewhere near your card and I my friend anywhere on earth with another software-defined radio that just re-emits back and forth 2388.46s - 2394.98s | So there's almost no way to defend against that unless you have some like capacitive touch on the smart card that would stop it 2395.46s - 2397.92s | And that's really like those RFID wallets 2398.18s - 2400.66s | That's what those are all about because somebody could come up to you 2400.66s - 2402.58s | You're nowhere near the cash register 2402.58s - 2408.44s | Someone else has a Proxmark up their sleeve and then they just bought you know, a really fancy dinner on you. Thank you very much 2408.76s - 2445.08s | So, yeah, they totally work though we've tested them in the lab and they do their job the question there was about the the 2445.72s - 2450.76s | Legal action since the you know, this key has been leaked since 2010. Has there any been class action suits? 2450.76s - 2456.04s | I I don't know. I and I don't know what the law is around that 2456.04s - 2461.80s | I actually have a friend who's a law professor in Texas and asked her to speak recently about cyber security law 2462.24s - 2468.00s | In particular and I came out of that talk with far more questions than I got answers. It is extremely 2468.76s - 2472.60s | Complicated and confusing it does seem to me though 2472.60s - 2480.00s | just like a


chunk_text:
like those RFID wallets 2398.18s - 2400.66s | That's what those are all about because somebody could come up to you 2400.66s - 2402.58s | You're nowhere near the cash register 2402.58s - 2408.44s | Someone else has a Proxmark up their sleeve and then they just bought you know, a really fancy dinner on you. Thank you very much 2408.76s - 2445.08s | So, yeah, they totally work though we've tested them in the lab and they do their job the question there was about the the 2445.72s - 2450.76s | Legal action since the you know, this key has been leaked since 2010. Has there any been class action suits? 2450.76s - 2456.04s | I I don't know. I and I don't know what the law is around that 2456.04s - 2461.80s | I actually have a friend who's a law professor in Texas and asked her to speak recently about cyber security law 2462.24s - 2468.00s | In particular and I came out of that talk with far more questions than I got answers. It is extremely 2468.76s - 2472.60s | Complicated and confusing it does seem to me though 2472.60s - 2480.00s | just like a gut feeling that if there's a security vulnerability the fix for it should be free for customers and it should be like 2480.80s - 2488.68s | Strongly advertised like hey, you haven't updated yet. Maybe you should consider this free firmware update 2489.08s - 2490.92s | so I 2490.92s - 2493.56s | Don't know. I mean though that was part of the reason I also 2494.72s - 2496.80s | Decided to throw my hat in the ring and try to build 2497.28s - 2501.44s | Products instead of staying in my every tower just pointing fingers at people saying you did it wrong 2501.52s - 2505.64s | It is really freaking hard though. I will stress like building a security product 2505.64s - 2510.32s | It is way harder than it sounds when you're on the offensive side your whole career 2510.32s - 2514.22s | Like why didn't they just do this and then you're on the other side like oh damn that is 2514.84s - 2519.92s | That's a lift there. That is that is not as easy as I made it sound in my publication 2520.44s - 2544.65s | Okay, I should have had this in my talk


chunk_text:
gut feeling that if there's a security vulnerability the fix for it should be free for customers and it should be like 2480.80s - 2488.68s | Strongly advertised like hey, you haven't updated yet. Maybe you should consider this free firmware update 2489.08s - 2490.92s | so I 2490.92s - 2493.56s | Don't know. I mean though that was part of the reason I also 2494.72s - 2496.80s | Decided to throw my hat in the ring and try to build 2497.28s - 2501.44s | Products instead of staying in my every tower just pointing fingers at people saying you did it wrong 2501.52s - 2505.64s | It is really freaking hard though. I will stress like building a security product 2505.64s - 2510.32s | It is way harder than it sounds when you're on the offensive side your whole career 2510.32s - 2514.22s | Like why didn't they just do this and then you're on the other side like oh damn that is 2514.84s - 2519.92s | That's a lift there. That is that is not as easy as I made it sound in my publication 2520.44s - 2544.65s | Okay, I should have had this in my talk 2544.65s - 2550.37s | Is there any way to secure your enterprise today with smart cards that I didn't go over? Yes hundred percent 2550.37s - 2552.37s | These are just the known vulnerabilities 2552.37s - 2557.25s | They do there there are cards like the Dez fire even like the my for Dez fire my for ultralights 2557.25s - 2562.57s | There are cards that are properly like they're using Dez they're using a yes, they're using good cryptography 2562.57s - 2567.05s | that is not broken so you can get these cards with the good cryptographic standards on them and 2567.61s - 2573.05s | Key them to your organization and you know, at least for now, there's no known vulnerabilities 2573.57s - 2577.53s | You're cruising. So yeah, there there are card stocks out there 2578.25s - 2580.25s | HID even sells Dez fire cards 2580.29s - 2583.57s | so it's not that like all of their cards have to be this I class or 2583.97s - 2588.73s | You know any brand and most of these readers will read the good cards 2588.73s - 2591.41s | So even if you buy off-brand readers, they'll read Dez fire


chunk_text:
2544.65s - 2550.37s | Is there any way to secure your enterprise today with smart cards that I didn't go over? Yes hundred percent 2550.37s - 2552.37s | These are just the known vulnerabilities 2552.37s - 2557.25s | They do there there are cards like the Dez fire even like the my for Dez fire my for ultralights 2557.25s - 2562.57s | There are cards that are properly like they're using Dez they're using a yes, they're using good cryptography 2562.57s - 2567.05s | that is not broken so you can get these cards with the good cryptographic standards on them and 2567.61s - 2573.05s | Key them to your organization and you know, at least for now, there's no known vulnerabilities 2573.57s - 2577.53s | You're cruising. So yeah, there there are card stocks out there 2578.25s - 2580.25s | HID even sells Dez fire cards 2580.29s - 2583.57s | so it's not that like all of their cards have to be this I class or 2583.97s - 2588.73s | You know any brand and most of these readers will read the good cards 2588.73s - 2591.41s | So even if you buy off-brand readers, they'll read Dez fire cards 2591.41s - 2595.37s | They'll read whatever cards you want and you can set them up in a way that you know 2595.37s - 2597.37s | someone can't just come up with their flipper and 2597.97s - 2601.13s | We plan on our website if we get time after Def Con 2601.13s - 2602.13s | So I get this question a lot 2602.13s - 2607.81s | We want to publish all of the known vulnerabilities kind of like the thumbs down don't buy this and then you know 2607.81s - 2613.47s | Some of the other card stocks at least we'll try and keep a record of what's been broken. What hasn't on our website? 2614.05s - 2621.74s | Any other question about how to break into buildings? 2622.38s - 2631.03s | You got me for I'm legally allowed to stay up here for ten more minutes where I get ripped off the stage is what I? 2631.03s - 2658.62s | Was told so we can hang out for a little bit more this question. I never know the answer to it 2658.62s - 2660.02s | Someone's been coming to Def Con forever 2660.02s - 2664.54s | How dangerous


chunk_text:
cards 2591.41s - 2595.37s | They'll read whatever cards you want and you can set them up in a way that you know 2595.37s - 2597.37s | someone can't just come up with their flipper and 2597.97s - 2601.13s | We plan on our website if we get time after Def Con 2601.13s - 2602.13s | So I get this question a lot 2602.13s - 2607.81s | We want to publish all of the known vulnerabilities kind of like the thumbs down don't buy this and then you know 2607.81s - 2613.47s | Some of the other card stocks at least we'll try and keep a record of what's been broken. What hasn't on our website? 2614.05s - 2621.74s | Any other question about how to break into buildings? 2622.38s - 2631.03s | You got me for I'm legally allowed to stay up here for ten more minutes where I get ripped off the stage is what I? 2631.03s - 2658.62s | Was told so we can hang out for a little bit more this question. I never know the answer to it 2658.62s - 2660.02s | Someone's been coming to Def Con forever 2660.02s - 2664.54s | How dangerous is it to walk around Def Con without the faith without your cards in a Faraday cage? 2664.66s - 2667.78s | Your credit cards are fine unless it's a relay attack 2667.78s - 2673.94s | There's no known like wireless attack that I'm aware of that can just clone cards if it is your employee badge 2673.94s - 2678.06s | I would say if you have a 125 kilohertz card, it's pretty likely 2679.02s - 2682.58s | Somebody here has read that card last year in the physical security village 2682.58s - 2688.10s | We had the wall of sheep for everybody that would walk in with their prox cards in their pocket and it it caught quite a few 2688.10s - 2690.10s | people 2690.70s - 2695.86s | Yeah, and if you have an i-class card that you know if you're a target and someone bumped into you awkwardly 2695.86s - 2699.04s | You know, maybe maybe go get a new badge when you get back to work 2699.26s - 2706.66s | But I I don't know. I generally think that like the shenanigans at Def Con is I hope it's overhyped as someone 2706.66s - 2710.10s | Who's


chunk_text:
is it to walk around Def Con without the faith without your cards in a Faraday cage? 2664.66s - 2667.78s | Your credit cards are fine unless it's a relay attack 2667.78s - 2673.94s | There's no known like wireless attack that I'm aware of that can just clone cards if it is your employee badge 2673.94s - 2678.06s | I would say if you have a 125 kilohertz card, it's pretty likely 2679.02s - 2682.58s | Somebody here has read that card last year in the physical security village 2682.58s - 2688.10s | We had the wall of sheep for everybody that would walk in with their prox cards in their pocket and it it caught quite a few 2688.10s - 2690.10s | people 2690.70s - 2695.86s | Yeah, and if you have an i-class card that you know if you're a target and someone bumped into you awkwardly 2695.86s - 2699.04s | You know, maybe maybe go get a new badge when you get back to work 2699.26s - 2706.66s | But I I don't know. I generally think that like the shenanigans at Def Con is I hope it's overhyped as someone 2706.66s - 2710.10s | Who's been coming my whole life, but someone did steal something from our village this year 2710.10s - 2715.78s | So now I'm like more more on your team like no, there's bad people here. We're not all good 2715.86s - 2719.86s | We're not all honest hackers. So but I you know credit cards and stuff 2720.42s - 2727.10s | You know, I would put them potentially in like a Faraday wallet or something, but you don't need to cancel them. You should be fine 2733.50s - 2735.14s | Yeah 2735.14s - 2762.74s | Well, let's keep let's keep rifting. Yeah, so if we let's say we go from smart cards to phones 2763.42s - 2766.46s | What risk would we open ourselves up to so? 2767.46s - 2769.74s | The biggest one there and the one 2770.26s - 2775.14s | That I've spent a lot of my research thinking about was the software attack, right? 2775.14s - 2778.14s | There are phones are on the internet. Our smart cards are not so 2778.86s - 2785.02s | The question that's kind of been like my brain itch for the past 15 years. Like what if my phone gets hacked, right?


chunk_text:
been coming my whole life, but someone did steal something from our village this year 2710.10s - 2715.78s | So now I'm like more more on your team like no, there's bad people here. We're not all good 2715.86s - 2719.86s | We're not all honest hackers. So but I you know credit cards and stuff 2720.42s - 2727.10s | You know, I would put them potentially in like a Faraday wallet or something, but you don't need to cancel them. You should be fine 2733.50s - 2735.14s | Yeah 2735.14s - 2762.74s | Well, let's keep let's keep rifting. Yeah, so if we let's say we go from smart cards to phones 2763.42s - 2766.46s | What risk would we open ourselves up to so? 2767.46s - 2769.74s | The biggest one there and the one 2770.26s - 2775.14s | That I've spent a lot of my research thinking about was the software attack, right? 2775.14s - 2778.14s | There are phones are on the internet. Our smart cards are not so 2778.86s - 2785.02s | The question that's kind of been like my brain itch for the past 15 years. Like what if my phone gets hacked, right? 2785.02s - 2786.30s | like that's 2786.30s - 2789.50s | That's now an attack factor that wouldn't have existed on a smart card 2789.90s - 2795.38s | So that's where the secure element the trust execution environment a lot of the hardware architecture 2795.38s - 2797.38s | That's been built out on these phones 2797.62s - 2800.54s | back to the bad implementation if done 2800.54s - 2806.26s | Well, if done correctly, you can actually mitigate that the software based attack 2806.82s - 2808.90s | It'll never be fully gone, right? 2808.90s - 2813.14s | There's always gonna be a chance that you didn't have before it was zero percent chance before now 2813.14s - 2819.46s | It's nonzero, but you really can push it down quite low to the point where you know 2819.46s - 2823.62s | I think my hope is eventually we can use that to like vote for the president, right? 2823.62s - 2827.70s | You could have your government ID on your phone and like election day comes out 2827.70s - 2831.10s | You don't worry about waiting in some line. You could just cast your vote in some secure way 2831.82s - 2835.04s


chunk_text:
2785.02s - 2786.30s | like that's 2786.30s - 2789.50s | That's now an attack factor that wouldn't have existed on a smart card 2789.90s - 2795.38s | So that's where the secure element the trust execution environment a lot of the hardware architecture 2795.38s - 2797.38s | That's been built out on these phones 2797.62s - 2800.54s | back to the bad implementation if done 2800.54s - 2806.26s | Well, if done correctly, you can actually mitigate that the software based attack 2806.82s - 2808.90s | It'll never be fully gone, right? 2808.90s - 2813.14s | There's always gonna be a chance that you didn't have before it was zero percent chance before now 2813.14s - 2819.46s | It's nonzero, but you really can push it down quite low to the point where you know 2819.46s - 2823.62s | I think my hope is eventually we can use that to like vote for the president, right? 2823.62s - 2827.70s | You could have your government ID on your phone and like election day comes out 2827.70s - 2831.10s | You don't worry about waiting in some line. You could just cast your vote in some secure way 2831.82s - 2835.04s | the physical attacks on the phone are gonna be no 2835.78s - 2841.58s | no better than the physical attacks on the card because it's the same chip at the end of the day that you're gonna be attacking so 2842.14s - 2845.14s | You're not really opening yourself up to another physical interface 2845.14s - 2848.62s | But now that you do have all these radios you have an application processor 2848.62s - 2853.18s | You have a lot more other ways to poke on that card remotely 2854.38s - 2856.70s | That's the one that I've spent most of my research 2857.50s - 2863.14s | Freaking out about and if you look at all my publications, we're like fuzzing the trusted execution environment on 2864.14s - 2866.94s | Smartphones to figure out our other apps in there 2867.66s - 2870.38s | Secure, you know if we put our stuff in there 2870.38s - 2874.70s | Does it as a neighbor gonna be the one that actually crumbles the whole security? So that's 2876.75s - 2880.15s | That's the sticky part of putting things on phones it can be done well 2880.15s - 2886.93s | But it's it's


chunk_text:
| the physical attacks on the phone are gonna be no 2835.78s - 2841.58s | no better than the physical attacks on the card because it's the same chip at the end of the day that you're gonna be attacking so 2842.14s - 2845.14s | You're not really opening yourself up to another physical interface 2845.14s - 2848.62s | But now that you do have all these radios you have an application processor 2848.62s - 2853.18s | You have a lot more other ways to poke on that card remotely 2854.38s - 2856.70s | That's the one that I've spent most of my research 2857.50s - 2863.14s | Freaking out about and if you look at all my publications, we're like fuzzing the trusted execution environment on 2864.14s - 2866.94s | Smartphones to figure out our other apps in there 2867.66s - 2870.38s | Secure, you know if we put our stuff in there 2870.38s - 2874.70s | Does it as a neighbor gonna be the one that actually crumbles the whole security? So that's 2876.75s - 2880.15s | That's the sticky part of putting things on phones it can be done well 2880.15s - 2886.93s | But it's it's hard and it is gonna take people to collaborate which you know and agree on security standards 2887.11s - 2922.27s | Yeah, the question was in 2010 Chase sent out a bunch of you know 2922.27s - 2927.07s | Tap to pay cards and then actually had a recall on them and had to send out new ones 2927.07s - 2931.87s | And the question was was that because of a security vulnerability? I'm not I'm not sure 2933.39s - 2935.07s | Probably 2935.07s - 2937.07s | That seems like a good reason I 2937.23s - 2941.99s | Know like that is the biggest issue with hardware tokens in general and back to the counterpoint on phones 2941.99s - 2946.75s | You can actually push over there updates to phones where you can't the physical security keys like I know 2947.67s - 2953.63s | YubiKey had an issue where they had some of their FIPS keys that had a vulnerability in them and you have to reissue hardware 2953.75s - 2955.75s | So that is actually another 2956.23s - 2962.03s | Interesting thing but then you run into these like specter meltdown attacks where you know, not only reissuing hardware


chunk_text:
hard and it is gonna take people to collaborate which you know and agree on security standards 2887.11s - 2922.27s | Yeah, the question was in 2010 Chase sent out a bunch of you know 2922.27s - 2927.07s | Tap to pay cards and then actually had a recall on them and had to send out new ones 2927.07s - 2931.87s | And the question was was that because of a security vulnerability? I'm not I'm not sure 2933.39s - 2935.07s | Probably 2935.07s - 2937.07s | That seems like a good reason I 2937.23s - 2941.99s | Know like that is the biggest issue with hardware tokens in general and back to the counterpoint on phones 2941.99s - 2946.75s | You can actually push over there updates to phones where you can't the physical security keys like I know 2947.67s - 2953.63s | YubiKey had an issue where they had some of their FIPS keys that had a vulnerability in them and you have to reissue hardware 2953.75s - 2955.75s | So that is actually another 2956.23s - 2962.03s | Interesting thing but then you run into these like specter meltdown attacks where you know, not only reissuing hardware 2962.03s - 2965.47s | But you now have to like refab processors. That's gonna take 10 years 2966.47s - 2972.63s | So it's it's a tough game like trying to build secure systems. It's it's really really complicated 2972.63s - 2977.03s | I do think we're getting much better at it though. Just if you look at the frequency of exploits 2977.03s - 2981.51s | It actually is going down over time. I don't think we're gonna be out of jobs anytime soon 2981.51s - 3000.27s | But you know, we are doing a good job going forward. Am I familiar with laser fault injection? 3000.59s - 3003.79s | Yes, like optical glitching attacks on hardware 3003.79s - 3008.55s | I am familiar with I've actually done one of them not with the intent to succeed 3008.55s - 3013.11s | but with the intent to learn and it is freaking rad like to look at a 3014.07s - 3019.39s | electron microscope you're looking at like a couple nanometer resolution on this chip and like I 3020.23s - 3022.67s | It's sweet. He's like red fuming nitric acid 3023.19s - 3025.79s | So, how do I think that'll play into


chunk_text:
2962.03s - 2965.47s | But you now have to like refab processors. That's gonna take 10 years 2966.47s - 2972.63s | So it's it's a tough game like trying to build secure systems. It's it's really really complicated 2972.63s - 2977.03s | I do think we're getting much better at it though. Just if you look at the frequency of exploits 2977.03s - 2981.51s | It actually is going down over time. I don't think we're gonna be out of jobs anytime soon 2981.51s - 3000.27s | But you know, we are doing a good job going forward. Am I familiar with laser fault injection? 3000.59s - 3003.79s | Yes, like optical glitching attacks on hardware 3003.79s - 3008.55s | I am familiar with I've actually done one of them not with the intent to succeed 3008.55s - 3013.11s | but with the intent to learn and it is freaking rad like to look at a 3014.07s - 3019.39s | electron microscope you're looking at like a couple nanometer resolution on this chip and like I 3020.23s - 3022.67s | It's sweet. He's like red fuming nitric acid 3023.19s - 3025.79s | So, how do I think that'll play into this going future? 3025.79s - 3030.17s | I think that's where you stand on the the shoulders of giants in the smart card world, right? 3030.17s - 3032.17s | So like these secure elements 3032.81s - 3040.93s | Really are done. Well to try to prevent against that stuff like these physical attacks have really been thought about in depth 3041.49s - 3047.37s | So if we can take all of that learned really leverage those secure elements on the phone and all that same technology 3048.09s - 3048.69s | You know 3048.69s - 3052.73s | We start to move forward the problem with kind of the industry as a whole 3052.85s - 3059.41s | It's as being a hardware industry as it has been you're using all these low-end microcontrollers, right? You're trying to drive cross down 3059.93s - 3064.21s | And I know pics in particular. That's what we had a pick is vulnerable to that attack 3064.41s - 3066.17s | So we wanted to see that happen 3066.17s - 3066.65s | We're like, okay 3066.65s - 3072.09s | We want to spread hit UV light here flip the right protect bit and dump the firmware in particular


chunk_text:
this going future? 3025.79s - 3030.17s | I think that's where you stand on the the shoulders of giants in the smart card world, right? 3030.17s - 3032.17s | So like these secure elements 3032.81s - 3040.93s | Really are done. Well to try to prevent against that stuff like these physical attacks have really been thought about in depth 3041.49s - 3047.37s | So if we can take all of that learned really leverage those secure elements on the phone and all that same technology 3048.09s - 3048.69s | You know 3048.69s - 3052.73s | We start to move forward the problem with kind of the industry as a whole 3052.85s - 3059.41s | It's as being a hardware industry as it has been you're using all these low-end microcontrollers, right? You're trying to drive cross down 3059.93s - 3064.21s | And I know pics in particular. That's what we had a pick is vulnerable to that attack 3064.41s - 3066.17s | So we wanted to see that happen 3066.17s - 3066.65s | We're like, okay 3066.65s - 3072.09s | We want to spread hit UV light here flip the right protect bit and dump the firmware in particular 3072.25s - 3075.49s | We were messing around with my Subaru WRX. I was like 3076.41s - 3080.21s | We were able to roll the odometer and make the odometer say leet 3080.21s - 3085.01s | That was like one of the fun the fun wins of that and then we just found some other things with known 3085.33s - 3092.45s | Some other processors with known attacks, so I mean a hundred percent the more security we start putting in our phones 3092.85s - 3097.33s | The more we need to beef up the defense and if you look at how phones have advanced 3097.33s - 3103.69s | we're already at the point where like they are really wildly impressive from a hardware architectural point of view and 3104.09s - 3109.09s | The more we throw in there the better job we have to do and I'll leave you with like 3109.25s - 3111.25s | My adage on why I think that's a good thing 3111.97s - 3115.01s | As a defender and I worked for the DoD for a bit 3115.01s - 3120.33s | So if you watch the movie 300 as a defender, you want to create


chunk_text:
3072.25s - 3075.49s | We were messing around with my Subaru WRX. I was like 3076.41s - 3080.21s | We were able to roll the odometer and make the odometer say leet 3080.21s - 3085.01s | That was like one of the fun the fun wins of that and then we just found some other things with known 3085.33s - 3092.45s | Some other processors with known attacks, so I mean a hundred percent the more security we start putting in our phones 3092.85s - 3097.33s | The more we need to beef up the defense and if you look at how phones have advanced 3097.33s - 3103.69s | we're already at the point where like they are really wildly impressive from a hardware architectural point of view and 3104.09s - 3109.09s | The more we throw in there the better job we have to do and I'll leave you with like 3109.25s - 3111.25s | My adage on why I think that's a good thing 3111.97s - 3115.01s | As a defender and I worked for the DoD for a bit 3115.01s - 3120.33s | So if you watch the movie 300 as a defender, you want to create a choke point, right? 3120.33s - 3121.65s | Like that's how you beat the Persians 3121.65s - 3126.17s | You know exactly where they're coming and you can focus all of your attack power there and all your defensive power 3126.65s - 3131.85s | So we really do put it all in the phone all in the secure element and this one chip that has a single line 3132.13s - 3133.53s | for IO 3133.53s - 3136.25s | Like you now your parsers are very 3137.01s - 3140.61s | Rudimentary can actually be audited quite well 3140.61s - 3144.65s | And if you get to the point where all you're looking at is this one input 3145.29s - 3147.29s | Like one input channel in and out 3147.57s - 3153.13s | You actually have a chance to defend that whereas now, you know with passwords and credentials and smart cards, you know 3153.13s - 3156.89s | You have all these cards out in the wild. You have no clue what's 3157.77s - 3163.49s | Happening where all these different technologies. So if you really do put all your eggs in one basket and guard that basket 3163.85s - 3170.53s |


chunk_text:
a choke point, right? 3120.33s - 3121.65s | Like that's how you beat the Persians 3121.65s - 3126.17s | You know exactly where they're coming and you can focus all of your attack power there and all your defensive power 3126.65s - 3131.85s | So we really do put it all in the phone all in the secure element and this one chip that has a single line 3132.13s - 3133.53s | for IO 3133.53s - 3136.25s | Like you now your parsers are very 3137.01s - 3140.61s | Rudimentary can actually be audited quite well 3140.61s - 3144.65s | And if you get to the point where all you're looking at is this one input 3145.29s - 3147.29s | Like one input channel in and out 3147.57s - 3153.13s | You actually have a chance to defend that whereas now, you know with passwords and credentials and smart cards, you know 3153.13s - 3156.89s | You have all these cards out in the wild. You have no clue what's 3157.77s - 3163.49s | Happening where all these different technologies. So if you really do put all your eggs in one basket and guard that basket 3163.85s - 3170.53s | It's not as crazy as it initially sounds or I've at least convinced myself of that after a 15-year academic career that 3170.77s - 3174.57s | You know, I've convinced myself. I'm not crazy. I don't know if I've convinced others yet. I 3176.91s - 3181.31s | Have two minutes for either a final question or an awkward silence 3181.95s - 3191.15s | All right 3191.15s - 3193.75s | Thank you all so much. Hopefully this was educational and useful 3194.15s - 3199.39s | swing by the physical security village if you want to play with any of this stuff hands-on and see what it's actually like to 3199.39s - 3201.39s | clone a card


chunk_text:
It's not as crazy as it initially sounds or I've at least convinced myself of that after a 15-year academic career that 3170.77s - 3174.57s | You know, I've convinced myself. I'm not crazy. I don't know if I've convinced others yet. I 3176.91s - 3181.31s | Have two minutes for either a final question or an awkward silence 3181.95s - 3191.15s | All right 3191.15s - 3193.75s | Thank you all so much. Hopefully this was educational and useful 3194.15s - 3199.39s | swing by the physical security village if you want to play with any of this stuff hands-on and see what it's actually like to 3199.39s - 3201.39s | clone a card


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=caY7ls4G460", "title": "DEF CON 32 - What To Expect When You\u2019re Exploiting: 0Days Baby Monitors & Wi-Fi Cams - Mager, Forte", "description": "Home surveillance technology is a modern convenience that has been made accessible to the masses through the rise of IoT devices, namely cloud-connected Wi-Fi cameras. From parents monitoring their infants to homeowners watching their entryways, these cameras provide users with access to instant, high definition video from the convenience of a mobile phone, tablet, or PC. However, the affordability of these devices and relative ease of cloud access generally correlates to flawed security, putting users at risk. We set out to explore the attack surface of various Wi-Fi camera models to gain a deeper understanding of how these devices are being exploited. In the end, we devised methods to gain local root access, uncovered user privacy issues, discovered a zero-day vulnerability within a prominent IoT device management platform that allows attackers to gain remote control of millions of cameras worldwide and access sensitive user data, and revealed how these devices may be vulnerable to remote code execution attacks through completely unauthenticated means thanks to an inherently flawed implementation of their underlying peer to peer networking protocol. Along with demonstrating our exploits against live cameras, we will highlight the methods used to obtain our most significant findings and provide guidance on remediating the issues we encountered so these devices can be used safely in your household. We will also invite audience members to probe and attack a camera during our talk and earn a prize in the process!", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2401, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 5.28s | This text was transcribed using whisper model: large-v2 Good morning DEF CON. Uh we are gonna be hacking some baby monitors and WiFi cameras today. 5.28s - 10.14s | So a little bit about me, my name is Mark Mager, I'm senior manager of security research 10.14s - 15.18s | at Elastic. Uh my background is primarily in Windows malware research and reverse engineering. 15.18s - 21.48s | Uh so what do we need to know about uh WiFi cameras and baby monitors today? Um basically 21.48s - 24.52s | we're gonna assume they're the exact same thing because they pretty much have the same 24.52s - 30.92s | feature set. Uh they're literally marketed and sold as equivalent devices. So uh what 30.92s


chunk_text:
Along with demonstrating our exploits against live cameras, we will highlight the methods used to obtain our most significant findings and provide guidance on remediating the issues we encountered so these devices can be used safely in your household. We will also invite audience members to probe and attack a camera during our talk and earn a prize in the process!", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2401, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 5.28s | This text was transcribed using whisper model: large-v2 Good morning DEF CON. Uh we are gonna be hacking some baby monitors and WiFi cameras today. 5.28s - 10.14s | So a little bit about me, my name is Mark Mager, I'm senior manager of security research 10.14s - 15.18s | at Elastic. Uh my background is primarily in Windows malware research and reverse engineering. 15.18s - 21.48s | Uh so what do we need to know about uh WiFi cameras and baby monitors today? Um basically 21.48s - 24.52s | we're gonna assume they're the exact same thing because they pretty much have the same 24.52s - 30.92s | feature set. Uh they're literally marketed and sold as equivalent devices. So uh what 30.92s - 37.08s | we're talking about is the $10 cameras you can find on Amazon uh that require internet 37.08s - 42.92s | connectivity to that specific vendor's cloud platform. And there's very basic operations, 42.92s - 48.12s | pan, tilt, zoom, uh things along those lines, motion detection, whatever. But yeah that's 48.12s - 52.88s | the what we're talking about when we say WiFi cameras for today. Uh so why WiFi cameras? 52.88s - 59.68s | Well there's literally almost 125 million households across the world that have these 59.68s - 66.36s | cameras installed within their house. So uh these things are everywhere. Um and they're 66.36s - 70.72s | obviously gotten going anywhere and they're super cheap. So you're gonna find them everywhere. 70.72s - 75.14s | Um the attacks that are typically associated with these cameras, what you're probably gonna 75.14s - 81.76s | hear about usually is uh people spying on babies uh and families, terrorizing them, 81.76s - 87.24s | that sort of thing. Uh a bit upsetting there. And even things like uh Russians performing 87.24s - 96.24s | uh reconnaissance on targets within Ukraine. Uh so when we set out to


chunk_text:
- 37.08s | we're talking about is the $10 cameras you can find on Amazon uh that require internet 37.08s - 42.92s | connectivity to that specific vendor's cloud platform. And there's very basic operations, 42.92s - 48.12s | pan, tilt, zoom, uh things along those lines, motion detection, whatever. But yeah that's 48.12s - 52.88s | the what we're talking about when we say WiFi cameras for today. Uh so why WiFi cameras? 52.88s - 59.68s | Well there's literally almost 125 million households across the world that have these 59.68s - 66.36s | cameras installed within their house. So uh these things are everywhere. Um and they're 66.36s - 70.72s | obviously gotten going anywhere and they're super cheap. So you're gonna find them everywhere. 70.72s - 75.14s | Um the attacks that are typically associated with these cameras, what you're probably gonna 75.14s - 81.76s | hear about usually is uh people spying on babies uh and families, terrorizing them, 81.76s - 87.24s | that sort of thing. Uh a bit upsetting there. And even things like uh Russians performing 87.24s - 96.24s | uh reconnaissance on targets within Ukraine. Uh so when we set out to uh evaluate the attack 96.24s - 101.32s | surface for WiFi cameras uh we wanted to break things down into a few different uh common 101.32s - 107.90s | attack vectors. That broke down primarily into leak credentials and cloud vulnerabilities. 107.90s - 115.74s | Those seem to be the most common um attack vectors, the most frequently seen ones um 115.74s - 121.30s | in uh more of the the attacks that we kinda see across the board. Um yeah so kinda focusing 121.30s - 128.22s | on those two, you know that's certainly what we wanted to kinda uh dig into was any vulnerabilities 128.22s - 135.26s | specific to the cloud platforms, uh the applications that control the cameras, and uh the camera 135.26s - 144.31s | hardware itself. Hello DEF CON. I'm Eric Forte and uh doing the presentation with Mark 144.31s - 149.27s | and I'm a Security Research Engineer at Elastic. I'm on the Threat Research and Detection Engineering 149.27s - 155.47s | team, otherwise known as TRADE. And my background is in Linux software development, IoT systems, 155.47s - 161.83s | UAVs, civil space sector, and then also doing some threat research. And


chunk_text:
uh evaluate the attack 96.24s - 101.32s | surface for WiFi cameras uh we wanted to break things down into a few different uh common 101.32s - 107.90s | attack vectors. That broke down primarily into leak credentials and cloud vulnerabilities. 107.90s - 115.74s | Those seem to be the most common um attack vectors, the most frequently seen ones um 115.74s - 121.30s | in uh more of the the attacks that we kinda see across the board. Um yeah so kinda focusing 121.30s - 128.22s | on those two, you know that's certainly what we wanted to kinda uh dig into was any vulnerabilities 128.22s - 135.26s | specific to the cloud platforms, uh the applications that control the cameras, and uh the camera 135.26s - 144.31s | hardware itself. Hello DEF CON. I'm Eric Forte and uh doing the presentation with Mark 144.31s - 149.27s | and I'm a Security Research Engineer at Elastic. I'm on the Threat Research and Detection Engineering 149.27s - 155.47s | team, otherwise known as TRADE. And my background is in Linux software development, IoT systems, 155.47s - 161.83s | UAVs, civil space sector, and then also doing some threat research. And so when we're talking 161.83s - 165.75s | about these cameras, we're for the purposes of this talk, we we looked at a number of 165.75s - 171.03s | different cameras, but we're gonna primarily focus on the WandsView Q5 and the WandsView Q6. 171.03s - 178.11s | And as far as why we picked these cameras, it was uh sort of clear to see on the Amazon reviews 178.11s - 182.35s | that they uh might have something for us to look at, some vulnerabilities that other people had 182.35s - 191.23s | just come across because they were readily hacked enough that um that it took notice. So these 191.31s - 197.47s | cameras are made by WandsView, but there are other vendors that also produce cameras such as 197.47s - 202.35s | Sonado and some others as well, which we'll touch on a little bit more in a little bit. But they're 202.35s - 207.95s | primarily under the AJ Cloud management infrastructure. And so this is gonna be the 207.95s - 214.63s | cloud services that provide you with the apps, with the weight of connecting to it. So they may, 214.63s - 218.83s | the


chunk_text:
so when we're talking 161.83s - 165.75s | about these cameras, we're for the purposes of this talk, we we looked at a number of 165.75s - 171.03s | different cameras, but we're gonna primarily focus on the WandsView Q5 and the WandsView Q6. 171.03s - 178.11s | And as far as why we picked these cameras, it was uh sort of clear to see on the Amazon reviews 178.11s - 182.35s | that they uh might have something for us to look at, some vulnerabilities that other people had 182.35s - 191.23s | just come across because they were readily hacked enough that um that it took notice. So these 191.31s - 197.47s | cameras are made by WandsView, but there are other vendors that also produce cameras such as 197.47s - 202.35s | Sonado and some others as well, which we'll touch on a little bit more in a little bit. But they're 202.35s - 207.95s | primarily under the AJ Cloud management infrastructure. And so this is gonna be the 207.95s - 214.63s | cloud services that provide you with the apps, with the weight of connecting to it. So they may, 214.63s - 218.83s | the WandsView versus Sonado versus others may have their own little differences in the apps 218.91s - 224.91s | themselves, but primarily this cloud interface is with AJ Cloud and we'll get into a lot more of 224.91s - 230.67s | that in a minute. So when we were first with these cameras, we kind of looked at a few different 230.67s - 235.95s | approaches for how we were gonna try and see if we could get some of those similar Amazon review 235.95s - 241.15s | results. So first, we were looking at remote access. So this is gonna be accessing the camera 241.15s - 246.99s | through whatever companion app that ships with with the camera. We also were gonna look at some 246.99s - 252.43s | local attacks. So it's gonna be some active and passive networking recon in addition to seeing 252.43s - 257.63s | what else other services and things were running there. Also looking at some device physical 257.63s - 263.31s | manipulation, which obviously these are Wi-Fi cameras. They're not necessarily like closed 263.31s - 268.83s | circuit TV cameras. So we're expecting that there's gonna be some physical attacks, which there are,


chunk_text:
WandsView versus Sonado versus others may have their own little differences in the apps 218.91s - 224.91s | themselves, but primarily this cloud interface is with AJ Cloud and we'll get into a lot more of 224.91s - 230.67s | that in a minute. So when we were first with these cameras, we kind of looked at a few different 230.67s - 235.95s | approaches for how we were gonna try and see if we could get some of those similar Amazon review 235.95s - 241.15s | results. So first, we were looking at remote access. So this is gonna be accessing the camera 241.15s - 246.99s | through whatever companion app that ships with with the camera. We also were gonna look at some 246.99s - 252.43s | local attacks. So it's gonna be some active and passive networking recon in addition to seeing 252.43s - 257.63s | what else other services and things were running there. Also looking at some device physical 257.63s - 263.31s | manipulation, which obviously these are Wi-Fi cameras. They're not necessarily like closed 263.31s - 268.83s | circuit TV cameras. So we're expecting that there's gonna be some physical attacks, which there are, 268.83s - 275.23s | we'll get to that. But it's still, again, as an attack vector can enable some other aspects. 276.19s - 282.75s | Then finally, looking at the hardware itself. So looking at the chip and seeing what we can use, 282.75s - 286.91s | what we can either get the firmware off, what we can do to kind of, again, extend that vulnerability 286.91s - 291.95s | process, look for serial communications and things like that, which spoiler alert, we have, 291.95s - 299.07s | we found some over, over UART. So for our lab setup, we have a number of different things that 299.07s - 303.79s | we wanted to look at, right? So we've got different apps. So, so we want to have a very controlled 303.79s - 308.43s | environment because we, we know say one, they're easy to hack. So we don't want to be hacked 308.43s - 314.67s | ourselves. But on top of that, we know as these are largely say Chinese make cameras that they 314.67s - 320.11s | may also want to be watching what we're doing. So we wanted to have a completely different setup. 320.11s - 325.63s


chunk_text:
268.83s - 275.23s | we'll get to that. But it's still, again, as an attack vector can enable some other aspects. 276.19s - 282.75s | Then finally, looking at the hardware itself. So looking at the chip and seeing what we can use, 282.75s - 286.91s | what we can either get the firmware off, what we can do to kind of, again, extend that vulnerability 286.91s - 291.95s | process, look for serial communications and things like that, which spoiler alert, we have, 291.95s - 299.07s | we found some over, over UART. So for our lab setup, we have a number of different things that 299.07s - 303.79s | we wanted to look at, right? So we've got different apps. So, so we want to have a very controlled 303.79s - 308.43s | environment because we, we know say one, they're easy to hack. So we don't want to be hacked 308.43s - 314.67s | ourselves. But on top of that, we know as these are largely say Chinese make cameras that they 314.67s - 320.11s | may also want to be watching what we're doing. So we wanted to have a completely different setup. 320.11s - 325.63s | And so we have a mobile hotspot. I like the T-Mobile T9s. They're cheap. You can get them 325.63s - 331.15s | for about 20 bucks and they do the job great. We have the camera of course itself. Then we needed 331.71s - 336.51s | say Windows and Linux operating systems. You don't actually need Linux, except I would argue that you 336.51s - 341.15s | do, but, but, but practically speaking, you don't need Linux to be able to run any of these things. 341.15s - 347.95s | But, but we, we use that, but we did need Windows to also look at the companion Windows app in 347.95s - 353.55s | addition to the iOS and Android apps, which we had phones and virtual machines set up for as well. 354.99s - 359.31s | From a software side, we use a number of different tools, including say Wireshark, 360.27s - 364.91s | running Android Studio to try and see what we could find out from the app, various other sort 364.91s - 372.19s | of decompiling mechanisms, and also using the Elastic Stack to look at the network communication 372.19s - 376.91s | logs and how


chunk_text:
| And so we have a mobile hotspot. I like the T-Mobile T9s. They're cheap. You can get them 325.63s - 331.15s | for about 20 bucks and they do the job great. We have the camera of course itself. Then we needed 331.71s - 336.51s | say Windows and Linux operating systems. You don't actually need Linux, except I would argue that you 336.51s - 341.15s | do, but, but, but practically speaking, you don't need Linux to be able to run any of these things. 341.15s - 347.95s | But, but we, we use that, but we did need Windows to also look at the companion Windows app in 347.95s - 353.55s | addition to the iOS and Android apps, which we had phones and virtual machines set up for as well. 354.99s - 359.31s | From a software side, we use a number of different tools, including say Wireshark, 360.27s - 364.91s | running Android Studio to try and see what we could find out from the app, various other sort 364.91s - 372.19s | of decompiling mechanisms, and also using the Elastic Stack to look at the network communication 372.19s - 376.91s | logs and how we can parse some of the different protocols that we saw. And we will, again, 376.91s - 380.83s | we'll talk to that more in a little bit, but specifically looking at some peer-to-peer traffic 380.83s - 386.99s | there. From a hardware standpoint, since we wanted to do the full gamut of going from complete 386.99s - 391.95s | hardware takedown as well as looking at all the software, we had some, some hardware teardown 391.95s - 399.15s | tools. I like the, what iFixit has, but of course you can take your pick. Then we needed some USB 399.15s - 404.99s | TTY connector, right? So in this case, you know, it's just your typical Adafruit USB TTY serial 404.99s - 412.03s | connector there. We also have a, and we'll get to it more in a minute, but using the GreatFET 1 412.99s - 417.79s | to, as a logic analyzer, to, and to be able to read voltages and things like that in case we 417.79s - 422.43s | needed to actually like hard pull something off of the chip, solder something, or things like that. 422.43s - 426.35s | Ultimately, we didn't need to do


chunk_text:
we can parse some of the different protocols that we saw. And we will, again, 376.91s - 380.83s | we'll talk to that more in a little bit, but specifically looking at some peer-to-peer traffic 380.83s - 386.99s | there. From a hardware standpoint, since we wanted to do the full gamut of going from complete 386.99s - 391.95s | hardware takedown as well as looking at all the software, we had some, some hardware teardown 391.95s - 399.15s | tools. I like the, what iFixit has, but of course you can take your pick. Then we needed some USB 399.15s - 404.99s | TTY connector, right? So in this case, you know, it's just your typical Adafruit USB TTY serial 404.99s - 412.03s | connector there. We also have a, and we'll get to it more in a minute, but using the GreatFET 1 412.99s - 417.79s | to, as a logic analyzer, to, and to be able to read voltages and things like that in case we 417.79s - 422.43s | needed to actually like hard pull something off of the chip, solder something, or things like that. 422.43s - 426.35s | Ultimately, we didn't need to do that, but we were prepared for that nonetheless. 427.79s - 432.99s | Raspberry Pi, because it's easy to image and then make it, and distribute. So for, 433.79s - 437.63s | for having, for doing cross-compilation and things like that, cheap, easy to come by. 437.63s - 446.67s | And then also, we used Alpha Wi-Fi, just a USB Wi-Fi NIC, which for us, why this was important, 446.67s - 452.51s | and why you'll need some NIC that you can get active, or rather passive sniffing on, 452.51s - 458.67s | is because you're going to want to capture all of the traffic going from the camera to the cloud, 458.67s - 463.15s | and not just what will appear as network traffic. And we'll get to that in a little bit, 463.23s - 467.79s | because you're going to, if, to follow along, you'll need to, to parse some, some additional 467.79s - 473.55s | protocols. So getting a little bit into our remote and local recon, initial attacks were 473.55s - 479.47s | limited. They had a fairly locked down attack surface. The active network and local reconnaissance 479.47s - 484.75s | doesn't reveal too much, or


chunk_text:
that, but we were prepared for that nonetheless. 427.79s - 432.99s | Raspberry Pi, because it's easy to image and then make it, and distribute. So for, 433.79s - 437.63s | for having, for doing cross-compilation and things like that, cheap, easy to come by. 437.63s - 446.67s | And then also, we used Alpha Wi-Fi, just a USB Wi-Fi NIC, which for us, why this was important, 446.67s - 452.51s | and why you'll need some NIC that you can get active, or rather passive sniffing on, 452.51s - 458.67s | is because you're going to want to capture all of the traffic going from the camera to the cloud, 458.67s - 463.15s | and not just what will appear as network traffic. And we'll get to that in a little bit, 463.23s - 467.79s | because you're going to, if, to follow along, you'll need to, to parse some, some additional 467.79s - 473.55s | protocols. So getting a little bit into our remote and local recon, initial attacks were 473.55s - 479.47s | limited. They had a fairly locked down attack surface. The active network and local reconnaissance 479.47s - 484.75s | doesn't reveal too much, or too much interesting as far as running on the traffic, the, or rather 484.75s - 491.87s | running on the camera. The network traffic itself is fairly mundane. It uses encrypted web sockets, 491.87s - 495.39s | which good sign, right, that they are at least using encryption, things like that. 496.75s - 501.47s | So you, we tried to do some man-in-the-middle attacks, but ultimately we weren't particularly 501.47s - 506.83s | successful with that. Looking at the apps themselves, they were likely obfuscated with 506.83s - 513.15s | ProGuard. We couldn't, just from the, from being, unpacking the APK, get too far there. 514.59s - 520.43s | But, so those APKs were just not easily that debuggable. But just as a quick note, 520.43s - 524.51s | ultimately there's three lines of communication. We're going from the mobile app to the cloud, 524.51s - 528.75s | the mobile app to the camera, and then also from the camera to the cloud, and then the mobile app. 528.75s - 532.67s | And that, just as a sort of primer, we'll get into that more in a little bit. 534.03s - 539.71s | Just as far as the physical device


chunk_text:
too much interesting as far as running on the traffic, the, or rather 484.75s - 491.87s | running on the camera. The network traffic itself is fairly mundane. It uses encrypted web sockets, 491.87s - 495.39s | which good sign, right, that they are at least using encryption, things like that. 496.75s - 501.47s | So you, we tried to do some man-in-the-middle attacks, but ultimately we weren't particularly 501.47s - 506.83s | successful with that. Looking at the apps themselves, they were likely obfuscated with 506.83s - 513.15s | ProGuard. We couldn't, just from the, from being, unpacking the APK, get too far there. 514.59s - 520.43s | But, so those APKs were just not easily that debuggable. But just as a quick note, 520.43s - 524.51s | ultimately there's three lines of communication. We're going from the mobile app to the cloud, 524.51s - 528.75s | the mobile app to the camera, and then also from the camera to the cloud, and then the mobile app. 528.75s - 532.67s | And that, just as a sort of primer, we'll get into that more in a little bit. 534.03s - 539.71s | Just as far as the physical device itself, again, we weren't really expecting it to be that secure. 539.71s - 544.75s | It has an exposed reset button. So if you had this sitting, like let's say up here on stage, 544.75s - 549.31s | if you were to walk by, hit the reset button and then flash a QR code, you could steal the camera 549.31s - 553.55s | and then now it's yours. You have full control over it. Again, that's not particularly surprising 553.55s - 559.07s | because that's part of the expected setup process. So, so in that sense, there's no, 559.07s - 565.95s | once you have reset the camera, there's no verification. So there's also an exposed SD 565.95s - 571.23s | card slot. So as we came to discover later, this can be used to load alternative firmware as well. 571.23s - 576.11s | We'll get into what the bootloader looks like in a minute too, but this, if you were to craft a 576.11s - 580.59s | malicious SD card, you could go plug it into the camera and then also have a field day there too. 582.03s - 587.23s | The hardware recon starts to get a little


chunk_text:
itself, again, we weren't really expecting it to be that secure. 539.71s - 544.75s | It has an exposed reset button. So if you had this sitting, like let's say up here on stage, 544.75s - 549.31s | if you were to walk by, hit the reset button and then flash a QR code, you could steal the camera 549.31s - 553.55s | and then now it's yours. You have full control over it. Again, that's not particularly surprising 553.55s - 559.07s | because that's part of the expected setup process. So, so in that sense, there's no, 559.07s - 565.95s | once you have reset the camera, there's no verification. So there's also an exposed SD 565.95s - 571.23s | card slot. So as we came to discover later, this can be used to load alternative firmware as well. 571.23s - 576.11s | We'll get into what the bootloader looks like in a minute too, but this, if you were to craft a 576.11s - 580.59s | malicious SD card, you could go plug it into the camera and then also have a field day there too. 582.03s - 587.23s | The hardware recon starts to get a little bit more interesting. So when we look at the chip, 587.23s - 593.79s | it's an Express T31 SoC. It's primarily a MIPS processor, but it also has a companion RISC-V 593.79s - 598.83s | processor. But the primary thing I want you to focus on for the sake of the demonstration 598.83s - 606.27s | is that we have an I2C and UART bus that we could be looking for right on the hardware, 606.27s - 613.87s | on the chip itself. We also have a secure boot, which may, you know, that could throw a wrench 613.87s - 618.91s | into things. And then we also have a hardware watchdog supported by this chip. Doesn't necessarily 618.91s - 623.87s | mean they're using it, but again, these are things that we can look for in our hardware recon. 624.43s - 632.03s | So in tearing down part of the camera, we found a potential UART, UN access ports there. 632.03s - 638.11s | And so we connected a logic analyzer, the great FET-1, looked at the voltages, used some of the 638.11s - 646.59s | protocol detection, saw that it appears to be UART. And if we look


chunk_text:
bit more interesting. So when we look at the chip, 587.23s - 593.79s | it's an Express T31 SoC. It's primarily a MIPS processor, but it also has a companion RISC-V 593.79s - 598.83s | processor. But the primary thing I want you to focus on for the sake of the demonstration 598.83s - 606.27s | is that we have an I2C and UART bus that we could be looking for right on the hardware, 606.27s - 613.87s | on the chip itself. We also have a secure boot, which may, you know, that could throw a wrench 613.87s - 618.91s | into things. And then we also have a hardware watchdog supported by this chip. Doesn't necessarily 618.91s - 623.87s | mean they're using it, but again, these are things that we can look for in our hardware recon. 624.43s - 632.03s | So in tearing down part of the camera, we found a potential UART, UN access ports there. 632.03s - 638.11s | And so we connected a logic analyzer, the great FET-1, looked at the voltages, used some of the 638.11s - 646.59s | protocol detection, saw that it appears to be UART. And if we look at the actual signal, we saw 646.59s - 653.31s | that it indeed was. So we go ahead and use screen, but you can use again, whatever your favorite tool 653.31s - 661.95s | is to connect over default baud rate to UART. And lo and behold on boot, we have UBOOT. So that 661.95s - 668.27s | of course is useful for us, but also we in further expecting this, that secure boot is not enabled 668.83s - 673.71s | by default, as far as the, on the camera, even though the chip supports it. So we can just do a 673.71s - 679.47s | quick boot into single user mode and get a root shell so that we can start poking around further. 679.47s - 684.43s | Now this camera was particularly easy to do this because you could just straight set the 684.43s - 689.23s | environment variable, the environment variables for UBOOT to be able to boot into single user 689.23s - 693.15s | mode and get root. Other cameras that we looked at were not as simple as this. And sometimes you 693.15s - 698.11s | have to use memory offsets and things like that,


chunk_text:
at the actual signal, we saw 646.59s - 653.31s | that it indeed was. So we go ahead and use screen, but you can use again, whatever your favorite tool 653.31s - 661.95s | is to connect over default baud rate to UART. And lo and behold on boot, we have UBOOT. So that 661.95s - 668.27s | of course is useful for us, but also we in further expecting this, that secure boot is not enabled 668.83s - 673.71s | by default, as far as the, on the camera, even though the chip supports it. So we can just do a 673.71s - 679.47s | quick boot into single user mode and get a root shell so that we can start poking around further. 679.47s - 684.43s | Now this camera was particularly easy to do this because you could just straight set the 684.43s - 689.23s | environment variable, the environment variables for UBOOT to be able to boot into single user 689.23s - 693.15s | mode and get root. Other cameras that we looked at were not as simple as this. And sometimes you 693.15s - 698.11s | have to use memory offsets and things like that, but, but this one in particular, what was fairly 698.11s - 704.59s | straightforward. So again, we can hit boot and then run, then just drop into our root shell 704.59s - 710.03s | and then be able to poke around on the camera. So when, now that we're there, so a few things 710.03s - 714.43s | that we want to then, then do to go forward. First off, we may want to try and establish 714.43s - 718.91s | persistence, but if you've done this type of attack before going to say a single user mode, 718.91s - 724.11s | especially on embedded devices and just embedded devices in general, you might see that you're on 724.11s - 731.39s | a read only file system. Well, many times this is only read only ish. It's not quite truly read only. 731.39s - 739.07s | So if we take a look at Fstab, we can see that a number of these mount points are separated, 739.07s - 747.31s | but then also they are TempFS shares. So we can then you make our own TempFS partition, 747.31s - 753.79s | or just mount a TempFS partition for read, write


chunk_text:
but, but this one in particular, what was fairly 698.11s - 704.59s | straightforward. So again, we can hit boot and then run, then just drop into our root shell 704.59s - 710.03s | and then be able to poke around on the camera. So when, now that we're there, so a few things 710.03s - 714.43s | that we want to then, then do to go forward. First off, we may want to try and establish 714.43s - 718.91s | persistence, but if you've done this type of attack before going to say a single user mode, 718.91s - 724.11s | especially on embedded devices and just embedded devices in general, you might see that you're on 724.11s - 731.39s | a read only file system. Well, many times this is only read only ish. It's not quite truly read only. 731.39s - 739.07s | So if we take a look at Fstab, we can see that a number of these mount points are separated, 739.07s - 747.31s | but then also they are TempFS shares. So we can then you make our own TempFS partition, 747.31s - 753.79s | or just mount a TempFS partition for read, write access, modify the desired settings. And we can 753.79s - 758.99s | run whatever we want, of course, and have, have persistence, which largely for these type of 758.99s - 763.87s | devices, you will need this type of interface, whether it be for, there's other methods for 763.87s - 768.91s | logging, but again, when, when Linux is running, it often needs to be able to make some level 768.91s - 773.71s | modifications. So this is just walking through one way of doing that of saying, Hey, I want to 773.71s - 781.79s | create a, a TempFS share for dev, and then go ahead and mount it. And then also then mount Etsy 781.79s - 788.35s | such that I can make Etsy read, write as well, which of course gives us access to, 788.35s - 794.51s | to some other things. And so just demonstrating there that if I run that, if I just create a 794.51s - 800.83s | file, then it does, in fact, it show up as opposed to when it didn't before. So if you want, so 800.83s - 804.03s | that's just one way, of course, then you can go and


chunk_text:
access, modify the desired settings. And we can 753.79s - 758.99s | run whatever we want, of course, and have, have persistence, which largely for these type of 758.99s - 763.87s | devices, you will need this type of interface, whether it be for, there's other methods for 763.87s - 768.91s | logging, but again, when, when Linux is running, it often needs to be able to make some level 768.91s - 773.71s | modifications. So this is just walking through one way of doing that of saying, Hey, I want to 773.71s - 781.79s | create a, a TempFS share for dev, and then go ahead and mount it. And then also then mount Etsy 781.79s - 788.35s | such that I can make Etsy read, write as well, which of course gives us access to, 788.35s - 794.51s | to some other things. And so just demonstrating there that if I run that, if I just create a 794.51s - 800.83s | file, then it does, in fact, it show up as opposed to when it didn't before. So if you want, so 800.83s - 804.03s | that's just one way, of course, then you can go and do whatever you want from that perspective. 804.91s - 809.87s | But if you want to go log into the existing root user, of course, you can pull Etsy password and 809.87s - 816.99s | then go and just use John the Ripper or something to, to crack that hash and, and go from there. 816.99s - 820.75s | But for, for our purposes, again, we want to keep going, looking for the other software 820.75s - 826.11s | vulnerabilities. So this gives us a, an easy way to pull the firmware over the serial connection. 826.11s - 830.99s | So we, and in addition to the firmware, we're pulling a JFS to read, write partition containing 830.99s - 836.83s | any log data, again, just might be useful for us. So this is just demonstrating how you can, 836.83s - 840.99s | one way of pulling the firmware. There are a number of different ways, but this is just how we 840.99s - 847.87s | did it using, using binwalk. And then of course, just echoing the bytes out in the appropriate 847.87s - 853.23s | format over the serial connection. So with that, I'm going to hand it


chunk_text:
do whatever you want from that perspective. 804.91s - 809.87s | But if you want to go log into the existing root user, of course, you can pull Etsy password and 809.87s - 816.99s | then go and just use John the Ripper or something to, to crack that hash and, and go from there. 816.99s - 820.75s | But for, for our purposes, again, we want to keep going, looking for the other software 820.75s - 826.11s | vulnerabilities. So this gives us a, an easy way to pull the firmware over the serial connection. 826.11s - 830.99s | So we, and in addition to the firmware, we're pulling a JFS to read, write partition containing 830.99s - 836.83s | any log data, again, just might be useful for us. So this is just demonstrating how you can, 836.83s - 840.99s | one way of pulling the firmware. There are a number of different ways, but this is just how we 840.99s - 847.87s | did it using, using binwalk. And then of course, just echoing the bytes out in the appropriate 847.87s - 853.23s | format over the serial connection. So with that, I'm going to hand it over to Mark to see what he 853.23s - 860.40s | did with the firmware. All right. So as Eric mentioned earlier, we definitely were running 860.40s - 867.92s | into issues with the iOS and Android apps for Wansview specifically, right? So we're hitting 867.92s - 872.96s | our heads against the wall a little bit. So we kind of back things up a little bit and went directly 872.96s - 879.60s | to Wansview site and they host a version of Wansview cloud that is for older versions of 879.60s - 885.92s | windows. I think it says windows seven specifically on their site. But the main takeaways from that 885.92s - 891.36s | is that that app is still compatible with all Wansview devices. It does have a limited feature 891.36s - 897.52s | set. I mean, they're still trying to push you towards using the apps. That's totally their 897.52s - 902.80s | sort of thing because they want everybody to sign up for their cloud plan so they can make more money 902.80s - 911.28s | off of everybody, not just the $10 sales from the device itself. A couple of other things related 911.28s


chunk_text:
over to Mark to see what he 853.23s - 860.40s | did with the firmware. All right. So as Eric mentioned earlier, we definitely were running 860.40s - 867.92s | into issues with the iOS and Android apps for Wansview specifically, right? So we're hitting 867.92s - 872.96s | our heads against the wall a little bit. So we kind of back things up a little bit and went directly 872.96s - 879.60s | to Wansview site and they host a version of Wansview cloud that is for older versions of 879.60s - 885.92s | windows. I think it says windows seven specifically on their site. But the main takeaways from that 885.92s - 891.36s | is that that app is still compatible with all Wansview devices. It does have a limited feature 891.36s - 897.52s | set. I mean, they're still trying to push you towards using the apps. That's totally their 897.52s - 902.80s | sort of thing because they want everybody to sign up for their cloud plan so they can make more money 902.80s - 911.28s | off of everybody, not just the $10 sales from the device itself. A couple of other things related 911.28s - 917.28s | to that, this windows app is it does generate a significantly less amount of network traffic 917.28s - 922.72s | that's going to come in handy later. And the binaries are not packed. Eric mentioned that 923.76s - 929.52s | the APKs look like they're probably packed with ProGuard. So, you know, definitely being able to 930.16s - 936.48s | disassemble and decompile and debug pretty easily. That helps out quite a bit. And then 937.36s - 943.84s | last but certainly not least is that it does generate a very, very verbose debug log file, 944.40s - 949.76s | which I'm going to dig into right now. And the first thing we noticed when we ran the first time, 949.76s - 956.40s | it logs user account credentials in clear text. That's obviously terrible. So, yeah, 956.40s - 963.68s | not a great sign of things. And as Eric mentioned before, we had significant difficulties trying to 963.68s - 968.32s | man in the middle any of the any of the app traffic before. So, we had no visibility into 968.32s - 976.40s | that. But hopefully their developers decided to actually log all posts and


chunk_text:
- 917.28s | to that, this windows app is it does generate a significantly less amount of network traffic 917.28s - 922.72s | that's going to come in handy later. And the binaries are not packed. Eric mentioned that 923.76s - 929.52s | the APKs look like they're probably packed with ProGuard. So, you know, definitely being able to 930.16s - 936.48s | disassemble and decompile and debug pretty easily. That helps out quite a bit. And then 937.36s - 943.84s | last but certainly not least is that it does generate a very, very verbose debug log file, 944.40s - 949.76s | which I'm going to dig into right now. And the first thing we noticed when we ran the first time, 949.76s - 956.40s | it logs user account credentials in clear text. That's obviously terrible. So, yeah, 956.40s - 963.68s | not a great sign of things. And as Eric mentioned before, we had significant difficulties trying to 963.68s - 968.32s | man in the middle any of the any of the app traffic before. So, we had no visibility into 968.32s - 976.40s | that. But hopefully their developers decided to actually log all posts and post requests and 976.40s - 980.96s | response data. So, it's all there in the clear. Who needs to man in the middle anything when you 980.96s - 988.81s | have it in the clear on a file on disk? So, yeah. So, digging into it, yeah, we could definitely 988.81s - 994.17s | get a ton of insight into the sign on process that we had we did not have before, including 994.97s - 1001.61s | the actual endpoint APIs as well as, you know, all the fields that are involved both in the 1001.61s - 1007.77s | requests and responses. So, you know, the first thing here is the app startup endpoint. It's not 1007.77s - 1016.25s | really a ton there. It's more just initial setup. This check is more just to see if this is a valid 1016.25s - 1022.89s | account that you're attempting to sign on. And then this here is where the actual let's see, 1022.89s - 1029.37s | yeah, as an initial account where, but yeah, challenge involved where the tokens generated 1029.37s - 1034.49s | for that specific client application. And then there's a little bit of a key exchange that


chunk_text:
post requests and 976.40s - 980.96s | response data. So, it's all there in the clear. Who needs to man in the middle anything when you 980.96s - 988.81s | have it in the clear on a file on disk? So, yeah. So, digging into it, yeah, we could definitely 988.81s - 994.17s | get a ton of insight into the sign on process that we had we did not have before, including 994.97s - 1001.61s | the actual endpoint APIs as well as, you know, all the fields that are involved both in the 1001.61s - 1007.77s | requests and responses. So, you know, the first thing here is the app startup endpoint. It's not 1007.77s - 1016.25s | really a ton there. It's more just initial setup. This check is more just to see if this is a valid 1016.25s - 1022.89s | account that you're attempting to sign on. And then this here is where the actual let's see, 1022.89s - 1029.37s | yeah, as an initial account where, but yeah, challenge involved where the tokens generated 1029.37s - 1034.49s | for that specific client application. And then there's a little bit of a key exchange that 1034.49s - 1040.25s | happens. But yeah, not too much else going on there. This is where the sign on really begins. 1042.01s - 1045.77s | Yeah, your password is at least salted and hashed. So, it's not set in the clear, thank God. 1046.17s - 1053.37s | And then yeah, I mean, it's mostly just to initialize the session and to confirm that 1053.37s - 1059.29s | you are allowed to log into this account. From there, we, things really start to get interesting 1059.29s - 1065.85s | because now we can, now that we're logged in, we can request a list of devices that are associated 1065.85s - 1071.69s | with that specific account. And as you can see here, there's a specific device ID along with 1071.69s - 1080.73s | some more configuration information, primarily endpoint URIs. And then there's another device 1080.73s - 1088.25s | configuration API endpoint that's hit. This is very notable. We're going to refer back to this 1088.25s - 1096.97s | later. But this is where a device ID is first transmitted from the application to the cloud. 1097.93s - 1104.97s | And more configuration information comes through. We'll dig into that


chunk_text:
1034.49s - 1040.25s | happens. But yeah, not too much else going on there. This is where the sign on really begins. 1042.01s - 1045.77s | Yeah, your password is at least salted and hashed. So, it's not set in the clear, thank God. 1046.17s - 1053.37s | And then yeah, I mean, it's mostly just to initialize the session and to confirm that 1053.37s - 1059.29s | you are allowed to log into this account. From there, we, things really start to get interesting 1059.29s - 1065.85s | because now we can, now that we're logged in, we can request a list of devices that are associated 1065.85s - 1071.69s | with that specific account. And as you can see here, there's a specific device ID along with 1071.69s - 1080.73s | some more configuration information, primarily endpoint URIs. And then there's another device 1080.73s - 1088.25s | configuration API endpoint that's hit. This is very notable. We're going to refer back to this 1088.25s - 1096.97s | later. But this is where a device ID is first transmitted from the application to the cloud. 1097.93s - 1104.97s | And more configuration information comes through. We'll dig into that a bit. And then the last 1104.97s - 1114.01s | request we really dig into is Fetch Infos. And this provides a much, much larger picture of 1114.01s - 1122.81s | the data that is stored for that specific device. And there's a lot to kind of dig into. But what 1122.89s - 1129.05s | you'll want to really highlight on is there's a snapshot URL that's provided. And that just 1129.05s - 1134.73s | happens to be publicly accessible. And that's a picture of my kitchen. So from back in April. 1136.49s - 1143.29s | So digging further into more of the response data, there's a few things certainly to note 1143.29s - 1149.85s | here that are a bit concerning, right? The firmware version, the very specific firmware 1149.85s - 1156.89s | version that is running on the device itself, that's referenced there along with the next 1156.89s - 1163.21s | firmware version they're supposed to upgrade to, along with the actual SSID that the device is 1163.21s - 1167.53s | currently signed on to, along with some other network configuration information, 1167.53s - 1174.65s | including its MAC address. And then we also have geolocation data in


chunk_text:
a bit. And then the last 1104.97s - 1114.01s | request we really dig into is Fetch Infos. And this provides a much, much larger picture of 1114.01s - 1122.81s | the data that is stored for that specific device. And there's a lot to kind of dig into. But what 1122.89s - 1129.05s | you'll want to really highlight on is there's a snapshot URL that's provided. And that just 1129.05s - 1134.73s | happens to be publicly accessible. And that's a picture of my kitchen. So from back in April. 1136.49s - 1143.29s | So digging further into more of the response data, there's a few things certainly to note 1143.29s - 1149.85s | here that are a bit concerning, right? The firmware version, the very specific firmware 1149.85s - 1156.89s | version that is running on the device itself, that's referenced there along with the next 1156.89s - 1163.21s | firmware version they're supposed to upgrade to, along with the actual SSID that the device is 1163.21s - 1167.53s | currently signed on to, along with some other network configuration information, 1167.53s - 1174.65s | including its MAC address. And then we also have geolocation data in the form of 1174.73s - 1182.49s | uh you know time zone data and things like that. So going back to the device configuration uh 1182.49s - 1189.37s | request, what we tried to do first is we wanted to see if we could actually access other devices 1189.37s - 1195.45s | that weren't associated with the RPAS particular account. Um so we tried a very naive approach 1195.45s - 1201.61s | where all we wanted to do was simply just replace the device ID in that particular request. 1201.61s - 1206.41s | And uh without really doing a significant amount of reverse engineering, we can locate that 1206.41s - 1212.25s | pretty easily based off of the verbose uh log data. Because if we just look up post request, 1212.25s - 1215.85s | uh we can you know we can see how many times that's specifically logged 1215.85s - 1222.73s | uh to the uh to the log file. And then we can cross-reference that with um the disassembly 1222.73s - 1229.93s | in IDA in order to target the specific uh device configuration post request uh to get a better 1229.93s - 1236.01s | idea of where we


chunk_text:
the form of 1174.73s - 1182.49s | uh you know time zone data and things like that. So going back to the device configuration uh 1182.49s - 1189.37s | request, what we tried to do first is we wanted to see if we could actually access other devices 1189.37s - 1195.45s | that weren't associated with the RPAS particular account. Um so we tried a very naive approach 1195.45s - 1201.61s | where all we wanted to do was simply just replace the device ID in that particular request. 1201.61s - 1206.41s | And uh without really doing a significant amount of reverse engineering, we can locate that 1206.41s - 1212.25s | pretty easily based off of the verbose uh log data. Because if we just look up post request, 1212.25s - 1215.85s | uh we can you know we can see how many times that's specifically logged 1215.85s - 1222.73s | uh to the uh to the log file. And then we can cross-reference that with um the disassembly 1222.73s - 1229.93s | in IDA in order to target the specific uh device configuration post request uh to get a better 1229.93s - 1236.01s | idea of where we would want to jump in. And so some digging further into um the particular 1236.01s - 1242.49s | function, um what we decided to do is we needed to set a breakpoint at this particular uh address 1242.49s - 1249.05s | which would be before the post request actually goes out um before the uh the JSON is fully uh 1249.05s - 1253.53s | fully formed as well. Um you know we're going to swap out the device IDs and memory and then 1253.53s - 1260.01s | resume execution. So pretty straightforward. Uh what this uh ends up kind of looking like is you 1260.01s - 1265.61s | know I wrote up maybe a 60 line uh Python script that that does this all for us uh which we will 1266.17s - 1276.81s | dig into right now. Okay so what we have right here is um well first I'll demonstrate that 1276.81s - 1291.92s | this account is so we already have one specific um camera that is tied to this account 1292.64s - 1298.72s | and it's offline at the moment so nothing you know particularly concerning there right. 1298.72s - 1313.71s | Uh we'll attempt to account


chunk_text:
would want to jump in. And so some digging further into um the particular 1236.01s - 1242.49s | function, um what we decided to do is we needed to set a breakpoint at this particular uh address 1242.49s - 1249.05s | which would be before the post request actually goes out um before the uh the JSON is fully uh 1249.05s - 1253.53s | fully formed as well. Um you know we're going to swap out the device IDs and memory and then 1253.53s - 1260.01s | resume execution. So pretty straightforward. Uh what this uh ends up kind of looking like is you 1260.01s - 1265.61s | know I wrote up maybe a 60 line uh Python script that that does this all for us uh which we will 1266.17s - 1276.81s | dig into right now. Okay so what we have right here is um well first I'll demonstrate that 1276.81s - 1291.92s | this account is so we already have one specific um camera that is tied to this account 1292.64s - 1298.72s | and it's offline at the moment so nothing you know particularly concerning there right. 1298.72s - 1313.71s | Uh we'll attempt to account uh to connect to it uh but nothing's going to happen. Now if we kick 1313.71s - 1319.39s | off the exploit script what it's going to do is it's going to launch the same Wansview cloud for 1319.39s - 1329.23s | Windows app uh we'll proceed to sign in as expected um and once we hit our breakpoint 1330.03s - 1336.83s | we will swap out the device ID in memory uh and then once it says finished here 1336.83s - 1354.68s | uh it will resume execution and we're online. So the thing is 1355.32s - 1363.66s | so yeah we can we can do everything in the app we can we can pan and tilt um 1364.86s - 1369.26s | yeah I mean that like I said it's a it is a bit more limited feature set compared to 1369.82s - 1377.58s | the uh the mobile apps but basically right we've proven we can get access to uh an account that or 1377.58s - 1383.74s | a device that's not associated with our account. It's obviously a very very uh significant uh 1384.30s - 1392.94s | uh access control vulnerability um so yeah you know certainly


chunk_text:
uh to connect to it uh but nothing's going to happen. Now if we kick 1313.71s - 1319.39s | off the exploit script what it's going to do is it's going to launch the same Wansview cloud for 1319.39s - 1329.23s | Windows app uh we'll proceed to sign in as expected um and once we hit our breakpoint 1330.03s - 1336.83s | we will swap out the device ID in memory uh and then once it says finished here 1336.83s - 1354.68s | uh it will resume execution and we're online. So the thing is 1355.32s - 1363.66s | so yeah we can we can do everything in the app we can we can pan and tilt um 1364.86s - 1369.26s | yeah I mean that like I said it's a it is a bit more limited feature set compared to 1369.82s - 1377.58s | the uh the mobile apps but basically right we've proven we can get access to uh an account that or 1377.58s - 1383.74s | a device that's not associated with our account. It's obviously a very very uh significant uh 1384.30s - 1392.94s | uh access control vulnerability um so yeah you know certainly that was a pretty big discovery 1392.94s - 1402.12s | um you know right off the bat. So you might have seen in the background that there was a you know 1402.12s - 1407.96s | certainly a lot of uh network traffic uh being generated in the background um it was all primarily 1407.96s - 1416.04s | UDP um but we hadn't really no idea what it is in particular um now doing research before we 1416.04s - 1423.32s | submitted Defcon we did come across uh a particular IoT peer-to-peer protocol uh called PPPP 1423.88s - 1431.96s | um that was um pretty significantly researched and detailed by Polymer PC he has a website 1431.96s - 1439.88s | um he presented a Defcon 28 in 2020 um fully tearing down the protocol and all that so uh 1439.88s - 1445.16s | ideally this was going to be something that uh you know maybe that was going to be in use here too 1445.16s - 1452.52s | so we kind of set out to explore that uh by just looking for references to P2P and and PPPP uh and 1452.52s - 1459.32s | yeah sure enough within the Wansview cloud


chunk_text:
that was a pretty big discovery 1392.94s - 1402.12s | um you know right off the bat. So you might have seen in the background that there was a you know 1402.12s - 1407.96s | certainly a lot of uh network traffic uh being generated in the background um it was all primarily 1407.96s - 1416.04s | UDP um but we hadn't really no idea what it is in particular um now doing research before we 1416.04s - 1423.32s | submitted Defcon we did come across uh a particular IoT peer-to-peer protocol uh called PPPP 1423.88s - 1431.96s | um that was um pretty significantly researched and detailed by Polymer PC he has a website 1431.96s - 1439.88s | um he presented a Defcon 28 in 2020 um fully tearing down the protocol and all that so uh 1439.88s - 1445.16s | ideally this was going to be something that uh you know maybe that was going to be in use here too 1445.16s - 1452.52s | so we kind of set out to explore that uh by just looking for references to P2P and and PPPP uh and 1452.52s - 1459.32s | yeah sure enough within the Wansview cloud uh binary itself as well as the uh the DLLs we sound 1459.32s - 1465.08s | we found you know numerous references uh even references to their specific PDBs which reference 1465.08s - 1472.20s | both uh you know you know multiple peer-to-peer terms so yeah we're um pretty sure that we're 1472.20s - 1479.16s | dealing with the same protocol and going from there then uh there is a excellent uh disector 1479.16s - 1484.36s | for this peer-to-peer protocol that is uh available and posted on GitHub as of last year 1484.36s - 1488.76s | um you know we load it in and all of a sudden that UDP traffic we have no idea what it is 1488.76s - 1494.44s | turns into a very recognizable uh messaging sequence uh that's associated with peer-to-peer 1494.76s - 1502.76s | uh so in very very briefly the peer-to-peer protocol is used by a ton of IoT devices across 1502.76s - 1508.04s | hundreds of vendors it's been in use for uh you know the better part of the last decade if not 1508.04s - 1514.52s | longer um it uses UDP hole punching in order to circumvent uh restrictive network


chunk_text:
uh binary itself as well as the uh the DLLs we sound 1459.32s - 1465.08s | we found you know numerous references uh even references to their specific PDBs which reference 1465.08s - 1472.20s | both uh you know you know multiple peer-to-peer terms so yeah we're um pretty sure that we're 1472.20s - 1479.16s | dealing with the same protocol and going from there then uh there is a excellent uh disector 1479.16s - 1484.36s | for this peer-to-peer protocol that is uh available and posted on GitHub as of last year 1484.36s - 1488.76s | um you know we load it in and all of a sudden that UDP traffic we have no idea what it is 1488.76s - 1494.44s | turns into a very recognizable uh messaging sequence uh that's associated with peer-to-peer 1494.76s - 1502.76s | uh so in very very briefly the peer-to-peer protocol is used by a ton of IoT devices across 1502.76s - 1508.04s | hundreds of vendors it's been in use for uh you know the better part of the last decade if not 1508.04s - 1514.52s | longer um it uses UDP hole punching in order to circumvent uh restrictive network configurations 1514.52s - 1519.96s | uh and it allows you uh you know these apps to connect to the cameras from anywhere in the world 1519.96s - 1523.48s | right they would they want it to be as accessible as possible right that's all point of these 1523.48s - 1528.76s | devices um and yeah sometimes the connections are either they're either direct to the camera 1528.76s - 1533.24s | depending on the configuration or they go through a relay uh if they have to if they have to um 1534.12s - 1543.61s | you know get around certain restrictions uh all right nothing to do so now we have established 1543.61s - 1549.85s | some initial access right so we also have as we looked at a little bit before the firmware which 1549.85s - 1555.85s | we can now go into some of some of that static reverse engineering we have packet capture for 1555.93s - 1561.77s | the camera and the app network communications we have log files from both the windows and the 1561.77s - 1568.33s | camera logs the logs as when we logged in before under root we of course have access to all


chunk_text:
configurations 1514.52s - 1519.96s | uh and it allows you uh you know these apps to connect to the cameras from anywhere in the world 1519.96s - 1523.48s | right they would they want it to be as accessible as possible right that's all point of these 1523.48s - 1528.76s | devices um and yeah sometimes the connections are either they're either direct to the camera 1528.76s - 1533.24s | depending on the configuration or they go through a relay uh if they have to if they have to um 1534.12s - 1543.61s | you know get around certain restrictions uh all right nothing to do so now we have established 1543.61s - 1549.85s | some initial access right so we also have as we looked at a little bit before the firmware which 1549.85s - 1555.85s | we can now go into some of some of that static reverse engineering we have packet capture for 1555.93s - 1561.77s | the camera and the app network communications we have log files from both the windows and the 1561.77s - 1568.33s | camera logs the logs as when we logged in before under root we of course have access to all of the 1568.33s - 1575.29s | the d message logs and things like that as well and then um we can get the camera logs from any 1575.29s - 1581.61s | of its hardware mechanisms as well for the audio and camera hand tilt zoom etc so now we want to 1581.61s - 1587.29s | kind of establish some more advanced access for looking for some additional exploits so one or 1587.29s - 1592.41s | first we're going to look for that live log output for some immediate feedback to determine some of 1592.41s - 1598.25s | the control flow again from the windows app right we were able to see that some of the they are 1598.25s - 1603.37s | logging the post request and responses so we're hopeful that they're going to do something similar 1603.37s - 1608.33s | on the camera but we also want to establish a we want to have a debugger running on that camera 1608.41s - 1614.97s | so we can look at some of these applications and see what we can do so first for live log output 1614.97s - 1620.81s | it's very very simple very easy you plug the uh


chunk_text:
of the 1568.33s - 1575.29s | the d message logs and things like that as well and then um we can get the camera logs from any 1575.29s - 1581.61s | of its hardware mechanisms as well for the audio and camera hand tilt zoom etc so now we want to 1581.61s - 1587.29s | kind of establish some more advanced access for looking for some additional exploits so one or 1587.29s - 1592.41s | first we're going to look for that live log output for some immediate feedback to determine some of 1592.41s - 1598.25s | the control flow again from the windows app right we were able to see that some of the they are 1598.25s - 1603.37s | logging the post request and responses so we're hopeful that they're going to do something similar 1603.37s - 1608.33s | on the camera but we also want to establish a we want to have a debugger running on that camera 1608.41s - 1614.97s | so we can look at some of these applications and see what we can do so first for live log output 1614.97s - 1620.81s | it's very very simple very easy you plug the uh serum you just get your serial shell over you 1620.81s - 1625.45s | aren't plug it into say in this case a raspberry pi but again you could use whatever you like 1625.45s - 1629.93s | and it spits out the logs over serial by default so you don't even necessarily need to use the the 1629.93s - 1635.21s | root access or boot the single user mode to just get the logs but again that's just one way of 1635.21s - 1642.17s | doing it but one thing that we'll quickly run into is the kernel watchdog so if the watchdog 1642.17s - 1649.45s | is not written to it reboots the camera so this what we're seeing here is if you try to kill the 1649.45s - 1656.01s | init the primary app or in this case we'll get to it in a minute but if you start to kill off things 1656.01s - 1662.01s | in the camera to go look at them or pause things it will trigger the the kernel watchdog process 1662.01s - 1667.53s | which will then reboot the camera this isn't the only say security mechanism this is just the one 1667.53s


chunk_text:
serum you just get your serial shell over you 1620.81s - 1625.45s | aren't plug it into say in this case a raspberry pi but again you could use whatever you like 1625.45s - 1629.93s | and it spits out the logs over serial by default so you don't even necessarily need to use the the 1629.93s - 1635.21s | root access or boot the single user mode to just get the logs but again that's just one way of 1635.21s - 1642.17s | doing it but one thing that we'll quickly run into is the kernel watchdog so if the watchdog 1642.17s - 1649.45s | is not written to it reboots the camera so this what we're seeing here is if you try to kill the 1649.45s - 1656.01s | init the primary app or in this case we'll get to it in a minute but if you start to kill off things 1656.01s - 1662.01s | in the camera to go look at them or pause things it will trigger the the kernel watchdog process 1662.01s - 1667.53s | which will then reboot the camera this isn't the only say security mechanism this is just the one 1667.53s - 1672.25s | that the primary one that you would have to get around to be able to run a debugger to be able to 1672.25s - 1677.93s | look at the primary application that they're running on the camera which they call init app 1677.93s - 1684.25s | which is which handles all of the connection to the aj cloud providing all of the video streaming 1684.25s - 1691.77s | and the rest of the control the camera they wrap this init app in a daemon.sh script which is just 1691.77s - 1696.73s | a simple while loop that says hey keep kicking off the init app if I have to kick it off more 1696.73s - 1701.53s | the next number of times reboot it again acting sort of like again a catch-all in case something 1701.53s - 1708.33s | went really wrong but that init app is reporting into the watchdog and so this is that's so if you 1708.33s - 1712.97s | either kill the init app or again kill the daemon and then kill the init app that's where you're 1712.97s - 1717.21s | going to end up rebooting the device and so if you're


chunk_text:
- 1672.25s | that the primary one that you would have to get around to be able to run a debugger to be able to 1672.25s - 1677.93s | look at the primary application that they're running on the camera which they call init app 1677.93s - 1684.25s | which is which handles all of the connection to the aj cloud providing all of the video streaming 1684.25s - 1691.77s | and the rest of the control the camera they wrap this init app in a daemon.sh script which is just 1691.77s - 1696.73s | a simple while loop that says hey keep kicking off the init app if I have to kick it off more 1696.73s - 1701.53s | the next number of times reboot it again acting sort of like again a catch-all in case something 1701.53s - 1708.33s | went really wrong but that init app is reporting into the watchdog and so this is that's so if you 1708.33s - 1712.97s | either kill the init app or again kill the daemon and then kill the init app that's where you're 1712.97s - 1717.21s | going to end up rebooting the device and so if you're using single user mode to get root you're 1717.21s - 1722.65s | going to to lose that and I and some of the unless you have set up some level of persistence 1722.65s - 1728.57s | you're going to lose any of the the edits as well so of course next step is to defeat the watchdog 1728.57s - 1732.89s | so there are a couple of approaches here right that you could do so the first one um which you 1732.89s - 1738.81s | can actually get this example right off from the uh the kernel watchdog 8 api um information from 1738.81s - 1743.93s | the the linux kernel you could just simply write some c code to keep sending a live messages to 1743.93s - 1749.21s | the watchdog right and so since we have root access we could do something like that however 1749.21s - 1753.37s | this approach is not necessarily what we want to do and not what we wanted to do either 1753.37s - 1760.41s | because the the fundamental problem with this is that while you could keep sending the messages 1760.41s - 1765.53s | or you could even use like take


chunk_text:
using single user mode to get root you're 1717.21s - 1722.65s | going to to lose that and I and some of the unless you have set up some level of persistence 1722.65s - 1728.57s | you're going to lose any of the the edits as well so of course next step is to defeat the watchdog 1728.57s - 1732.89s | so there are a couple of approaches here right that you could do so the first one um which you 1732.89s - 1738.81s | can actually get this example right off from the uh the kernel watchdog 8 api um information from 1738.81s - 1743.93s | the the linux kernel you could just simply write some c code to keep sending a live messages to 1743.93s - 1749.21s | the watchdog right and so since we have root access we could do something like that however 1749.21s - 1753.37s | this approach is not necessarily what we want to do and not what we wanted to do either 1753.37s - 1760.41s | because the the fundamental problem with this is that while you could keep sending the messages 1760.41s - 1765.53s | or you could even use like take hold of the kernel semaphores and keep it open just for yourself so 1765.53s - 1772.81s | init app can't write to it that doesn't necessarily that help you because init app if it can't write 1772.81s - 1778.73s | to it then it's going to know that you're here and know that you're now disabling its ability 1778.73s - 1783.69s | to operate and then it may change the way that it's going to operate in this case we know say 1783.69s - 1787.93s | that it that it does but again that's not necessarily the approach you want to use even 1787.93s - 1792.17s | though it might work for your environment so there's another way um there's there's other 1792.17s - 1795.05s | ways other than these two but these are just the ones we're going to talk through today 1795.05s - 1801.13s | um there's the magic close feature which if you go look in the linux kernel driver uh what the 1801.13s - 1807.61s | watchdog driver api from linux kernel 2.4.18 you can see that there if you write a magic 1807.61s - 1811.77s | character in this case an uppercase v there's another


chunk_text:
hold of the kernel semaphores and keep it open just for yourself so 1765.53s - 1772.81s | init app can't write to it that doesn't necessarily that help you because init app if it can't write 1772.81s - 1778.73s | to it then it's going to know that you're here and know that you're now disabling its ability 1778.73s - 1783.69s | to operate and then it may change the way that it's going to operate in this case we know say 1783.69s - 1787.93s | that it that it does but again that's not necessarily the approach you want to use even 1787.93s - 1792.17s | though it might work for your environment so there's another way um there's there's other 1792.17s - 1795.05s | ways other than these two but these are just the ones we're going to talk through today 1795.05s - 1801.13s | um there's the magic close feature which if you go look in the linux kernel driver uh what the 1801.13s - 1807.61s | watchdog driver api from linux kernel 2.4.18 you can see that there if you write a magic 1807.61s - 1811.77s | character in this case an uppercase v there's another character that'll work as well but if 1811.77s - 1817.93s | you write that to dev watchdog and that's the last thing that gets written to dev watchdog 1817.93s - 1824.17s | it then can cleanly disable the watchdog uh the kernel watchdog now as a note the camera is not 1824.17s - 1830.73s | running linux kernel 2.4.18 but it does still work um so your mileage may vary it's running a 1830.73s - 1836.09s | three dot kernel but um again it still still may work so you could write a simple script such as 1836.09s - 1841.85s | this or again however you would like to do it to just simply continuously write v and the reason 1841.85s - 1846.81s | why you may want to do something like this instead of just write v and stop is something some other 1846.81s - 1851.53s | process especially as you're doing your reverse engineering might come along and reactivate the 1851.53s - 1857.21s | watchdog so if you want to try and keep making it such that that you're not going to be rebooted or 1857.21s - 1862.57s | at least as have some protection against that you


chunk_text:
character that'll work as well but if 1811.77s - 1817.93s | you write that to dev watchdog and that's the last thing that gets written to dev watchdog 1817.93s - 1824.17s | it then can cleanly disable the watchdog uh the kernel watchdog now as a note the camera is not 1824.17s - 1830.73s | running linux kernel 2.4.18 but it does still work um so your mileage may vary it's running a 1830.73s - 1836.09s | three dot kernel but um again it still still may work so you could write a simple script such as 1836.09s - 1841.85s | this or again however you would like to do it to just simply continuously write v and the reason 1841.85s - 1846.81s | why you may want to do something like this instead of just write v and stop is something some other 1846.81s - 1851.53s | process especially as you're doing your reverse engineering might come along and reactivate the 1851.53s - 1857.21s | watchdog so if you want to try and keep making it such that that you're not going to be rebooted or 1857.21s - 1862.57s | at least as have some protection against that you you might want to continuously write to it 1862.57s - 1868.01s | so now with the watchdog generally defeated we need to be able to run a debugger on the camera 1868.01s - 1873.45s | which means we need to be able to compile binaries that can run on the camera um so in this case we 1873.45s - 1881.61s | discovered that our our camera is a little indian mint um so just as a quick um example we can 1881.61s - 1888.65s | compile arbitrary c code using just out of the box um like the mips linux gcc compilers we can 1888.65s - 1895.77s | run a quick hello mips and see so i did not know this at the time when i was doing it i built a 1895.77s - 1902.41s | tool chain and compiled uh compiled gdb server myself using that tool chain but later on we 1902.41s - 1906.49s | found that there is a pre-built one that works that that's the link to be able to get to it again 1906.49s - 1911.37s | again that will be available but what you'll need to do to be able to run gdb server


chunk_text:
you might want to continuously write to it 1862.57s - 1868.01s | so now with the watchdog generally defeated we need to be able to run a debugger on the camera 1868.01s - 1873.45s | which means we need to be able to compile binaries that can run on the camera um so in this case we 1873.45s - 1881.61s | discovered that our our camera is a little indian mint um so just as a quick um example we can 1881.61s - 1888.65s | compile arbitrary c code using just out of the box um like the mips linux gcc compilers we can 1888.65s - 1895.77s | run a quick hello mips and see so i did not know this at the time when i was doing it i built a 1895.77s - 1902.41s | tool chain and compiled uh compiled gdb server myself using that tool chain but later on we 1902.41s - 1906.49s | found that there is a pre-built one that works that that's the link to be able to get to it again 1906.49s - 1911.37s | again that will be available but what you'll need to do to be able to run gdb server you'll need to 1911.37s - 1916.09s | make sure that you're exporting the proper paths to get the proper libraries that an app needs 1916.09s - 1920.97s | then expose it over some port it could be it works over serial i would recommend if you can use it 1920.97s - 1924.97s | doing it over networking just because the serial debugging can be very slow when you're using this 1924.97s - 1934.57s | many libraries um again just an example of how to do that um so we can then connect to our um use 1934.57s - 1939.61s | and this is actually one important note when you're using gdb to connect to gdb server you will 1939.61s - 1945.69s | likely you very likely need to use the multi-architecture version otherwise it will not 1945.69s - 1950.81s | work unless you happen to be running um little indian mips on your laptop which at least for me 1950.81s - 1959.21s | i i'm not um but once you get there again we know that an in-app is calling out to the watchdog so 1959.21s - 1964.89s | we need to overwrite those functions in memory with no ops


chunk_text:
you'll need to 1911.37s - 1916.09s | make sure that you're exporting the proper paths to get the proper libraries that an app needs 1916.09s - 1920.97s | then expose it over some port it could be it works over serial i would recommend if you can use it 1920.97s - 1924.97s | doing it over networking just because the serial debugging can be very slow when you're using this 1924.97s - 1934.57s | many libraries um again just an example of how to do that um so we can then connect to our um use 1934.57s - 1939.61s | and this is actually one important note when you're using gdb to connect to gdb server you will 1939.61s - 1945.69s | likely you very likely need to use the multi-architecture version otherwise it will not 1945.69s - 1950.81s | work unless you happen to be running um little indian mips on your laptop which at least for me 1950.81s - 1959.21s | i i'm not um but once you get there again we know that an in-app is calling out to the watchdog so 1959.21s - 1964.89s | we need to overwrite those functions in memory with no ops to be able to have it not call to 1964.89s - 1970.81s | the watchdog at all is this absolutely necessary maybe not but it will make it a lot cleaner for 1970.81s - 1974.65s | us if we just don't have to worry about it so that's that's what we did and you can at least 1974.65s - 1978.89s | in our case we were able to find that that that those locations were where those functions were 1978.89s - 1986.65s | and uh we just overwrote them sure so i'll hand it over to mark all right uh so yeah we're gonna 1986.65s - 1992.33s | skip over the the this second demo on just kind of jump right into it so uh with the peer-to-peer 1992.33s - 1997.13s | discovery what we wanted to do is build a client so we could actually connect directly to our 1997.13s - 2003.85s | camera uh and uh issue commands to it in order to attack and exploit it right uh so the peer-to-peer 2003.85s - 2010.33s | servers you can discover them uh using nmap or mass scan uh and delivering that 4-byte payload 2010.33s - 2018.49s | uh


chunk_text:
to be able to have it not call to 1964.89s - 1970.81s | the watchdog at all is this absolutely necessary maybe not but it will make it a lot cleaner for 1970.81s - 1974.65s | us if we just don't have to worry about it so that's that's what we did and you can at least 1974.65s - 1978.89s | in our case we were able to find that that that those locations were where those functions were 1978.89s - 1986.65s | and uh we just overwrote them sure so i'll hand it over to mark all right uh so yeah we're gonna 1986.65s - 1992.33s | skip over the the this second demo on just kind of jump right into it so uh with the peer-to-peer 1992.33s - 1997.13s | discovery what we wanted to do is build a client so we could actually connect directly to our 1997.13s - 2003.85s | camera uh and uh issue commands to it in order to attack and exploit it right uh so the peer-to-peer 2003.85s - 2010.33s | servers you can discover them uh using nmap or mass scan uh and delivering that 4-byte payload 2010.33s - 2018.49s | uh to udp port 607222 um and yeah so very briefly how to establish a peer-to-peer connection 2018.49s - 2025.37s | uh you need to send it a hello message from the client uh it'll it'll act back uh you need to 2025.37s - 2032.17s | query for a specific device id if this peer-to-peer server has any idea of it uh those are device 2032.17s - 2036.01s | ids are also serial numbers they're found on the bottom or on the back of these devices 2036.65s - 2041.37s | um and hopefully the peer-to-peer server will say that it knows how to access the device 2041.45s - 2049.05s | uh and then instruct you to punch a hole to a specific ip and port um and then once we have 2049.05s - 2054.97s | the idea of where we're supposed to go to uh we can query that specific relay server or the device 2054.97s - 2061.93s | itself uh you know if we can connect to it um it should hopefully say yes uh and then it'll send 2061.93s - 2066.73s | its packets back and then yeah your peer-to-peer connection is ready uh so yeah there's a good


chunk_text:
to udp port 607222 um and yeah so very briefly how to establish a peer-to-peer connection 2018.49s - 2025.37s | uh you need to send it a hello message from the client uh it'll it'll act back uh you need to 2025.37s - 2032.17s | query for a specific device id if this peer-to-peer server has any idea of it uh those are device 2032.17s - 2036.01s | ids are also serial numbers they're found on the bottom or on the back of these devices 2036.65s - 2041.37s | um and hopefully the peer-to-peer server will say that it knows how to access the device 2041.45s - 2049.05s | uh and then instruct you to punch a hole to a specific ip and port um and then once we have 2049.05s - 2054.97s | the idea of where we're supposed to go to uh we can query that specific relay server or the device 2054.97s - 2061.93s | itself uh you know if we can connect to it um it should hopefully say yes uh and then it'll send 2061.93s - 2066.73s | its packets back and then yeah your peer-to-peer connection is ready uh so yeah there's a good 2066.73s - 2070.09s | exploit script that we kind of base some of our work on uh definitely check that out when you 2070.09s - 2075.53s | get a chance um but yeah basically uh in order to prove things out uh we we looked at how the 2075.53s - 2081.21s | camera panned initially over wireshark uh it was very easy to tell which specific uh packet 2081.21s - 2087.45s | belonged to a pan operation uh then we trace that back to uh debug debug log messages from the 2087.45s - 2093.93s | firmware uh and then actually dug into the firmware itself specifically to find where uh 2093.93s - 2099.53s | where that log uh message is being generated and what function is primarily handling um 2100.25s - 2107.77s | a lot of the comms and all that so uh very brief uh demo and we're gonna just kind of jump ahead to 2107.77s - 2117.21s | our more compelling demo of essentially what you can do um with our discovery of how to build a 2117.21s - 2125.53s | peer-to-peer client so um what we can see here is there is a uh there's an ini


chunk_text:
2066.73s - 2070.09s | exploit script that we kind of base some of our work on uh definitely check that out when you 2070.09s - 2075.53s | get a chance um but yeah basically uh in order to prove things out uh we we looked at how the 2075.53s - 2081.21s | camera panned initially over wireshark uh it was very easy to tell which specific uh packet 2081.21s - 2087.45s | belonged to a pan operation uh then we trace that back to uh debug debug log messages from the 2087.45s - 2093.93s | firmware uh and then actually dug into the firmware itself specifically to find where uh 2093.93s - 2099.53s | where that log uh message is being generated and what function is primarily handling um 2100.25s - 2107.77s | a lot of the comms and all that so uh very brief uh demo and we're gonna just kind of jump ahead to 2107.77s - 2117.21s | our more compelling demo of essentially what you can do um with our discovery of how to build a 2117.21s - 2125.53s | peer-to-peer client so um what we can see here is there is a uh there's an ini file on the camera 2125.53s - 2132.25s | itself that has the serial number and what we find out is that that's that is the only way that 2132.25s - 2140.65s | the device knows what its own device id is and so there is actually a command through peer-to-peer 2140.65s - 2147.45s | that allows us to overwrite the contents of that ini file so what we're trying to do is overwrite 2147.45s - 2154.01s | uh the the serial number itself to an arbitrary value that's just going to completely brick this 2154.01s - 2159.05s | machine and make it completely inaccessible to the internet and essentially the user is gonna 2159.05s - 2164.25s | have to throw it away because there's no way to restore that unless you have access like we do 2164.89s - 2171.29s | uh and so we send our packets uh and what we can see here is we pulled up the same ini file 2171.29s - 2178.09s | and now it's full of garbage and we actually have another command we're gonna send to it that's 2178.09s - 2185.13s | gonna crash and reboot the cam uh and from there uh what


chunk_text:
file on the camera 2125.53s - 2132.25s | itself that has the serial number and what we find out is that that's that is the only way that 2132.25s - 2140.65s | the device knows what its own device id is and so there is actually a command through peer-to-peer 2140.65s - 2147.45s | that allows us to overwrite the contents of that ini file so what we're trying to do is overwrite 2147.45s - 2154.01s | uh the the serial number itself to an arbitrary value that's just going to completely brick this 2154.01s - 2159.05s | machine and make it completely inaccessible to the internet and essentially the user is gonna 2159.05s - 2164.25s | have to throw it away because there's no way to restore that unless you have access like we do 2164.89s - 2171.29s | uh and so we send our packets uh and what we can see here is we pulled up the same ini file 2171.29s - 2178.09s | and now it's full of garbage and we actually have another command we're gonna send to it that's 2178.09s - 2185.13s | gonna crash and reboot the cam uh and from there uh what we can see is you know things are kind of 2185.13s - 2191.21s | already going haywire a little bit uh the camera is attempting to reboot right now but what we'll 2191.21s - 2198.81s | find out pretty shortly here is that it has uh it will attempt to issue requests to AJ Cloud's 2198.81s - 2203.45s | infrastructure but ultimately it's going to be unsuccessful because it's sending along 2204.25s - 2213.07s | absolute garbage uh in its curl requests and if we kind of like skip ahead a little bit here 2213.07s - 2223.68s | this is a press for time um what we can see here yeah if you if you kind of highlight that 2223.68s - 2231.44s | there's not much there ah yes so yeah yeah that doesn't really look like a good curl request 2231.52s - 2248.44s | yes okay so very very briefly um what devices are actually affected by this right uh so Wansview 2249.24s - 2254.60s | every single device associated with Wansview is affected including pet feeders, light bulbs, 2254.60s - 2259.88s | indoor and outdoor cameras, uh Galayu as well since they're uh you know an affiliate company


chunk_text:
we can see is you know things are kind of 2185.13s - 2191.21s | already going haywire a little bit uh the camera is attempting to reboot right now but what we'll 2191.21s - 2198.81s | find out pretty shortly here is that it has uh it will attempt to issue requests to AJ Cloud's 2198.81s - 2203.45s | infrastructure but ultimately it's going to be unsuccessful because it's sending along 2204.25s - 2213.07s | absolute garbage uh in its curl requests and if we kind of like skip ahead a little bit here 2213.07s - 2223.68s | this is a press for time um what we can see here yeah if you if you kind of highlight that 2223.68s - 2231.44s | there's not much there ah yes so yeah yeah that doesn't really look like a good curl request 2231.52s - 2248.44s | yes okay so very very briefly um what devices are actually affected by this right uh so Wansview 2249.24s - 2254.60s | every single device associated with Wansview is affected including pet feeders, light bulbs, 2254.60s - 2259.88s | indoor and outdoor cameras, uh Galayu as well since they're uh you know an affiliate company 2259.88s - 2267.72s | of Wansview uh and Sonato as well um and then also Felimi is another uh manufacturer that that we 2268.04s - 2274.52s | were able to experiment with um but ultimately the affected vendors uh it all stems from AJ 2274.52s - 2281.00s | Cloud it's whoever's running their device firmware on their cloud platform and this 2281.00s - 2286.28s | ultimately affects seven different vendors possibly even more we weren't able to confirm all of these 2288.70s - 2293.26s | so just real quick what are some things that the vendors did right they have certificate web-based 2293.26s - 2297.02s | authentication it was fairly difficult to do some man-in-the-middle attacks from that 2297.02s - 2301.90s | they have signed and obfuscated APKs another good thing they have a pared down local operating 2301.90s - 2307.10s | system that at least attempts to be read-only they could have had secure boot but again they have a 2307.10s - 2312.86s | read-only ish file system so you have to do some work even with physical access to be able to go 2312.86s - 2317.34s | and attack the machine what they did wrong of course unauthenticated


chunk_text:
2259.88s - 2267.72s | of Wansview uh and Sonato as well um and then also Felimi is another uh manufacturer that that we 2268.04s - 2274.52s | were able to experiment with um but ultimately the affected vendors uh it all stems from AJ 2274.52s - 2281.00s | Cloud it's whoever's running their device firmware on their cloud platform and this 2281.00s - 2286.28s | ultimately affects seven different vendors possibly even more we weren't able to confirm all of these 2288.70s - 2293.26s | so just real quick what are some things that the vendors did right they have certificate web-based 2293.26s - 2297.02s | authentication it was fairly difficult to do some man-in-the-middle attacks from that 2297.02s - 2301.90s | they have signed and obfuscated APKs another good thing they have a pared down local operating 2301.90s - 2307.10s | system that at least attempts to be read-only they could have had secure boot but again they have a 2307.10s - 2312.86s | read-only ish file system so you have to do some work even with physical access to be able to go 2312.86s - 2317.34s | and attack the machine what they did wrong of course unauthenticated cloud access are the 2317.34s - 2322.86s | demos that we showed you again did not require any authentication we have significant verbose 2322.86s - 2327.90s | debugging in the log app the vulnerable peer-to-peer access and again no secure boot despite 2327.90s - 2333.98s | the SOC supporting it and it's very easy to manipulate when you have physical access so 2333.98s - 2338.22s | mitigations of course if you want to use them segment them off your network the critical 2338.22s - 2342.30s | vulnerabilities in the cloud infrastructure will put your data at risk so we would just recommend 2342.30s - 2349.26s | not using them at all um again restrict the inbound outbound comms um you basically just 2349.26s - 2354.06s | want to block all of the the different traffic that you have you could also flash it with a 2354.06s - 2359.10s | different operating system for sake of time i'm going to kind of run through this really fast 2359.10s - 2364.78s | open ipc i would recommend you checking it out the at least the q5 is directly uh supported so 2364.78s - 2370.94s | you could flash it with that but


chunk_text:
cloud access are the 2317.34s - 2322.86s | demos that we showed you again did not require any authentication we have significant verbose 2322.86s - 2327.90s | debugging in the log app the vulnerable peer-to-peer access and again no secure boot despite 2327.90s - 2333.98s | the SOC supporting it and it's very easy to manipulate when you have physical access so 2333.98s - 2338.22s | mitigations of course if you want to use them segment them off your network the critical 2338.22s - 2342.30s | vulnerabilities in the cloud infrastructure will put your data at risk so we would just recommend 2342.30s - 2349.26s | not using them at all um again restrict the inbound outbound comms um you basically just 2349.26s - 2354.06s | want to block all of the the different traffic that you have you could also flash it with a 2354.06s - 2359.10s | different operating system for sake of time i'm going to kind of run through this really fast 2359.10s - 2364.78s | open ipc i would recommend you checking it out the at least the q5 is directly uh supported so 2364.78s - 2370.94s | you could flash it with that but it's surprise uh supports a lot of different socs so um we have our 2370.94s - 2377.10s | tools that we used for this demo we'll be releasing them shortly on github um so and feel free to 2377.10s - 2382.22s | follow along with the demo um there's some other future research opportunities again apologies 2382.22s - 2387.10s | for having to run through this real quick but thank you so much for for coming to our talk 2387.10s - 2393.18s | um special thanks to of course the following here and feel and definitely follow us um on 2393.18s - 2401.02s | twitter and elastic security labs so again thank you very much defcon


chunk_text:
it's surprise uh supports a lot of different socs so um we have our 2370.94s - 2377.10s | tools that we used for this demo we'll be releasing them shortly on github um so and feel free to 2377.10s - 2382.22s | follow along with the demo um there's some other future research opportunities again apologies 2382.22s - 2387.10s | for having to run through this real quick but thank you so much for for coming to our talk 2387.10s - 2393.18s | um special thanks to of course the following here and feel and definitely follow us um on 2393.18s - 2401.02s | twitter and elastic security labs so again thank you very much defcon


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=TK3A510jArc", "title": "DEF CON 32 - Using AI Computer Vision in Your OSINT Data Analysis - Mike Raggo", "description": "OSINT is a great mechanism for the collection of data, but what do you do with all of it once it\u2019s collected? It can take significant time with the human eye to analyze each image or video. Furthermore, you may miss important artifacts in the foreground or background. Computer vision can churn through the plethora of data to pull out the relevant evidence at lightning speed. For the last 5 years we\u2019ve been exploring the use of Azure and AWS for computer vision to rapidly process large sets of image and video data acquisitions for forensic evidence.Through the use of AI we have analyzed thousands of images and videos to perform object detection, facial recognition, OCR, voice to text analysis, and more. In this session we\u2019ll explore the use of cloud platforms to exponentially increase your analysis of uncovering key artifacts to your case using demos and real world examples. We then apply chronolocation analysis to allow an investigator to paint a true-life narrative, for example an individual with a weapon at a location at a particular time. We\u2019ll provide live demos of common scenarios to reveal benefits to processing your data collections in a rapid, efficient, comprehensive, and accurate manner. We\u2019ll then wrap-up the presentation with additional AI computer vision recommendations and resources.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 3159, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 7.18s | This text was transcribed using whisper model: large-v2 Good morning, everyone. Good morning. Hopefully everyone got some sleep? Ducks. 12.22s - 17.34s | Before we begin, we got what? Two minutes? Oh, yeah, the clock. What am I doing? The clock is right here. 18.78s - 21.18s | Just who's here? This is your first DEF CON. 22.10s - 25.06s | Wow. Okay, so if this is your first DEF CON, 25.82s - 27.82s | welcome. 28.62s - 30.62s | You know, sitting in decks, 30.70s - 33.50s | we haven't had a nice room like this for, you know, a 34.14s - 40.06s | while, but 2019 was the last year and every time I look at a room of this size, it feels like 40.94s - 47.50s | DEF CON of the ye good old days when talks weren't like 20, like 2,000 people and literally like 48.14s


chunk_text:
provide live demos of common scenarios to reveal benefits to processing your data collections in a rapid, efficient, comprehensive, and accurate manner. We\u2019ll then wrap-up the presentation with additional AI computer vision recommendations and resources.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 3159, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 7.18s | This text was transcribed using whisper model: large-v2 Good morning, everyone. Good morning. Hopefully everyone got some sleep? Ducks. 12.22s - 17.34s | Before we begin, we got what? Two minutes? Oh, yeah, the clock. What am I doing? The clock is right here. 18.78s - 21.18s | Just who's here? This is your first DEF CON. 22.10s - 25.06s | Wow. Okay, so if this is your first DEF CON, 25.82s - 27.82s | welcome. 28.62s - 30.62s | You know, sitting in decks, 30.70s - 33.50s | we haven't had a nice room like this for, you know, a 34.14s - 40.06s | while, but 2019 was the last year and every time I look at a room of this size, it feels like 40.94s - 47.50s | DEF CON of the ye good old days when talks weren't like 20, like 2,000 people and literally like 48.14s - 53.84s | back in the ye good old days, like in the early 2000s, I mean, yeah, the talk room would be like this small and congregate. 56.06s - 58.06s | You know, one of the things I tell people is 58.86s - 60.70s | yeah, there's like 60.70s - 65.18s | 30, 40,000 people now at DEF CON, but the premise is the same 66.38s - 72.94s | for anyone who, especially if this is your first time coming to the conference, learn as much as you can. 75.58s - 78.78s | Make good use of your time. Talk to other people. 79.98s - 81.98s | That's where the real learning happens. 82.70s - 85.98s | Hallway Con is always, always valuable. You'll learn 86.62s - 88.62s | probably more than 89.02s - 94.70s | talking to the person next to you or sitting at the table than going to a lot of talks. 94.86s - 100.22s | Oh, sorry, man. I didn't want to, I didn't, I didn't want to, I mean to say, I forgot. Oh, 101.02s - 102.86s | but 102.86s - 105.74s | no, the, you know, it is the size of the 107.90s


chunk_text:
- 53.84s | back in the ye good old days, like in the early 2000s, I mean, yeah, the talk room would be like this small and congregate. 56.06s - 58.06s | You know, one of the things I tell people is 58.86s - 60.70s | yeah, there's like 60.70s - 65.18s | 30, 40,000 people now at DEF CON, but the premise is the same 66.38s - 72.94s | for anyone who, especially if this is your first time coming to the conference, learn as much as you can. 75.58s - 78.78s | Make good use of your time. Talk to other people. 79.98s - 81.98s | That's where the real learning happens. 82.70s - 85.98s | Hallway Con is always, always valuable. You'll learn 86.62s - 88.62s | probably more than 89.02s - 94.70s | talking to the person next to you or sitting at the table than going to a lot of talks. 94.86s - 100.22s | Oh, sorry, man. I didn't want to, I didn't, I didn't want to, I mean to say, I forgot. Oh, 101.02s - 102.86s | but 102.86s - 105.74s | no, the, you know, it is the size of the 107.90s - 110.06s | talk rooms makes a big deal. 110.54s - 117.42s | You know, it feels, this definitely feels like a more intimate setting than what it, you know, than what it is now. 117.50s - 120.38s | I mean, I think my last DEF CON talk was like, holy, 121.10s - 127.18s | you know, there's like, I didn't know what was, it was like eight, it went to 800 people and then it went to like 127.88s - 129.88s | 1,500 and like, 130.22s - 137.42s | never had the honor of talking to a group of this size. So enjoy your time here at DEF CON. 137.98s - 139.50s | And 139.50s - 141.10s | we are now 141.10s - 145.10s | at the top of the hour. Good morning. It's 10 o'clock 146.38s - 148.48s | from beautiful Las Vegas, Nevada. 151.50s - 154.30s | So our first of four talks of the day 157.00s - 159.18s | presented by that Packet Hacking Village. 159.98s - 161.42s | And 161.42s - 162.22s | we 162.22s - 167.66s | have the honor and it seems like this is like an annual, an annual get-together and 168.46s


chunk_text:
- 110.06s | talk rooms makes a big deal. 110.54s - 117.42s | You know, it feels, this definitely feels like a more intimate setting than what it, you know, than what it is now. 117.50s - 120.38s | I mean, I think my last DEF CON talk was like, holy, 121.10s - 127.18s | you know, there's like, I didn't know what was, it was like eight, it went to 800 people and then it went to like 127.88s - 129.88s | 1,500 and like, 130.22s - 137.42s | never had the honor of talking to a group of this size. So enjoy your time here at DEF CON. 137.98s - 139.50s | And 139.50s - 141.10s | we are now 141.10s - 145.10s | at the top of the hour. Good morning. It's 10 o'clock 146.38s - 148.48s | from beautiful Las Vegas, Nevada. 151.50s - 154.30s | So our first of four talks of the day 157.00s - 159.18s | presented by that Packet Hacking Village. 159.98s - 161.42s | And 161.42s - 162.22s | we 162.22s - 167.66s | have the honor and it seems like this is like an annual, an annual get-together and 168.46s - 174.86s | having Mike on stage to give a talk never ever disappoints and you're going to learn a lot. You're going to love this talk. 176.86s - 183.18s | It is my pleasure to introduce to you all someone that we consider a friend. Mike Rago, everyone. 192.22s - 197.82s | All right. Well, thanks so much for having me again. Shouts out to the Packet Hacking Village and Ming for 198.46s - 200.46s | having me back again. Really enjoy 201.02s - 208.14s | doing these particular talks at DEF CON. I've been coming here for I don't know how many years, I think since year 2000 and 209.34s - 214.22s | try to never miss a con because there's just so much information and it's a great crowd and lots of friends. 216.22s - 217.82s | In this particular 217.82s - 221.90s | talk, we're going to talk about using AI for doing computer vision 222.86s - 228.00s | to leverage all your data sets you may have across your OSINT data collections and performing 228.48s - 230.48s | efficient analysis around that. 230.80s - 236.32s | This is a culmination of a lot of research


chunk_text:
- 174.86s | having Mike on stage to give a talk never ever disappoints and you're going to learn a lot. You're going to love this talk. 176.86s - 183.18s | It is my pleasure to introduce to you all someone that we consider a friend. Mike Rago, everyone. 192.22s - 197.82s | All right. Well, thanks so much for having me again. Shouts out to the Packet Hacking Village and Ming for 198.46s - 200.46s | having me back again. Really enjoy 201.02s - 208.14s | doing these particular talks at DEF CON. I've been coming here for I don't know how many years, I think since year 2000 and 209.34s - 214.22s | try to never miss a con because there's just so much information and it's a great crowd and lots of friends. 216.22s - 217.82s | In this particular 217.82s - 221.90s | talk, we're going to talk about using AI for doing computer vision 222.86s - 228.00s | to leverage all your data sets you may have across your OSINT data collections and performing 228.48s - 230.48s | efficient analysis around that. 230.80s - 236.32s | This is a culmination of a lot of research that myself and a very good friend of mine, Chet Hosmer, 236.80s - 243.68s | have collaborated on for many years and actually have done talks in the past here in the Packet Hacking Village on 244.56s - 249.28s | OSINT data collection, data analysis, reporting, pruning down that data, 249.68s - 255.20s | really making it very actionable rather than really dealing with that wasteland of data and trying to prune that down. 255.20s - 256.88s | So we'll talk a lot about 256.88s - 262.32s | some of the previous strategies and just kind of highlight those for you again and then focus on really what we're going to talk about 262.40s - 268.72s | today, which is looking at those images and video and trying to do a variety of cool and interesting things in them, 269.04s - 274.24s | but in a very automated and efficient manner and with, in my opinion, a lot better accuracy. 274.24s - 276.24s | But you know, I'll let you guys judge that for yourselves. 280.66s - 283.78s | So Ming knows I don't really like to talk about myself too much. 283.78s - 289.54s | So instead I'll tell


chunk_text:
that myself and a very good friend of mine, Chet Hosmer, 236.80s - 243.68s | have collaborated on for many years and actually have done talks in the past here in the Packet Hacking Village on 244.56s - 249.28s | OSINT data collection, data analysis, reporting, pruning down that data, 249.68s - 255.20s | really making it very actionable rather than really dealing with that wasteland of data and trying to prune that down. 255.20s - 256.88s | So we'll talk a lot about 256.88s - 262.32s | some of the previous strategies and just kind of highlight those for you again and then focus on really what we're going to talk about 262.40s - 268.72s | today, which is looking at those images and video and trying to do a variety of cool and interesting things in them, 269.04s - 274.24s | but in a very automated and efficient manner and with, in my opinion, a lot better accuracy. 274.24s - 276.24s | But you know, I'll let you guys judge that for yourselves. 280.66s - 283.78s | So Ming knows I don't really like to talk about myself too much. 283.78s - 289.54s | So instead I'll tell you a funny story about how I got into cybersecurity and Ming has heard this story before. 290.50s - 291.46s | So 291.46s - 292.88s | it's circa 292.88s - 297.72s | 1994. I'm working at the NASDAQ stock market as a Unix system administrator 298.18s - 302.90s | and it was long before there were vulnerability scanners out there like Nessus and other things. So 304.18s - 310.58s | I saw this article on Information Week by a gentleman by the name of Dan Farmer who presented the first couple DEF CONs 311.22s - 317.30s | and he released a tool called, of all names, called SATAN, which was an acronym for one of the first vulnerability scanners 317.30s - 319.80s | and in this case for old Unix platforms. 320.34s - 324.74s | So I thought, hey, it was always one of those types of people, probably much like yourselves. 324.98s - 330.02s | I'm going to download it and run it wide open on the trading floor in the middle of the day and see what kind 330.02s - 332.02s | of vulnerabilities I can find. 332.18s - 338.98s | So obviously not a very bright idea


chunk_text:
you a funny story about how I got into cybersecurity and Ming has heard this story before. 290.50s - 291.46s | So 291.46s - 292.88s | it's circa 292.88s - 297.72s | 1994. I'm working at the NASDAQ stock market as a Unix system administrator 298.18s - 302.90s | and it was long before there were vulnerability scanners out there like Nessus and other things. So 304.18s - 310.58s | I saw this article on Information Week by a gentleman by the name of Dan Farmer who presented the first couple DEF CONs 311.22s - 317.30s | and he released a tool called, of all names, called SATAN, which was an acronym for one of the first vulnerability scanners 317.30s - 319.80s | and in this case for old Unix platforms. 320.34s - 324.74s | So I thought, hey, it was always one of those types of people, probably much like yourselves. 324.98s - 330.02s | I'm going to download it and run it wide open on the trading floor in the middle of the day and see what kind 330.02s - 332.02s | of vulnerabilities I can find. 332.18s - 338.98s | So obviously not a very bright idea because they accidentally knocked over a couple servers taking down the trading floor in the middle of the day. 339.86s - 345.06s | But it was a good test of the failover for NASDAQ, failed over without missing a beat. 346.02s - 350.82s | But I was called into the CISO's office and I fully expected to be fired. 351.30s - 356.10s | And he said, Mike, I'm here to offer you one of two options. You're either fired or you can take a promotion. 356.82s - 361.38s | So I certainly didn't want to be fired. So I took the promotion and and asked questions later. 361.38s - 367.06s | But essentially he said, listen, you clearly demonstrated you could take down the network, albeit by accident. 367.62s - 369.22s | But 369.22s - 371.38s | now it's going to be your job to protect it. 371.62s - 376.50s | So I had to build out first security team there and really start protecting the network. 377.46s - 380.90s | One other thing I'd just highlight on this slide, you know, 381.46s - 383.62s | Chet and I collaborate on a lot of research. 383.70s - 387.86s | If


chunk_text:
because they accidentally knocked over a couple servers taking down the trading floor in the middle of the day. 339.86s - 345.06s | But it was a good test of the failover for NASDAQ, failed over without missing a beat. 346.02s - 350.82s | But I was called into the CISO's office and I fully expected to be fired. 351.30s - 356.10s | And he said, Mike, I'm here to offer you one of two options. You're either fired or you can take a promotion. 356.82s - 361.38s | So I certainly didn't want to be fired. So I took the promotion and and asked questions later. 361.38s - 367.06s | But essentially he said, listen, you clearly demonstrated you could take down the network, albeit by accident. 367.62s - 369.22s | But 369.22s - 371.38s | now it's going to be your job to protect it. 371.62s - 376.50s | So I had to build out first security team there and really start protecting the network. 377.46s - 380.90s | One other thing I'd just highlight on this slide, you know, 381.46s - 383.62s | Chet and I collaborate on a lot of research. 383.70s - 387.86s | If you go back and look at the YouTube videos from the Packet Hacking Village in the Wall of Sheep, 388.10s - 392.42s | you'll see a plethora of talks that we've done and many of them around OSINT. 392.74s - 398.34s | So certain call outs I make out in these slides, if you're looking to go back in time and look at in detail at some 398.34s - 400.50s | of those other presentations we've done around OSINT, 401.06s - 404.26s | they are out there and on YouTube and Twitch and other places. 406.18s - 410.36s | One last thing, one of the things I've taken on recently is also mentoring 411.06s - 415.54s | folks that are looking to get into cybersecurity. They may be in IT today, 415.54s - 420.90s | they may have graduated college or something else. And we know that there's this big gap between, you know, 420.98s - 427.38s | folks that want to get into the cybersecurity industry and a plethora of jobs out there, millions of jobs around the globe. 428.10s - 432.18s | But they all ask for experience, which is kind of odd considering it's an entry-level job.


chunk_text:
you go back and look at the YouTube videos from the Packet Hacking Village in the Wall of Sheep, 388.10s - 392.42s | you'll see a plethora of talks that we've done and many of them around OSINT. 392.74s - 398.34s | So certain call outs I make out in these slides, if you're looking to go back in time and look at in detail at some 398.34s - 400.50s | of those other presentations we've done around OSINT, 401.06s - 404.26s | they are out there and on YouTube and Twitch and other places. 406.18s - 410.36s | One last thing, one of the things I've taken on recently is also mentoring 411.06s - 415.54s | folks that are looking to get into cybersecurity. They may be in IT today, 415.54s - 420.90s | they may have graduated college or something else. And we know that there's this big gap between, you know, 420.98s - 427.38s | folks that want to get into the cybersecurity industry and a plethora of jobs out there, millions of jobs around the globe. 428.10s - 432.18s | But they all ask for experience, which is kind of odd considering it's an entry-level job. 432.18s - 437.86s | So what we do is we work with folks and mentor them, give them research projects to work on. 438.02s - 443.22s | They get that hands-on experience to help build their resume and hopefully land one of those jobs. 445.22s - 447.22s | All right, into the presentation. 447.94s - 450.66s | So we know with OSINT data collection, 451.54s - 456.98s | whether you're investigating a person of interest, a top of interest or whatever it may be, 457.38s - 462.02s | you typically end up with a wasteland of data, various types of social media, 462.98s - 467.22s | information from various sites, RSS feeds, all kinds of different things. 467.86s - 473.14s | And then you're left with the job of sifting through all that data to find the artifacts that 473.62s - 480.66s | are actually the evidence that you're looking for. It's super time consuming. The majority of the data is worthless that you, you know, 480.82s - 485.70s | collect. And so what we've talked about last year or the year before in a variety of talks is 486.18s - 490.02s | collecting a lot of data and using


chunk_text:
432.18s - 437.86s | So what we do is we work with folks and mentor them, give them research projects to work on. 438.02s - 443.22s | They get that hands-on experience to help build their resume and hopefully land one of those jobs. 445.22s - 447.22s | All right, into the presentation. 447.94s - 450.66s | So we know with OSINT data collection, 451.54s - 456.98s | whether you're investigating a person of interest, a top of interest or whatever it may be, 457.38s - 462.02s | you typically end up with a wasteland of data, various types of social media, 462.98s - 467.22s | information from various sites, RSS feeds, all kinds of different things. 467.86s - 473.14s | And then you're left with the job of sifting through all that data to find the artifacts that 473.62s - 480.66s | are actually the evidence that you're looking for. It's super time consuming. The majority of the data is worthless that you, you know, 480.82s - 485.70s | collect. And so what we've talked about last year or the year before in a variety of talks is 486.18s - 490.02s | collecting a lot of data and using efficient methods for pruning that down. 490.74s - 497.94s | In one particular case, we talked about leveraging Power BI to sort that data, transform it, find the actual artifacts 497.94s - 504.02s | you're looking for, and or create dashboards. And that presentation I think is last year that we did that here 504.66s - 506.66s | in the Packet Hacking Village. 506.82s - 510.52s | What we're going to talk about today is beyond all of that collection, 511.40s - 514.04s | I've got a bunch of images. I've got a bunch of videos. 514.20s - 518.28s | It's time consuming to go through those things and find the artifacts you're looking for. 518.60s - 522.28s | You may be looking for a particular object like a gun or something else. 523.16s - 528.52s | In the video, you may want to pull out certain audio, but if you've got a thousand video files 528.76s - 531.24s | and they're all more than a gig in size, 531.56s - 536.12s | it's super time consuming to try to watch all those videos and try to find the artifacts you're looking for. 536.44s - 538.44s | And most of


chunk_text:
efficient methods for pruning that down. 490.74s - 497.94s | In one particular case, we talked about leveraging Power BI to sort that data, transform it, find the actual artifacts 497.94s - 504.02s | you're looking for, and or create dashboards. And that presentation I think is last year that we did that here 504.66s - 506.66s | in the Packet Hacking Village. 506.82s - 510.52s | What we're going to talk about today is beyond all of that collection, 511.40s - 514.04s | I've got a bunch of images. I've got a bunch of videos. 514.20s - 518.28s | It's time consuming to go through those things and find the artifacts you're looking for. 518.60s - 522.28s | You may be looking for a particular object like a gun or something else. 523.16s - 528.52s | In the video, you may want to pull out certain audio, but if you've got a thousand video files 528.76s - 531.24s | and they're all more than a gig in size, 531.56s - 536.12s | it's super time consuming to try to watch all those videos and try to find the artifacts you're looking for. 536.44s - 538.44s | And most of the time you're going to miss them. 538.68s - 542.28s | So we're going to talk about using AI computer vision and 543.24s - 545.80s | we'll talk about AWS as well as Azure. 545.88s - 547.88s | We'll talk a little bit about ChatGBT, 548.20s - 554.36s | but really kind of give you some thought provoking ideas and kind of a starting strategy in terms of how you can get started 554.44s - 556.92s | with all of this if it's something that's somewhat new to you. 558.68s - 560.68s | One other thing I find is 560.68s - 564.68s | I find it kind of humorous that people refer to it as OSINT because 565.24s - 567.96s | Chet and I agree that we kind of refer to it more as 568.52s - 575.00s | OSINFO. You're collecting a ton of information. The intelligence is one small piece of it, right? 575.40s - 579.00s | So a lot of what people are doing is collecting a wasteland of data 579.64s - 583.40s | trying to convert it into intelligence or OSINT type data. 584.76s - 588.70s | So at the end of the day, this really all


chunk_text:
the time you're going to miss them. 538.68s - 542.28s | So we're going to talk about using AI computer vision and 543.24s - 545.80s | we'll talk about AWS as well as Azure. 545.88s - 547.88s | We'll talk a little bit about ChatGBT, 548.20s - 554.36s | but really kind of give you some thought provoking ideas and kind of a starting strategy in terms of how you can get started 554.44s - 556.92s | with all of this if it's something that's somewhat new to you. 558.68s - 560.68s | One other thing I find is 560.68s - 564.68s | I find it kind of humorous that people refer to it as OSINT because 565.24s - 567.96s | Chet and I agree that we kind of refer to it more as 568.52s - 575.00s | OSINFO. You're collecting a ton of information. The intelligence is one small piece of it, right? 575.40s - 579.00s | So a lot of what people are doing is collecting a wasteland of data 579.64s - 583.40s | trying to convert it into intelligence or OSINT type data. 584.76s - 588.70s | So at the end of the day, this really all just begs for some type of automation 589.42s - 592.46s | and in testing AI and a lot of the research we've done, 592.86s - 599.02s | computer vision across these various platforms and even what you may be able to do to an extent within Python and other things 599.26s - 601.42s | can give you the ability to do this kind of thing. 605.13s - 610.49s | In terms of OCR or optical character recognition, there's a lot of cool artifacts that you can 611.29s - 616.89s | leverage and identify across images and video. They may be things such as signs or license plates. 617.13s - 623.37s | There may be things in the foreground such as a store sign or in the background such as a military vehicle 623.69s - 628.97s | with a specific serial number on it that maybe you can track in various locations across all your images. 629.37s - 631.37s | We'll talk about a lot of those scenarios. 632.97s - 634.97s | Also, you can do object 635.51s - 641.85s | recognition or identification as well. So what type of object or objects are you actually looking for? 642.57s - 644.89s


chunk_text:
just begs for some type of automation 589.42s - 592.46s | and in testing AI and a lot of the research we've done, 592.86s - 599.02s | computer vision across these various platforms and even what you may be able to do to an extent within Python and other things 599.26s - 601.42s | can give you the ability to do this kind of thing. 605.13s - 610.49s | In terms of OCR or optical character recognition, there's a lot of cool artifacts that you can 611.29s - 616.89s | leverage and identify across images and video. They may be things such as signs or license plates. 617.13s - 623.37s | There may be things in the foreground such as a store sign or in the background such as a military vehicle 623.69s - 628.97s | with a specific serial number on it that maybe you can track in various locations across all your images. 629.37s - 631.37s | We'll talk about a lot of those scenarios. 632.97s - 634.97s | Also, you can do object 635.51s - 641.85s | recognition or identification as well. So what type of object or objects are you actually looking for? 642.57s - 644.89s | Are you monitoring events at 645.45s - 653.29s | sports games and trying to identify amongst the crowd either inside the stadium or outside if maybe somebody has some form of a weapon? 653.69s - 660.09s | Object identification can really help you with that and AI is super efficient at identifying those things across your data. 662.70s - 664.70s | Also, when we talk about video, 664.94s - 666.30s | there's also 666.30s - 667.66s | speech recognition. 667.66s - 674.78s | So whether they're conversations in the foreground or the background, being able to extract that and have the AI 675.34s - 681.90s | really map out all those conversations for you. Maybe there's specific words you're actually looking for amongst the speech. 682.62s - 686.54s | All of that speech recognition will also allow you to identify that too. 688.51s - 693.39s | And then what we really want to do is it's great that we've automated and found all of this stuff, 693.79s - 695.79s | but then how do we report on it? 695.79s - 699.57s | How can we maybe consume it in an automated way into some kind of a dashboard? 700.11s


chunk_text:
| Are you monitoring events at 645.45s - 653.29s | sports games and trying to identify amongst the crowd either inside the stadium or outside if maybe somebody has some form of a weapon? 653.69s - 660.09s | Object identification can really help you with that and AI is super efficient at identifying those things across your data. 662.70s - 664.70s | Also, when we talk about video, 664.94s - 666.30s | there's also 666.30s - 667.66s | speech recognition. 667.66s - 674.78s | So whether they're conversations in the foreground or the background, being able to extract that and have the AI 675.34s - 681.90s | really map out all those conversations for you. Maybe there's specific words you're actually looking for amongst the speech. 682.62s - 686.54s | All of that speech recognition will also allow you to identify that too. 688.51s - 693.39s | And then what we really want to do is it's great that we've automated and found all of this stuff, 693.79s - 695.79s | but then how do we report on it? 695.79s - 699.57s | How can we maybe consume it in an automated way into some kind of a dashboard? 700.11s - 702.43s | Maybe I want to plot these things on a map. 702.75s - 708.03s | We'll talk about some of those things we covered last year and how you can do that and some new ideas this year too. 711.63s - 714.91s | So getting started with this, we'll first talk a little bit about Azure. 715.15s - 720.83s | I'll kind of pivot to AWS and we'll kind of go back and forth as we go through the slides across these different topics. 721.95s - 723.55s | Within Azure, 723.55s - 725.55s | you can go to the main page, 725.63s - 731.15s | you can upload images and play around with the optical character recognition as well as the object detection. 731.47s - 735.23s | And there's also video analysis and a whole variety of other things that you can do. 735.87s - 737.55s | There's also spatial analysis. 737.55s - 742.99s | So if you have a video and you're looking at people that maybe come into a room and then leave a room or where they 742.99s - 749.95s | are spatially, scattered throughout a large room or something else that you are monitoring


chunk_text:
- 702.43s | Maybe I want to plot these things on a map. 702.75s - 708.03s | We'll talk about some of those things we covered last year and how you can do that and some new ideas this year too. 711.63s - 714.91s | So getting started with this, we'll first talk a little bit about Azure. 715.15s - 720.83s | I'll kind of pivot to AWS and we'll kind of go back and forth as we go through the slides across these different topics. 721.95s - 723.55s | Within Azure, 723.55s - 725.55s | you can go to the main page, 725.63s - 731.15s | you can upload images and play around with the optical character recognition as well as the object detection. 731.47s - 735.23s | And there's also video analysis and a whole variety of other things that you can do. 735.87s - 737.55s | There's also spatial analysis. 737.55s - 742.99s | So if you have a video and you're looking at people that maybe come into a room and then leave a room or where they 742.99s - 749.95s | are spatially, scattered throughout a large room or something else that you are monitoring or that you want to look at, 750.27s - 752.27s | there's a whole variety of different 752.67s - 754.67s | components that are available to you. 755.15s - 760.99s | And if you start to dive into it, we'll talk about how you can train as well based on large data sets, 760.99s - 766.33s | which we'll get into too. 766.33s - 772.49s | So in a very simple way, you know, you can upload these images and perform optical character recognition on it. 772.57s - 776.73s | You can upload an image and for a suite of images and say like, 777.37s - 782.25s | what have you found in this image and let the AI computer vision identify that for you. 785.44s - 789.04s | Anybody a fan of the the cult movie, They Live? 789.44s - 791.36s | Okay, it was actually, you know, 791.84s - 796.08s | a part of DEFCON a couple years ago, right, where it was sort of the theme for the conference. 796.08s - 798.08s | So I was super stoked when I saw that. 798.48s - 801.36s | Throughout the movie, there's all kinds of signs, right? 801.52s -


chunk_text:
or that you want to look at, 750.27s - 752.27s | there's a whole variety of different 752.67s - 754.67s | components that are available to you. 755.15s - 760.99s | And if you start to dive into it, we'll talk about how you can train as well based on large data sets, 760.99s - 766.33s | which we'll get into too. 766.33s - 772.49s | So in a very simple way, you know, you can upload these images and perform optical character recognition on it. 772.57s - 776.73s | You can upload an image and for a suite of images and say like, 777.37s - 782.25s | what have you found in this image and let the AI computer vision identify that for you. 785.44s - 789.04s | Anybody a fan of the the cult movie, They Live? 789.44s - 791.36s | Okay, it was actually, you know, 791.84s - 796.08s | a part of DEFCON a couple years ago, right, where it was sort of the theme for the conference. 796.08s - 798.08s | So I was super stoked when I saw that. 798.48s - 801.36s | Throughout the movie, there's all kinds of signs, right? 801.52s - 808.80s | And, you know, the guys put on the sunglasses and they can actually see these signs that are otherwise somewhat hidden to the casual viewer. 809.68s - 814.24s | But this is a good example that if you're collecting images and or video, 814.64s - 820.00s | there's so much stuff going on, like if you've got a cityscape or something else that you're looking at, 820.32s - 825.20s | like, how do I even look at this and am I going to miss something like a license plate in the background or 825.60s - 830.40s | something else that's really important, maybe a document that somebody's holding and on the back of it, 830.40s - 832.64s | you can see what, you know, what it's about. 833.28s - 840.00s | So, you know, the optical character recognition obviously can create bounding boxes or you can look at the entire image 840.48s - 844.80s | and have it automatically identify all of this for you. As you can see here, 844.88s - 850.64s | there's a plethora of things that are identified in the image in a very quick and efficient manner in a matter of a couple


chunk_text:
808.80s | And, you know, the guys put on the sunglasses and they can actually see these signs that are otherwise somewhat hidden to the casual viewer. 809.68s - 814.24s | But this is a good example that if you're collecting images and or video, 814.64s - 820.00s | there's so much stuff going on, like if you've got a cityscape or something else that you're looking at, 820.32s - 825.20s | like, how do I even look at this and am I going to miss something like a license plate in the background or 825.60s - 830.40s | something else that's really important, maybe a document that somebody's holding and on the back of it, 830.40s - 832.64s | you can see what, you know, what it's about. 833.28s - 840.00s | So, you know, the optical character recognition obviously can create bounding boxes or you can look at the entire image 840.48s - 844.80s | and have it automatically identify all of this for you. As you can see here, 844.88s - 850.64s | there's a plethora of things that are identified in the image in a very quick and efficient manner in a matter of a couple seconds. 851.04s - 853.92s | If you have, you know, a hundred thousand images, 854.16s - 859.36s | yeah, you can use the back-end training and actually go through that and we'll talk about some of that too. 863.82s - 868.86s | Common questions I get, you know, what about international languages? Yep, those are supported as well. 869.02s - 874.46s | So it has the ability to identify that. If you're gathering a lot of OSINT data through social means, 875.10s - 879.26s | in this case, this was a TikTok video and not only did it, you know, 879.74s - 885.42s | grab and identify all the characters of whether it be Ukrainian, Russian or something else, 885.82s - 889.82s | but furthermore, it captured something I didn't even notice in the image, 889.98s - 894.94s | which is at the bottom in very fine print was their handle for actually for TikTok. 895.34s - 901.58s | So those kinds of things will uncover artifacts that you probably miss trying to go through image by image yourself, 901.90s - 907.50s | you know, using a, you know, human type of analysis to really do that vision and identify


chunk_text:
seconds. 851.04s - 853.92s | If you have, you know, a hundred thousand images, 854.16s - 859.36s | yeah, you can use the back-end training and actually go through that and we'll talk about some of that too. 863.82s - 868.86s | Common questions I get, you know, what about international languages? Yep, those are supported as well. 869.02s - 874.46s | So it has the ability to identify that. If you're gathering a lot of OSINT data through social means, 875.10s - 879.26s | in this case, this was a TikTok video and not only did it, you know, 879.74s - 885.42s | grab and identify all the characters of whether it be Ukrainian, Russian or something else, 885.82s - 889.82s | but furthermore, it captured something I didn't even notice in the image, 889.98s - 894.94s | which is at the bottom in very fine print was their handle for actually for TikTok. 895.34s - 901.58s | So those kinds of things will uncover artifacts that you probably miss trying to go through image by image yourself, 901.90s - 907.50s | you know, using a, you know, human type of analysis to really do that vision and identify those things. 907.98s - 913.18s | I will admit the majority of the time it always finds something in almost every image that I've missed 914.14s - 916.14s | just simply by trying to look at it myself. 919.88s - 925.18s | Geolocation information becomes increasingly difficult. If you attended our talk a few years ago, 925.18s - 927.66s | we were talking about how to collect data 928.46s - 930.70s | via Twitter and other means and 931.66s - 935.18s | actually do geolocation on it in a very unique way. 936.30s - 937.82s | And 937.82s - 943.26s | as those things become locked down more and more and more becomes increasingly difficult. 944.14s - 951.34s | But optical character recognition, object recognition, and all of these things can actually help paint a new picture 951.82s - 953.82s | around the location information. 954.46s - 960.78s | In this particular case, we had been and continue to do a lot of research around the Russian-Ukrainian war. 961.74s - 963.34s | In this particular case, 963.34s - 968.70s | I was actually collecting images looking for military vehicles and you can see that there's one here in the background.


chunk_text:
those things. 907.98s - 913.18s | I will admit the majority of the time it always finds something in almost every image that I've missed 914.14s - 916.14s | just simply by trying to look at it myself. 919.88s - 925.18s | Geolocation information becomes increasingly difficult. If you attended our talk a few years ago, 925.18s - 927.66s | we were talking about how to collect data 928.46s - 930.70s | via Twitter and other means and 931.66s - 935.18s | actually do geolocation on it in a very unique way. 936.30s - 937.82s | And 937.82s - 943.26s | as those things become locked down more and more and more becomes increasingly difficult. 944.14s - 951.34s | But optical character recognition, object recognition, and all of these things can actually help paint a new picture 951.82s - 953.82s | around the location information. 954.46s - 960.78s | In this particular case, we had been and continue to do a lot of research around the Russian-Ukrainian war. 961.74s - 963.34s | In this particular case, 963.34s - 968.70s | I was actually collecting images looking for military vehicles and you can see that there's one here in the background. 969.18s - 973.84s | What I didn't notice was the fact that there was a teeny little sign in the foreground 974.30s - 980.86s | on the station facility there that actually tells me a little bit more about the location and where this is. 981.58s - 987.82s | So again, if you're having issues with trying to identify where was this picture taken or where was this activity going on, 988.62s - 989.42s | you know, again, 989.42s - 996.46s | the optical character recognition of the bounding boxes might pick up on something really tiny in the background or foreground that you didn't even notice. 997.10s - 1001.50s | We'll talk later about how we took this data, automated it, and plotted it on a map 1001.74s - 1008.14s | and how we used it for predictive analysis related to the war and we had more than a 95 accuracy with this data. 1011.60s - 1015.68s | In terms of MIST, I was wondering what it was. It's actually a shipping company 1016.32s - 1017.52s | in the Ukraine. 1017.52s - 1023.52s | But there were other signs and things in this image and others that exposed or


chunk_text:
969.18s - 973.84s | What I didn't notice was the fact that there was a teeny little sign in the foreground 974.30s - 980.86s | on the station facility there that actually tells me a little bit more about the location and where this is. 981.58s - 987.82s | So again, if you're having issues with trying to identify where was this picture taken or where was this activity going on, 988.62s - 989.42s | you know, again, 989.42s - 996.46s | the optical character recognition of the bounding boxes might pick up on something really tiny in the background or foreground that you didn't even notice. 997.10s - 1001.50s | We'll talk later about how we took this data, automated it, and plotted it on a map 1001.74s - 1008.14s | and how we used it for predictive analysis related to the war and we had more than a 95 accuracy with this data. 1011.60s - 1015.68s | In terms of MIST, I was wondering what it was. It's actually a shipping company 1016.32s - 1017.52s | in the Ukraine. 1017.52s - 1023.52s | But there were other signs and things in this image and others that exposed or enumerated in more detail again 1023.60s - 1026.24s | where these locations were of these military vehicles. 1026.80s - 1029.36s | And hold that thought because we'll come back to that in just a moment. 1033.64s - 1034.52s | Also, 1034.52s - 1039.72s | you know, during the beginning of the war, there were a lot of people trying to, you know, leave the country. 1040.28s - 1042.28s | And there was, you know, 1042.68s - 1045.40s | a lot of interesting pictures with mobs of people. 1046.20s - 1051.08s | And again, in trying to identify where some of this activity was going, 1051.40s - 1057.88s | the optical character recognition was great at picking up, again, location information based on signs of the train station and other things. 1058.28s - 1062.12s | Again, this became super useful when trying to plot this out on a map. 1066.49s - 1067.61s | In addition, 1067.61s - 1069.13s | license plates. 1069.13s - 1072.09s | Again, whether it's serial numbers on a tank, 1072.89s - 1075.53s | letters that are on military vehicles, 1076.41s - 1080.59s | license plates, and other things, these can be really useful if you identify 1081.45s


chunk_text:
enumerated in more detail again 1023.60s - 1026.24s | where these locations were of these military vehicles. 1026.80s - 1029.36s | And hold that thought because we'll come back to that in just a moment. 1033.64s - 1034.52s | Also, 1034.52s - 1039.72s | you know, during the beginning of the war, there were a lot of people trying to, you know, leave the country. 1040.28s - 1042.28s | And there was, you know, 1042.68s - 1045.40s | a lot of interesting pictures with mobs of people. 1046.20s - 1051.08s | And again, in trying to identify where some of this activity was going, 1051.40s - 1057.88s | the optical character recognition was great at picking up, again, location information based on signs of the train station and other things. 1058.28s - 1062.12s | Again, this became super useful when trying to plot this out on a map. 1066.49s - 1067.61s | In addition, 1067.61s - 1069.13s | license plates. 1069.13s - 1072.09s | Again, whether it's serial numbers on a tank, 1072.89s - 1075.53s | letters that are on military vehicles, 1076.41s - 1080.59s | license plates, and other things, these can be really useful if you identify 1081.45s - 1086.73s | this vehicle in more than one location and also plotting that in a map and over a timeline. 1087.21s - 1092.73s | So again, just another example of like a lot of information you may have scattered across, you know, 1092.87s - 1098.57s | thousands if not hundreds of thousands of images or video that you have and which is really efficient at identifying this. 1102.75s - 1104.75s | One of the things I also did 1104.83s - 1106.83s | was, and some of this was, 1108.27s - 1112.91s | we started to talk about it a little bit in the last few talks over the last few years here at DEFCON, 1113.39s - 1119.47s | was around tracking all these military vehicles and trying to predict where they were going to, where Russia was going to attack next. 1120.27s - 1122.27s | And in doing so, I, you know, 1122.35s - 1128.11s | initially noticed that a lot of these military vehicles had all these serial numbers and things on the sides of them. 1128.51s - 1131.47s | And, you know, my thought was thinking was that, you know, 1131.71s - 1134.59s | I don't exactly


chunk_text:
- 1086.73s | this vehicle in more than one location and also plotting that in a map and over a timeline. 1087.21s - 1092.73s | So again, just another example of like a lot of information you may have scattered across, you know, 1092.87s - 1098.57s | thousands if not hundreds of thousands of images or video that you have and which is really efficient at identifying this. 1102.75s - 1104.75s | One of the things I also did 1104.83s - 1106.83s | was, and some of this was, 1108.27s - 1112.91s | we started to talk about it a little bit in the last few talks over the last few years here at DEFCON, 1113.39s - 1119.47s | was around tracking all these military vehicles and trying to predict where they were going to, where Russia was going to attack next. 1120.27s - 1122.27s | And in doing so, I, you know, 1122.35s - 1128.11s | initially noticed that a lot of these military vehicles had all these serial numbers and things on the sides of them. 1128.51s - 1131.47s | And, you know, my thought was thinking was that, you know, 1131.71s - 1134.59s | I don't exactly know where all of these images are coming from, 1134.99s - 1141.79s | unless the person, you know, that posted it or tweeted it or something else says spotted this vehicle at XYZ location in Kiev 1142.03s - 1144.03s | or wherever it may be. 1144.19s - 1150.03s | But I was kind of wondering, you know, from these numbers if I could start to kind of determine, you know, 1150.67s - 1155.31s | how many, how often across my images maybe this particular vehicle showed up. 1155.79s - 1158.99s | So if I did have limited vehicle information such as, you know, 1159.31s - 1162.35s | the person, you know, posted from Kiev or something like that, 1163.15s - 1167.79s | and then I saw this vehicle over on the other side of the country, which we actually did, 1168.19s - 1173.79s | we were able to plot that stuff on a map. So pulling out these serial numbers was actually quite useful, too. 1174.51s - 1179.79s | And there's sometimes various codes, as you can see here, too, that are representative of things, too. 1179.79s - 1184.03s | So we're talking more than just numbers and letters and


chunk_text:
know where all of these images are coming from, 1134.99s - 1141.79s | unless the person, you know, that posted it or tweeted it or something else says spotted this vehicle at XYZ location in Kiev 1142.03s - 1144.03s | or wherever it may be. 1144.19s - 1150.03s | But I was kind of wondering, you know, from these numbers if I could start to kind of determine, you know, 1150.67s - 1155.31s | how many, how often across my images maybe this particular vehicle showed up. 1155.79s - 1158.99s | So if I did have limited vehicle information such as, you know, 1159.31s - 1162.35s | the person, you know, posted from Kiev or something like that, 1163.15s - 1167.79s | and then I saw this vehicle over on the other side of the country, which we actually did, 1168.19s - 1173.79s | we were able to plot that stuff on a map. So pulling out these serial numbers was actually quite useful, too. 1174.51s - 1179.79s | And there's sometimes various codes, as you can see here, too, that are representative of things, too. 1179.79s - 1184.03s | So we're talking more than just numbers and letters and some special characters. 1184.03s - 1188.27s | There may be weird codes, international languages, things like that, that is very good at bringing out. 1190.75s - 1196.27s | Interestingly enough, this was another picture I had, and you can see the same vehicle number popped up. 1196.91s - 1201.79s | Now, I was kind of wondering if it was maybe a category of vehicles or this number represented, 1202.19s - 1204.59s | you know, a military team or things like that. 1204.91s - 1208.75s | But as we looked through the data more and more, it was very unique to the truck. 1208.91s - 1213.79s | We looked at the characteristics of the truck and some markings and scratches and things like that in the truck. 1213.87s - 1215.87s | It was absolutely the same vehicle. 1215.95s - 1222.03s | So again, it became super helpful in terms of the geolocation or really just plotting these things on a map. 1225.45s - 1228.01s | Taking this data and making it useful, 1229.13s - 1231.61s | you know, there's a lot of different tools out there. 1231.77s - 1235.13s | You know, people use Grafana, Splunk, a whole bunch of different


chunk_text:
some special characters. 1184.03s - 1188.27s | There may be weird codes, international languages, things like that, that is very good at bringing out. 1190.75s - 1196.27s | Interestingly enough, this was another picture I had, and you can see the same vehicle number popped up. 1196.91s - 1201.79s | Now, I was kind of wondering if it was maybe a category of vehicles or this number represented, 1202.19s - 1204.59s | you know, a military team or things like that. 1204.91s - 1208.75s | But as we looked through the data more and more, it was very unique to the truck. 1208.91s - 1213.79s | We looked at the characteristics of the truck and some markings and scratches and things like that in the truck. 1213.87s - 1215.87s | It was absolutely the same vehicle. 1215.95s - 1222.03s | So again, it became super helpful in terms of the geolocation or really just plotting these things on a map. 1225.45s - 1228.01s | Taking this data and making it useful, 1229.13s - 1231.61s | you know, there's a lot of different tools out there. 1231.77s - 1235.13s | You know, people use Grafana, Splunk, a whole bunch of different things. 1235.21s - 1240.17s | I personally like to use Power BI because I like how it can take the data and do 1240.47s - 1244.81s | transforms on it and look at it in a lot of different ways I didn't think about looking at the data. 1245.93s - 1248.01s | In addition, it allows a lot of 1248.81s - 1251.71s | click and point and create various widgets in your dashboard. 1251.93s - 1257.93s | So now you can use it to kind of sort on the data, maybe by timeline, maybe by object type, maybe by 1259.13s - 1264.89s | keyword or, you know, that was identified via optical character recognition and a whole variety of different things. 1265.69s - 1272.09s | This also became very helpful in tying together posts and also the trustworthiness of those posts. 1272.41s - 1274.81s | So one of the things that is always a challenge is, 1275.29s - 1279.77s | is, you know, all of this content legitimate or is it meant to throw people off? 1281.93s - 1288.03s | And so in doing so we were able to sort on the top 5, 10, 25 posters 1288.57s - 1292.73s


chunk_text:
things. 1235.21s - 1240.17s | I personally like to use Power BI because I like how it can take the data and do 1240.47s - 1244.81s | transforms on it and look at it in a lot of different ways I didn't think about looking at the data. 1245.93s - 1248.01s | In addition, it allows a lot of 1248.81s - 1251.71s | click and point and create various widgets in your dashboard. 1251.93s - 1257.93s | So now you can use it to kind of sort on the data, maybe by timeline, maybe by object type, maybe by 1259.13s - 1264.89s | keyword or, you know, that was identified via optical character recognition and a whole variety of different things. 1265.69s - 1272.09s | This also became very helpful in tying together posts and also the trustworthiness of those posts. 1272.41s - 1274.81s | So one of the things that is always a challenge is, 1275.29s - 1279.77s | is, you know, all of this content legitimate or is it meant to throw people off? 1281.93s - 1288.03s | And so in doing so we were able to sort on the top 5, 10, 25 posters 1288.57s - 1292.73s | and in cross validating like the data that they had posted said, you know, 1292.81s - 1298.33s | these are the most trustworthy people that are posting a plethora of things around military vehicles or other things. 1298.81s - 1300.33s | So sorting that 1300.33s - 1304.89s | became very useful, very practical and was great because in a point and click I could say, okay, 1304.89s - 1309.29s | I got it sorted in the way that I wanted. Now click, create a PDF report, boom, 1309.37s - 1313.37s | I've got my triage report ready to use and, you know, put into action. 1315.79s - 1320.35s | There's a variety of different widgets across all these different, you know, tools and many others. 1321.15s - 1326.91s | In this particular case, there's all kinds of cool plugins. So there's word clouds and things like this. 1327.47s - 1334.91s | What was really interesting about this one was I was not looking at the Oblast region of Kiev at all. 1335.23s - 1339.23s | I was looking at other regions in Kiev where people were posting from and things like that. 1339.71s - 1343.39s | And for whatever


chunk_text:
| and in cross validating like the data that they had posted said, you know, 1292.81s - 1298.33s | these are the most trustworthy people that are posting a plethora of things around military vehicles or other things. 1298.81s - 1300.33s | So sorting that 1300.33s - 1304.89s | became very useful, very practical and was great because in a point and click I could say, okay, 1304.89s - 1309.29s | I got it sorted in the way that I wanted. Now click, create a PDF report, boom, 1309.37s - 1313.37s | I've got my triage report ready to use and, you know, put into action. 1315.79s - 1320.35s | There's a variety of different widgets across all these different, you know, tools and many others. 1321.15s - 1326.91s | In this particular case, there's all kinds of cool plugins. So there's word clouds and things like this. 1327.47s - 1334.91s | What was really interesting about this one was I was not looking at the Oblast region of Kiev at all. 1335.23s - 1339.23s | I was looking at other regions in Kiev where people were posting from and things like that. 1339.71s - 1343.39s | And for whatever reason, I just overlooked this part of the city. 1343.95s - 1347.95s | But you can see here, it's one of the top five largest words, 1348.35s - 1354.05s | meaning that it's the, you know, in the top five quantity of posts where people were talking about Oblast. 1354.83s - 1356.51s | What I uncovered was, 1356.51s - 1361.23s | because I was looking at tanks and military vehicles, it didn't even pop up for me. 1362.03s - 1366.75s | This was being posted because they were destroying a lot of churches around the Kiev area. 1367.15s - 1369.25s | So I started to take a look at the churches. 1369.79s - 1375.23s | That became one of the most interesting and key ingredients to the attacks and what was going on. 1375.71s - 1379.87s | The Russians were really destroying the majority of the churches across the Ukraine. 1380.43s - 1385.41s | And based on the timeline, we could see where they were based on when the church was destroyed. 1386.75s - 1391.31s | So this really uncovered that artifact and it became the most precision, 1391.77s - 1396.03s | predictive component of the data we looked at,


chunk_text:
reason, I just overlooked this part of the city. 1343.95s - 1347.95s | But you can see here, it's one of the top five largest words, 1348.35s - 1354.05s | meaning that it's the, you know, in the top five quantity of posts where people were talking about Oblast. 1354.83s - 1356.51s | What I uncovered was, 1356.51s - 1361.23s | because I was looking at tanks and military vehicles, it didn't even pop up for me. 1362.03s - 1366.75s | This was being posted because they were destroying a lot of churches around the Kiev area. 1367.15s - 1369.25s | So I started to take a look at the churches. 1369.79s - 1375.23s | That became one of the most interesting and key ingredients to the attacks and what was going on. 1375.71s - 1379.87s | The Russians were really destroying the majority of the churches across the Ukraine. 1380.43s - 1385.41s | And based on the timeline, we could see where they were based on when the church was destroyed. 1386.75s - 1391.31s | So this really uncovered that artifact and it became the most precision, 1391.77s - 1396.03s | predictive component of the data we looked at, even more than the military vehicles. 1396.59s - 1401.71s | So again, leveraging transforms and these other things that are built into these reporting tools can help you look 1402.35s - 1405.71s | at the data from a completely different angle you've had never considered. 1410.28s - 1413.32s | As I mentioned, these things may show up in multiple pictures. 1413.64s - 1418.84s | So if you're not exactly sure what you're looking for, but you kind of have a sense for what you're looking for, 1419.32s - 1423.32s | again, this is where the computer vision is going to help you refine that and determine, 1423.64s - 1428.28s | now I know what I am looking for. For me, I went into it looking for military vehicles. 1428.44s - 1430.78s | It came out of it looking for destroyed churches. 1432.84s - 1439.34s | And so these, you know, things of interest, person of interest, and more may be identified at multiple locations. 1439.64s - 1442.38s | And again, this can be great for all kinds of location analysis. 1447.61s - 1450.89s | Again, a lot of this stuff I overlooked by looking at it manually. 1451.77s - 1456.65s


chunk_text:
even more than the military vehicles. 1396.59s - 1401.71s | So again, leveraging transforms and these other things that are built into these reporting tools can help you look 1402.35s - 1405.71s | at the data from a completely different angle you've had never considered. 1410.28s - 1413.32s | As I mentioned, these things may show up in multiple pictures. 1413.64s - 1418.84s | So if you're not exactly sure what you're looking for, but you kind of have a sense for what you're looking for, 1419.32s - 1423.32s | again, this is where the computer vision is going to help you refine that and determine, 1423.64s - 1428.28s | now I know what I am looking for. For me, I went into it looking for military vehicles. 1428.44s - 1430.78s | It came out of it looking for destroyed churches. 1432.84s - 1439.34s | And so these, you know, things of interest, person of interest, and more may be identified at multiple locations. 1439.64s - 1442.38s | And again, this can be great for all kinds of location analysis. 1447.61s - 1450.89s | Again, a lot of this stuff I overlooked by looking at it manually. 1451.77s - 1456.65s | And in addition, there may be a lot of things in the foreground and the background that may be very informative. 1456.81s - 1461.77s | So bottom line, in my humble opinion, my two cents, is if you're not using optical character recognition, 1462.01s - 1464.41s | you're probably missing most of the important data points. 1473.07s - 1478.75s | So, you know, we talked about Azure and we'll get into AWS here in a moment. 1479.63s - 1483.97s | But in addition, you can use ChatGBT for doing some optical character recognition. 1484.77s - 1489.57s | There are, of course, APIs available, just like there are for AWS and for Azure. 1490.29s - 1495.33s | I've had kind of, you know, limited luck with identifying things within this. 1495.41s - 1499.89s | You can see I uploaded an image, but it doesn't really show me the image that I uploaded. 1500.13s - 1505.75s | It did find that number on the side of the military vehicle. So it was quite good at doing the optical character recognition. 1506.29s - 1509.73s | But again, I didn't really dive into it, you know, very deeply. 1509.81s - 1514.93s | But


chunk_text:
| And in addition, there may be a lot of things in the foreground and the background that may be very informative. 1456.81s - 1461.77s | So bottom line, in my humble opinion, my two cents, is if you're not using optical character recognition, 1462.01s - 1464.41s | you're probably missing most of the important data points. 1473.07s - 1478.75s | So, you know, we talked about Azure and we'll get into AWS here in a moment. 1479.63s - 1483.97s | But in addition, you can use ChatGBT for doing some optical character recognition. 1484.77s - 1489.57s | There are, of course, APIs available, just like there are for AWS and for Azure. 1490.29s - 1495.33s | I've had kind of, you know, limited luck with identifying things within this. 1495.41s - 1499.89s | You can see I uploaded an image, but it doesn't really show me the image that I uploaded. 1500.13s - 1505.75s | It did find that number on the side of the military vehicle. So it was quite good at doing the optical character recognition. 1506.29s - 1509.73s | But again, I didn't really dive into it, you know, very deeply. 1509.81s - 1514.93s | But if you're looking for, you know, if you prefer ChatGBT, you can do some of this stuff with ChatGBT as well. 1517.36s - 1519.36s | All right, so object recognition. 1519.36s - 1526.80s | So up until now, we've talked about optical character recognition and identifying license plates and serial numbers and military numbers for vehicles. 1527.28s - 1532.72s | Now we're looking for objects. It may be a gun. It may be a military vehicle. It may be a person. It may be a car. 1533.92s - 1540.56s | And, you know, again, fundamentally with the, you know, free interface that's provided, in this case with Azure, 1540.88s - 1546.24s | you can upload, you know, an image and have it identify for you things that are in the image. 1546.64s - 1549.68s | It may be very transparent to you, and that's fine, right? 1550.16s - 1554.40s | But again, we want to see what we've missed. And furthermore, we probably have a massive data set. 1554.40s - 1557.92s | So we're not going to necessarily upload these images one at a time, 1558.16s - 1564.64s | but the automation will allow you to either have a storage


chunk_text:
if you're looking for, you know, if you prefer ChatGBT, you can do some of this stuff with ChatGBT as well. 1517.36s - 1519.36s | All right, so object recognition. 1519.36s - 1526.80s | So up until now, we've talked about optical character recognition and identifying license plates and serial numbers and military numbers for vehicles. 1527.28s - 1532.72s | Now we're looking for objects. It may be a gun. It may be a military vehicle. It may be a person. It may be a car. 1533.92s - 1540.56s | And, you know, again, fundamentally with the, you know, free interface that's provided, in this case with Azure, 1540.88s - 1546.24s | you can upload, you know, an image and have it identify for you things that are in the image. 1546.64s - 1549.68s | It may be very transparent to you, and that's fine, right? 1550.16s - 1554.40s | But again, we want to see what we've missed. And furthermore, we probably have a massive data set. 1554.40s - 1557.92s | So we're not going to necessarily upload these images one at a time, 1558.16s - 1564.64s | but the automation will allow you to either have a storage with a plethora of images that you can automate that will look at 1564.64s - 1569.12s | it in much the same manner. We'll also talk about how you can train these classifiers, too. 1571.17s - 1578.53s | So in this particular case, we identified, you know, two individuals as well as a land vehicle or a military vehicle, 1578.53s - 1584.69s | but not a tank. And I was trying to do some training on tanks and really kind of test that out. 1585.49s - 1591.41s | It also will give you kind of a threshold value and accuracy adjustments for the bounding boxes, 1591.57s - 1595.01s | how you want to carve up the image and have the computer vision look at it. 1595.09s - 1597.65s | So there's a lot of different options that you can leverage here. 1597.97s - 1601.49s | And if it's something you want to play around with, I certainly encourage you to go out to, 1601.89s - 1606.13s | you know, the Azure site and in what I'll talk about in a minute with AWS, 1606.29s - 1609.41s | where you can test some of these things out and get more familiar


chunk_text:
with a plethora of images that you can automate that will look at 1564.64s - 1569.12s | it in much the same manner. We'll also talk about how you can train these classifiers, too. 1571.17s - 1578.53s | So in this particular case, we identified, you know, two individuals as well as a land vehicle or a military vehicle, 1578.53s - 1584.69s | but not a tank. And I was trying to do some training on tanks and really kind of test that out. 1585.49s - 1591.41s | It also will give you kind of a threshold value and accuracy adjustments for the bounding boxes, 1591.57s - 1595.01s | how you want to carve up the image and have the computer vision look at it. 1595.09s - 1597.65s | So there's a lot of different options that you can leverage here. 1597.97s - 1601.49s | And if it's something you want to play around with, I certainly encourage you to go out to, 1601.89s - 1606.13s | you know, the Azure site and in what I'll talk about in a minute with AWS, 1606.29s - 1609.41s | where you can test some of these things out and get more familiar with them if you want to, 1610.29s - 1612.29s | you know, play around in your own sandbox. 1615.60s - 1617.60s | When you actually create an account, 1618.08s - 1620.08s | you can actually go in there and train the 1621.60s - 1626.02s | model. And what this allows you to do is if you are looking for certain things in particular, 1626.42s - 1632.58s | now you can upload from Kaggle or something else, a whole bunch of images, a huge corpus of data 1633.38s - 1637.06s | that is already pre-sorted for you where they're all tanks, right? 1637.22s - 1641.30s | And this is going to give me the fundamental baseline by which now when you 1641.68s - 1645.94s | automate the feed of all of these images you have, this wasteland of data, 1646.34s - 1652.42s | to help better identify if in any of those images, in this case, if they're in any of those images, if there's an actual tank. 1652.42s - 1660.02s | So, I did exactly that. Went to Kaggle, downloaded a bunch of images, uploaded them into this and had, 1660.66s - 1665.62s | and trained it, basically, in how


chunk_text:
with them if you want to, 1610.29s - 1612.29s | you know, play around in your own sandbox. 1615.60s - 1617.60s | When you actually create an account, 1618.08s - 1620.08s | you can actually go in there and train the 1621.60s - 1626.02s | model. And what this allows you to do is if you are looking for certain things in particular, 1626.42s - 1632.58s | now you can upload from Kaggle or something else, a whole bunch of images, a huge corpus of data 1633.38s - 1637.06s | that is already pre-sorted for you where they're all tanks, right? 1637.22s - 1641.30s | And this is going to give me the fundamental baseline by which now when you 1641.68s - 1645.94s | automate the feed of all of these images you have, this wasteland of data, 1646.34s - 1652.42s | to help better identify if in any of those images, in this case, if they're in any of those images, if there's an actual tank. 1652.42s - 1660.02s | So, I did exactly that. Went to Kaggle, downloaded a bunch of images, uploaded them into this and had, 1660.66s - 1665.62s | and trained it, basically, in how to do this. And it wasn't difficult. This was a lot of point and click, right? 1665.78s - 1668.66s | I'm not doing, like, command line coding, things like that. 1668.98s - 1671.06s | I do use the API personally, 1671.06s - 1676.02s | but I really wanted to kind of help people understand how I could get, how someone could get started very easily with this. 1676.50s - 1680.02s | When you go ahead and create this, it will go ahead and generate keys for you, 1680.02s - 1682.90s | so you can do it from a command line. You could even use curl. 1683.06s - 1687.46s | There's a bunch of different ways in which you can easily use it. And on GitHub and other places, 1687.62s - 1690.50s | there's a whole bunch of Python code and other things if you want to leverage 1691.06s - 1695.30s | those bases that people may have created to help you more efficiently refine a lot of this. 1698.47s - 1703.99s | As I mentioned, it'll create a bounding box around the object that's identified. When you upload these images, 1704.07s - 1708.87s | you'll go ahead and actually manually


chunk_text:
to do this. And it wasn't difficult. This was a lot of point and click, right? 1665.78s - 1668.66s | I'm not doing, like, command line coding, things like that. 1668.98s - 1671.06s | I do use the API personally, 1671.06s - 1676.02s | but I really wanted to kind of help people understand how I could get, how someone could get started very easily with this. 1676.50s - 1680.02s | When you go ahead and create this, it will go ahead and generate keys for you, 1680.02s - 1682.90s | so you can do it from a command line. You could even use curl. 1683.06s - 1687.46s | There's a bunch of different ways in which you can easily use it. And on GitHub and other places, 1687.62s - 1690.50s | there's a whole bunch of Python code and other things if you want to leverage 1691.06s - 1695.30s | those bases that people may have created to help you more efficiently refine a lot of this. 1698.47s - 1703.99s | As I mentioned, it'll create a bounding box around the object that's identified. When you upload these images, 1704.07s - 1708.87s | you'll go ahead and actually manually tag them. Again, this is for the training purpose only. 1709.35s - 1713.43s | And so you have these, in this case, tanks. You can go in there and label it as a tank. 1714.39s - 1719.91s | And then once you're all done with doing that labeling, then you can go through the process of training. 1720.15s - 1724.87s | So you'll upload or leverage the images that you've actually uploaded. And as a last step, 1724.95s - 1728.87s | it'll go through and perform the training on all the images that you tagged. 1731.25s - 1734.21s | Then you can start to test the accuracy of all of this. 1734.85s - 1736.77s | So in this case here, 1736.77s - 1741.43s | and one thing it kind of does is it sort of grays out the image a little bit when it shows the overlay 1741.73s - 1746.61s | of what it identified and the level of accuracy to kind of see how well your model worked. 1747.17s - 1750.37s | Within the training is the ability to iterate. 1750.45s - 1754.29s | So there is a drop down that you can leverage where you can say, you


chunk_text:
tag them. Again, this is for the training purpose only. 1709.35s - 1713.43s | And so you have these, in this case, tanks. You can go in there and label it as a tank. 1714.39s - 1719.91s | And then once you're all done with doing that labeling, then you can go through the process of training. 1720.15s - 1724.87s | So you'll upload or leverage the images that you've actually uploaded. And as a last step, 1724.95s - 1728.87s | it'll go through and perform the training on all the images that you tagged. 1731.25s - 1734.21s | Then you can start to test the accuracy of all of this. 1734.85s - 1736.77s | So in this case here, 1736.77s - 1741.43s | and one thing it kind of does is it sort of grays out the image a little bit when it shows the overlay 1741.73s - 1746.61s | of what it identified and the level of accuracy to kind of see how well your model worked. 1747.17s - 1750.37s | Within the training is the ability to iterate. 1750.45s - 1754.29s | So there is a drop down that you can leverage where you can say, you know, it's pretty good, 1754.37s - 1757.17s | but I want to train again and put some more images in here, right? 1757.33s - 1762.45s | So you can actually go through that iteration over and over to hit the level of refinement that you're looking for. 1763.25s - 1769.89s | In addition, at the bottom, it'll also show you things such as the threshold value, the accuracy. 1769.89s - 1774.29s | You can also see the accuracy in the bounding box too, 90% accuracy. 1774.29s - 1775.65s | I guess that's pretty good. 1775.65s - 1781.01s | And we're going to show you in the next slide, though, is we're going to realize that like this isn't quite as accurate as we thought, 1781.01s - 1783.25s | and it'll probably require additional iteration. 1784.05s - 1789.49s | I love this episode, by the way. 1789.49s - 1794.13s | So, you know, Homer had this vehicle that, you know, he designed that had, you know, 1795.09s - 1798.37s | the biggest cup holder and all kinds of other things, you know, in it. 1798.37s - 1802.69s | And I was like, you know, kind of looks like a military vehicle


chunk_text:
know, it's pretty good, 1754.37s - 1757.17s | but I want to train again and put some more images in here, right? 1757.33s - 1762.45s | So you can actually go through that iteration over and over to hit the level of refinement that you're looking for. 1763.25s - 1769.89s | In addition, at the bottom, it'll also show you things such as the threshold value, the accuracy. 1769.89s - 1774.29s | You can also see the accuracy in the bounding box too, 90% accuracy. 1774.29s - 1775.65s | I guess that's pretty good. 1775.65s - 1781.01s | And we're going to show you in the next slide, though, is we're going to realize that like this isn't quite as accurate as we thought, 1781.01s - 1783.25s | and it'll probably require additional iteration. 1784.05s - 1789.49s | I love this episode, by the way. 1789.49s - 1794.13s | So, you know, Homer had this vehicle that, you know, he designed that had, you know, 1795.09s - 1798.37s | the biggest cup holder and all kinds of other things, you know, in it. 1798.37s - 1802.69s | And I was like, you know, kind of looks like a military vehicle could maybe be mistaken by, 1802.69s - 1804.69s | you know, the computer vision is maybe a tank. 1804.69s - 1807.73s | So, you know, let me upload this and see how good this thing is. 1809.92s - 1815.12s | Well, lo and behold, 98% accuracy that this is a tank, right? 1815.12s - 1817.04s | We all know that it's not, right? 1817.04s - 1819.60s | So it's not really a fault of the AI, right? 1819.60s - 1823.92s | It just means we need to upload a larger corpus of data and do better training on it. 1824.48s - 1828.00s | How many images did I load when I did the training on this? 1828.00s - 1829.36s | 11, right? 1829.36s - 1835.04s | So clearly not enough images to, you know, accurately go ahead and train this model, right? 1835.04s - 1840.48s | And what they typically recommend is, you know, upwards of 100, 500, maybe 1,000 images. 1840.48s - 1846.00s | And again, websites like Kaggle and other things have, you know, large data sets like that. 1846.00s - 1848.48s | I think you need an account, but you can download those 1849.12s - 1852.48s |


chunk_text:
could maybe be mistaken by, 1802.69s - 1804.69s | you know, the computer vision is maybe a tank. 1804.69s - 1807.73s | So, you know, let me upload this and see how good this thing is. 1809.92s - 1815.12s | Well, lo and behold, 98% accuracy that this is a tank, right? 1815.12s - 1817.04s | We all know that it's not, right? 1817.04s - 1819.60s | So it's not really a fault of the AI, right? 1819.60s - 1823.92s | It just means we need to upload a larger corpus of data and do better training on it. 1824.48s - 1828.00s | How many images did I load when I did the training on this? 1828.00s - 1829.36s | 11, right? 1829.36s - 1835.04s | So clearly not enough images to, you know, accurately go ahead and train this model, right? 1835.04s - 1840.48s | And what they typically recommend is, you know, upwards of 100, 500, maybe 1,000 images. 1840.48s - 1846.00s | And again, websites like Kaggle and other things have, you know, large data sets like that. 1846.00s - 1848.48s | I think you need an account, but you can download those 1849.12s - 1852.48s | and then upload those to the training model to ensure better accuracy. 1855.54s - 1860.66s | I also decided, hey, well, you know, let me, you know, with this limited training I've done, 1860.66s - 1864.50s | let me upload, you know, just a regular vehicle in this case, a Land Rover. 1864.50s - 1869.06s | Well, it also identified it as a tank with 95% accuracy, right? 1869.06s - 1870.34s | Clearly not a tank. 1870.34s - 1875.46s | So again, definitely want to go through iterations on this and upload large data sets. 1875.46s - 1876.66s | Not a difficult thing, right? 1876.66s - 1878.66s | A lot of this stuff is just point and click. 1878.66s - 1882.02s | And if you do prefer command line, you can do it via those means too. 1882.02s - 1883.62s | The API is available. 1883.62s - 1886.18s | It creates a key within this screen here. 1886.18s - 1887.46s | You can click over to that. 1887.46s - 1890.98s | It'll give you your URL and the key and all of that kind of stuff. 1890.98s - 1894.42s | So you can leverage the API to do the exact


chunk_text:
and then upload those to the training model to ensure better accuracy. 1855.54s - 1860.66s | I also decided, hey, well, you know, let me, you know, with this limited training I've done, 1860.66s - 1864.50s | let me upload, you know, just a regular vehicle in this case, a Land Rover. 1864.50s - 1869.06s | Well, it also identified it as a tank with 95% accuracy, right? 1869.06s - 1870.34s | Clearly not a tank. 1870.34s - 1875.46s | So again, definitely want to go through iterations on this and upload large data sets. 1875.46s - 1876.66s | Not a difficult thing, right? 1876.66s - 1878.66s | A lot of this stuff is just point and click. 1878.66s - 1882.02s | And if you do prefer command line, you can do it via those means too. 1882.02s - 1883.62s | The API is available. 1883.62s - 1886.18s | It creates a key within this screen here. 1886.18s - 1887.46s | You can click over to that. 1887.46s - 1890.98s | It'll give you your URL and the key and all of that kind of stuff. 1890.98s - 1894.42s | So you can leverage the API to do the exact same type of analysis. 1898.31s - 1898.63s | All right. 1898.63s - 1900.07s | So let's talk about AWS. 1900.63s - 1908.07s | So in a talk I did about five or six years ago, I did a talk around optical character recognition, 1908.07s - 1911.03s | object detection, and things like that, and using AWS. 1911.67s - 1915.11s | And continued to do testing, you know, within AWS as well. 1915.91s - 1921.51s | And if you're familiar with AWS, you can download these CloudFormation templates 1922.07s - 1924.55s | that are provided in the AWS store. 1924.55s - 1927.91s | Upload that and it will build out some of this stuff for you 1927.91s - 1931.59s | so that you have kind of a cool interface by which you can upload images. 1931.59s - 1936.23s | So if you have an AWS account or you get a free account, you can look at the marketplace. 1936.23s - 1938.87s | There'll be things sitting out there that people have built. 1938.87s - 1945.51s | You can load it or download a CloudFormation template or Terraform, if you prefer, into AWS. 1945.51s - 1947.19s | Have it build this out


chunk_text:
same type of analysis. 1898.31s - 1898.63s | All right. 1898.63s - 1900.07s | So let's talk about AWS. 1900.63s - 1908.07s | So in a talk I did about five or six years ago, I did a talk around optical character recognition, 1908.07s - 1911.03s | object detection, and things like that, and using AWS. 1911.67s - 1915.11s | And continued to do testing, you know, within AWS as well. 1915.91s - 1921.51s | And if you're familiar with AWS, you can download these CloudFormation templates 1922.07s - 1924.55s | that are provided in the AWS store. 1924.55s - 1927.91s | Upload that and it will build out some of this stuff for you 1927.91s - 1931.59s | so that you have kind of a cool interface by which you can upload images. 1931.59s - 1936.23s | So if you have an AWS account or you get a free account, you can look at the marketplace. 1936.23s - 1938.87s | There'll be things sitting out there that people have built. 1938.87s - 1945.51s | You can load it or download a CloudFormation template or Terraform, if you prefer, into AWS. 1945.51s - 1947.19s | Have it build this out for you. 1947.19s - 1950.87s | And then you can do, you know, similar kinds of things within AWS too. 1951.59s - 1957.43s | In this particular case at the time, I was doing research around fake image detection. 1957.43s - 1960.95s | And these images, some of them were fake. 1960.95s - 1962.31s | Some of them were real. 1962.31s - 1970.15s | And the AI available with the computer vision within AWS, also known as recognition with a K, 1971.35s - 1974.79s | allows you to do very similar things to what I showed you within Azure. 1975.75s - 1981.11s | So you can see at the bottom, it identified a whole variety of characteristics of the image, 1981.11s - 1983.59s | such as humans, flag, symbol. 1984.79s - 1988.47s | The symbol was identified actually from the flag that's orange and white, 1988.47s - 1989.91s | which you can see in the background. 1992.31s - 1995.35s | Apparel, clothing, a tie, things like that. 1995.35s - 1998.31s | And so that became quite helpful in kind of determining, 1998.31s - 1999.99s | comparing this to a couple different pictures. 1999.99s - 2001.59s | Which one is the


chunk_text:
for you. 1947.19s - 1950.87s | And then you can do, you know, similar kinds of things within AWS too. 1951.59s - 1957.43s | In this particular case at the time, I was doing research around fake image detection. 1957.43s - 1960.95s | And these images, some of them were fake. 1960.95s - 1962.31s | Some of them were real. 1962.31s - 1970.15s | And the AI available with the computer vision within AWS, also known as recognition with a K, 1971.35s - 1974.79s | allows you to do very similar things to what I showed you within Azure. 1975.75s - 1981.11s | So you can see at the bottom, it identified a whole variety of characteristics of the image, 1981.11s - 1983.59s | such as humans, flag, symbol. 1984.79s - 1988.47s | The symbol was identified actually from the flag that's orange and white, 1988.47s - 1989.91s | which you can see in the background. 1992.31s - 1995.35s | Apparel, clothing, a tie, things like that. 1995.35s - 1998.31s | And so that became quite helpful in kind of determining, 1998.31s - 1999.99s | comparing this to a couple different pictures. 1999.99s - 2001.59s | Which one is the real one? 2001.59s - 2004.39s | Well, the storyline was about a particular country, 2004.39s - 2009.43s | whereas the image showed a flag from a different country with a different individual. 2009.43s - 2011.83s | And again, you know, you can do facial recognition too. 2011.83s - 2015.19s | I'll leave that up to you, you know, from a privacy standpoint. 2015.19s - 2020.39s | But again, similar kind of thing that you can do also within AWS. 2020.39s - 2024.95s | If you prefer AWS, again, that's a talk I did in the Packet Hacking Village, 2024.95s - 2029.19s | maybe about five or six years ago, which I know is out on YouTube and other things too. 2033.24s - 2036.60s | All right. So what are the benefits of the object detection? 2037.48s - 2039.16s | It can help build out that timeline. 2039.16s - 2044.20s | So if I can find characteristics of the image that enumerate where the picture was taken, 2044.20s - 2047.08s | then I can actually map it out on a map just like this. 2048.68s - 2053.24s | So I automated within Google Maps the ability to auto-label these images 2053.32s


chunk_text:
real one? 2001.59s - 2004.39s | Well, the storyline was about a particular country, 2004.39s - 2009.43s | whereas the image showed a flag from a different country with a different individual. 2009.43s - 2011.83s | And again, you know, you can do facial recognition too. 2011.83s - 2015.19s | I'll leave that up to you, you know, from a privacy standpoint. 2015.19s - 2020.39s | But again, similar kind of thing that you can do also within AWS. 2020.39s - 2024.95s | If you prefer AWS, again, that's a talk I did in the Packet Hacking Village, 2024.95s - 2029.19s | maybe about five or six years ago, which I know is out on YouTube and other things too. 2033.24s - 2036.60s | All right. So what are the benefits of the object detection? 2037.48s - 2039.16s | It can help build out that timeline. 2039.16s - 2044.20s | So if I can find characteristics of the image that enumerate where the picture was taken, 2044.20s - 2047.08s | then I can actually map it out on a map just like this. 2048.68s - 2053.24s | So I automated within Google Maps the ability to auto-label these images 2053.32s - 2057.64s | and then plot them on a map because I wanted to use it for predictive analysis. 2057.64s - 2060.76s | So here, and this is part of the presentation I covered last year, 2060.76s - 2066.28s | but now using this with the optical character recognition and object detection 2066.28s - 2067.96s | to map out a lot of these things. 2069.32s - 2073.96s | So as I had these fed into Google Maps and then tagged, 2074.76s - 2077.72s | and by location or estimated location, 2077.72s - 2082.92s | I could start to kind of map out the formation and the ongoing war 2082.92s - 2085.72s | in terms of a timeline, location, and other things. 2086.28s - 2090.84s | Again, which is super helpful if you don't have latitude, longitude, geolocation, 2090.84s - 2093.00s | specific type data, which many times you don't. 2093.88s - 2096.84s | So this became super helpful in mapping this out 2096.84s - 2100.36s | and understanding where the Russians might attack next within the Ukraine. 2104.24s - 2106.24s | So again, if this is something you're interested in, 2106.80s - 2109.12s | we dove really deep on this


chunk_text:
- 2057.64s | and then plot them on a map because I wanted to use it for predictive analysis. 2057.64s - 2060.76s | So here, and this is part of the presentation I covered last year, 2060.76s - 2066.28s | but now using this with the optical character recognition and object detection 2066.28s - 2067.96s | to map out a lot of these things. 2069.32s - 2073.96s | So as I had these fed into Google Maps and then tagged, 2074.76s - 2077.72s | and by location or estimated location, 2077.72s - 2082.92s | I could start to kind of map out the formation and the ongoing war 2082.92s - 2085.72s | in terms of a timeline, location, and other things. 2086.28s - 2090.84s | Again, which is super helpful if you don't have latitude, longitude, geolocation, 2090.84s - 2093.00s | specific type data, which many times you don't. 2093.88s - 2096.84s | So this became super helpful in mapping this out 2096.84s - 2100.36s | and understanding where the Russians might attack next within the Ukraine. 2104.24s - 2106.24s | So again, if this is something you're interested in, 2106.80s - 2109.12s | we dove really deep on this last year. 2109.12s - 2114.40s | But one of the things I will say is it became very helpful with predictive analysis. 2114.40s - 2117.68s | So we started to identify churches that were being destroyed, 2117.68s - 2119.68s | which was a data point I wasn't looking at at all. 2119.68s - 2120.96s | We talked about that earlier. 2121.76s - 2125.84s | So in terms of looking at those data points of the churches being destroyed, 2125.84s - 2128.00s | we actually could see the path of the military 2128.00s - 2130.16s | and where they were going from a timeline perspective. 2130.72s - 2135.52s | If you're tracking a person of interest unrelated to war or something like that, 2135.52s - 2138.96s | again, you can leverage this data and potentially map it on a map too. 2139.52s - 2140.64s | Very easy to do. 2140.64s - 2146.32s | I just used Google Maps, went in there and leveraged the ability to create all of these pins, 2146.32s - 2149.28s | put all that data in there, which was quite easy to do, 2149.28s - 2153.60s | and then started looking at the data from a predictive


chunk_text:
last year. 2109.12s - 2114.40s | But one of the things I will say is it became very helpful with predictive analysis. 2114.40s - 2117.68s | So we started to identify churches that were being destroyed, 2117.68s - 2119.68s | which was a data point I wasn't looking at at all. 2119.68s - 2120.96s | We talked about that earlier. 2121.76s - 2125.84s | So in terms of looking at those data points of the churches being destroyed, 2125.84s - 2128.00s | we actually could see the path of the military 2128.00s - 2130.16s | and where they were going from a timeline perspective. 2130.72s - 2135.52s | If you're tracking a person of interest unrelated to war or something like that, 2135.52s - 2138.96s | again, you can leverage this data and potentially map it on a map too. 2139.52s - 2140.64s | Very easy to do. 2140.64s - 2146.32s | I just used Google Maps, went in there and leveraged the ability to create all of these pins, 2146.32s - 2149.28s | put all that data in there, which was quite easy to do, 2149.28s - 2153.60s | and then started looking at the data from a predictive analysis perspective. 2158.20s - 2160.76s | So some of the lessons learned on the object detection side, 2161.32s - 2163.72s | definitely train and then train again. 2163.72s - 2165.72s | This takes an iterative approach. 2165.72s - 2167.96s | But again, there's large data sets sitting out there 2167.96s - 2169.80s | that are very easy to download and upload, 2170.28s - 2176.04s | whole process, identifying that and getting those images in there just takes a few minutes, 2176.04s - 2179.88s | but it might take a day or longer for it to train if you have a huge corpus of data. 2182.21s - 2185.25s | But what's really great about it is when you do that training, 2185.25s - 2187.97s | now it's focusing on the data you're most interested in. 2187.97s - 2191.25s | And I'll take a day's worth of training versus 2191.25s - 2194.93s | two weeks of sifting through a wasteland of OSINT data any day. 2198.08s - 2199.84s | So you can also do video analysis. 2200.80s - 2204.16s | This type of thing is available within AWS and Azure. 2204.72s - 2207.68s | And the extraction is really interesting. 2209.44s -


chunk_text:
analysis perspective. 2158.20s - 2160.76s | So some of the lessons learned on the object detection side, 2161.32s - 2163.72s | definitely train and then train again. 2163.72s - 2165.72s | This takes an iterative approach. 2165.72s - 2167.96s | But again, there's large data sets sitting out there 2167.96s - 2169.80s | that are very easy to download and upload, 2170.28s - 2176.04s | whole process, identifying that and getting those images in there just takes a few minutes, 2176.04s - 2179.88s | but it might take a day or longer for it to train if you have a huge corpus of data. 2182.21s - 2185.25s | But what's really great about it is when you do that training, 2185.25s - 2187.97s | now it's focusing on the data you're most interested in. 2187.97s - 2191.25s | And I'll take a day's worth of training versus 2191.25s - 2194.93s | two weeks of sifting through a wasteland of OSINT data any day. 2198.08s - 2199.84s | So you can also do video analysis. 2200.80s - 2204.16s | This type of thing is available within AWS and Azure. 2204.72s - 2207.68s | And the extraction is really interesting. 2209.44s - 2212.72s | If you're trying to do this today, it's very manually intensive. 2213.44s - 2217.28s | You may have a lot of videos, very time consuming as well. 2218.64s - 2223.52s | And one of the cool things when I first started doing this a number of years back 2223.52s - 2225.04s | is the speech recognition too, 2225.04s - 2227.92s | which actually helped me find some really interesting things 2227.92s - 2230.40s | going on with some of the investigations I was doing 2230.40s - 2232.56s | and really brought out some cool evidence. 2232.56s - 2233.84s | So let's talk more about that. 2236.79s - 2242.07s | So in the case of AWS recognition, it will identify objects throughout the video. 2242.87s - 2246.95s | It'll also tell you in the timeline where it showed up in the video, 2246.95s - 2254.15s | how often it showed up in the video, and the location, as I mentioned in the timeline. 2255.03s - 2259.99s | It may also miss a lot of subtleties that you actually didn't identify. 2260.63s - 2264.95s | Much like the optical character recognition and the object detection, 2265.67s - 2268.95s | with


chunk_text:
2212.72s | If you're trying to do this today, it's very manually intensive. 2213.44s - 2217.28s | You may have a lot of videos, very time consuming as well. 2218.64s - 2223.52s | And one of the cool things when I first started doing this a number of years back 2223.52s - 2225.04s | is the speech recognition too, 2225.04s - 2227.92s | which actually helped me find some really interesting things 2227.92s - 2230.40s | going on with some of the investigations I was doing 2230.40s - 2232.56s | and really brought out some cool evidence. 2232.56s - 2233.84s | So let's talk more about that. 2236.79s - 2242.07s | So in the case of AWS recognition, it will identify objects throughout the video. 2242.87s - 2246.95s | It'll also tell you in the timeline where it showed up in the video, 2246.95s - 2254.15s | how often it showed up in the video, and the location, as I mentioned in the timeline. 2255.03s - 2259.99s | It may also miss a lot of subtleties that you actually didn't identify. 2260.63s - 2264.95s | Much like the optical character recognition and the object detection, 2265.67s - 2268.95s | with the video analysis, very similar approach in that regard. 2268.95s - 2272.23s | But again, help identify things in the foreground or the background. 2272.95s - 2282.39s | In the video, this was an interview myself and a coworker did for CNN. 2283.27s - 2286.95s | I did a demo and later in the video was showing things in the video 2286.95s - 2290.71s | and I was blown away with how it found all this stuff 2290.71s - 2293.27s | in the actual demo that I was actually doing. 2293.27s - 2295.43s | Things I didn't even realize were in the image. 2295.43s - 2297.75s | So there's lots of cool stuff and you can see at the bottom 2299.35s - 2302.23s | how you can really leverage this and automate this as a process. 2302.23s - 2305.43s | You can upload all the images and just have it crank through all of them 2305.43s - 2308.23s | and create reports or consolidated reports for you. 2308.23s - 2310.47s | Very clean and efficient way to do it. 2310.47s - 2313.59s | This was also related to a talk I did a couple years back, 2313.67s - 2318.07s |


chunk_text:
the video analysis, very similar approach in that regard. 2268.95s - 2272.23s | But again, help identify things in the foreground or the background. 2272.95s - 2282.39s | In the video, this was an interview myself and a coworker did for CNN. 2283.27s - 2286.95s | I did a demo and later in the video was showing things in the video 2286.95s - 2290.71s | and I was blown away with how it found all this stuff 2290.71s - 2293.27s | in the actual demo that I was actually doing. 2293.27s - 2295.43s | Things I didn't even realize were in the image. 2295.43s - 2297.75s | So there's lots of cool stuff and you can see at the bottom 2299.35s - 2302.23s | how you can really leverage this and automate this as a process. 2302.23s - 2305.43s | You can upload all the images and just have it crank through all of them 2305.43s - 2308.23s | and create reports or consolidated reports for you. 2308.23s - 2310.47s | Very clean and efficient way to do it. 2310.47s - 2313.59s | This was also related to a talk I did a couple years back, 2313.67s - 2318.07s | which is also on YouTube if you're looking at this from an AWS standpoint. 2320.88s - 2322.96s | You can do the same thing within Azure. 2322.96s - 2326.56s | From that home screen, if you want to upload a sample video, 2326.56s - 2328.16s | it'll do the same type of thing. 2328.16s - 2329.52s | May look a little bit different, right? 2329.52s - 2330.96s | Different cloud platform. 2330.96s - 2333.12s | But it effectively does the same kind of thing. 2333.68s - 2337.92s | And here I uploaded a presentation Chet and I had done at a different conference, 2337.92s - 2340.72s | which was more like slides and talking, 2340.72s - 2343.28s | but it did pick up on all the instances. 2343.28s - 2345.52s | In this case, I wanted to find related to OSINT. 2346.32s - 2348.64s | Any slide that had OSINT on it and all of that stuff, 2348.64s - 2351.44s | it found it not by virtue of the PowerPoint, 2351.44s - 2354.88s | but by virtue of the actual video itself, which I thought was pretty cool. 2354.88s - 2358.96s | And this only took a couple minutes to


chunk_text:
which is also on YouTube if you're looking at this from an AWS standpoint. 2320.88s - 2322.96s | You can do the same thing within Azure. 2322.96s - 2326.56s | From that home screen, if you want to upload a sample video, 2326.56s - 2328.16s | it'll do the same type of thing. 2328.16s - 2329.52s | May look a little bit different, right? 2329.52s - 2330.96s | Different cloud platform. 2330.96s - 2333.12s | But it effectively does the same kind of thing. 2333.68s - 2337.92s | And here I uploaded a presentation Chet and I had done at a different conference, 2337.92s - 2340.72s | which was more like slides and talking, 2340.72s - 2343.28s | but it did pick up on all the instances. 2343.28s - 2345.52s | In this case, I wanted to find related to OSINT. 2346.32s - 2348.64s | Any slide that had OSINT on it and all of that stuff, 2348.64s - 2351.44s | it found it not by virtue of the PowerPoint, 2351.44s - 2354.88s | but by virtue of the actual video itself, which I thought was pretty cool. 2354.88s - 2358.96s | And this only took a couple minutes to run and it was an hour long presentation. 2362.56s - 2365.36s | The speech recognition is also super awesome. 2365.36s - 2369.12s | In the case of AWS, again, it'll help identify 2369.12s - 2371.52s | where in the video in the timeline this occurred. 2372.16s - 2378.96s | It'll also then transform this into words and phrases 2378.96s - 2382.24s | and how frequently they showed up, the confidence level, 2382.24s - 2385.36s | and actually gives you a search capability to go through that 2385.36s - 2387.36s | if you're looking for somebody talking about 2387.36s - 2389.52s | something suspicious to your investigation. 2392.72s - 2394.96s | So when you dive into the details of it, 2394.96s - 2396.56s | you have all these various filters. 2396.56s - 2399.52s | You can see all the keywords, all the mentions, 2399.52s - 2401.92s | and everything that were done as a result of 2402.88s - 2406.32s | analyzing the video using AWS recognition 2406.32s - 2408.24s | and the speech recognition componentry. 2409.92s - 2412.08s | There are a variety of other things that you can do with it. 2412.08s - 2417.20s | As you can see here,


chunk_text:
run and it was an hour long presentation. 2362.56s - 2365.36s | The speech recognition is also super awesome. 2365.36s - 2369.12s | In the case of AWS, again, it'll help identify 2369.12s - 2371.52s | where in the video in the timeline this occurred. 2372.16s - 2378.96s | It'll also then transform this into words and phrases 2378.96s - 2382.24s | and how frequently they showed up, the confidence level, 2382.24s - 2385.36s | and actually gives you a search capability to go through that 2385.36s - 2387.36s | if you're looking for somebody talking about 2387.36s - 2389.52s | something suspicious to your investigation. 2392.72s - 2394.96s | So when you dive into the details of it, 2394.96s - 2396.56s | you have all these various filters. 2396.56s - 2399.52s | You can see all the keywords, all the mentions, 2399.52s - 2401.92s | and everything that were done as a result of 2402.88s - 2406.32s | analyzing the video using AWS recognition 2406.32s - 2408.24s | and the speech recognition componentry. 2409.92s - 2412.08s | There are a variety of other things that you can do with it. 2412.08s - 2417.20s | As you can see here, it used to have the capabilities with celebrities. 2417.20s - 2420.08s | I know there's been some privacy lockdowns and things like that 2420.08s - 2424.08s | with some of the cloud vendors, but also faces, words, cues. 2424.08s - 2427.28s | You could upload a face of a person of interest 2427.28s - 2429.28s | that you're investigating, things like that. 2429.28s - 2433.76s | Again, rely on your laws, privacy, all of that kind of stuff. 2438.36s - 2441.96s | So some of the things that come out of this then 2441.96s - 2445.72s | are trying to improve the accuracy, the efficiency, 2445.72s - 2448.44s | and what I consider time to evidence. 2448.44s - 2451.88s | Again, if you collected a plethora of data or your team has, 2451.88s - 2454.68s | and now it's your job to kind of sift through all of this, 2454.68s - 2457.80s | these automated approaches are kind of priceless. 2457.80s - 2460.44s | I mean, you could just leverage all this ability 2460.44s - 2463.48s | to really find that data of interest you're most interested in. 2463.48s - 2465.56s | It's impossible to do all of it manually.


chunk_text:
it used to have the capabilities with celebrities. 2417.20s - 2420.08s | I know there's been some privacy lockdowns and things like that 2420.08s - 2424.08s | with some of the cloud vendors, but also faces, words, cues. 2424.08s - 2427.28s | You could upload a face of a person of interest 2427.28s - 2429.28s | that you're investigating, things like that. 2429.28s - 2433.76s | Again, rely on your laws, privacy, all of that kind of stuff. 2438.36s - 2441.96s | So some of the things that come out of this then 2441.96s - 2445.72s | are trying to improve the accuracy, the efficiency, 2445.72s - 2448.44s | and what I consider time to evidence. 2448.44s - 2451.88s | Again, if you collected a plethora of data or your team has, 2451.88s - 2454.68s | and now it's your job to kind of sift through all of this, 2454.68s - 2457.80s | these automated approaches are kind of priceless. 2457.80s - 2460.44s | I mean, you could just leverage all this ability 2460.44s - 2463.48s | to really find that data of interest you're most interested in. 2463.48s - 2465.56s | It's impossible to do all of it manually. 2467.08s - 2471.08s | In addition, it can also kind of validate narratives you may have 2471.08s - 2473.80s | or nefarious activity that you're trying to prove out. 2474.44s - 2476.76s | So as you start to look at the data, 2476.76s - 2480.04s | you may eliminate things too that you thought were important artifacts 2480.04s - 2483.80s | that are actually unrelated to the event, the activity, 2483.80s - 2486.20s | the investigation as well. 2486.20s - 2488.20s | So there's that other side of the coin too, 2488.20s - 2492.92s | and making sure you kind of validate the legitimateness of that evidence. 2494.76s - 2497.56s | And it's not a replacement for the human in the loop, 2498.44s - 2504.28s | but it will vastly distill down your valuable data to less than 1%. 2505.16s - 2508.68s | And then as your team may be going through and manually, 2508.68s - 2511.64s | visually looking at a lot of these things to validate it, 2511.64s - 2515.56s | help create that really refined, curated data set 2515.56s - 2517.08s | that you're really focused on. 2517.08s - 2520.44s | In other words, the human in


chunk_text:
2467.08s - 2471.08s | In addition, it can also kind of validate narratives you may have 2471.08s - 2473.80s | or nefarious activity that you're trying to prove out. 2474.44s - 2476.76s | So as you start to look at the data, 2476.76s - 2480.04s | you may eliminate things too that you thought were important artifacts 2480.04s - 2483.80s | that are actually unrelated to the event, the activity, 2483.80s - 2486.20s | the investigation as well. 2486.20s - 2488.20s | So there's that other side of the coin too, 2488.20s - 2492.92s | and making sure you kind of validate the legitimateness of that evidence. 2494.76s - 2497.56s | And it's not a replacement for the human in the loop, 2498.44s - 2504.28s | but it will vastly distill down your valuable data to less than 1%. 2505.16s - 2508.68s | And then as your team may be going through and manually, 2508.68s - 2511.64s | visually looking at a lot of these things to validate it, 2511.64s - 2515.56s | help create that really refined, curated data set 2515.56s - 2517.08s | that you're really focused on. 2517.08s - 2520.44s | In other words, the human in the loop will really come into play 2520.44s - 2524.60s | much more in that last mile with the analysis and the results of that. 2525.72s - 2528.36s | So I know we have a few minutes left. 2529.24s - 2532.92s | Anybody have any questions or anything related to what we've covered? 2536.32s - 2536.82s | Go ahead. 2537.62s - 2540.02s | How are you, you know, these sorts of data, 2540.02s - 2544.20s | you know, there's these are offers and stuff like that. 2544.20s - 2547.08s | But say, you know, you're, you're looking to do, 2547.88s - 2562.12s | like, trace labs, but, you know, listed out there in images and stuff like that. 2562.84s - 2566.68s | Where, besides X, you know, where, where would I go, 2566.68s - 2573.64s | where things like that, where would you find availability for? 2573.64s - 2577.24s | Yeah, I have found over the years, 2578.20s - 2583.56s | the source, the sources that are best are related to the type of thing you're doing. 2583.56s - 2585.08s | So here's an example. 2585.08s - 2588.84s | So, yeah, X may have a plethora of data in the


chunk_text:
the loop will really come into play 2520.44s - 2524.60s | much more in that last mile with the analysis and the results of that. 2525.72s - 2528.36s | So I know we have a few minutes left. 2529.24s - 2532.92s | Anybody have any questions or anything related to what we've covered? 2536.32s - 2536.82s | Go ahead. 2537.62s - 2540.02s | How are you, you know, these sorts of data, 2540.02s - 2544.20s | you know, there's these are offers and stuff like that. 2544.20s - 2547.08s | But say, you know, you're, you're looking to do, 2547.88s - 2562.12s | like, trace labs, but, you know, listed out there in images and stuff like that. 2562.84s - 2566.68s | Where, besides X, you know, where, where would I go, 2566.68s - 2573.64s | where things like that, where would you find availability for? 2573.64s - 2577.24s | Yeah, I have found over the years, 2578.20s - 2583.56s | the source, the sources that are best are related to the type of thing you're doing. 2583.56s - 2585.08s | So here's an example. 2585.08s - 2588.84s | So, yeah, X may have a plethora of data in the case of like, 2588.84s - 2589.88s | I'll give a few examples. 2589.88s - 2592.20s | The first being the Russian-Ukrainian war. 2592.20s - 2596.76s | But we also found that the second most useful resource was actually Discord. 2596.76s - 2599.96s | So people were posting stuff from around the world on there 2599.96s - 2602.68s | that were both pro-Russian as well as pro-Ukrainian, 2602.68s - 2605.48s | you know, not to get into the political side of it, 2605.48s - 2609.24s | but there was, like, valuable data coming in from, like, both sides. 2609.24s - 2613.24s | So those became a wealth of information for the type of research we did. 2613.24s - 2615.88s | Did we get information from other locations too? 2615.88s - 2619.08s | Sure, we got stuff from Facebook and Instagram and other locations, 2619.08s - 2622.12s | but I would say those were the two standouts in terms of the war. 2623.32s - 2626.28s | In other types of, you know, analysis and investigation, 2626.28s - 2629.40s | we've done, for example, an imminent weather event. 2629.40s - 2632.04s | You know, I live in Cape Coral, Florida, you know, 2632.04s


chunk_text:
case of like, 2588.84s - 2589.88s | I'll give a few examples. 2589.88s - 2592.20s | The first being the Russian-Ukrainian war. 2592.20s - 2596.76s | But we also found that the second most useful resource was actually Discord. 2596.76s - 2599.96s | So people were posting stuff from around the world on there 2599.96s - 2602.68s | that were both pro-Russian as well as pro-Ukrainian, 2602.68s - 2605.48s | you know, not to get into the political side of it, 2605.48s - 2609.24s | but there was, like, valuable data coming in from, like, both sides. 2609.24s - 2613.24s | So those became a wealth of information for the type of research we did. 2613.24s - 2615.88s | Did we get information from other locations too? 2615.88s - 2619.08s | Sure, we got stuff from Facebook and Instagram and other locations, 2619.08s - 2622.12s | but I would say those were the two standouts in terms of the war. 2623.32s - 2626.28s | In other types of, you know, analysis and investigation, 2626.28s - 2629.40s | we've done, for example, an imminent weather event. 2629.40s - 2632.04s | You know, I live in Cape Coral, Florida, you know, 2632.04s - 2635.40s | and we were hit directly by Hurricane Ian, you know. 2635.96s - 2639.24s | And really trying to get that intelligence, 2639.24s - 2643.32s | I was going out there and gathering all kinds of weather-related data. 2643.32s - 2646.44s | I was also doing it not by just hitting up social media, 2646.44s - 2651.88s | but RSS feeds and other things were incredibly useful for my OSINT data collection. 2651.88s - 2654.52s | So I was able to gather a lot of that information, 2654.52s - 2657.00s | you know, quite handy as well. 2657.00s - 2659.00s | And that became a really important data source. 2659.00s - 2660.84s | It was like, who uses RSS anymore? 2660.84s - 2662.44s | And it was like, it's like bigger than ever. 2662.44s - 2665.00s | I couldn't believe how much data was out there, you know. 2665.00s - 2667.96s | So at the end of the day, I think it becomes, you know, 2667.96s - 2670.20s | it becomes a little bit part of the tradecraft 2670.20s - 2673.80s | in kind of determining like the type of investigation you're doing 2673.80s - 2678.84s | and


chunk_text:
- 2635.40s | and we were hit directly by Hurricane Ian, you know. 2635.96s - 2639.24s | And really trying to get that intelligence, 2639.24s - 2643.32s | I was going out there and gathering all kinds of weather-related data. 2643.32s - 2646.44s | I was also doing it not by just hitting up social media, 2646.44s - 2651.88s | but RSS feeds and other things were incredibly useful for my OSINT data collection. 2651.88s - 2654.52s | So I was able to gather a lot of that information, 2654.52s - 2657.00s | you know, quite handy as well. 2657.00s - 2659.00s | And that became a really important data source. 2659.00s - 2660.84s | It was like, who uses RSS anymore? 2660.84s - 2662.44s | And it was like, it's like bigger than ever. 2662.44s - 2665.00s | I couldn't believe how much data was out there, you know. 2665.00s - 2667.96s | So at the end of the day, I think it becomes, you know, 2667.96s - 2670.20s | it becomes a little bit part of the tradecraft 2670.20s - 2673.80s | in kind of determining like the type of investigation you're doing 2673.80s - 2678.84s | and what the most useful, you know, locations are for that type of data. 2678.84s - 2681.32s | You know, I don't know if that fully answers your question, 2681.32s - 2682.28s | but that's what I've learned. 2682.76s - 2693.53s | Yeah, right, exactly. 2694.09s - 2694.81s | Cool. 2694.81s - 2696.25s | I know someone had a question over here. 2705.82s - 2710.22s | Yeah, there are options to assign weighted values to it as well. 2710.22s - 2713.26s | There's a bunch of dropdowns I didn't really get into in a lot of detail 2713.26s - 2715.98s | in like a 40-minute presentation, but you're absolutely right. 2715.98s - 2719.10s | So whether it's in AWS or within Azure, 2719.10s - 2723.42s | there are a lot of those weighted options and thresholds and performance stuff 2724.22s - 2726.54s | that you can actually validate as you train 2726.54s - 2728.70s | and then retrain and go through those iterations. 2728.70s - 2729.26s | Good point. 2729.26s - 2730.22s | Yep, absolutely. 2731.58s - 2732.38s | Go ahead. 2732.38s - 2740.79s | Oh, interesting. 2741.19s - 2747.91s | Um, I know that in the example for Azure with


chunk_text:
what the most useful, you know, locations are for that type of data. 2678.84s - 2681.32s | You know, I don't know if that fully answers your question, 2681.32s - 2682.28s | but that's what I've learned. 2682.76s - 2693.53s | Yeah, right, exactly. 2694.09s - 2694.81s | Cool. 2694.81s - 2696.25s | I know someone had a question over here. 2705.82s - 2710.22s | Yeah, there are options to assign weighted values to it as well. 2710.22s - 2713.26s | There's a bunch of dropdowns I didn't really get into in a lot of detail 2713.26s - 2715.98s | in like a 40-minute presentation, but you're absolutely right. 2715.98s - 2719.10s | So whether it's in AWS or within Azure, 2719.10s - 2723.42s | there are a lot of those weighted options and thresholds and performance stuff 2724.22s - 2726.54s | that you can actually validate as you train 2726.54s - 2728.70s | and then retrain and go through those iterations. 2728.70s - 2729.26s | Good point. 2729.26s - 2730.22s | Yep, absolutely. 2731.58s - 2732.38s | Go ahead. 2732.38s - 2740.79s | Oh, interesting. 2741.19s - 2747.91s | Um, I know that in the example for Azure with Power Automate and Power Apps, 2747.91s - 2750.39s | you can do it kind of like a live feed. 2750.39s - 2758.15s | So as an example, I've done labs with X or formerly Twitter doing exactly that. 2758.15s - 2762.23s | So as the tweets are coming out more based on the live feed, 2762.23s - 2765.27s | whereas what you're viewing in the app is it may be a second old, 2765.27s - 2767.19s | but it's historical data, right? 2767.19s - 2773.35s | Using the live streaming Tweepy API versus the historical feed, right? 2773.35s - 2776.31s | So techniques like that, yes, you know, to leverage that. 2776.31s - 2777.59s | So the short answer is yes. 2777.59s - 2780.15s | And I think that becomes a little part of the tradecraft too. 2780.15s - 2784.63s | I know Chet and I did a presentation a few years ago on how to use Tweepy to do that with, 2785.27s - 2789.67s | at the time it was Twitter, you know, but we also tested when it morphed into X as well. 2790.31s - 2792.23s | I'm sorry, there's so many people raising their hands. 2792.23s -


chunk_text:
Power Automate and Power Apps, 2747.91s - 2750.39s | you can do it kind of like a live feed. 2750.39s - 2758.15s | So as an example, I've done labs with X or formerly Twitter doing exactly that. 2758.15s - 2762.23s | So as the tweets are coming out more based on the live feed, 2762.23s - 2765.27s | whereas what you're viewing in the app is it may be a second old, 2765.27s - 2767.19s | but it's historical data, right? 2767.19s - 2773.35s | Using the live streaming Tweepy API versus the historical feed, right? 2773.35s - 2776.31s | So techniques like that, yes, you know, to leverage that. 2776.31s - 2777.59s | So the short answer is yes. 2777.59s - 2780.15s | And I think that becomes a little part of the tradecraft too. 2780.15s - 2784.63s | I know Chet and I did a presentation a few years ago on how to use Tweepy to do that with, 2785.27s - 2789.67s | at the time it was Twitter, you know, but we also tested when it morphed into X as well. 2790.31s - 2792.23s | I'm sorry, there's so many people raising their hands. 2792.23s - 2792.55s | Go ahead. 2817.34s - 2820.46s | We have and we demonstrated it in the Packet Hacking Village. 2821.34s - 2823.34s | I think two years ago. 2823.98s - 2825.82s | So if you go back and look at those videos, 2825.82s - 2829.82s | we created a Python tool and a little mini UI for doing that. 2829.82s - 2834.30s | And it would collect from multiple sources to do that kind of thing. 2834.30s - 2838.14s | Again, kind of based on the tradecraft and knowing what you wanted to collect. 2838.14s - 2841.66s | Again, we use the Russian-Ukrainian War because there was a ton of data around that. 2841.66s - 2843.18s | We also did it around the election, 2843.18s - 2848.30s | the previous election and things like that too, excuse me, to collect that data. 2848.30s - 2850.70s | So the short answer is yes, you can definitely do that. 2850.70s - 2852.70s | The APIs may be quite different. 2852.70s - 2856.38s | So the API for Discord versus X versus all these different things 2856.38s - 2859.26s | are all slightly proprietary unto themselves, right? 2859.26s - 2860.86s | But the


chunk_text:
2792.55s | Go ahead. 2817.34s - 2820.46s | We have and we demonstrated it in the Packet Hacking Village. 2821.34s - 2823.34s | I think two years ago. 2823.98s - 2825.82s | So if you go back and look at those videos, 2825.82s - 2829.82s | we created a Python tool and a little mini UI for doing that. 2829.82s - 2834.30s | And it would collect from multiple sources to do that kind of thing. 2834.30s - 2838.14s | Again, kind of based on the tradecraft and knowing what you wanted to collect. 2838.14s - 2841.66s | Again, we use the Russian-Ukrainian War because there was a ton of data around that. 2841.66s - 2843.18s | We also did it around the election, 2843.18s - 2848.30s | the previous election and things like that too, excuse me, to collect that data. 2848.30s - 2850.70s | So the short answer is yes, you can definitely do that. 2850.70s - 2852.70s | The APIs may be quite different. 2852.70s - 2856.38s | So the API for Discord versus X versus all these different things 2856.38s - 2859.26s | are all slightly proprietary unto themselves, right? 2859.26s - 2860.86s | But the short answer is yes. 2860.86s - 2861.10s | Yeah. 2861.90s - 2863.02s | Someone had a question over here. 2863.58s - 2863.90s | Go ahead. 2873.24s - 2876.28s | I can't, honestly, I can't really comment on that 2876.28s - 2879.48s | because it's changing so much and there's so many different laws. 2879.48s - 2880.12s | Yeah. 2880.12s - 2882.04s | So you're absolutely right. 2883.48s - 2886.12s | The only advice I would really give is what you would expect, 2886.12s - 2889.08s | which is like check your local vicinity, your country, 2889.32s - 2893.24s | all of those things and see what you are and are not allowed to do. 2893.24s - 2895.08s | There's so many overlapping laws now, 2895.08s - 2898.68s | I'd probably get myself in trouble making any kind of recommendation. 2898.68s - 2899.88s | So my apologies. 2899.88s - 2900.60s | So, yeah. 2916.73s - 2921.69s | So what you're talking about is testing to see 2922.49s - 2926.01s | if you've created something that it will accidentally miss. 2926.57s - 2927.05s | Yeah. 2927.05s - 2927.45s | Yeah. 2927.45s - 2928.09s | So I have. 2928.09s - 2931.69s | And


chunk_text:
short answer is yes. 2860.86s - 2861.10s | Yeah. 2861.90s - 2863.02s | Someone had a question over here. 2863.58s - 2863.90s | Go ahead. 2873.24s - 2876.28s | I can't, honestly, I can't really comment on that 2876.28s - 2879.48s | because it's changing so much and there's so many different laws. 2879.48s - 2880.12s | Yeah. 2880.12s - 2882.04s | So you're absolutely right. 2883.48s - 2886.12s | The only advice I would really give is what you would expect, 2886.12s - 2889.08s | which is like check your local vicinity, your country, 2889.32s - 2893.24s | all of those things and see what you are and are not allowed to do. 2893.24s - 2895.08s | There's so many overlapping laws now, 2895.08s - 2898.68s | I'd probably get myself in trouble making any kind of recommendation. 2898.68s - 2899.88s | So my apologies. 2899.88s - 2900.60s | So, yeah. 2916.73s - 2921.69s | So what you're talking about is testing to see 2922.49s - 2926.01s | if you've created something that it will accidentally miss. 2926.57s - 2927.05s | Yeah. 2927.05s - 2927.45s | Yeah. 2927.45s - 2928.09s | So I have. 2928.09s - 2931.69s | And that was in a presentation a couple of years ago when I did the AWS one. 2931.69s - 2936.33s | What I did in that particular one was I come from a steganography background. 2936.33s - 2940.97s | So I was really looking for creative ways to circumvent the detection, 2940.97s - 2943.45s | basically, for the optical character recognition. 2943.45s - 2946.01s | In that presentation, I covered a couple of different types. 2946.65s - 2949.93s | The easiest one was taking a Word document, 2951.45s - 2954.89s | making it a black background instead of a white background, 2954.89s - 2960.41s | and then changing the shade of my characters to just one off 2960.41s - 2962.41s | from the main page. 2962.41s - 2964.57s | So it looked like black on black. 2964.57s - 2967.21s | If you looked at it at histogram or other type of analysis, 2968.01s - 2971.29s | the exposure type of analysis, you would see it. 2971.29s - 2974.57s | But I wanted to see if the AI could actually detect it or not. 2974.57s - 2975.13s | And it didn't. 2975.69s - 2977.93s | But I talked about that in the


chunk_text:
that was in a presentation a couple of years ago when I did the AWS one. 2931.69s - 2936.33s | What I did in that particular one was I come from a steganography background. 2936.33s - 2940.97s | So I was really looking for creative ways to circumvent the detection, 2940.97s - 2943.45s | basically, for the optical character recognition. 2943.45s - 2946.01s | In that presentation, I covered a couple of different types. 2946.65s - 2949.93s | The easiest one was taking a Word document, 2951.45s - 2954.89s | making it a black background instead of a white background, 2954.89s - 2960.41s | and then changing the shade of my characters to just one off 2960.41s - 2962.41s | from the main page. 2962.41s - 2964.57s | So it looked like black on black. 2964.57s - 2967.21s | If you looked at it at histogram or other type of analysis, 2968.01s - 2971.29s | the exposure type of analysis, you would see it. 2971.29s - 2974.57s | But I wanted to see if the AI could actually detect it or not. 2974.57s - 2975.13s | And it didn't. 2975.69s - 2977.93s | But I talked about that in the presentation. 2977.93s - 2981.13s | So in the point I had made was like, 2981.13s - 2987.37s | and I think the presentation I did at the time was remaining covert in an overt world. 2987.37s - 2989.05s | I did it in the packet hacking village. 2989.05s - 2991.05s | I think it was in that presentation where I talked about 2991.05s - 2994.57s | how you could covertly communicate in a whole bunch of different ways. 2994.57s - 2995.53s | And that was one of them. 2995.53s - 2998.81s | And I showed how the optical character recognition didn't detect it. 2998.81s - 3000.25s | So does that kind of help? 3000.25s - 3001.61s | Is that we were kind of wondering? 3001.61s - 3002.25s | Yeah. 3002.25s - 3002.65s | Yeah. 3002.65s - 3006.25s | If you're interested in that topic, that particular presentation, 3006.25s - 3008.33s | I cover a bunch of other methods too. 3008.33s - 3008.89s | Yep. 3008.89s - 3010.97s | So any other questions? 3010.97s - 3011.47s | Oh, go ahead. 3012.19s - 3015.07s | So I see we have that string surface. 3015.07s - 3016.27s | We have an object surface.


chunk_text:
presentation. 2977.93s - 2981.13s | So in the point I had made was like, 2981.13s - 2987.37s | and I think the presentation I did at the time was remaining covert in an overt world. 2987.37s - 2989.05s | I did it in the packet hacking village. 2989.05s - 2991.05s | I think it was in that presentation where I talked about 2991.05s - 2994.57s | how you could covertly communicate in a whole bunch of different ways. 2994.57s - 2995.53s | And that was one of them. 2995.53s - 2998.81s | And I showed how the optical character recognition didn't detect it. 2998.81s - 3000.25s | So does that kind of help? 3000.25s - 3001.61s | Is that we were kind of wondering? 3001.61s - 3002.25s | Yeah. 3002.25s - 3002.65s | Yeah. 3002.65s - 3006.25s | If you're interested in that topic, that particular presentation, 3006.25s - 3008.33s | I cover a bunch of other methods too. 3008.33s - 3008.89s | Yep. 3008.89s - 3010.97s | So any other questions? 3010.97s - 3011.47s | Oh, go ahead. 3012.19s - 3015.07s | So I see we have that string surface. 3015.07s - 3016.27s | We have an object surface. 3018.19s - 3023.07s | If we're looking for, let's say, an object with a specific variation, 3023.71s - 3028.59s | do we have to then create that object dictionary with those variations in it? 3030.19s - 3033.23s | So let's say I need to find this way of hearing 3033.23s - 3037.79s | that has specifically no upcapping from the ground up. 3037.87s - 3041.95s | I'm going to have to upload 100, 500 images of that with no upcapping. 3041.95s - 3042.75s | What will it be? 3042.75s - 3046.19s | Like, for an individual, like maybe a face tattoo or a scar. 3046.19s - 3049.63s | At what point do I get to answer that in regularity? 3049.63s - 3054.59s | Because sometimes that is really the difference between getting the info to the... 3055.47s - 3056.11s | Yeah. 3056.11s - 3058.03s | It's a complex answer. 3058.03s - 3062.19s | So I'll see if I can kind of answer it with my knowledge. 3063.15s - 3070.43s | One, the most key ingredient in that case, in my opinion, would be the bounding boxes. 3070.43s - 3075.71s | Having bounding boxes focused on a smaller portion of a


chunk_text:
3018.19s - 3023.07s | If we're looking for, let's say, an object with a specific variation, 3023.71s - 3028.59s | do we have to then create that object dictionary with those variations in it? 3030.19s - 3033.23s | So let's say I need to find this way of hearing 3033.23s - 3037.79s | that has specifically no upcapping from the ground up. 3037.87s - 3041.95s | I'm going to have to upload 100, 500 images of that with no upcapping. 3041.95s - 3042.75s | What will it be? 3042.75s - 3046.19s | Like, for an individual, like maybe a face tattoo or a scar. 3046.19s - 3049.63s | At what point do I get to answer that in regularity? 3049.63s - 3054.59s | Because sometimes that is really the difference between getting the info to the... 3055.47s - 3056.11s | Yeah. 3056.11s - 3058.03s | It's a complex answer. 3058.03s - 3062.19s | So I'll see if I can kind of answer it with my knowledge. 3063.15s - 3070.43s | One, the most key ingredient in that case, in my opinion, would be the bounding boxes. 3070.43s - 3075.71s | Having bounding boxes focused on a smaller portion of a picture. 3075.71s - 3079.23s | Because in most cases, you're going to have a picture of the whole car, 3079.23s - 3081.07s | including the wheels and the hubcaps. 3081.07s - 3085.39s | Not just pictures of wheels with hubcaps or not hubcaps, right? 3085.39s - 3091.87s | And then in addition, you're looking for maybe the front left tire only, right? 3091.87s - 3096.51s | And how does the AI know, like, am I looking at the driver's side of the car 3096.51s - 3098.27s | or the passenger side of the car? 3098.27s - 3099.39s | And those kinds of things. 3099.39s - 3102.91s | So I think a little bit of it would be testing. 3102.91s - 3109.71s | But the root of it, in my opinion, it starts with the bounding boxes type stuff. 3109.71s - 3113.87s | So you're kind of training it to do a more refined look at every image, 3113.87s - 3116.43s | which is mostly like each one is going to be a car. 3116.43s - 3118.59s | And the car is going to be at different angles, 3118.59s - 3121.95s | but that you specifically want to focus on the


chunk_text:
picture. 3075.71s - 3079.23s | Because in most cases, you're going to have a picture of the whole car, 3079.23s - 3081.07s | including the wheels and the hubcaps. 3081.07s - 3085.39s | Not just pictures of wheels with hubcaps or not hubcaps, right? 3085.39s - 3091.87s | And then in addition, you're looking for maybe the front left tire only, right? 3091.87s - 3096.51s | And how does the AI know, like, am I looking at the driver's side of the car 3096.51s - 3098.27s | or the passenger side of the car? 3098.27s - 3099.39s | And those kinds of things. 3099.39s - 3102.91s | So I think a little bit of it would be testing. 3102.91s - 3109.71s | But the root of it, in my opinion, it starts with the bounding boxes type stuff. 3109.71s - 3113.87s | So you're kind of training it to do a more refined look at every image, 3113.87s - 3116.43s | which is mostly like each one is going to be a car. 3116.43s - 3118.59s | And the car is going to be at different angles, 3118.59s - 3121.95s | but that you specifically want to focus on the wheels and the hubcaps. 3121.95s - 3127.47s | I know that on the Azure side, when you go through the training, 3127.47s - 3131.39s | it will ask you the level of refinement that you want for those bounding boxes. 3131.39s - 3134.43s | And in addition, the kinds of things you're actually looking for. 3134.43s - 3136.59s | So it'll help you kind of get started with it. 3136.59s - 3139.31s | And then you could kind of iterate with it too, you know, from there. 3140.83s - 3141.63s | Sound cool? You're welcome. 3142.35s - 3144.27s | Cool. Well, awesome. 3144.27s - 3146.99s | I know we're probably, yeah, we're right at 150. 3146.99s - 3149.15s | So thanks so much for attending. 3149.15s - 3151.63s | I hope you guys got a couple good nuggets out of this. 3151.63s - 3153.23s | And thanks so much for coming.


chunk_text:
wheels and the hubcaps. 3121.95s - 3127.47s | I know that on the Azure side, when you go through the training, 3127.47s - 3131.39s | it will ask you the level of refinement that you want for those bounding boxes. 3131.39s - 3134.43s | And in addition, the kinds of things you're actually looking for. 3134.43s - 3136.59s | So it'll help you kind of get started with it. 3136.59s - 3139.31s | And then you could kind of iterate with it too, you know, from there. 3140.83s - 3141.63s | Sound cool? You're welcome. 3142.35s - 3144.27s | Cool. Well, awesome. 3144.27s - 3146.99s | I know we're probably, yeah, we're right at 150. 3146.99s - 3149.15s | So thanks so much for attending. 3149.15s - 3151.63s | I hope you guys got a couple good nuggets out of this. 3151.63s - 3153.23s | And thanks so much for coming.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=YtMutNk8RpY", "title": "DEF CON 32 - Offensive Security Testing Safeguarding the Final Frontier - Andrzej Olchawa", "description": "Every space mission is underpinned by critical software that spacecraft operators utilize to monitor and command their assets. The Mission Control System serves as the primary interface with a spacecraft, marking it as a crucial component of the ground segment. For decades, these systems were operated exclusively within the confines of mission control rooms, accessible only to a select group of individuals through a limited number of computer workstations. This paradigm has recently shifted, with numerous space organizations enabling their personnel to manage space assets remotely, including from the comfort of their homes. This increased accessibility has rendered space-related systems susceptible to the same security vulnerabilities that affect our daily-use software.\n\nDespite the adoption of newer technology stacks in many mission control systems\u2014either through upgrades or complete replacements\u2014the consideration of security requirements has often been deferred to the final stages of development or overlooked entirely. This negligence presents a significant risk, exposing the space sector to potential exploitation by malicious entities. Like in other technology domains, merely expanding strategies to incorporate security measures, instituting security policies, and integrating new security requirements are positive but insufficient. Despite being developed and tested by extensive teams and presumably adhering to best practices, we have observed firsthand how contemporary mission control systems remain prone to elementary security flaws.\n\nThe most effective strategy to equip space systems with a robust defense against malicious actors involves integrating offensive security testing throughout their development lifecycle.\n\nIn this presentation, we share the results of the security research we have recently conducted on the more established, open-source Mission Control Systems: NASA OpenMCT and YaMCS. We present the details of the vulnerabilities we have discovered in those two systems, and their potential impact on a space mission when they are chained together into one exploit. We conclude by presenting with the audience the lessons learned from those security assessments.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 841, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 3.60s | This text was transcribed using whisper model: large-v2 Hi everyone. My name is Andy. Uh I'm going to present you with 3.60s - 8.14s | some uh offensive security testing. Um in this 8.14s - 12.18s | presentation I will uh briefly introduce you to the uh ground 12.18s - 16.82s | segment and the software that we use uh


chunk_text:
positive but insufficient. Despite being developed and tested by extensive teams and presumably adhering to best practices, we have observed firsthand how contemporary mission control systems remain prone to elementary security flaws.\n\nThe most effective strategy to equip space systems with a robust defense against malicious actors involves integrating offensive security testing throughout their development lifecycle.\n\nIn this presentation, we share the results of the security research we have recently conducted on the more established, open-source Mission Control Systems: NASA OpenMCT and YaMCS. We present the details of the vulnerabilities we have discovered in those two systems, and their potential impact on a space mission when they are chained together into one exploit. We conclude by presenting with the audience the lessons learned from those security assessments.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 841, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 3.60s | This text was transcribed using whisper model: large-v2 Hi everyone. My name is Andy. Uh I'm going to present you with 3.60s - 8.14s | some uh offensive security testing. Um in this 8.14s - 12.18s | presentation I will uh briefly introduce you to the uh ground 12.18s - 16.82s | segment and the software that we use uh on it. Uh I will focus 16.82s - 20.68s | on one particular software which is the mission control system. 20.68s - 25.52s | And I will um show you some some uh vulnerabilities which we have 25.52s - 28.76s | found on those uh software applications and then give you a 28.76s - 34.65s | couple of demos on uh how we managed to exploit them. So um 34.65s - 38.31s | ground segment consists of many uh interconnected components uh 38.31s - 44.35s | or elements. You can see in this orange on this orange part um 44.35s - 48.49s | where exactly it lies in the in the uh in the mission um in the 48.49s - 52.19s | space mission. Uh it consists of different elements. Uh the all 52.19s - 55.83s | those elements uh perform different functions but they all 55.83s - 59.11s | depend on each other uh either by receiving input from or 59.11s - 62.97s | sending outputs to other components. However most of 62.97s - 65.75s | those components they don't require any user interaction and 65.75s - 69.25s | this is what brings us to the mission control system.


chunk_text:
on it. Uh I will focus 16.82s - 20.68s | on one particular software which is the mission control system. 20.68s - 25.52s | And I will um show you some some uh vulnerabilities which we have 25.52s - 28.76s | found on those uh software applications and then give you a 28.76s - 34.65s | couple of demos on uh how we managed to exploit them. So um 34.65s - 38.31s | ground segment consists of many uh interconnected components uh 38.31s - 44.35s | or elements. You can see in this orange on this orange part um 44.35s - 48.49s | where exactly it lies in the in the uh in the mission um in the 48.49s - 52.19s | space mission. Uh it consists of different elements. Uh the all 52.19s - 55.83s | those elements uh perform different functions but they all 55.83s - 59.11s | depend on each other uh either by receiving input from or 59.11s - 62.97s | sending outputs to other components. However most of 62.97s - 65.75s | those components they don't require any user interaction and 65.75s - 69.25s | this is what brings us to the mission control system. Uh which 69.25s - 74.25s | is the main interface um it is the main interface between the 74.25s - 78.39s | ground station uh and uh and other components. Uh it is also 78.39s - 83.19s | it also serves as um primary interface between the uh between 83.19s - 85.89s | between the spacecraft controllers and um and the 86.25s - 91.25s | spacecraft itself. Which uh I would argue is the it makes it 91.25s - 94.83s | the most vulnerable system in the whole ground segment. As uh 94.83s - 97.83s | as we know the weakest link of every information system is 97.83s - 103.83s | humans. So for decades uh the space missions were operated 103.83s - 107.93s | from uh dedicated mission control rooms. Uh accessible 107.93s - 114.27s | only by uh specific um only by the spacecraft controllers. And 114.29s - 116.93s | this however has changed recently mainly due to COVID. 116.93s - 122.23s | Um and the organization started opening up and letting their 122.23s - 126.81s | users or their uh spacecraft operators to conduct operations 126.81s - 130.97s | uh remotely. So this of course creates a


chunk_text:
Uh which 69.25s - 74.25s | is the main interface um it is the main interface between the 74.25s - 78.39s | ground station uh and uh and other components. Uh it is also 78.39s - 83.19s | it also serves as um primary interface between the uh between 83.19s - 85.89s | between the spacecraft controllers and um and the 86.25s - 91.25s | spacecraft itself. Which uh I would argue is the it makes it 91.25s - 94.83s | the most vulnerable system in the whole ground segment. As uh 94.83s - 97.83s | as we know the weakest link of every information system is 97.83s - 103.83s | humans. So for decades uh the space missions were operated 103.83s - 107.93s | from uh dedicated mission control rooms. Uh accessible 107.93s - 114.27s | only by uh specific um only by the spacecraft controllers. And 114.29s - 116.93s | this however has changed recently mainly due to COVID. 116.93s - 122.23s | Um and the organization started opening up and letting their 122.23s - 126.81s | users or their uh spacecraft operators to conduct operations 126.81s - 130.97s | uh remotely. So this of course creates a new attack surface for 130.97s - 134.15s | uh for the mission control system which is usually uh very 134.15s - 138.75s | outdated software and vulnerable to typical um typical 138.75s - 141.95s | vulnerabilities which we have on any other software uh that we 141.97s - 147.47s | use on a daily basis. So what is being done about it? Um from 147.47s - 150.11s | the community from the space community perspective obviously 150.11s - 153.81s | we expand strategies and include um security uh to include 153.81s - 158.69s | security aspects. We impose uh security policies. And then we 158.69s - 161.99s | also introduce security requirements to our systems. 161.99s - 166.63s | Um however I don't think it's gonna be enough at this point. 166.63s - 170.13s | And as we will see later there is one uh very specific element 170.15s - 174.55s | that is missing into those um into the actions which is the 174.55s - 182.29s | offensive security testing. So um every organization uh has a 182.29s - 184.37s | their own mission control system. They try to develop 184.37s - 188.77s | their own uh software. Because


chunk_text:
new attack surface for 130.97s - 134.15s | uh for the mission control system which is usually uh very 134.15s - 138.75s | outdated software and vulnerable to typical um typical 138.75s - 141.95s | vulnerabilities which we have on any other software uh that we 141.97s - 147.47s | use on a daily basis. So what is being done about it? Um from 147.47s - 150.11s | the community from the space community perspective obviously 150.11s - 153.81s | we expand strategies and include um security uh to include 153.81s - 158.69s | security aspects. We impose uh security policies. And then we 158.69s - 161.99s | also introduce security requirements to our systems. 161.99s - 166.63s | Um however I don't think it's gonna be enough at this point. 166.63s - 170.13s | And as we will see later there is one uh very specific element 170.15s - 174.55s | that is missing into those um into the actions which is the 174.55s - 182.29s | offensive security testing. So um every organization uh has a 182.29s - 184.37s | their own mission control system. They try to develop 184.37s - 188.77s | their own uh software. Because uh you know what as they say the 188.77s - 194.31s | space is hard right? So uh they have to do it themselves. So um 194.31s - 197.47s | some of that software is open source. So what we have done we 197.47s - 199.95s | decided to have a look at it and see how they perform from the 200.93s - 205.03s | from the vulnerability standpoint. And here is what we 205.03s - 207.91s | have found out. Uh for full disclosure all those 207.91s - 211.67s | vulnerabilities have been already disclosed uh using the 211.67s - 215.71s | um contacting the vendor and they have been already 215.71s - 223.05s | addressed and um and all of them have CVE assigned. So on uh NASA 223.05s - 226.05s | OpenMCT we have found a couple of vulnerabilities such as uh 226.05s - 232.07s | prototype pollution XSS and CSRF. On the IMCS which is 232.07s - 235.13s | another mission control system. It is one of the more established 235.13s - 239.71s | ones. One um we have found uh a few more vulnerabilities such as 239.71s - 243.31s | directory traversal uh arbitrary file


chunk_text:
uh you know what as they say the 188.77s - 194.31s | space is hard right? So uh they have to do it themselves. So um 194.31s - 197.47s | some of that software is open source. So what we have done we 197.47s - 199.95s | decided to have a look at it and see how they perform from the 200.93s - 205.03s | from the vulnerability standpoint. And here is what we 205.03s - 207.91s | have found out. Uh for full disclosure all those 207.91s - 211.67s | vulnerabilities have been already disclosed uh using the 211.67s - 215.71s | um contacting the vendor and they have been already 215.71s - 223.05s | addressed and um and all of them have CVE assigned. So on uh NASA 223.05s - 226.05s | OpenMCT we have found a couple of vulnerabilities such as uh 226.05s - 232.07s | prototype pollution XSS and CSRF. On the IMCS which is 232.07s - 235.13s | another mission control system. It is one of the more established 235.13s - 239.71s | ones. One um we have found uh a few more vulnerabilities such as 239.71s - 243.31s | directory traversal uh arbitrary file deletion session hijacking 243.31s - 247.95s | and uh a few XSS vulnerabilities. And then on 247.95s - 252.01s | NASA AIT core we have found and NASA AIT core is like a 252.01s - 255.95s | framework to develop ground ground segment software um by 255.95s - 259.99s | different missions. We have found SQL injection uh a few 259.99s - 264.79s | local code executions and also um realize that the encryption 264.79s - 268.67s | and the communication is completely missing. So as you 268.67s - 271.27s | seen before that most of those vulnerabilities they don't have 271.27s - 275.93s | that um much of an impact on the mission. However this is where 275.93s - 279.91s | the training of vulnerabilities come in play. And in case of the 279.91s - 282.95s | IMCS we decided to combine a directory traversal session 282.95s - 288.65s | hijacking and XSS. And that led us to quite severe sensitive 288.65s - 292.73s | information disclosure because now the attackers can when they 292.73s - 294.93s | trigger when the XSS is triggered the attackers can 294.93s - 298.57s | actually retrieve any arbitrary file that is stored


chunk_text:
deletion session hijacking 243.31s - 247.95s | and uh a few XSS vulnerabilities. And then on 247.95s - 252.01s | NASA AIT core we have found and NASA AIT core is like a 252.01s - 255.95s | framework to develop ground ground segment software um by 255.95s - 259.99s | different missions. We have found SQL injection uh a few 259.99s - 264.79s | local code executions and also um realize that the encryption 264.79s - 268.67s | and the communication is completely missing. So as you 268.67s - 271.27s | seen before that most of those vulnerabilities they don't have 271.27s - 275.93s | that um much of an impact on the mission. However this is where 275.93s - 279.91s | the training of vulnerabilities come in play. And in case of the 279.91s - 282.95s | IMCS we decided to combine a directory traversal session 282.95s - 288.65s | hijacking and XSS. And that led us to quite severe sensitive 288.65s - 292.73s | information disclosure because now the attackers can when they 292.73s - 294.93s | trigger when the XSS is triggered the attackers can 294.93s - 298.57s | actually retrieve any arbitrary file that is stored on the IMCS 298.57s - 304.89s | server. So uh here is uh let's have a look at typical scenario. 304.89s - 308.59s | Um so this is like um at the very high level overview of a 308.59s - 311.13s | space mission. You have a space segment from right to left 311.13s - 314.33s | you have a space left you have a space segment. There is a 314.33s - 316.71s | ground station, there is IMCS which is the mission control 316.71s - 321.87s | system uh in subject that is um that is used by Bob uh to send 321.87s - 324.65s | telemetry uh send telecoms and receive telemetry from 324.65s - 328.99s | spacecraft. We also have Alice that is working with Bob and the 328.99s - 332.09s | whole organization has a publicly facing website. Now we 332.09s - 337.79s | also have an attacker and that is um that has a C2 server. Now 337.79s - 341.05s | as it usually goes there is a recon and phishing campaign. 341.05s - 344.33s | Uh the adversaries learn about Alice from the um public 344.33s - 348.33s | website. They decide to uh


chunk_text:
on the IMCS 298.57s - 304.89s | server. So uh here is uh let's have a look at typical scenario. 304.89s - 308.59s | Um so this is like um at the very high level overview of a 308.59s - 311.13s | space mission. You have a space segment from right to left 311.13s - 314.33s | you have a space left you have a space segment. There is a 314.33s - 316.71s | ground station, there is IMCS which is the mission control 316.71s - 321.87s | system uh in subject that is um that is used by Bob uh to send 321.87s - 324.65s | telemetry uh send telecoms and receive telemetry from 324.65s - 328.99s | spacecraft. We also have Alice that is working with Bob and the 328.99s - 332.09s | whole organization has a publicly facing website. Now we 332.09s - 337.79s | also have an attacker and that is um that has a C2 server. Now 337.79s - 341.05s | as it usually goes there is a recon and phishing campaign. 341.05s - 344.33s | Uh the adversaries learn about Alice from the um public 344.33s - 348.33s | website. They decide to uh target her with um phishing 348.33s - 354.62s | campaign. Alice takes the bait uh unfortunately she then clicks 354.62s - 357.86s | on a link or opens a word document and that deploys the 357.86s - 362.12s | C2 beacon uh on her workstation. This way uh making her 362.12s - 368.67s | workstation compromised. Um the attackers now have access to her 368.67s - 373.23s | workstation. They learn about Bob um from her emails and they 373.23s - 376.91s | decided to target Bob with uh eternal phishing campaign. They 376.91s - 380.45s | uh send him an email with uh some payload that would trigger 380.45s - 388.11s | the XSS and they do it as Alice. So uh Bob trusts Alice. He um 388.11s - 391.95s | executes the payload that triggers the XSS. That XSS then 391.95s - 395.09s | uh because there are um there is a session hijacking 395.09s - 399.59s | vulnerability and the traversal director vulnerability 399.59s - 404.59s | um that triggers the um this lets the attackers to retrieve 404.59s - 412.97s | all any arbitrary file on uh on the XSS server. Now if Bob has 412.97s


chunk_text:
target her with um phishing 348.33s - 354.62s | campaign. Alice takes the bait uh unfortunately she then clicks 354.62s - 357.86s | on a link or opens a word document and that deploys the 357.86s - 362.12s | C2 beacon uh on her workstation. This way uh making her 362.12s - 368.67s | workstation compromised. Um the attackers now have access to her 368.67s - 373.23s | workstation. They learn about Bob um from her emails and they 373.23s - 376.91s | decided to target Bob with uh eternal phishing campaign. They 376.91s - 380.45s | uh send him an email with uh some payload that would trigger 380.45s - 388.11s | the XSS and they do it as Alice. So uh Bob trusts Alice. He um 388.11s - 391.95s | executes the payload that triggers the XSS. That XSS then 391.95s - 395.09s | uh because there are um there is a session hijacking 395.09s - 399.59s | vulnerability and the traversal director vulnerability 399.59s - 404.59s | um that triggers the um this lets the attackers to retrieve 404.59s - 412.97s | all any arbitrary file on uh on the XSS server. Now if Bob has 412.97s - 415.77s | access to the internet uh the files can directly be retrieved 415.77s - 420.07s | and sent to attacker workstation. Otherwise um if 420.07s - 424.05s | Bob is behind the firewall or is using VPN uh we can use 424.07s - 427.61s | Alice workstation to um as a proxy and then retrieve the 427.61s - 433.82s | files using the C2 beacon. So I have prepared uh short demo how 433.82s - 440.30s | that would look like in practice. So what you will see 440.30s - 443.98s | here, this is our, this is the exploit we developed. Um it 443.98s - 448.74s | generates a payload that will end up uh being sent to the to 448.74s - 452.82s | the Bob and Bob will uh actually use that payload and um 452.82s - 456.48s | because he thought that it was received from Alice, load it on 456.50s - 463.69s | the YAMCS and then that will trigger our exploit chain. So 463.69s - 467.93s | first this exploit generates the payload which is called XSV uh 467.93s - 474.91s | XSVJS and also starts the HTTP server. Bob is gonna load


chunk_text:
- 415.77s | access to the internet uh the files can directly be retrieved 415.77s - 420.07s | and sent to attacker workstation. Otherwise um if 420.07s - 424.05s | Bob is behind the firewall or is using VPN uh we can use 424.07s - 427.61s | Alice workstation to um as a proxy and then retrieve the 427.61s - 433.82s | files using the C2 beacon. So I have prepared uh short demo how 433.82s - 440.30s | that would look like in practice. So what you will see 440.30s - 443.98s | here, this is our, this is the exploit we developed. Um it 443.98s - 448.74s | generates a payload that will end up uh being sent to the to 448.74s - 452.82s | the Bob and Bob will uh actually use that payload and um 452.82s - 456.48s | because he thought that it was received from Alice, load it on 456.50s - 463.69s | the YAMCS and then that will trigger our exploit chain. So 463.69s - 467.93s | first this exploit generates the payload which is called XSV uh 467.93s - 474.91s | XSVJS and also starts the HTTP server. Bob is gonna load that 474.91s - 479.37s | file on the YAMCS server. Imagine that is one of the 479.37s - 487.92s | telemetry displays that Alice decided to share with him. So he 487.92s - 494.20s | loads the file and he decides to open it. And that's all he 494.26s - 499.96s | sees. Now, under the hoods, there was an XSS triggered that 499.96s - 502.60s | would retrieve the file and then send it back because of the 502.60s - 506.26s | directed traversal and send the back the back the content to the 506.26s - 511.14s | HTTP server that was started by um that was started by the 511.14s - 516.54s | attacker. So here like in any uh any example of for proof of 516.54s - 521.68s | concept you can see we got the access to XC password file 521.68s - 526.16s | content. So that's um combining those vulnerabilities is 526.16s - 548.18s | actually quite easy. So, the whole exploit is easy. So, next 548.18s - 552.14s | up is the uh vulnerability chain, the the exploit chain uh 552.14s - 556.68s | for NASA EIT Corp. Um combining one of the local


chunk_text:
that 474.91s - 479.37s | file on the YAMCS server. Imagine that is one of the 479.37s - 487.92s | telemetry displays that Alice decided to share with him. So he 487.92s - 494.20s | loads the file and he decides to open it. And that's all he 494.26s - 499.96s | sees. Now, under the hoods, there was an XSS triggered that 499.96s - 502.60s | would retrieve the file and then send it back because of the 502.60s - 506.26s | directed traversal and send the back the back the content to the 506.26s - 511.14s | HTTP server that was started by um that was started by the 511.14s - 516.54s | attacker. So here like in any uh any example of for proof of 516.54s - 521.68s | concept you can see we got the access to XC password file 521.68s - 526.16s | content. So that's um combining those vulnerabilities is 526.16s - 548.18s | actually quite easy. So, the whole exploit is easy. So, next 548.18s - 552.14s | up is the uh vulnerability chain, the the exploit chain uh 552.14s - 556.68s | for NASA EIT Corp. Um combining one of the local execution uh 556.68s - 559.12s | code execution and missing missing encryption, we managed 559.12s - 563.02s | to uh conduct the man in the middle attack and inject our own 563.02s - 569.26s | payload uh into the into the uh communication um string which 569.26s - 572.20s | uh which then is triggered on the telemetry client and then 572.20s - 577.84s | it's executed giving us the reversal. So, I'll quickly 577.84s - 586.66s | start on the demo and explain what you see. Sir. Like this? 586.66s - 591.73s | Yup. Okay. Okay. So, basically, what you see here on the left 591.73s - 595.33s | side, uh you have, on the top left side, you have telemetry 595.33s - 602.47s | client. On the left, uh bottom side, you have telemetry 602.47s - 607.01s | simulator that is both are provided by the EIT Corp. On the 607.01s - 610.01s | right side, you have our exploit on the top and then on the 610.01s - 613.25s | bottom side, on the right bottom, you have the Nesca's 613.25s - 618.83s | list that was gonna grab the or is gonna receive the reversal. 618.83s


chunk_text:
execution uh 556.68s - 559.12s | code execution and missing missing encryption, we managed 559.12s - 563.02s | to uh conduct the man in the middle attack and inject our own 563.02s - 569.26s | payload uh into the into the uh communication um string which 569.26s - 572.20s | uh which then is triggered on the telemetry client and then 572.20s - 577.84s | it's executed giving us the reversal. So, I'll quickly 577.84s - 586.66s | start on the demo and explain what you see. Sir. Like this? 586.66s - 591.73s | Yup. Okay. Okay. So, basically, what you see here on the left 591.73s - 595.33s | side, uh you have, on the top left side, you have telemetry 595.33s - 602.47s | client. On the left, uh bottom side, you have telemetry 602.47s - 607.01s | simulator that is both are provided by the EIT Corp. On the 607.01s - 610.01s | right side, you have our exploit on the top and then on the 610.01s - 613.25s | bottom side, on the right bottom, you have the Nesca's 613.25s - 618.83s | list that was gonna grab the or is gonna receive the reversal. 618.83s - 624.09s | So, we start the telemetry client first on the on the left 624.09s - 629.32s | side. Now, this is what would normally be happening on the 629.32s - 636.59s | mission control or on the ground station. Then, we start 636.59s - 640.33s | telemetry uh simulator which will generate some telemetry 640.33s - 646.05s | packets as if they were coming down from spacecraft. We start 646.05s - 650.01s | our uh Netcat listener and you can see on the left hand side, 650.01s - 652.19s | on the left hand side, we already have started receiving 652.19s - 665.80s | some telemetry from the simulator. Then, we run our 665.80s - 669.50s | exploit that is conducting the man in the middle attack and 669.50s - 672.70s | then the first frame. So, we have injected our frame and the 672.70s - 674.66s | first frame. So, the first frame that is sent from 674.66s - 679.08s | telemetry simulator to the ground station is called um by 679.08s - 682.10s | the man in the middle attack. There, we injected our payload 682.10s - 686.32s | which you can see down here as


chunk_text:
- 624.09s | So, we start the telemetry client first on the on the left 624.09s - 629.32s | side. Now, this is what would normally be happening on the 629.32s - 636.59s | mission control or on the ground station. Then, we start 636.59s - 640.33s | telemetry uh simulator which will generate some telemetry 640.33s - 646.05s | packets as if they were coming down from spacecraft. We start 646.05s - 650.01s | our uh Netcat listener and you can see on the left hand side, 650.01s - 652.19s | on the left hand side, we already have started receiving 652.19s - 665.80s | some telemetry from the simulator. Then, we run our 665.80s - 669.50s | exploit that is conducting the man in the middle attack and 669.50s - 672.70s | then the first frame. So, we have injected our frame and the 672.70s - 674.66s | first frame. So, the first frame that is sent from 674.66s - 679.08s | telemetry simulator to the ground station is called um by 679.08s - 682.10s | the man in the middle attack. There, we injected our payload 682.10s - 686.32s | which you can see down here as well and that was actually 686.32s - 690.38s | executed and it was triggered and it gives us, it gave us the 690.38s - 693.68s | reversal uh to the telemetry client running on the mission 693.68s - 721.98s | control. So, that's another proof of concept. Sorry about 721.98s - 733.20s | that. So, just for reference, we have um this is speed um 733.20s - 737.34s | between dynamic, static, and dynamic uh analysis which we 737.34s - 741.30s | have done on those systems. Um it is still important to 741.30s - 743.84s | conduct static analysis because as you can see, uh the low 743.84s - 746.88s | hanging fruits and many other vulnerabilities are found uh 746.88s - 750.28s | using those but they will static analysis will not uh 750.28s - 752.82s | will will not catch everything. So, you have to conduct the 752.82s - 757.02s | dynamic analysis and then you have to try to uh conduct 757.08s - 762.18s | the exploitation phase. Um in case of SCoS 2000, SCoS 2000 is 762.18s - 764.88s | one of the main mission control systems developed by uh by 764.88s - 768.56s |


chunk_text:
well and that was actually 686.32s - 690.38s | executed and it was triggered and it gives us, it gave us the 690.38s - 693.68s | reversal uh to the telemetry client running on the mission 693.68s - 721.98s | control. So, that's another proof of concept. Sorry about 721.98s - 733.20s | that. So, just for reference, we have um this is speed um 733.20s - 737.34s | between dynamic, static, and dynamic uh analysis which we 737.34s - 741.30s | have done on those systems. Um it is still important to 741.30s - 743.84s | conduct static analysis because as you can see, uh the low 743.84s - 746.88s | hanging fruits and many other vulnerabilities are found uh 746.88s - 750.28s | using those but they will static analysis will not uh 750.28s - 752.82s | will will not catch everything. So, you have to conduct the 752.82s - 757.02s | dynamic analysis and then you have to try to uh conduct 757.08s - 762.18s | the exploitation phase. Um in case of SCoS 2000, SCoS 2000 is 762.18s - 764.88s | one of the main mission control systems developed by uh by 764.88s - 768.56s | European Space Agency. Uh we haven't done any um extensive 768.56s - 771.66s | analysis on the system, any vulnerability research. We only 771.66s - 776.12s | run the flow finder on it and using the static code analysis 776.12s - 780.10s | you can see uh I'm pretty sure that at least one of those uh 780.10s - 783.70s | almost 2500 buffer overflow uh vulnerabilities would be 783.72s - 791.14s | exploitable. So, uh in conclusions, um the point I'm 791.14s - 793.54s | trying to make is that the space applications are still 793.54s - 796.52s | not properly being tested from the offensive security 796.52s - 801.72s | standpoint. Um the best way is to uh hire a service to do it 801.72s - 805.92s | properly or you can also you can also try to do it yourself but 805.92s - 807.70s | you have to do it and you have to include it in your 807.70s - 812.80s | frameworks and uh you should do it before uh the adversaries do 812.82s - 817.32s | it for you. So, as I mentioned before, all that research was 817.32s - 821.32s | already published. So,


chunk_text:
European Space Agency. Uh we haven't done any um extensive 768.56s - 771.66s | analysis on the system, any vulnerability research. We only 771.66s - 776.12s | run the flow finder on it and using the static code analysis 776.12s - 780.10s | you can see uh I'm pretty sure that at least one of those uh 780.10s - 783.70s | almost 2500 buffer overflow uh vulnerabilities would be 783.72s - 791.14s | exploitable. So, uh in conclusions, um the point I'm 791.14s - 793.54s | trying to make is that the space applications are still 793.54s - 796.52s | not properly being tested from the offensive security 796.52s - 801.72s | standpoint. Um the best way is to uh hire a service to do it 801.72s - 805.92s | properly or you can also you can also try to do it yourself but 805.92s - 807.70s | you have to do it and you have to include it in your 807.70s - 812.80s | frameworks and uh you should do it before uh the adversaries do 812.82s - 817.32s | it for you. So, as I mentioned before, all that research was 817.32s - 821.32s | already published. So, here you can find um I guess the slides 821.32s - 824.96s | will be uh provided afterwards so we can we can have a look at 824.96s - 828.40s | the publications. Otherwise, if you want the links uh today, you 828.40s - 830.80s | can hit me up after the after the talk and I'll give it to 830.80s - 837.04s | you. And that was it. Thank you very much.


chunk_text:
here you can find um I guess the slides 821.32s - 824.96s | will be uh provided afterwards so we can we can have a look at 824.96s - 828.40s | the publications. Otherwise, if you want the links uh today, you 828.40s - 830.80s | can hit me up after the after the talk and I'll give it to 830.80s - 837.04s | you. And that was it. Thank you very much.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=LysMyDrOGn4", "title": "DEF CON 32 - XR for All: Accessibility and Privacy for Disabled Users - Dylan Fox", "description": "Extended Reality (XR) technologies offer tremendous new possibilities for socializing, entertainment, training, and more. Unfortunately, many disabled users find themselves excluded from XR entirely or exposed to severe privacy risks for using it. In this talk, Dylan Fox, Director of Operations for the XR Access Initiative at Cornell Tech, will discuss the core challenges disabled people face in using XR, the tensions between privacy and assistive capabilities, and the open-source efforts happening now to ensure XR is accessible to everyone.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1375, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 5.52s | This text was transcribed using whisper model: large-v2 Hello everybody, uh, love to get started for you today. As I just mentioned, uh, I didn't bring my 5.52s - 12.48s | laptop because, uh, I had been given many fear-mongering tales, excuse me, uh, of DEF CON 12.48s - 18.48s | and the vicious hackers within, as this is my first time at DEF CON. Um, now, ideally we're 18.48s - 24.96s | gonna have a laptop from the, uh, XR Village host for me to present on, but unfortunately I haven't 24.96s - 30.72s | been able to get in contact with her, so I'm gonna do, uh, what is called a pro-gamer move 30.72s - 36.64s | and ask if anybody in the audience has a laptop they would be willing to let me present my slides 36.64s - 44.48s | from. This is a great look for me, I know. Uh, if not, that's okay, we will, I'll, I'll bring 44.48s - 48.80s | out my phone for you and you all can just, um, look at the, look at the slides from here. That'll 48.80s - 60.88s | work, right? Um, uh, well, that's all right. Uh, we'll do this theater of the mind. So, hello everybody, 60.88s - 67.04s | uh, my name is Dylan Fox, uh, and I'm here to talk to you today about XR for All, accessibility and 67.04s - 74.24s | privacy for disabled users. Uh, I am the Director of Operations for XR Access, which I'll be talking 74.24s - 81.68s | to you about in just a moment, uh, and you can reach me at dylan at xraccess.org. Uh, our agenda 81.68s -


chunk_text:
me to present on, but unfortunately I haven't 24.96s - 30.72s | been able to get in contact with her, so I'm gonna do, uh, what is called a pro-gamer move 30.72s - 36.64s | and ask if anybody in the audience has a laptop they would be willing to let me present my slides 36.64s - 44.48s | from. This is a great look for me, I know. Uh, if not, that's okay, we will, I'll, I'll bring 44.48s - 48.80s | out my phone for you and you all can just, um, look at the, look at the slides from here. That'll 48.80s - 60.88s | work, right? Um, uh, well, that's all right. Uh, we'll do this theater of the mind. So, hello everybody, 60.88s - 67.04s | uh, my name is Dylan Fox, uh, and I'm here to talk to you today about XR for All, accessibility and 67.04s - 74.24s | privacy for disabled users. Uh, I am the Director of Operations for XR Access, which I'll be talking 74.24s - 81.68s | to you about in just a moment, uh, and you can reach me at dylan at xraccess.org. Uh, our agenda 81.68s - 86.00s | today is I'm going to tell you a little bit about the XR Access Initiative that I represent. 86.00s - 92.64s | Uh, we're going to talk about the benefits that accessibility-focused XR can provide to people 92.64s - 97.84s | with disabilities. Uh, we're talking about the privacy risks that those benefits come along with, 97.84s - 102.24s | uh, and then best practices for mitigating those risks, or how we can have the, the best of both 102.24s - 109.36s | worlds. Uh, and hopefully at the end, we'll have some time for Q and A. Uh, so to start with, uh, 109.36s - 118.48s | the XR Access Initiative, uh, is a community dedicated to connecting people in order to make 118.48s - 125.04s | virtual augmented and mixed reality accessible for people with disabilities. Uh, we were originally 125.04s - 130.56s | founded in 2019 as just kind of a community of people coming together to wanted to make this 130.56s - 136.32s | new tech accessible. Uh, and now we are a proud research initiative of Cornell Tech in New York. 137.12s - 143.92s | Uh, we do a lot in terms of


chunk_text:
86.00s | today is I'm going to tell you a little bit about the XR Access Initiative that I represent. 86.00s - 92.64s | Uh, we're going to talk about the benefits that accessibility-focused XR can provide to people 92.64s - 97.84s | with disabilities. Uh, we're talking about the privacy risks that those benefits come along with, 97.84s - 102.24s | uh, and then best practices for mitigating those risks, or how we can have the, the best of both 102.24s - 109.36s | worlds. Uh, and hopefully at the end, we'll have some time for Q and A. Uh, so to start with, uh, 109.36s - 118.48s | the XR Access Initiative, uh, is a community dedicated to connecting people in order to make 118.48s - 125.04s | virtual augmented and mixed reality accessible for people with disabilities. Uh, we were originally 125.04s - 130.56s | founded in 2019 as just kind of a community of people coming together to wanted to make this 130.56s - 136.32s | new tech accessible. Uh, and now we are a proud research initiative of Cornell Tech in New York. 137.12s - 143.92s | Uh, we do a lot in terms of researching the fundamentals of accessibility. You know, how do 143.92s - 150.80s | we make these technologies accessible, especially to blind and low vision people? Uh, we also make a 150.80s - 156.88s | lot of resources that we provide to designers and developers on how to make their apps accessible. 156.88s - 163.76s | Uh, we con- connects different communities in terms of the, uh, big, you know, the big technical 163.76s - 170.64s | platforms, the content creators, uh, researchers, government people, uh, and of course, people who 170.64s - 175.52s | are disabled and advocates, uh, in order to come together to solve some of these really thorny 175.52s - 182.16s | problems, uh, on how to make these things accessible. Uh, and we advocate and educate for XR 182.16s - 188.96s | accessibility, just like I'm doing right here. Uh, we also hold every year our XR Access Symposium. 188.96s - 195.52s | Uh, you just missed the one June 6th and 7th, but, uh, we have our, all of our videos up on YouTube. So 195.52s - 200.16s | if you're interested in learning more about kind of the hot topics in XR accessibility, 200.16s


chunk_text:
researching the fundamentals of accessibility. You know, how do 143.92s - 150.80s | we make these technologies accessible, especially to blind and low vision people? Uh, we also make a 150.80s - 156.88s | lot of resources that we provide to designers and developers on how to make their apps accessible. 156.88s - 163.76s | Uh, we con- connects different communities in terms of the, uh, big, you know, the big technical 163.76s - 170.64s | platforms, the content creators, uh, researchers, government people, uh, and of course, people who 170.64s - 175.52s | are disabled and advocates, uh, in order to come together to solve some of these really thorny 175.52s - 182.16s | problems, uh, on how to make these things accessible. Uh, and we advocate and educate for XR 182.16s - 188.96s | accessibility, just like I'm doing right here. Uh, we also hold every year our XR Access Symposium. 188.96s - 195.52s | Uh, you just missed the one June 6th and 7th, but, uh, we have our, all of our videos up on YouTube. So 195.52s - 200.16s | if you're interested in learning more about kind of the hot topics in XR accessibility, 200.16s - 204.88s | uh, I'd encourage you to check that out. Uh, our website is xraccess.org. 205.76s - 213.28s | So let's talk about accessibility-focused XR. Now, XR, for those of you who aren't aware, 213.28s - 220.56s | is, uh, an umbrella term, uh, referring to extended reality. Uh, and that covers virtual reality, 220.56s - 226.96s | where you are immersed in this virtual space, augmented reality, where you augment reality 226.96s - 231.76s | with data, uh, and mixed reality, which is a little column A and a little column B. 231.76s - 237.28s | Uh, and all of these come together to form a technology that has really grown in popularity 237.28s - 243.44s | over the last five or ten years, uh, and is really poised to make a big change in people's lives if 243.44s - 250.48s | we use it correctly. So that's XR. What about the accessibility half of XR accessibility? 251.76s - 258.72s | Now, the first thing, the notion that I want to dispel for you all, is that accessibility 259.36s - 267.20s | is a checklist that you run down in order to support a few people who are


chunk_text:
- 204.88s | uh, I'd encourage you to check that out. Uh, our website is xraccess.org. 205.76s - 213.28s | So let's talk about accessibility-focused XR. Now, XR, for those of you who aren't aware, 213.28s - 220.56s | is, uh, an umbrella term, uh, referring to extended reality. Uh, and that covers virtual reality, 220.56s - 226.96s | where you are immersed in this virtual space, augmented reality, where you augment reality 226.96s - 231.76s | with data, uh, and mixed reality, which is a little column A and a little column B. 231.76s - 237.28s | Uh, and all of these come together to form a technology that has really grown in popularity 237.28s - 243.44s | over the last five or ten years, uh, and is really poised to make a big change in people's lives if 243.44s - 250.48s | we use it correctly. So that's XR. What about the accessibility half of XR accessibility? 251.76s - 258.72s | Now, the first thing, the notion that I want to dispel for you all, is that accessibility 259.36s - 267.20s | is a checklist that you run down in order to support a few people who are in wheelchairs 267.20s - 270.88s | or what have you out of the goodness of your heart. Because that's a lie. 272.24s - 280.72s | Uh, accessibility affects all of us. Accessibility is defined as basically being able to use 280.72s - 287.44s | something no matter what your ability is, because we all have abilities to see, to hear, to touch, 288.40s - 295.60s | um, and sometimes those abilities can become hampered, right? Uh, now that can be permanently, 295.60s - 300.80s | right? If you are, you know, have a genetic condition that makes you born without ears, 301.52s - 306.72s | you're probably deaf, right? And that would be a permanent condition. But you might also be deaf 306.72s - 313.04s | because you have an ear infection, or you might be deaf because you're at a really loud bar, 313.04s - 316.08s | like, you know, the middle of the arcade party last night. That thing was deafening. 317.04s - 325.44s | Um, and accessibility will help everybody no matter what that source of disability is from. 326.08s - 334.24s | Because disability isn't really just about your hampered ability. Disability is when your 334.24s


chunk_text:
in wheelchairs 267.20s - 270.88s | or what have you out of the goodness of your heart. Because that's a lie. 272.24s - 280.72s | Uh, accessibility affects all of us. Accessibility is defined as basically being able to use 280.72s - 287.44s | something no matter what your ability is, because we all have abilities to see, to hear, to touch, 288.40s - 295.60s | um, and sometimes those abilities can become hampered, right? Uh, now that can be permanently, 295.60s - 300.80s | right? If you are, you know, have a genetic condition that makes you born without ears, 301.52s - 306.72s | you're probably deaf, right? And that would be a permanent condition. But you might also be deaf 306.72s - 313.04s | because you have an ear infection, or you might be deaf because you're at a really loud bar, 313.04s - 316.08s | like, you know, the middle of the arcade party last night. That thing was deafening. 317.04s - 325.44s | Um, and accessibility will help everybody no matter what that source of disability is from. 326.08s - 334.24s | Because disability isn't really just about your hampered ability. Disability is when your 334.24s - 341.44s | abilities don't match up with the expectations or the assumptions of the technology that you use, 341.44s - 348.40s | or the spaces around you. So somebody in a wheelchair is not disabled inherently. 348.40s - 352.96s | They are disabled when they come to a place that the only way to get in is stairs, 352.96s - 357.68s | right? You know, never use the term wheelchair bound, because a lot of the people that use 357.68s - 361.44s | wheelchairs will tell you, I'm not bound to this wheelchair. The wheelchair is what 362.32s - 366.64s | gives me mobility. It's what lets me move around and be where I want to be. 367.60s - 374.48s | So when we talk about accessibility, accessibility is about technology that adapts to your needs. 374.48s - 379.92s | It's about technology that no matter what your abilities are, you'll still be able to use. 381.60s - 388.16s | There's a woman, Cindy Lee, who wrote the book on CSS and was also an accomplished accessibility 388.16s - 396.24s | advocate, and she had this idea that we're all just temporarily abled, right? All of us, 397.12s -


chunk_text:
- 341.44s | abilities don't match up with the expectations or the assumptions of the technology that you use, 341.44s - 348.40s | or the spaces around you. So somebody in a wheelchair is not disabled inherently. 348.40s - 352.96s | They are disabled when they come to a place that the only way to get in is stairs, 352.96s - 357.68s | right? You know, never use the term wheelchair bound, because a lot of the people that use 357.68s - 361.44s | wheelchairs will tell you, I'm not bound to this wheelchair. The wheelchair is what 362.32s - 366.64s | gives me mobility. It's what lets me move around and be where I want to be. 367.60s - 374.48s | So when we talk about accessibility, accessibility is about technology that adapts to your needs. 374.48s - 379.92s | It's about technology that no matter what your abilities are, you'll still be able to use. 381.60s - 388.16s | There's a woman, Cindy Lee, who wrote the book on CSS and was also an accomplished accessibility 388.16s - 396.24s | advocate, and she had this idea that we're all just temporarily abled, right? All of us, 397.12s - 402.56s | at some time or another where we're just in a loud room or we get old and our bodies start to 402.56s - 407.76s | fail us, all of us will be disabled at some point in our lives. So when we're talking about 407.76s - 412.08s | accessibility, don't make the mistake of thinking, oh, accessibility, that's for those people over 412.08s - 416.08s | there. Oh, accessibility, that's the thing that fricking bureaucrats make me want to check off 416.08s - 421.68s | a list so we don't get sued. It's not the case. Accessibility is for all of us. Quick show of 421.68s - 428.24s | hand, who here in the audience has either personally experienced accessibility or rather 428.24s - 433.20s | personally experienced disability or has a relative who has disabilities? Show of hands. 433.20s - 438.08s | I know I have. That's a good portion of you, and I think 100% of the people that are actually 438.08s - 445.44s | paying attention and thinking about it. So where does that leave us on accessibility and XR? 446.56s - 452.88s | Well, there's two perspectives when it comes to XR accessibility. The


