# MediaChunks

chunk_text:
2614.87s | Okay, this is the point where I would recommend you might want to pull your 2614.87s - 2618.03s | phones out, because I'm going to be giving a lot of resources, you are 2618.03s - 2619.79s | totally free to take pictures. 2619.79s - 2621.11s | That's why I do this. 2621.83s - 2627.35s | I'm always the mind of I'm here to help educate you and show you where you can go 2627.35s - 2628.59s | next after this. 2629.51s - 2636.67s | So websites, right at the top 6502.org is like the place for anything about this. 2636.71s - 2642.95s | The 6502, there's Buku resources, emulators, software sources, hardware, 2643.27s - 2645.31s | tutorials, and everything like that. 2645.59s - 2649.51s | The other one is a neat one that I discovered, they have a lot of pages on 2649.51s - 2655.11s | the 6502, and so forth, and a lot on the Kim one, including PDF scans of a lot of 2655.11s - 2658.15s | the documentation, which I thought was really, really cool. 2659.59s - 2661.79s | The last one is the Internet Archive. 2662.43s - 2666.59s | If you are interested in looking for books, and you can't find them, or they're 2666.59s - 2671.11s | really, really expensive, try going there and searching, you can probably find 2671.11s - 2673.13s | them as PDF scan. 2673.13s - 2676.43s | So all the books I talked about, you can probably find them there if you don't 2676.43s - 2676.87s | want them. 2677.07s - 2680.07s | Me, I want physical books. 2680.11s - 2681.23s | That's, that's just me. 2681.41s - 2688.19s | So, so I'm not sure if you guys familiar with Adam Osborne, the Osborne 2688.19s - 2692.29s | computer, but one of the things that I liked about him is he had his own 2692.29s - 2697.41s | publishing company, which then became part of McGraw Hill as Osborne McGraw 2697.41s - 2701.53s | Hill, and it was one of my favorite sources for books. 2701.73s - 2705.29s | So he did a series called an introduction to microcomputers. 2705.29s - 2712.61s | I had four volumes numbered zero through three, but I only recommend you look at 2712.61s - 2713.69s | getting the first two. 2714.67s - 2719.39s | You can get them really inexpensive off of like


chunk_text:
looking for books, and you can't find them, or they're 2666.59s - 2671.11s | really, really expensive, try going there and searching, you can probably find 2671.11s - 2673.13s | them as PDF scan. 2673.13s - 2676.43s | So all the books I talked about, you can probably find them there if you don't 2676.43s - 2676.87s | want them. 2677.07s - 2680.07s | Me, I want physical books. 2680.11s - 2681.23s | That's, that's just me. 2681.41s - 2688.19s | So, so I'm not sure if you guys familiar with Adam Osborne, the Osborne 2688.19s - 2692.29s | computer, but one of the things that I liked about him is he had his own 2692.29s - 2697.41s | publishing company, which then became part of McGraw Hill as Osborne McGraw 2697.41s - 2701.53s | Hill, and it was one of my favorite sources for books. 2701.73s - 2705.29s | So he did a series called an introduction to microcomputers. 2705.29s - 2712.61s | I had four volumes numbered zero through three, but I only recommend you look at 2712.61s - 2713.69s | getting the first two. 2714.67s - 2719.39s | You can get them really inexpensive off of like Amazon and eBay, make sure you 2719.39s - 2721.07s | get the last edition. 2721.07s - 2723.27s | But those are really, really good introduction to this. 2725.47s - 2729.55s | I don't have volume two and three, they go for the people ask for stupid money 2729.55s - 2730.71s | for it, and I'm like, sorry. 2731.03s - 2736.87s | But if you really are into into the hardware of microprocessors, the last two 2736.87s - 2739.19s | books you might want to get, I actually got them. 2739.63s - 2742.07s | They're literally about two inches thick. 2742.29s - 2744.65s | It's not they're not going to tell you how to program these, but they're going 2744.65s - 2748.77s | to tell you about all the electronics and the hardware of these processor night. 2748.97s - 2750.53s | To me, that was like really, really cool. 2750.81s - 2753.21s | But I'm a nerd. 2753.21s - 2755.49s | So what can you say? 2757.48s - 2761.90s | When it comes to a semi language program, one of my two authors is Lance 2761.90s - 2766.78s | Leventhal, who did all these things through Osborne McGraw Hill. 2767.54s -


chunk_text:
Amazon and eBay, make sure you 2719.39s - 2721.07s | get the last edition. 2721.07s - 2723.27s | But those are really, really good introduction to this. 2725.47s - 2729.55s | I don't have volume two and three, they go for the people ask for stupid money 2729.55s - 2730.71s | for it, and I'm like, sorry. 2731.03s - 2736.87s | But if you really are into into the hardware of microprocessors, the last two 2736.87s - 2739.19s | books you might want to get, I actually got them. 2739.63s - 2742.07s | They're literally about two inches thick. 2742.29s - 2744.65s | It's not they're not going to tell you how to program these, but they're going 2744.65s - 2748.77s | to tell you about all the electronics and the hardware of these processor night. 2748.97s - 2750.53s | To me, that was like really, really cool. 2750.81s - 2753.21s | But I'm a nerd. 2753.21s - 2755.49s | So what can you say? 2757.48s - 2761.90s | When it comes to a semi language program, one of my two authors is Lance 2761.90s - 2766.78s | Leventhal, who did all these things through Osborne McGraw Hill. 2767.54s - 2770.18s | He did the 65021, which had a second edition. 2770.18s - 2771.42s | That's that's what it looks like. 2771.72s - 2775.24s | He also did an assembly language subroutine series, which I was not aware 2775.24s - 2778.64s | of, but I got the 65021 recently. 2779.04s - 2783.42s | The 68000, I know I used that in college, but he did others. 2783.42s - 2794.04s | He did a 6800, a 6809, the Z8000, the 8085, and so forth, as well as assembly 2794.04s - 2796.40s | language subroutines for some of these, these ones. 2797.02s - 2800.78s | Please be advised that people are asking stupid money for these. 2800.78s - 2808.86s | But if you go on lulu.com, someone has made available his Z80 and the first 2808.86s - 2811.64s | edition of the 6502 book there on Lulu. 2811.90s - 2815.62s | And I think they cost about 20 bucks or 30. 2815.70s - 2817.30s | Yeah, I think about 20 bucks or 30 bucks. 2817.58s - 2820.30s | So if you don't want to buy a used copy, go there. 2821.00s - 2826.06s | The other guy is Rodney Zaks, who founded


chunk_text:
2770.18s | He did the 65021, which had a second edition. 2770.18s - 2771.42s | That's that's what it looks like. 2771.72s - 2775.24s | He also did an assembly language subroutine series, which I was not aware 2775.24s - 2778.64s | of, but I got the 65021 recently. 2779.04s - 2783.42s | The 68000, I know I used that in college, but he did others. 2783.42s - 2794.04s | He did a 6800, a 6809, the Z8000, the 8085, and so forth, as well as assembly 2794.04s - 2796.40s | language subroutines for some of these, these ones. 2797.02s - 2800.78s | Please be advised that people are asking stupid money for these. 2800.78s - 2808.86s | But if you go on lulu.com, someone has made available his Z80 and the first 2808.86s - 2811.64s | edition of the 6502 book there on Lulu. 2811.90s - 2815.62s | And I think they cost about 20 bucks or 30. 2815.70s - 2817.30s | Yeah, I think about 20 bucks or 30 bucks. 2817.58s - 2820.30s | So if you don't want to buy a used copy, go there. 2821.00s - 2826.06s | The other guy is Rodney Zaks, who founded Cybex Books, which is still 2826.06s - 2828.12s | around, but as an imprint of Wiley. 2828.52s - 2832.32s | He did actually a four book series on the 6502. 2832.92s - 2836.36s | I know I used his 6502 book in college. 2836.60s - 2839.84s | The last one is the fourth edition with that really cool cover. 2840.12s - 2841.92s | I have most of the series. 2841.92s - 2844.90s | I'm trying to get the, I'm trying to find the application book, but I want that 2844.90s - 2849.48s | cover, but his other, he's got a really great Z80 book that I want to get. 2849.48s - 2852.06s | Again, I'm not going to pay the stupid money people are asking for. 2853.22s - 2855.46s | But he's another good one. 2855.90s - 2864.94s | I found on Tindy that someone had reprinted the, these MOS books on the 2864.94s - 2868.94s | Kim one, I actually brought one of them with me that you guys can take a look 2868.94s - 2874.68s | at, I got the user manual, but he had these on Tindy, he might be running out. 2874.98s - 2877.62s | So


chunk_text:
Cybex Books, which is still 2826.06s - 2828.12s | around, but as an imprint of Wiley. 2828.52s - 2832.32s | He did actually a four book series on the 6502. 2832.92s - 2836.36s | I know I used his 6502 book in college. 2836.60s - 2839.84s | The last one is the fourth edition with that really cool cover. 2840.12s - 2841.92s | I have most of the series. 2841.92s - 2844.90s | I'm trying to get the, I'm trying to find the application book, but I want that 2844.90s - 2849.48s | cover, but his other, he's got a really great Z80 book that I want to get. 2849.48s - 2852.06s | Again, I'm not going to pay the stupid money people are asking for. 2853.22s - 2855.46s | But he's another good one. 2855.90s - 2864.94s | I found on Tindy that someone had reprinted the, these MOS books on the 2864.94s - 2868.94s | Kim one, I actually brought one of them with me that you guys can take a look 2868.94s - 2874.68s | at, I got the user manual, but he had these on Tindy, he might be running out. 2874.98s - 2877.62s | So if you want them, get them while the getting's good. 2877.76s - 2882.24s | Other books are these on the 65816. 2882.56s - 2885.28s | I've had the Osborne one, but I've never done programming. 2885.44s - 2890.52s | The last one was actually from Brady, but now Western Design has reprinted it. 2890.52s - 2893.56s | So you can easily get it off of Amazon. 2894.60s - 2898.96s | But I've had people, I've read stuff that people don't think it's that 2898.96s - 2900.44s | good of a book for a semi-language program. 2900.44s - 2902.68s | So just be, be aware. 2903.28s - 2905.48s | I have not got it myself, so I cannot speak. 2905.94s - 2909.22s | So you want to actually play around and program with these. 2909.22s - 2910.50s | Well, you have various options. 2910.50s - 2912.34s | It's kind of depending on what you want. 2913.46s - 2916.90s | Do you want hardware or are you happy with software or something in between? 2917.18s - 2918.78s | That, that's, that's up to you. 2920.14s - 2923.58s | There are many communities of fans that still keep these things to going and


chunk_text:
if you want them, get them while the getting's good. 2877.76s - 2882.24s | Other books are these on the 65816. 2882.56s - 2885.28s | I've had the Osborne one, but I've never done programming. 2885.44s - 2890.52s | The last one was actually from Brady, but now Western Design has reprinted it. 2890.52s - 2893.56s | So you can easily get it off of Amazon. 2894.60s - 2898.96s | But I've had people, I've read stuff that people don't think it's that 2898.96s - 2900.44s | good of a book for a semi-language program. 2900.44s - 2902.68s | So just be, be aware. 2903.28s - 2905.48s | I have not got it myself, so I cannot speak. 2905.94s - 2909.22s | So you want to actually play around and program with these. 2909.22s - 2910.50s | Well, you have various options. 2910.50s - 2912.34s | It's kind of depending on what you want. 2913.46s - 2916.90s | Do you want hardware or are you happy with software or something in between? 2917.18s - 2918.78s | That, that's, that's up to you. 2920.14s - 2923.58s | There are many communities of fans that still keep these things to going and 2923.58s - 2925.02s | they're actually creating new stuff. 2926.66s - 2929.50s | I can actually have wifi on my Atari 8 bits. 2929.50s - 2934.90s | I'm, I can have, I can use compact flash and SD cards for storage because 2934.90s - 2936.72s | of the work that these people have done. 2937.04s - 2940.48s | So if you want, you can go get the classic 8 bit, you can go on the 2940.48s - 2945.80s | eBay and take a look, just be aware that sometimes they work, sometimes they don't. 2945.82s - 2947.20s | Most of the buyers are pretty honest. 2947.20s - 2948.56s | They'll say like, no, this doesn't work. 2948.80s - 2950.40s | You're getting this for parts or whatever. 2950.64s - 2952.84s | You might need to do some retrobriting, which is to clean 2952.84s - 2954.32s | up the coloring and so forth. 2954.64s - 2964.56s | But I've gotten an 800, a 1200 XL and a 130 XE off of eBay for what I 2964.58s - 2966.42s | thought was reasonable, reasonable prices. 2967.62s - 2970.18s | So just, just be aware. 2971.50s - 2974.58s | If you want brand


chunk_text:
2923.58s - 2925.02s | they're actually creating new stuff. 2926.66s - 2929.50s | I can actually have wifi on my Atari 8 bits. 2929.50s - 2934.90s | I'm, I can have, I can use compact flash and SD cards for storage because 2934.90s - 2936.72s | of the work that these people have done. 2937.04s - 2940.48s | So if you want, you can go get the classic 8 bit, you can go on the 2940.48s - 2945.80s | eBay and take a look, just be aware that sometimes they work, sometimes they don't. 2945.82s - 2947.20s | Most of the buyers are pretty honest. 2947.20s - 2948.56s | They'll say like, no, this doesn't work. 2948.80s - 2950.40s | You're getting this for parts or whatever. 2950.64s - 2952.84s | You might need to do some retrobriting, which is to clean 2952.84s - 2954.32s | up the coloring and so forth. 2954.64s - 2964.56s | But I've gotten an 800, a 1200 XL and a 130 XE off of eBay for what I 2964.58s - 2966.42s | thought was reasonable, reasonable prices. 2967.62s - 2970.18s | So just, just be aware. 2971.50s - 2974.58s | If you want brand new, check out this. 2976.14s - 2978.78s | This is an effort of a guy by the name was the 8 bit guy. 2979.14s - 2982.86s | It's a brand new 65, 65 or two base system. 2983.22s - 2986.34s | They are currently making and selling developer systems. 2986.34s - 2988.62s | They cost about 300 bucks. 2989.30s - 2991.94s | They're still having people developing software and so forth. 2992.24s - 2995.88s | So, but it looks, it's a, I think it's kind of a cool, cool project. 2995.88s - 2996.88s | So take a look at it. 2997.68s - 3000.08s | Like I said, you can do chem one clones. 3000.08s - 3002.16s | Like I said, this, this is a chem one clone. 3002.48s - 3006.00s | I got this off of Tendy and you can have, and I got the extra stuff. 3006.00s - 3008.20s | I'm trying to like get this thing to work and so forth. 3008.20s - 3013.52s | So if you want different, there's all other, if you go into Tendy and just 3013.52s - 3016.60s | search, let's search for 65 two, you can find out there's the Pico 3016.60s


chunk_text:
new, check out this. 2976.14s - 2978.78s | This is an effort of a guy by the name was the 8 bit guy. 2979.14s - 2982.86s | It's a brand new 65, 65 or two base system. 2983.22s - 2986.34s | They are currently making and selling developer systems. 2986.34s - 2988.62s | They cost about 300 bucks. 2989.30s - 2991.94s | They're still having people developing software and so forth. 2992.24s - 2995.88s | So, but it looks, it's a, I think it's kind of a cool, cool project. 2995.88s - 2996.88s | So take a look at it. 2997.68s - 3000.08s | Like I said, you can do chem one clones. 3000.08s - 3002.16s | Like I said, this, this is a chem one clone. 3002.48s - 3006.00s | I got this off of Tendy and you can have, and I got the extra stuff. 3006.00s - 3008.20s | I'm trying to like get this thing to work and so forth. 3008.20s - 3013.52s | So if you want different, there's all other, if you go into Tendy and just 3013.52s - 3016.60s | search, let's search for 65 two, you can find out there's the Pico 3016.60s - 3018.68s | computer actually brought mine with me. 3018.92s - 3020.48s | I still got to get that working. 3020.74s - 3022.54s | The Roscoe is kind of interesting. 3022.54s - 3025.38s | It's real old school computer. 3025.38s - 3028.38s | That's what it, what's it, what it stands for, or you can do the other one, but 3028.38s - 3029.78s | there's others that are there on Tendy. 3029.78s - 3033.30s | If you know, it's like what you want, do you want to, you want a computer where 3033.54s - 3036.98s | you're going to have to basically hook it to your laptop and send it code and 3036.98s - 3040.14s | whatnot, or do you want one that's more of a standalone computer with a, with 3040.14s - 3044.46s | a keyboard and screen, you know, there's different options if you don't want 3044.46s - 3046.58s | that, you can go hardware alternatives. 3046.58s - 3050.68s | One is emulation through what's called field programmable gate array. 3051.00s - 3052.32s | Look into the Mr. 3052.32s - 3059.32s | Project where people are emulating all kinds of retro computers in that, in 3059.32s - 3060.48s


chunk_text:
- 3018.68s | computer actually brought mine with me. 3018.92s - 3020.48s | I still got to get that working. 3020.74s - 3022.54s | The Roscoe is kind of interesting. 3022.54s - 3025.38s | It's real old school computer. 3025.38s - 3028.38s | That's what it, what's it, what it stands for, or you can do the other one, but 3028.38s - 3029.78s | there's others that are there on Tendy. 3029.78s - 3033.30s | If you know, it's like what you want, do you want to, you want a computer where 3033.54s - 3036.98s | you're going to have to basically hook it to your laptop and send it code and 3036.98s - 3040.14s | whatnot, or do you want one that's more of a standalone computer with a, with 3040.14s - 3044.46s | a keyboard and screen, you know, there's different options if you don't want 3044.46s - 3046.58s | that, you can go hardware alternatives. 3046.58s - 3050.68s | One is emulation through what's called field programmable gate array. 3051.00s - 3052.32s | Look into the Mr. 3052.32s - 3059.32s | Project where people are emulating all kinds of retro computers in that, in 3059.32s - 3060.48s | this, what have Mr. 3060.48s - 3061.08s | System. 3061.56s - 3065.44s | You might've seen the various minis that have been hit in the market. 3065.48s - 3070.92s | There has been the Atari 400 mini and the Atari 2600 and the Commodore mini 3070.92s - 3075.64s | and the Amiga mini and the Nintendo mini and the Sega mini, and I'm probably 3075.66s - 3078.94s | missing some, but, and they're all done with FPGA. 3079.58s - 3084.86s | Then there's this interesting one, which is the mega 65 from Germany, which they 3084.86s - 3089.50s | have basically recreated what would have been Commodore's last eight bit system 3089.50s - 3090.74s | using FPGA. 3091.10s - 3095.26s | I thought about getting it until I looked at the price and it's like, not yet. 3095.46s - 3098.50s | So, and if you want, if you just, if you're not going to, you just want 3098.50s - 3102.22s | software emulation again, check out the 6502 or for that. 3102.72s - 3103.08s | Videos. 3103.08s - 3104.56s | There's a lot of cool videos out there. 3104.88s - 3107.08s | What the eight bit guy is a


chunk_text:
| this, what have Mr. 3060.48s - 3061.08s | System. 3061.56s - 3065.44s | You might've seen the various minis that have been hit in the market. 3065.48s - 3070.92s | There has been the Atari 400 mini and the Atari 2600 and the Commodore mini 3070.92s - 3075.64s | and the Amiga mini and the Nintendo mini and the Sega mini, and I'm probably 3075.66s - 3078.94s | missing some, but, and they're all done with FPGA. 3079.58s - 3084.86s | Then there's this interesting one, which is the mega 65 from Germany, which they 3084.86s - 3089.50s | have basically recreated what would have been Commodore's last eight bit system 3089.50s - 3090.74s | using FPGA. 3091.10s - 3095.26s | I thought about getting it until I looked at the price and it's like, not yet. 3095.46s - 3098.50s | So, and if you want, if you just, if you're not going to, you just want 3098.50s - 3102.22s | software emulation again, check out the 6502 or for that. 3102.72s - 3103.08s | Videos. 3103.08s - 3104.56s | There's a lot of cool videos out there. 3104.88s - 3107.08s | What the eight bit guy is a neat guy. 3107.08s - 3111.88s | He's the guy that behind the commander X 16 low spec gamer has some neat videos. 3111.88s - 3113.80s | The first one is on the 6502. 3114.12s - 3118.12s | He did one of the Z80 recommend you look up his one on the arm. 3118.64s - 3124.80s | You will then learn why you, you have the 6502 to thank for the, for, for arm 3124.80s - 3125.60s | processors. 3125.60s - 3130.54s | So, and also look for videos with Chuck Peddle, Bill Minch, Rodney Zaks, and 3130.54s - 3131.46s | all these other guys. 3131.70s - 3132.62s | They're really, really cool. 3132.90s - 3134.18s | You want events and groups. 3134.18s - 3138.66s | There's the vintage computer Federation, and I was really shocked that they have 3138.66s - 3144.26s | these all around the country as well as overseas and look for groups in your 3144.26s - 3146.66s | area that are into retro computing. 3147.86s - 3150.34s | So if you want to contact me, that's my Twitter handle. 3150.34s - 3153.46s | I am, I am at retrocomputing.com. 3153.72s - 3154.72s | That's my Twitter handle.


chunk_text:
neat guy. 3107.08s - 3111.88s | He's the guy that behind the commander X 16 low spec gamer has some neat videos. 3111.88s - 3113.80s | The first one is on the 6502. 3114.12s - 3118.12s | He did one of the Z80 recommend you look up his one on the arm. 3118.64s - 3124.80s | You will then learn why you, you have the 6502 to thank for the, for, for arm 3124.80s - 3125.60s | processors. 3125.60s - 3130.54s | So, and also look for videos with Chuck Peddle, Bill Minch, Rodney Zaks, and 3130.54s - 3131.46s | all these other guys. 3131.70s - 3132.62s | They're really, really cool. 3132.90s - 3134.18s | You want events and groups. 3134.18s - 3138.66s | There's the vintage computer Federation, and I was really shocked that they have 3138.66s - 3144.26s | these all around the country as well as overseas and look for groups in your 3144.26s - 3146.66s | area that are into retro computing. 3147.86s - 3150.34s | So if you want to contact me, that's my Twitter handle. 3150.34s - 3153.46s | I am, I am at retrocomputing.com. 3153.72s - 3154.72s | That's my Twitter handle. 3154.72s - 3160.36s | I am, I am on the DEF CON discord as well as as one for the makers community. 3160.60s - 3162.56s | So if you want to reach out to me, that's great. 3162.84s - 3163.88s | That's my LinkedIn. 3164.24s - 3171.16s | I would recommend you, there's a retro tech community over there, someplace 3171.16s - 3172.36s | that you can drop by then. 3172.66s - 3173.52s | I was disappointed. 3173.52s - 3174.80s | They had no Atari stuff. 3174.80s - 3175.32s | I'm sorry. 3175.32s - 3178.64s | I'm an Atari and, and there's also the hardware hacking village. 3178.84s - 3180.80s | After this, I'm going to head over to the hardware hacking village. 3181.02s - 3183.74s | I'll have a few of my things with me. 3184.02s - 3186.34s | You want to talk with me and tell me I'm an idiot. 3186.38s - 3189.74s | I don't know what the hell I'm talking about and I shouldn't have been here or 3189.74s - 3192.38s | what have you, or you have questions and comments and whatnot. 3193.18s - 3197.34s | I'm happy to hang out there and you can


chunk_text:
3154.72s - 3160.36s | I am, I am on the DEF CON discord as well as as one for the makers community. 3160.60s - 3162.56s | So if you want to reach out to me, that's great. 3162.84s - 3163.88s | That's my LinkedIn. 3164.24s - 3171.16s | I would recommend you, there's a retro tech community over there, someplace 3171.16s - 3172.36s | that you can drop by then. 3172.66s - 3173.52s | I was disappointed. 3173.52s - 3174.80s | They had no Atari stuff. 3174.80s - 3175.32s | I'm sorry. 3175.32s - 3178.64s | I'm an Atari and, and there's also the hardware hacking village. 3178.84s - 3180.80s | After this, I'm going to head over to the hardware hacking village. 3181.02s - 3183.74s | I'll have a few of my things with me. 3184.02s - 3186.34s | You want to talk with me and tell me I'm an idiot. 3186.38s - 3189.74s | I don't know what the hell I'm talking about and I shouldn't have been here or 3189.74s - 3192.38s | what have you, or you have questions and comments and whatnot. 3193.18s - 3197.34s | I'm happy to hang out there and you can see, you can, I'll even let you touch my 3197.34s - 3197.84s | stuff. 3198.06s - 3201.02s | So thank you very much. 3201.14s - 3204.22s | And I will see you all later.


chunk_text:
see, you can, I'll even let you touch my 3197.34s - 3197.84s | stuff. 3198.06s - 3201.02s | So thank you very much. 3201.14s - 3204.22s | And I will see you all later.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=UmBNgn_9-zY", "title": "DEF CON 32 - Building a secure resilient nationwide EV charging network - Harry Krejsa, Sarah Hipel", "description": "Unprecedented investments in vehicle electrification are creating new pathways for hackers to exploit EVs and EV chargers. Many of these risks are theoretical and have not been demonstrated in the wild\u2026yet. Policymakers are racing to better understand systemic cyber risks present in this new EV ecosystem\u2014particularly those which might impact the electric grid\u2014so we can devise effective mitigations now. This talk offers a White House policymaker\u2019s perspective on the changing EV landscape, new policy measures under consideration to identify and reduce the impact of vulnerabilities, and the critical role that hackers can play in focusing our work.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1374, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 6.24s | This text was transcribed using whisper model: large-v2 Alright, good afternoon. My name is Harry Kreisa and I work at the White House 6.24s - 10.68s | Office of the National Cyber Director. I am Sarah Heupel. I work at the Joint 10.68s - 15.94s | Office of Energy and Transportation. And we're really excited to talk to you here 15.94s - 22.20s | today about how our digital ecosystem is going to be a big part of our clean 22.20s - 25.44s | energy transition and how the clean energy transition is going to be 25.44s - 29.28s | changing our digital ecosystem. We are excited to tell you about what we've 29.28s - 34.16s | been learning about EVs, vehicle electrification, and how those lessons 34.16s - 39.84s | are going to inform the broader clean energy transition. And what we are doing 39.84s - 43.32s | in government and how we're hoping to partner with you and the broader DEF CON 43.32s - 47.72s | community to prepare that digital ecosystem for the most ambitious, 47.72s - 57.12s | abundant, and exciting version of this transition that is possible. So we have 57.12s - 61.28s | some early lessons from this process. You may have heard that the Biden-Harris 61.28s - 65.28s | administration is engaging in some generational level investments in our 65.28s - 69.52s | infrastructure, in our advanced manufacturing capacity. A lot of it 69.52s - 73.04s | downstream from the bipartisan infrastructure law, the Inflation 73.04s - 76.80s | Reduction Act, and the Chips and Science Act. Some of


chunk_text:
how our digital ecosystem is going to be a big part of our clean 22.20s - 25.44s | energy transition and how the clean energy transition is going to be 25.44s - 29.28s | changing our digital ecosystem. We are excited to tell you about what we've 29.28s - 34.16s | been learning about EVs, vehicle electrification, and how those lessons 34.16s - 39.84s | are going to inform the broader clean energy transition. And what we are doing 39.84s - 43.32s | in government and how we're hoping to partner with you and the broader DEF CON 43.32s - 47.72s | community to prepare that digital ecosystem for the most ambitious, 47.72s - 57.12s | abundant, and exciting version of this transition that is possible. So we have 57.12s - 61.28s | some early lessons from this process. You may have heard that the Biden-Harris 61.28s - 65.28s | administration is engaging in some generational level investments in our 65.28s - 69.52s | infrastructure, in our advanced manufacturing capacity. A lot of it 69.52s - 73.04s | downstream from the bipartisan infrastructure law, the Inflation 73.04s - 76.80s | Reduction Act, and the Chips and Science Act. Some of the largest clean energy 76.80s - 81.32s | and advanced manufacturing investments in the history of the United States and around the world. 81.32s - 86.32s | And in that process, we've started to get some early lessons from this 86.32s - 91.44s | breakneck deployment of clean energy technologies. And that is that in many 91.44s - 97.44s | cases, decarbonization is digitization. Clean energy technologies are often much 97.44s - 103.72s | more technically sophisticated, interconnected, and supply chain complex 103.72s - 109.32s | than the fossil-based analogs that they're replacing. We're thusly getting a 109.32s - 113.88s | better appreciation for how the future that we're moving into powered by clean 113.88s - 119.84s | energy is going to be capable of much more than just a lower carbon one. It's 119.84s - 125.48s | going to be capable of a near zero marginal cost electricity world. A world 125.48s - 129.08s | where we're going to be able to have software-defined grid management, virtual 129.08s - 135.08s | power plants, and just a much more exciting, resilient, and flexible future 135.08s - 138.88s | than could have ever been possible without those kinds of advanced 138.88s


chunk_text:
the largest clean energy 76.80s - 81.32s | and advanced manufacturing investments in the history of the United States and around the world. 81.32s - 86.32s | And in that process, we've started to get some early lessons from this 86.32s - 91.44s | breakneck deployment of clean energy technologies. And that is that in many 91.44s - 97.44s | cases, decarbonization is digitization. Clean energy technologies are often much 97.44s - 103.72s | more technically sophisticated, interconnected, and supply chain complex 103.72s - 109.32s | than the fossil-based analogs that they're replacing. We're thusly getting a 109.32s - 113.88s | better appreciation for how the future that we're moving into powered by clean 113.88s - 119.84s | energy is going to be capable of much more than just a lower carbon one. It's 119.84s - 125.48s | going to be capable of a near zero marginal cost electricity world. A world 125.48s - 129.08s | where we're going to be able to have software-defined grid management, virtual 129.08s - 135.08s | power plants, and just a much more exciting, resilient, and flexible future 135.08s - 138.88s | than could have ever been possible without those kinds of advanced 138.88s - 144.28s | clean energy technologies. Now there's also some hurdles between here and there. 144.28s - 151.24s | The clean energy ecosystem has a lot more new stakeholders, new entrants in it 151.24s - 155.64s | than a lot of traditional infrastructure sectors. We're benefiting from the 155.64s - 159.40s | dynamism and innovation of a lot of these new entrants and these 159.40s - 164.32s | smaller organizations, but they also come without the same decades of experience 164.32s - 168.28s | that some of the traditional infrastructure players have. Those traditional 168.28s - 171.68s | infrastructure players often know each other, they know their regulators, they're 171.68s - 175.92s | used to thinking in terms of threats, threats from state-bound actors, from 175.92s - 179.88s | criminals, and they're used to thinking about how they interact with each other 179.88s - 185.08s | in a way that the clean energy ecosystem has not had the same time to develop yet. 185.08s - 191.04s | We have also seen that this deployment is happening at the pace and speed that 191.04s - 196.72s | we need to tackle our climate goals, but also at a pace and speed


chunk_text:
- 144.28s | clean energy technologies. Now there's also some hurdles between here and there. 144.28s - 151.24s | The clean energy ecosystem has a lot more new stakeholders, new entrants in it 151.24s - 155.64s | than a lot of traditional infrastructure sectors. We're benefiting from the 155.64s - 159.40s | dynamism and innovation of a lot of these new entrants and these 159.40s - 164.32s | smaller organizations, but they also come without the same decades of experience 164.32s - 168.28s | that some of the traditional infrastructure players have. Those traditional 168.28s - 171.68s | infrastructure players often know each other, they know their regulators, they're 171.68s - 175.92s | used to thinking in terms of threats, threats from state-bound actors, from 175.92s - 179.88s | criminals, and they're used to thinking about how they interact with each other 179.88s - 185.08s | in a way that the clean energy ecosystem has not had the same time to develop yet. 185.08s - 191.04s | We have also seen that this deployment is happening at the pace and speed that 191.04s - 196.72s | we need to tackle our climate goals, but also at a pace and speed that is faster 196.72s - 202.08s | than a lot of traditional government mechanisms for regulatory purposes, 202.08s - 208.40s | industry-led, and public-private standards-building processes are used to 208.40s - 213.48s | operate that. We also know that, yes, a lot of what we're talking about today is 213.48s - 218.08s | the dynamics in clean energy specifically, but we're entering a wave 218.08s - 223.80s | of physical-digital convergence for our entire infrastructure. There's, as a result, 223.80s - 228.80s | lots of parts of our critical infrastructure that were never designed to be connected to the Internet 228.80s - 233.80s | have benefited from a sort of accidental air gap for the last few decades, and have never been 233.80s - 238.36s | prompted to engage in the sort of technology modernization and cyber 238.36s - 242.80s | security considerations that they're going to need to in the years ahead. 242.80s - 249.80s | And so we have this once-in-a-generation opportunity to pull a do-over on a bunch of our critical infrastructure, 249.80s - 255.80s | to use the clean energy transition as an opportunity to rethink how we build 255.80s - 260.80s | the very foundations


chunk_text:
that is faster 196.72s - 202.08s | than a lot of traditional government mechanisms for regulatory purposes, 202.08s - 208.40s | industry-led, and public-private standards-building processes are used to 208.40s - 213.48s | operate that. We also know that, yes, a lot of what we're talking about today is 213.48s - 218.08s | the dynamics in clean energy specifically, but we're entering a wave 218.08s - 223.80s | of physical-digital convergence for our entire infrastructure. There's, as a result, 223.80s - 228.80s | lots of parts of our critical infrastructure that were never designed to be connected to the Internet 228.80s - 233.80s | have benefited from a sort of accidental air gap for the last few decades, and have never been 233.80s - 238.36s | prompted to engage in the sort of technology modernization and cyber 238.36s - 242.80s | security considerations that they're going to need to in the years ahead. 242.80s - 249.80s | And so we have this once-in-a-generation opportunity to pull a do-over on a bunch of our critical infrastructure, 249.80s - 255.80s | to use the clean energy transition as an opportunity to rethink how we build 255.80s - 260.80s | the very foundations of a lot of our society so that it is more capable of 260.80s - 265.80s | that secure, resilient future while being a lower-carbon MARAC. 265.80s - 270.80s | And one of the places in our infrastructure where this is most clear 270.80s - 275.80s | and these dynamics are most prominent is in electric vehicle technology. 275.80s - 279.80s | I'm going to let my colleague, Sarah, tell you a bit more about that. 279.80s - 287.80s | Great, thank you. Okay, so in a moment, I'm going to tell you a bit more about the Joint Office of Energy and Transportation. 287.80s - 293.80s | But to begin with, I want to start from the start, which is that transportation is a leading 293.80s - 300.80s | greenhouse gas emitting sector, and all of that is led by light-conveying vehicles, 300.80s - 305.80s | followed by medium-to-heavy-duty vehicles. And I think it's fair to say that the federal government, 305.80s - 310.80s | and in this case, the Department of Energy, Department of Transportation, and the White House, 310.80s - 316.80s | is fundamentally, foundationally committed to reducing and eliminating those emissions. 316.80s - 321.80s | The


chunk_text:
of a lot of our society so that it is more capable of 260.80s - 265.80s | that secure, resilient future while being a lower-carbon MARAC. 265.80s - 270.80s | And one of the places in our infrastructure where this is most clear 270.80s - 275.80s | and these dynamics are most prominent is in electric vehicle technology. 275.80s - 279.80s | I'm going to let my colleague, Sarah, tell you a bit more about that. 279.80s - 287.80s | Great, thank you. Okay, so in a moment, I'm going to tell you a bit more about the Joint Office of Energy and Transportation. 287.80s - 293.80s | But to begin with, I want to start from the start, which is that transportation is a leading 293.80s - 300.80s | greenhouse gas emitting sector, and all of that is led by light-conveying vehicles, 300.80s - 305.80s | followed by medium-to-heavy-duty vehicles. And I think it's fair to say that the federal government, 305.80s - 310.80s | and in this case, the Department of Energy, Department of Transportation, and the White House, 310.80s - 316.80s | is fundamentally, foundationally committed to reducing and eliminating those emissions. 316.80s - 321.80s | The sales of fully electric and hybrid vehicles are going up. 321.80s - 327.80s | They're starting to approximate the high-P curve, and that is a big part of transitioning 327.80s - 332.80s | to cleaner transportation. Cleaner energy is part of that. 332.80s - 337.80s | In my office, the Joint Office of Energy and Transportation is the technical lead 337.80s - 341.80s | on the infrastructure build-out that's behind that. 341.80s - 348.80s | So, a bit more on the Joint Office. We came into being from the bipartisan infrastructure law. 348.80s - 354.80s | We like to say that we're the startup of government, but I'm from startups, and that's not true. 355.80s - 362.80s | We are doing government differently, though, and I will say that the focus on affordable, reliable, convenient, 362.80s - 370.80s | equitable, and safe is a real thing. We are very focused on that, and we are pretty nimble and dynamic. 370.80s - 375.80s | So, the Joint Office brought in a number of people from the private sector, myself included, 375.80s - 382.80s | and I am fortunate enough to serve as the lead of engineering for standards, reliability, and cybersecurity.


chunk_text:
sales of fully electric and hybrid vehicles are going up. 321.80s - 327.80s | They're starting to approximate the high-P curve, and that is a big part of transitioning 327.80s - 332.80s | to cleaner transportation. Cleaner energy is part of that. 332.80s - 337.80s | In my office, the Joint Office of Energy and Transportation is the technical lead 337.80s - 341.80s | on the infrastructure build-out that's behind that. 341.80s - 348.80s | So, a bit more on the Joint Office. We came into being from the bipartisan infrastructure law. 348.80s - 354.80s | We like to say that we're the startup of government, but I'm from startups, and that's not true. 355.80s - 362.80s | We are doing government differently, though, and I will say that the focus on affordable, reliable, convenient, 362.80s - 370.80s | equitable, and safe is a real thing. We are very focused on that, and we are pretty nimble and dynamic. 370.80s - 375.80s | So, the Joint Office brought in a number of people from the private sector, myself included, 375.80s - 382.80s | and I am fortunate enough to serve as the lead of engineering for standards, reliability, and cybersecurity. 382.80s - 386.80s | I have excellent principals, like my principal, Brendan Harris, for cybersecurity, 386.80s - 391.80s | as well as other folks I've been able to pull in from the private sector in national labs 391.80s - 393.80s | and other areas of government. 393.80s - 399.80s | The EV charging ecosystem does have a multiplicity of interdependencies. 399.80s - 404.80s | It is, I'm sure, old to deal with that for some areas of government. 404.80s - 408.80s | This is new for this area of government. We'll talk more about that. 408.80s - 413.80s | The private sector has been trying to crack this nut for a while, but if you're in the automotive area, 413.80s - 415.80s | you know probably a bit about electric vehicles. 415.80s - 421.80s | You know that there's the auto manufacturers, there's the EV charging station manufacturers, 421.80s - 426.80s | network operators, application developers, security, operational security, 426.80s - 429.80s | and then, of course, there's a tie-in to the utility grid. 429.80s - 437.80s | Add to that the layer cake, basically, of government from city to state, municipal, tribal, federal. 437.80s - 440.80s | There's a


chunk_text:
382.80s - 386.80s | I have excellent principals, like my principal, Brendan Harris, for cybersecurity, 386.80s - 391.80s | as well as other folks I've been able to pull in from the private sector in national labs 391.80s - 393.80s | and other areas of government. 393.80s - 399.80s | The EV charging ecosystem does have a multiplicity of interdependencies. 399.80s - 404.80s | It is, I'm sure, old to deal with that for some areas of government. 404.80s - 408.80s | This is new for this area of government. We'll talk more about that. 408.80s - 413.80s | The private sector has been trying to crack this nut for a while, but if you're in the automotive area, 413.80s - 415.80s | you know probably a bit about electric vehicles. 415.80s - 421.80s | You know that there's the auto manufacturers, there's the EV charging station manufacturers, 421.80s - 426.80s | network operators, application developers, security, operational security, 426.80s - 429.80s | and then, of course, there's a tie-in to the utility grid. 429.80s - 437.80s | Add to that the layer cake, basically, of government from city to state, municipal, tribal, federal. 437.80s - 440.80s | There's a lot of layers that are happening in this. 440.80s - 443.80s | So what the joint office is doing is two things. 443.80s - 452.80s | We are the center of gravity for security and cyber-physical security around the charging infrastructure, 452.80s - 460.80s | and then we are also seeking to create a web of interconnectedness amongst all these devices and all these players. 460.80s - 464.80s | It's interoperability, it's reliability, it's security by design. 464.80s - 470.80s | It's all the principles we cherish from the private sector, from what you all are experts on, 470.80s - 474.80s | and we're bringing them into the federal government. Just checking my timer. 474.80s - 479.80s | Okay, so unique infrastructure, unique challenges. 480.80s - 488.80s | As I talked a bit about, as all the headlines say, electric vehicle charging reliability has some room for improvement. 488.80s - 490.80s | We're shooting for 97%. 490.80s - 496.80s | I like all lines myself, but 97% is what our law is, and so that is what we're aiming for. 496.80s - 497.80s | Some work to go on that. 497.80s - 503.80s | I could say so much about


chunk_text:
lot of layers that are happening in this. 440.80s - 443.80s | So what the joint office is doing is two things. 443.80s - 452.80s | We are the center of gravity for security and cyber-physical security around the charging infrastructure, 452.80s - 460.80s | and then we are also seeking to create a web of interconnectedness amongst all these devices and all these players. 460.80s - 464.80s | It's interoperability, it's reliability, it's security by design. 464.80s - 470.80s | It's all the principles we cherish from the private sector, from what you all are experts on, 470.80s - 474.80s | and we're bringing them into the federal government. Just checking my timer. 474.80s - 479.80s | Okay, so unique infrastructure, unique challenges. 480.80s - 488.80s | As I talked a bit about, as all the headlines say, electric vehicle charging reliability has some room for improvement. 488.80s - 490.80s | We're shooting for 97%. 490.80s - 496.80s | I like all lines myself, but 97% is what our law is, and so that is what we're aiming for. 496.80s - 497.80s | Some work to go on that. 497.80s - 503.80s | I could say so much about all of our efforts there, all the funding, the Charging Experience Consortium 503.80s - 506.80s | that I'm staying on task for cybersecurity right now. 506.80s - 514.80s | A lot of work for interoperability, data sharing, privacy frameworks, equity, utility coordination that I discussed earlier. 514.80s - 517.80s | But really, why does this matter? 517.80s - 527.80s | So again, fundamentally and foundationally, we need everybody who rides and drives electric to trust the infrastructure. 527.80s - 532.80s | They might not trust the government, they might not know how it got there, they might not know why it's there, 532.80s - 537.80s | but what I need is for my neighbors, I'm a Detroiter, a Detroit City resident, long time. 537.80s - 546.80s | I need for my neighbors to pull up and plug their vehicle in, for them to know their data's safe, their vehicle's safe, they are safe. 546.80s - 552.80s | They can charge an Evert, they can charge in a blackout, they can charge in a tornado, they can trust it. 552.80s - 554.80s | And that's what we're here to do. 554.80s - 559.80s | We're here to help provide trust in


chunk_text:
all of our efforts there, all the funding, the Charging Experience Consortium 503.80s - 506.80s | that I'm staying on task for cybersecurity right now. 506.80s - 514.80s | A lot of work for interoperability, data sharing, privacy frameworks, equity, utility coordination that I discussed earlier. 514.80s - 517.80s | But really, why does this matter? 517.80s - 527.80s | So again, fundamentally and foundationally, we need everybody who rides and drives electric to trust the infrastructure. 527.80s - 532.80s | They might not trust the government, they might not know how it got there, they might not know why it's there, 532.80s - 537.80s | but what I need is for my neighbors, I'm a Detroiter, a Detroit City resident, long time. 537.80s - 546.80s | I need for my neighbors to pull up and plug their vehicle in, for them to know their data's safe, their vehicle's safe, they are safe. 546.80s - 552.80s | They can charge an Evert, they can charge in a blackout, they can charge in a tornado, they can trust it. 552.80s - 554.80s | And that's what we're here to do. 554.80s - 559.80s | We're here to help provide trust in the system, to anchor that trust, 559.80s - 566.80s | and to support their ability to ride and drive electric no matter what's thrown at them. 566.80s - 572.80s | So it is very connected, as I was saying, and interconnected at that. 572.80s - 575.80s | So we have a number of different players that come into this. 575.80s - 581.80s | I've discussed a few from automakers, EBSC manufacturers, network operators. 581.80s - 585.80s | Obviously there's applications developers, cellular providers. 585.80s - 591.80s | Quite a lot's going to happen with the utility grid that I'll touch on, I'll hint to, I'll allude and foreshadow, 591.80s - 597.80s | and hopefully you'll find out more about that in the future if you'll follow along with everything we're doing. 597.80s - 603.80s | And then there's consumer information, there's informational security and operational security, 603.80s - 609.80s | there's privacy frameworks, and there's the ability for, when I was talking about the layer cake of government, 609.80s - 615.80s | without going too far into it, but often when there's funding, whether it's BIL or IRA funding, 615.80s - 617.80s | it kind of flows from the federal


chunk_text:
the system, to anchor that trust, 559.80s - 566.80s | and to support their ability to ride and drive electric no matter what's thrown at them. 566.80s - 572.80s | So it is very connected, as I was saying, and interconnected at that. 572.80s - 575.80s | So we have a number of different players that come into this. 575.80s - 581.80s | I've discussed a few from automakers, EBSC manufacturers, network operators. 581.80s - 585.80s | Obviously there's applications developers, cellular providers. 585.80s - 591.80s | Quite a lot's going to happen with the utility grid that I'll touch on, I'll hint to, I'll allude and foreshadow, 591.80s - 597.80s | and hopefully you'll find out more about that in the future if you'll follow along with everything we're doing. 597.80s - 603.80s | And then there's consumer information, there's informational security and operational security, 603.80s - 609.80s | there's privacy frameworks, and there's the ability for, when I was talking about the layer cake of government, 609.80s - 615.80s | without going too far into it, but often when there's funding, whether it's BIL or IRA funding, 615.80s - 617.80s | it kind of flows from the federal government. 617.80s - 623.80s | They give it to states or they give it to cities and municipalities for different types of programming, 623.80s - 628.80s | and then those entities select their suppliers and those suppliers execute. 628.80s - 632.80s | And the entities, whether they're cities or states or whatever level of government, 632.80s - 637.80s | they need to be able to understand what they're procuring from their suppliers, 637.80s - 643.80s | ensure excellence in what they're getting from the suppliers, the equipment, the services being rendered, 643.80s - 647.80s | the reliability, the SLAs, they need to know what they're getting. 647.80s - 649.80s | So a big part of that is what we offer. 649.80s - 652.80s | We call that technical assistance in the government. 652.80s - 658.80s | I'll talk a little bit more about the types of technical assistance we offer to make sure that underpinning, 658.80s - 662.80s | so everyone who rides and drives electric can trust the infrastructure, 662.80s - 668.80s | but just want you to keep in mind there's all these parts coming together and the grid. 668.80s - 676.80s | So this diagram is not


chunk_text:
government. 617.80s - 623.80s | They give it to states or they give it to cities and municipalities for different types of programming, 623.80s - 628.80s | and then those entities select their suppliers and those suppliers execute. 628.80s - 632.80s | And the entities, whether they're cities or states or whatever level of government, 632.80s - 637.80s | they need to be able to understand what they're procuring from their suppliers, 637.80s - 643.80s | ensure excellence in what they're getting from the suppliers, the equipment, the services being rendered, 643.80s - 647.80s | the reliability, the SLAs, they need to know what they're getting. 647.80s - 649.80s | So a big part of that is what we offer. 649.80s - 652.80s | We call that technical assistance in the government. 652.80s - 658.80s | I'll talk a little bit more about the types of technical assistance we offer to make sure that underpinning, 658.80s - 662.80s | so everyone who rides and drives electric can trust the infrastructure, 662.80s - 668.80s | but just want you to keep in mind there's all these parts coming together and the grid. 668.80s - 676.80s | So this diagram is not really intended to be legible because it's complicated, and that's okay. 676.80s - 678.80s | Complexity is great, right? 678.80s - 683.80s | There's a number of different players that have a piece of this block diagram, 683.80s - 687.80s | whether they're in the private sector, their utilities, or they're in the public sector, 687.80s - 693.80s | they're in the Office of Electricity, they're the Vehicle Technologies Office, they're our partners in the White House. 693.80s - 698.80s | So what we're figuring out across the Department of Energy and the Department of Transportation 698.80s - 702.80s | is what the interplay and interrelatedness of this. 702.80s - 708.80s | So when vehicles are connected to the grid or they're receiving telematic signals about grid services, 708.80s - 713.80s | grid information, that they can trust those signals, they can trust that information, 713.80s - 716.80s | and that the grid can trust those assets and resources. 716.80s - 718.80s | And it's not just vehicles. 718.80s - 721.80s | There's other linchpin technologies, right? 721.80s - 725.80s | There's smart inverters, there's buildings, there's grid-type storage, 725.80s - 729.80s | there's a lot of distributed energy resources


chunk_text:
really intended to be legible because it's complicated, and that's okay. 676.80s - 678.80s | Complexity is great, right? 678.80s - 683.80s | There's a number of different players that have a piece of this block diagram, 683.80s - 687.80s | whether they're in the private sector, their utilities, or they're in the public sector, 687.80s - 693.80s | they're in the Office of Electricity, they're the Vehicle Technologies Office, they're our partners in the White House. 693.80s - 698.80s | So what we're figuring out across the Department of Energy and the Department of Transportation 698.80s - 702.80s | is what the interplay and interrelatedness of this. 702.80s - 708.80s | So when vehicles are connected to the grid or they're receiving telematic signals about grid services, 708.80s - 713.80s | grid information, that they can trust those signals, they can trust that information, 713.80s - 716.80s | and that the grid can trust those assets and resources. 716.80s - 718.80s | And it's not just vehicles. 718.80s - 721.80s | There's other linchpin technologies, right? 721.80s - 725.80s | There's smart inverters, there's buildings, there's grid-type storage, 725.80s - 729.80s | there's a lot of distributed energy resources out there. 729.80s - 733.80s | And the paradigm of how information flows is starting to change. 733.80s - 738.80s | It's not necessarily just the utility issues some command and control things 738.80s - 741.80s | and then your air conditioner does something. 741.80s - 748.80s | We're starting to see that those end devices have minds, or at least they can communicate between each other, right? 748.80s - 752.80s | Think like autonomous vehicles and paraphernalia communication. 752.80s - 756.80s | That's what's starting to happen in distributed energy resources as well. 756.80s - 762.80s | So we need to make sure that those resources are secure, they can securely and intelligently communicate, 762.80s - 769.80s | they can bring value and a trust chain back up and have revenue-grade data 769.80s - 775.80s | and have everything securely webbed, connected when they do start to connect to the utility grid. 775.80s - 779.80s | So that's something that the Department of Energy and our partners at the Department of Transportation 779.80s - 782.80s | are starting to think a lot about. 782.80s - 788.80s | So before I turn it back over to Harry, I want to


chunk_text:
out there. 729.80s - 733.80s | And the paradigm of how information flows is starting to change. 733.80s - 738.80s | It's not necessarily just the utility issues some command and control things 738.80s - 741.80s | and then your air conditioner does something. 741.80s - 748.80s | We're starting to see that those end devices have minds, or at least they can communicate between each other, right? 748.80s - 752.80s | Think like autonomous vehicles and paraphernalia communication. 752.80s - 756.80s | That's what's starting to happen in distributed energy resources as well. 756.80s - 762.80s | So we need to make sure that those resources are secure, they can securely and intelligently communicate, 762.80s - 769.80s | they can bring value and a trust chain back up and have revenue-grade data 769.80s - 775.80s | and have everything securely webbed, connected when they do start to connect to the utility grid. 775.80s - 779.80s | So that's something that the Department of Energy and our partners at the Department of Transportation 779.80s - 782.80s | are starting to think a lot about. 782.80s - 788.80s | So before I turn it back over to Harry, I want to talk a little bit more about what the Joint Office of Energy 788.80s - 792.80s | and Transportation specifically is working on. 792.80s - 795.80s | So I come from the private sector, which I mentioned, 795.80s - 799.80s | and I like to just keep mentioning because it's so new to me to be in the government. 799.80s - 804.80s | And every time the Department of Energy lab person, I love them so much, 804.80s - 809.80s | every time they say they wrote a report and somebody didn't read it and they're really upset about it, 809.80s - 814.80s | I just want to shake them because when do you think they're going to read it? 814.80s - 817.80s | I worked at Rivian, I worked at Ford before that. 817.80s - 824.80s | I slept at my desk, I would bring the lamp into my desk for when the lights would go off at work 824.80s - 826.80s | so I could keep working. 826.80s - 828.80s | People don't have time to read reports. 828.80s - 830.80s | That's kind of all there is to it. 830.80s - 832.80s | There's no report reading time,


chunk_text:
talk a little bit more about what the Joint Office of Energy 788.80s - 792.80s | and Transportation specifically is working on. 792.80s - 795.80s | So I come from the private sector, which I mentioned, 795.80s - 799.80s | and I like to just keep mentioning because it's so new to me to be in the government. 799.80s - 804.80s | And every time the Department of Energy lab person, I love them so much, 804.80s - 809.80s | every time they say they wrote a report and somebody didn't read it and they're really upset about it, 809.80s - 814.80s | I just want to shake them because when do you think they're going to read it? 814.80s - 817.80s | I worked at Rivian, I worked at Ford before that. 817.80s - 824.80s | I slept at my desk, I would bring the lamp into my desk for when the lights would go off at work 824.80s - 826.80s | so I could keep working. 826.80s - 828.80s | People don't have time to read reports. 828.80s - 830.80s | That's kind of all there is to it. 830.80s - 832.80s | There's no report reading time, unfortunately. 832.80s - 834.80s | We're already missing our kids' baseball games. 834.80s - 837.80s | I already don't have any hobbies. 837.80s - 838.80s | There's no reports. 838.80s - 843.80s | So what we need to do is create tools that make sense and that are, 843.80s - 850.80s | I wouldn't say competitive with the private sector, but like not that look good, 850.80s - 855.80s | that compete at the quality level of the private sector. 855.80s - 860.80s | So one example of that is those of you from or around automotive or working automotive, 860.80s - 864.80s | you probably know that OEMs often have pretty good security teams. 864.80s - 868.80s | Maybe you wish it was a little more or better or whatever, especially if you're automotive. 868.80s - 871.80s | But they're pretty good, they're pretty big, they're usually divided up. 871.80s - 875.80s | You might even have a PKI specialized team or something fancy like that. 875.80s - 882.80s | But when you look at EBSC manufacturers, network operators, much smaller companies, 882.80s - 888.80s | much newer industry, they might only have 30 people that work there. 888.80s


chunk_text:
unfortunately. 832.80s - 834.80s | We're already missing our kids' baseball games. 834.80s - 837.80s | I already don't have any hobbies. 837.80s - 838.80s | There's no reports. 838.80s - 843.80s | So what we need to do is create tools that make sense and that are, 843.80s - 850.80s | I wouldn't say competitive with the private sector, but like not that look good, 850.80s - 855.80s | that compete at the quality level of the private sector. 855.80s - 860.80s | So one example of that is those of you from or around automotive or working automotive, 860.80s - 864.80s | you probably know that OEMs often have pretty good security teams. 864.80s - 868.80s | Maybe you wish it was a little more or better or whatever, especially if you're automotive. 868.80s - 871.80s | But they're pretty good, they're pretty big, they're usually divided up. 871.80s - 875.80s | You might even have a PKI specialized team or something fancy like that. 875.80s - 882.80s | But when you look at EBSC manufacturers, network operators, much smaller companies, 882.80s - 888.80s | much newer industry, they might only have 30 people that work there. 888.80s - 892.80s | They probably do have a couple systems engineers that are like dope at cybersecurity, 892.80s - 895.80s | but not a lot of people. 895.80s - 898.80s | So expecting one of them to be like a master pen tester 899.80s - 904.80s | and understand how to run a full star model or really understand how to do this, 904.80s - 909.80s | how the bandwidth, or have the company be able to pay for a third-party, 909.80s - 913.80s | excellent pen testing company, like the margin's not there. 913.80s - 916.80s | So what we want to do is create tooling. 916.80s - 919.80s | We also in my program, different world of my program, 919.80s - 925.80s | but we have the first, the Curtin of Energy, direct contribution into open source. 925.80s - 929.80s | We work with the Linux Foundation Everest Project, which Perry will talk about, 929.80s - 931.80s | but we'll flash up in a minute. 931.80s - 935.80s | So through that Everest Project in the Linux Foundation, 935.80s - 939.80s | we are going to amend on a pen testing tool. 939.80s - 942.80s | And what


chunk_text:
- 892.80s | They probably do have a couple systems engineers that are like dope at cybersecurity, 892.80s - 895.80s | but not a lot of people. 895.80s - 898.80s | So expecting one of them to be like a master pen tester 899.80s - 904.80s | and understand how to run a full star model or really understand how to do this, 904.80s - 909.80s | how the bandwidth, or have the company be able to pay for a third-party, 909.80s - 913.80s | excellent pen testing company, like the margin's not there. 913.80s - 916.80s | So what we want to do is create tooling. 916.80s - 919.80s | We also in my program, different world of my program, 919.80s - 925.80s | but we have the first, the Curtin of Energy, direct contribution into open source. 925.80s - 929.80s | We work with the Linux Foundation Everest Project, which Perry will talk about, 929.80s - 931.80s | but we'll flash up in a minute. 931.80s - 935.80s | So through that Everest Project in the Linux Foundation, 935.80s - 939.80s | we are going to amend on a pen testing tool. 939.80s - 942.80s | And what that tool would look like is say you've got a great technician, 942.80s - 947.80s | a great systems engineer, and they'll provide like a hands-on step-by-step 947.80s - 950.80s | of how to execute a pen test against your system. 950.80s - 953.80s | How do you layer security? How do you look for threat layers? 953.80s - 955.80s | How do you evaluate what you have? 955.80s - 959.80s | How can you find improvements, whether marginal or significant? 959.80s - 964.80s | It will give you like a step-by-step hands-on walkthrough of really, 964.80s - 968.80s | really doing an excellent pen test for your domain, for your system specifically. 968.80s - 971.80s | That's the kind of tooling you need to build. 971.80s - 978.80s | Other things when I talked about, I'm like 100% less reports as a T-shirt I wear at work, 978.80s - 980.80s | but we do need to create frameworks. 980.80s - 984.80s | So frameworks are like the procurement language I talked about before. 984.80s - 986.80s | The suppliers loved it. 986.80s - 991.80s | When we put out procurement language, it was like 25 different requirements 991.80s -


chunk_text:
that tool would look like is say you've got a great technician, 942.80s - 947.80s | a great systems engineer, and they'll provide like a hands-on step-by-step 947.80s - 950.80s | of how to execute a pen test against your system. 950.80s - 953.80s | How do you layer security? How do you look for threat layers? 953.80s - 955.80s | How do you evaluate what you have? 955.80s - 959.80s | How can you find improvements, whether marginal or significant? 959.80s - 964.80s | It will give you like a step-by-step hands-on walkthrough of really, 964.80s - 968.80s | really doing an excellent pen test for your domain, for your system specifically. 968.80s - 971.80s | That's the kind of tooling you need to build. 971.80s - 978.80s | Other things when I talked about, I'm like 100% less reports as a T-shirt I wear at work, 978.80s - 980.80s | but we do need to create frameworks. 980.80s - 984.80s | So frameworks are like the procurement language I talked about before. 984.80s - 986.80s | The suppliers loved it. 986.80s - 991.80s | When we put out procurement language, it was like 25 different requirements 991.80s - 995.80s | that you should ask for for cyber and cyber security for states 995.80s - 998.80s | when they were looking for suppliers because they're like, 998.80s - 1001.80s | holy smokes, this is way more thorough than we thought the federal government 1001.80s - 1002.80s | would come up with. 1002.80s - 1004.80s | That's the kind of frameworks we want. 1004.80s - 1009.80s | We want privacy frameworks so consumers know that their data is protected 1009.80s - 1011.80s | at all times. 1011.80s - 1013.80s | Data should flow, but it should be protected. 1013.80s - 1014.80s | They should be able to opt out. 1014.80s - 1018.80s | They should be able to have the right to be forgiven, forgotten, excuse me. 1018.80s - 1020.80s | Theoretically, that's just Sarah's opinion, 1020.80s - 1023.80s | but we need to be able to protect their data and their privacy. 1023.80s - 1025.80s | So that's a framework we're working on. 1025.80s - 1027.80s | Another is an incident response. 1027.80s - 1032.80s | Something happens in the value chain, we should be able to know who jumps on it. 1032.80s - 1033.80s | The supplier should


chunk_text:
995.80s | that you should ask for for cyber and cyber security for states 995.80s - 998.80s | when they were looking for suppliers because they're like, 998.80s - 1001.80s | holy smokes, this is way more thorough than we thought the federal government 1001.80s - 1002.80s | would come up with. 1002.80s - 1004.80s | That's the kind of frameworks we want. 1004.80s - 1009.80s | We want privacy frameworks so consumers know that their data is protected 1009.80s - 1011.80s | at all times. 1011.80s - 1013.80s | Data should flow, but it should be protected. 1013.80s - 1014.80s | They should be able to opt out. 1014.80s - 1018.80s | They should be able to have the right to be forgiven, forgotten, excuse me. 1018.80s - 1020.80s | Theoretically, that's just Sarah's opinion, 1020.80s - 1023.80s | but we need to be able to protect their data and their privacy. 1023.80s - 1025.80s | So that's a framework we're working on. 1025.80s - 1027.80s | Another is an incident response. 1027.80s - 1032.80s | Something happens in the value chain, we should be able to know who jumps on it. 1032.80s - 1033.80s | The supplier should jump on it. 1033.80s - 1035.80s | Is the city involved? 1035.80s - 1036.80s | Is the state involved? 1036.80s - 1038.80s | Is the federal government involved? 1038.80s - 1042.80s | Is it like an S fund where we have to go get a subcomponent manufacturer? 1042.80s - 1045.80s | How do we know where the incident root cause is? 1045.80s - 1046.80s | How do we take action on it? 1046.80s - 1048.80s | Who's on first? 1048.80s - 1050.80s | That's the kind of frameworks that we really need, 1050.80s - 1054.80s | and that's what we're working on right now. 1054.80s - 1056.80s | Going forward, where do we want to go next? 1056.80s - 1059.80s | So I can't believe I made it through a whole talk, 1059.80s - 1064.80s | and I only mentioned public key infrastructure once, I think, so far. 1064.80s - 1067.80s | So let me mention it several more times. 1067.80s - 1070.80s | So my favorite thing ever is public key infrastructure, 1070.80s - 1073.80s | and we have a lot of activity around this. 1073.80s - 1081.80s | I have this vision, this goal in life, which is


chunk_text:
jump on it. 1033.80s - 1035.80s | Is the city involved? 1035.80s - 1036.80s | Is the state involved? 1036.80s - 1038.80s | Is the federal government involved? 1038.80s - 1042.80s | Is it like an S fund where we have to go get a subcomponent manufacturer? 1042.80s - 1045.80s | How do we know where the incident root cause is? 1045.80s - 1046.80s | How do we take action on it? 1046.80s - 1048.80s | Who's on first? 1048.80s - 1050.80s | That's the kind of frameworks that we really need, 1050.80s - 1054.80s | and that's what we're working on right now. 1054.80s - 1056.80s | Going forward, where do we want to go next? 1056.80s - 1059.80s | So I can't believe I made it through a whole talk, 1059.80s - 1064.80s | and I only mentioned public key infrastructure once, I think, so far. 1064.80s - 1067.80s | So let me mention it several more times. 1067.80s - 1070.80s | So my favorite thing ever is public key infrastructure, 1070.80s - 1073.80s | and we have a lot of activity around this. 1073.80s - 1081.80s | I have this vision, this goal in life, which is to have roaming for plug-and-charge, 1081.80s - 1083.80s | a national plug-and-charge, one might call it. 1083.80s - 1085.80s | Perhaps you even go to Canada and Mexico, 1085.80s - 1088.80s | and we just call it a North American plug-and-charge. 1088.80s - 1089.80s | I think we're there. 1089.80s - 1093.80s | So I heard the fellow earlier talking about injections 1093.80s - 1097.80s | into ISO 15118-2 when I walked in, my favorite topic. 1097.80s - 1103.80s | So we have 15118-2, which has PKI referenced in it, 1103.80s - 1106.80s | public key infrastructure referenced in it. 1106.80s - 1111.80s | It's been sort of a hot mess and a topic of heated debate and fighting 1111.80s - 1115.80s | and infighting and outfighting for years and years and years and years. 1115.80s - 1117.80s | But it seems like we got it together, 1117.80s - 1120.80s | and there will be a certified trust list, it looks like, 1120.80s - 1124.80s | and there's a number of different suppliers and North America have opted in. 1124.80s - 1127.80s | It looks like we have the framework together. 1127.80s - 1130.80s | So the federal government, because


chunk_text:
to have roaming for plug-and-charge, 1081.80s - 1083.80s | a national plug-and-charge, one might call it. 1083.80s - 1085.80s | Perhaps you even go to Canada and Mexico, 1085.80s - 1088.80s | and we just call it a North American plug-and-charge. 1088.80s - 1089.80s | I think we're there. 1089.80s - 1093.80s | So I heard the fellow earlier talking about injections 1093.80s - 1097.80s | into ISO 15118-2 when I walked in, my favorite topic. 1097.80s - 1103.80s | So we have 15118-2, which has PKI referenced in it, 1103.80s - 1106.80s | public key infrastructure referenced in it. 1106.80s - 1111.80s | It's been sort of a hot mess and a topic of heated debate and fighting 1111.80s - 1115.80s | and infighting and outfighting for years and years and years and years. 1115.80s - 1117.80s | But it seems like we got it together, 1117.80s - 1120.80s | and there will be a certified trust list, it looks like, 1120.80s - 1124.80s | and there's a number of different suppliers and North America have opted in. 1124.80s - 1127.80s | It looks like we have the framework together. 1127.80s - 1130.80s | So the federal government, because I love public key infrastructure so much, 1130.80s - 1133.80s | has done quite a lot to make sure folks can trust this 1133.80s - 1135.80s | when they ride and drive electric. 1135.80s - 1138.80s | We've done healthy testing, supported it, 1138.80s - 1142.80s | NREL, the National Renewable Energy Laboratory. 1142.80s - 1145.80s | We then did adversarial testing against it 1145.80s - 1149.80s | where we shared best and standard practices for adversarial testing. 1149.80s - 1152.80s | Now we're moving on to more like firmware-based. 1152.80s - 1155.80s | So if you have been in the industry, 1155.80s - 1160.80s | the industry talks about state machines different than, I think, 1160.80s - 1163.80s | the public sector and national labs who talk about a state machine. 1163.80s - 1168.80s | So I think about this as, you know, you need to pull certificates out of your HSM 1168.80s - 1172.80s | and pull them into your charging controller so you can run your TLS library 1172.80s - 1175.80s | and then know to switch the vehicle from state E to B 1175.80s - 1178.80s | to start your 15118-2 charging controller. 1178.80s - 1181.80s


chunk_text:
I love public key infrastructure so much, 1130.80s - 1133.80s | has done quite a lot to make sure folks can trust this 1133.80s - 1135.80s | when they ride and drive electric. 1135.80s - 1138.80s | We've done healthy testing, supported it, 1138.80s - 1142.80s | NREL, the National Renewable Energy Laboratory. 1142.80s - 1145.80s | We then did adversarial testing against it 1145.80s - 1149.80s | where we shared best and standard practices for adversarial testing. 1149.80s - 1152.80s | Now we're moving on to more like firmware-based. 1152.80s - 1155.80s | So if you have been in the industry, 1155.80s - 1160.80s | the industry talks about state machines different than, I think, 1160.80s - 1163.80s | the public sector and national labs who talk about a state machine. 1163.80s - 1168.80s | So I think about this as, you know, you need to pull certificates out of your HSM 1168.80s - 1172.80s | and pull them into your charging controller so you can run your TLS library 1172.80s - 1175.80s | and then know to switch the vehicle from state E to B 1175.80s - 1178.80s | to start your 15118-2 charging controller. 1178.80s - 1181.80s | Well, every supplier on earth has to do that, 1181.80s - 1184.80s | and it's just everybody has to do it over and over and over again. 1184.80s - 1188.80s | If we could start creating technologies like that as a commodity 1188.80s - 1190.80s | and releasing them into open source 1190.80s - 1193.80s | or at least creating standard and best practices, 1193.80s - 1196.80s | I think that'll help speed up innovation 1196.80s - 1200.80s | and it'll help American engineering and manufacturing 1200.80s - 1203.80s | compete better with other geographies. 1203.80s - 1205.80s | So we're really working on getting into the weeds, 1205.80s - 1209.80s | getting down to the module level, then at the device level, 1209.80s - 1211.80s | then into the cloud level. 1211.80s - 1216.80s | And I'll just make one last pitch for putting the user first in ChargeX. 1216.80s - 1221.80s | So I do fund one of the largest consortiums within the Department of Energy 1221.80s - 1223.80s | called the Charging Experience Consortium. 1223.80s - 1228.80s | I won't bore you to tears with it, but it's 88 private sector partners. 1228.80s - 1231.80s |


chunk_text:
| Well, every supplier on earth has to do that, 1181.80s - 1184.80s | and it's just everybody has to do it over and over and over again. 1184.80s - 1188.80s | If we could start creating technologies like that as a commodity 1188.80s - 1190.80s | and releasing them into open source 1190.80s - 1193.80s | or at least creating standard and best practices, 1193.80s - 1196.80s | I think that'll help speed up innovation 1196.80s - 1200.80s | and it'll help American engineering and manufacturing 1200.80s - 1203.80s | compete better with other geographies. 1203.80s - 1205.80s | So we're really working on getting into the weeds, 1205.80s - 1209.80s | getting down to the module level, then at the device level, 1209.80s - 1211.80s | then into the cloud level. 1211.80s - 1216.80s | And I'll just make one last pitch for putting the user first in ChargeX. 1216.80s - 1221.80s | So I do fund one of the largest consortiums within the Department of Energy 1221.80s - 1223.80s | called the Charging Experience Consortium. 1223.80s - 1228.80s | I won't bore you to tears with it, but it's 88 private sector partners. 1228.80s - 1231.80s | So if you are from a company that's not a member of it, 1231.80s - 1233.80s | we would love to have you. 1233.80s - 1235.80s | We run three national labs, 1235.80s - 1239.80s | and we focus on the user experience soup to nuts, 1239.80s - 1241.80s | everything you can imagine about it. 1241.80s - 1244.80s | And that's where it all starts, that's where it all ends, 1244.80s - 1247.80s | equity, user experience, cybersecurity. 1247.80s - 1252.80s | And with that, I'll have Harry to sum up. 1252.80s - 1256.80s | So as Sarah described, we've got some big takeaways here 1256.80s - 1261.80s | from that complex ecosystem that is becoming a more unified one 1261.80s - 1264.80s | that is providing us this future we want to live in 1264.80s - 1268.80s | based on creating these stakeholder groups 1268.80s - 1271.80s | so we know how to navigate all that technical ambiguity, 1271.80s - 1274.80s | figuring out how to get through standards and balance processes 1274.80s - 1278.80s | in a more nimble way, making sure we're ahead of where research is going, 1278.80s - 1280.80s | where technology is going,


chunk_text:
So if you are from a company that's not a member of it, 1231.80s - 1233.80s | we would love to have you. 1233.80s - 1235.80s | We run three national labs, 1235.80s - 1239.80s | and we focus on the user experience soup to nuts, 1239.80s - 1241.80s | everything you can imagine about it. 1241.80s - 1244.80s | And that's where it all starts, that's where it all ends, 1244.80s - 1247.80s | equity, user experience, cybersecurity. 1247.80s - 1252.80s | And with that, I'll have Harry to sum up. 1252.80s - 1256.80s | So as Sarah described, we've got some big takeaways here 1256.80s - 1261.80s | from that complex ecosystem that is becoming a more unified one 1261.80s - 1264.80s | that is providing us this future we want to live in 1264.80s - 1268.80s | based on creating these stakeholder groups 1268.80s - 1271.80s | so we know how to navigate all that technical ambiguity, 1271.80s - 1274.80s | figuring out how to get through standards and balance processes 1274.80s - 1278.80s | in a more nimble way, making sure we're ahead of where research is going, 1278.80s - 1280.80s | where technology is going, so we have the opportunity 1280.80s - 1283.80s | to mitigate systemic risk along the way. 1283.80s - 1288.80s | And in the spirit of trying to create these stakeholder communities 1288.80s - 1291.80s | and that sense of shared strategic direction, 1291.80s - 1295.80s | today the Biden-Harris administration is announcing its priorities 1295.80s - 1298.80s | for ensuring the digital ecosystem is ready to deliver 1298.80s - 1300.80s | on the clean energy transition. 1300.80s - 1302.80s | And that includes five linchpin technologies 1302.80s - 1304.80s | that Sarah mentioned in there, 1304.80s - 1306.80s | which are batteries and battery management systems, 1306.80s - 1309.80s | inverter controls, distributed control systems 1309.80s - 1312.80s | like virtual power plants, building management systems, 1312.80s - 1314.80s | and of course EVs and EV cybersecurity. 1314.80s - 1317.80s | But you may notice here that three or four of those 1317.80s - 1320.80s | first ones there are all co-residents in EVs 1320.80s - 1322.80s | and EV charging infrastructure. 1322.80s - 1324.80s | So there's lots of economies of scale here 1324.80s - 1327.80s | and lessons that you can bring forward here from this process. 1327.80s


chunk_text:
so we have the opportunity 1280.80s - 1283.80s | to mitigate systemic risk along the way. 1283.80s - 1288.80s | And in the spirit of trying to create these stakeholder communities 1288.80s - 1291.80s | and that sense of shared strategic direction, 1291.80s - 1295.80s | today the Biden-Harris administration is announcing its priorities 1295.80s - 1298.80s | for ensuring the digital ecosystem is ready to deliver 1298.80s - 1300.80s | on the clean energy transition. 1300.80s - 1302.80s | And that includes five linchpin technologies 1302.80s - 1304.80s | that Sarah mentioned in there, 1304.80s - 1306.80s | which are batteries and battery management systems, 1306.80s - 1309.80s | inverter controls, distributed control systems 1309.80s - 1312.80s | like virtual power plants, building management systems, 1312.80s - 1314.80s | and of course EVs and EV cybersecurity. 1314.80s - 1317.80s | But you may notice here that three or four of those 1317.80s - 1320.80s | first ones there are all co-residents in EVs 1320.80s - 1322.80s | and EV charging infrastructure. 1322.80s - 1324.80s | So there's lots of economies of scale here 1324.80s - 1327.80s | and lessons that you can bring forward here from this process. 1327.80s - 1329.80s | And that's why we need you. 1329.80s - 1332.80s | That's why we need people like you in the car hacking village 1332.80s - 1335.80s | to tear these things apart, to show us where the vulnerabilities are, 1335.80s - 1337.80s | to make these things stronger, 1337.80s - 1340.80s | and put many eyes and prodding keyboards on it. 1340.80s - 1343.80s | And it's why we want you to look at open source software stacks 1343.80s - 1346.80s | that underpin all of these technologies 1346.80s - 1349.80s | that are going to be critical to the success of the clean energy transition. 1349.80s - 1351.80s | We want you looking at these. 1351.80s - 1354.80s | We want your help making sure that they're secure and resilient 1354.80s - 1357.80s | and able to get us to that future that we all deserve to live in. 1357.80s - 1360.80s | So please take a look at them, find those holes, 1360.80s - 1362.80s | and let us know how to make them better 1362.80s - 1364.80s | and make the linchpin technologies 1364.80s - 1366.80s | and the open source software that they live


chunk_text:
- 1329.80s | And that's why we need you. 1329.80s - 1332.80s | That's why we need people like you in the car hacking village 1332.80s - 1335.80s | to tear these things apart, to show us where the vulnerabilities are, 1335.80s - 1337.80s | to make these things stronger, 1337.80s - 1340.80s | and put many eyes and prodding keyboards on it. 1340.80s - 1343.80s | And it's why we want you to look at open source software stacks 1343.80s - 1346.80s | that underpin all of these technologies 1346.80s - 1349.80s | that are going to be critical to the success of the clean energy transition. 1349.80s - 1351.80s | We want you looking at these. 1351.80s - 1354.80s | We want your help making sure that they're secure and resilient 1354.80s - 1357.80s | and able to get us to that future that we all deserve to live in. 1357.80s - 1360.80s | So please take a look at them, find those holes, 1360.80s - 1362.80s | and let us know how to make them better 1362.80s - 1364.80s | and make the linchpin technologies 1364.80s - 1366.80s | and the open source software that they live on 1366.80s - 1369.80s | possible to deliver us that future we all want and deserve. 1369.80s - 1371.80s | Thank you.


chunk_text:
on 1366.80s - 1369.80s | possible to deliver us that future we all want and deserve. 1369.80s - 1371.80s | Thank you.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=dDFtkjYx0V8", "title": "DEF CON 32 - Behind the Badge:How we used hardware to make AV badge - Adam Batori, Robert Pafford", "description": "ADS-B aircraft tracking has long been done with Raspberry Pi\u2019s and SDRs. We set out to build our own receiver from the ground up, but without resorting to expensive and power-hungry SDR chips. Join us for a behind-the-scenes look as we walk through how we were able to (ab)use hardware to squeeze an entire Linux system, custom signal processing chain, and map visualizer into a chip that costs less than most microcontrollers.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1262, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 4.24s | This text was transcribed using whisper model: large-v2 All right. Thank you, everyone, for coming out. And apologies, there's a little delay, 4.24s - 11.04s | as happens with these things. But we're going to go pretty fast. We have a lot to go over, 11.04s - 19.04s | thanks in no part to our Silicon vendors, our supply chain, or DHL. But yeah, we're excited 19.04s - 24.08s | to talk about behind the badge and a little bit on how we use and abuse hardware to create the 24.08s - 28.08s | ADS-B receiver on a badge for the aerospace versions here. My name is Adam Latorre. This 28.08s - 35.36s | is Robert Bradford. And let's get into it. So we'll start off with some theory and some 35.36s - 46.94s | practice. But the theory of the badge is when, yeah, the idea we have for the badge is actually 46.94s - 51.74s | one that Aerospace Village has had kind of in the back pocket for a while, which is it wouldn't be 52.38s - 58.38s | super cool to do an ADS-B receiver on a badge, fully integrated and able to run without needing 58.38s - 63.34s | a network connection from a service like FlightAware or anything that feeds community 63.34s - 69.90s | crowdsource ADS-B. So for those of you that might not be aware, ADS-B, or Automatic Dependent 69.90s - 76.46s | Surveillance Broadcast, is a protocol. It's a type of signal that's a very important aspect 76.46s - 81.66s | of aviation safety. It is transmitted between airplanes, between ground stations, and in some 81.66s - 89.58s | cases even with satellites that can transmit a whole host of


chunk_text:
the 24.08s - 28.08s | ADS-B receiver on a badge for the aerospace versions here. My name is Adam Latorre. This 28.08s - 35.36s | is Robert Bradford. And let's get into it. So we'll start off with some theory and some 35.36s - 46.94s | practice. But the theory of the badge is when, yeah, the idea we have for the badge is actually 46.94s - 51.74s | one that Aerospace Village has had kind of in the back pocket for a while, which is it wouldn't be 52.38s - 58.38s | super cool to do an ADS-B receiver on a badge, fully integrated and able to run without needing 58.38s - 63.34s | a network connection from a service like FlightAware or anything that feeds community 63.34s - 69.90s | crowdsource ADS-B. So for those of you that might not be aware, ADS-B, or Automatic Dependent 69.90s - 76.46s | Surveillance Broadcast, is a protocol. It's a type of signal that's a very important aspect 76.46s - 81.66s | of aviation safety. It is transmitted between airplanes, between ground stations, and in some 81.66s - 89.58s | cases even with satellites that can transmit a whole host of messages between different stations. 90.14s - 94.22s | The most relevant for us are things like call signs, flight numbers, AKO addresses, 95.58s - 100.78s | altitude, headings, so information about planes that you can see flying overhead. 101.82s - 109.42s | And while it's intended uses for safety and air traffic control, a common hobbyist and enthusiast 109.58s - 115.82s | case is it's just cool to be able to see a map of all the planes and aircraft around you overhead 115.82s - 119.42s | and be able to see what flight number it is, its heading, where it's going, flight plans. 120.46s - 125.42s | And ADS-B itself can exist over multiple types of data links, but when we say ADS-B, 125.42s - 130.78s | the most common physical medium that it's sent over is the MODIS downlink at 1090 megahertz. 131.42s - 136.62s | And if you want more information on ADS-B, what it's used for, talk to the Aerospace Village. 137.50s - 142.86s | But where we come in as like hardware design and badge designers is how do we actually, 142.86s - 146.30s | we have this signal, we know what we want to


chunk_text:
messages between different stations. 90.14s - 94.22s | The most relevant for us are things like call signs, flight numbers, AKO addresses, 95.58s - 100.78s | altitude, headings, so information about planes that you can see flying overhead. 101.82s - 109.42s | And while it's intended uses for safety and air traffic control, a common hobbyist and enthusiast 109.58s - 115.82s | case is it's just cool to be able to see a map of all the planes and aircraft around you overhead 115.82s - 119.42s | and be able to see what flight number it is, its heading, where it's going, flight plans. 120.46s - 125.42s | And ADS-B itself can exist over multiple types of data links, but when we say ADS-B, 125.42s - 130.78s | the most common physical medium that it's sent over is the MODIS downlink at 1090 megahertz. 131.42s - 136.62s | And if you want more information on ADS-B, what it's used for, talk to the Aerospace Village. 137.50s - 142.86s | But where we come in as like hardware design and badge designers is how do we actually, 142.86s - 146.30s | we have this signal, we know what we want to receive, but how do we actually implement and 147.18s - 153.58s | make a badge that can receive this signal? So the most common like enthusiast receivers 153.58s - 159.50s | utilize SDRs or software-defined radios like the RTL-SDR. And because this was designed a long time 159.50s - 164.38s | ago, the protocol and the modulation is actually fairly simple to demodulate and decode. It's 164.94s - 169.34s | on-off keyed, which is effectively digital amplitude modulation. It's either on or off. 169.34s - 174.78s | You're either getting RF or you are not on the 1090 megahertz. And the data bits themselves 174.78s - 179.66s | are Manchester encoded, meaning that the data exists in the transitions between 1 and 0 or 0 179.66s - 187.82s | and 1. Now to do this on a badge, if you want to do a so-called real SDR receiver, the chips that 187.82s - 195.10s | require for that is expensive. They are like very high-end RF chipsets and it's way too expensive 195.10s - 201.50s | to put on a badge. Think of something like a Hyper-RF, for example, as a proper SDR. 202.46s - 210.30s | The SDRs like


chunk_text:
receive, but how do we actually implement and 147.18s - 153.58s | make a badge that can receive this signal? So the most common like enthusiast receivers 153.58s - 159.50s | utilize SDRs or software-defined radios like the RTL-SDR. And because this was designed a long time 159.50s - 164.38s | ago, the protocol and the modulation is actually fairly simple to demodulate and decode. It's 164.94s - 169.34s | on-off keyed, which is effectively digital amplitude modulation. It's either on or off. 169.34s - 174.78s | You're either getting RF or you are not on the 1090 megahertz. And the data bits themselves 174.78s - 179.66s | are Manchester encoded, meaning that the data exists in the transitions between 1 and 0 or 0 179.66s - 187.82s | and 1. Now to do this on a badge, if you want to do a so-called real SDR receiver, the chips that 187.82s - 195.10s | require for that is expensive. They are like very high-end RF chipsets and it's way too expensive 195.10s - 201.50s | to put on a badge. Think of something like a Hyper-RF, for example, as a proper SDR. 202.46s - 210.30s | The SDRs like the RTL-SDR uses a DVB-T, which is a digital terrestrial broadcast television. 211.18s - 215.90s | And they overdrive those chips to run faster than they're intended to, which lets you get 215.90s - 221.74s | into that 1090 megahertz band and then receive it and decode it in software. One of the issues that 222.30s - 225.74s | we found when we started looking to using one of these DVB-T tuner chips ourselves, though, 225.74s - 232.70s | is that they are very power hungry. They are very power hungry, especially when 232.70s - 238.94s | being overdriven to hit the 1090 megahertz band. And in addition to just getting really, really hot, 238.94s - 244.38s | the battery life of the badge would be next to zero. So we had to come up with a new way to do it. 245.18s - 249.90s | And the third major way of receiving ADS-B is the log amp architecture. 249.90s - 255.34s | This uses a very fast RF power level meter, which converts the logarithmic received RF power 255.34s - 260.94s | into a linear output voltage. And in this mode, it can act as an envelope detector 262.30s


chunk_text:
the RTL-SDR uses a DVB-T, which is a digital terrestrial broadcast television. 211.18s - 215.90s | And they overdrive those chips to run faster than they're intended to, which lets you get 215.90s - 221.74s | into that 1090 megahertz band and then receive it and decode it in software. One of the issues that 222.30s - 225.74s | we found when we started looking to using one of these DVB-T tuner chips ourselves, though, 225.74s - 232.70s | is that they are very power hungry. They are very power hungry, especially when 232.70s - 238.94s | being overdriven to hit the 1090 megahertz band. And in addition to just getting really, really hot, 238.94s - 244.38s | the battery life of the badge would be next to zero. So we had to come up with a new way to do it. 245.18s - 249.90s | And the third major way of receiving ADS-B is the log amp architecture. 249.90s - 255.34s | This uses a very fast RF power level meter, which converts the logarithmic received RF power 255.34s - 260.94s | into a linear output voltage. And in this mode, it can act as an envelope detector 262.30s - 270.06s | when filtered with some very tight 1090 megahertz saw filters. So the way that the architecture, 270.06s - 278.22s | the receive chain works is that you get the entire RF spectrum coming in through your antenna 278.22s - 283.58s | that gets amplified and filtered and amplified and filtered again through very tight 1090 megahertz 283.58s - 289.66s | bandpass filters. So we can extract only the very specific slice of the spectrum that is centered at 289.66s - 295.74s | 1090 megahertz. And then because the signal that we are trying to demodulate is just on and off, 296.22s - 303.10s | the RF power meter will let us know is it seeing no RF or is it seeing more RF. And that lets us 303.10s - 313.18s | turn the 1090 megahertz ADS-B packets in the air into a two megahertz baseband level output. 314.46s - 321.90s | And we actually used an amplifier and anti-aliasing filter chip from a composite video signal, 322.70s - 330.06s | from a composite video receiver, because it is very cheap. If you want to buy an eighth order 330.06s - 335.74s | Butterworth filter with multiple channels


chunk_text:
- 270.06s | when filtered with some very tight 1090 megahertz saw filters. So the way that the architecture, 270.06s - 278.22s | the receive chain works is that you get the entire RF spectrum coming in through your antenna 278.22s - 283.58s | that gets amplified and filtered and amplified and filtered again through very tight 1090 megahertz 283.58s - 289.66s | bandpass filters. So we can extract only the very specific slice of the spectrum that is centered at 289.66s - 295.74s | 1090 megahertz. And then because the signal that we are trying to demodulate is just on and off, 296.22s - 303.10s | the RF power meter will let us know is it seeing no RF or is it seeing more RF. And that lets us 303.10s - 313.18s | turn the 1090 megahertz ADS-B packets in the air into a two megahertz baseband level output. 314.46s - 321.90s | And we actually used an amplifier and anti-aliasing filter chip from a composite video signal, 322.70s - 330.06s | from a composite video receiver, because it is very cheap. If you want to buy an eighth order 330.06s - 335.74s | Butterworth filter with multiple channels and power amplifiers and clamp diodes, well, 335.74s - 341.58s | analog devices would love to charge you a lot of money for that. But no one uses composite 341.58s - 345.90s | video anymore, right? But if you want this composite video amplifier with an eighth order 345.90s - 351.98s | Butterworth filter implemented into it and multiple chains and an amplifier, well, 352.78s - 360.62s | please take it. Who uses composite video? But the last step in this process is digitizing the 360.62s - 366.86s | signal itself. Again, the common way of doing it is to put it into a fast analog to digital 366.86s - 374.78s | converter, an ADC. But again, high performance RF intended ADCs are expensive. And 375.98s - 379.34s | when trying to optimize design, the best chip is no chip. 382.14s - 386.78s | So the SOC that we're using for the main Linux component of the badge is the Allwinner T113. 386.78s - 391.26s | It has dual Cortex-A7s, and we'll get into some more of the specs a little bit later. 391.82s - 396.86s | But it doesn't have any fast ADCs on board, at least nothing that's


chunk_text:
and power amplifiers and clamp diodes, well, 335.74s - 341.58s | analog devices would love to charge you a lot of money for that. But no one uses composite 341.58s - 345.90s | video anymore, right? But if you want this composite video amplifier with an eighth order 345.90s - 351.98s | Butterworth filter implemented into it and multiple chains and an amplifier, well, 352.78s - 360.62s | please take it. Who uses composite video? But the last step in this process is digitizing the 360.62s - 366.86s | signal itself. Again, the common way of doing it is to put it into a fast analog to digital 366.86s - 374.78s | converter, an ADC. But again, high performance RF intended ADCs are expensive. And 375.98s - 379.34s | when trying to optimize design, the best chip is no chip. 382.14s - 386.78s | So the SOC that we're using for the main Linux component of the badge is the Allwinner T113. 386.78s - 391.26s | It has dual Cortex-A7s, and we'll get into some more of the specs a little bit later. 391.82s - 396.86s | But it doesn't have any fast ADCs on board, at least nothing that's actually fast enough to 396.86s - 403.34s | demodulate ADS-B. Well, it is intended actually for automotive video applications. 403.98s - 409.90s | So it has multiple video inputs and outputs. And one of the supported video input modes is 409.90s - 417.26s | composite video. Well, if you know your composite video trivia, the baseband signal has frequency 417.26s - 422.78s | components that require at least a 27 mega sample ADC. And sure enough, if you look at the block 422.78s - 431.18s | diagram we have in our data sheet, it says that on the left side next to the PGA is an ADC block, 431.18s - 440.32s | because you must have a fast ADC to be able to digitize composite video. And it's a fast ADC, 440.32s - 447.04s | but if I actually go back, you can see the ADC is not isolated. It's wrapped inside a bunch of 447.04s - 453.12s | filters. You have the PGA, you have all the hardware blocks that are designed to demodulate 453.12s - 458.72s | composite video. So you don't get raw samples from the ADC, you get pixels basically. So it 458.72s - 464.08s |


chunk_text:
actually fast enough to 396.86s - 403.34s | demodulate ADS-B. Well, it is intended actually for automotive video applications. 403.98s - 409.90s | So it has multiple video inputs and outputs. And one of the supported video input modes is 409.90s - 417.26s | composite video. Well, if you know your composite video trivia, the baseband signal has frequency 417.26s - 422.78s | components that require at least a 27 mega sample ADC. And sure enough, if you look at the block 422.78s - 431.18s | diagram we have in our data sheet, it says that on the left side next to the PGA is an ADC block, 431.18s - 440.32s | because you must have a fast ADC to be able to digitize composite video. And it's a fast ADC, 440.32s - 447.04s | but if I actually go back, you can see the ADC is not isolated. It's wrapped inside a bunch of 447.04s - 453.12s | filters. You have the PGA, you have all the hardware blocks that are designed to demodulate 453.12s - 458.72s | composite video. So you don't get raw samples from the ADC, you get pixels basically. So it 458.72s - 464.08s | tries to find a lock, it tries to find H-sync, it tries to find V-sync. It has built-in filters to 464.08s - 471.28s | do color correction, which means that as it stands, it could not receive ADS-B, it couldn't actually 472.16s - 475.68s | get you samples because it would just always say, oh, I can't find a signal, I can't see a video 475.68s - 482.32s | signal, and just do nothing. But the ADC itself is in the silicon. And as we like to say, we paid 482.32s - 487.44s | for the whole silicon and we want to use the whole silicon. And well, we had to do some reverse 487.44s - 493.44s | engineering on how to be able to disable these filters. And we were able to discover certain 493.44s - 500.40s | undocumented registers, some undocumented registers in the all-owner chip itself that let you put it 500.40s - 506.24s | into this special manufacturing test mode. See, making fast ADCs, the reason it's expensive 506.24s - 510.80s | and isolation is that it's kind of hard to fabricate and then verify the harmonic performance 510.80s - 517.12s | of. So the silicon


chunk_text:
tries to find a lock, it tries to find H-sync, it tries to find V-sync. It has built-in filters to 464.08s - 471.28s | do color correction, which means that as it stands, it could not receive ADS-B, it couldn't actually 472.16s - 475.68s | get you samples because it would just always say, oh, I can't find a signal, I can't see a video 475.68s - 482.32s | signal, and just do nothing. But the ADC itself is in the silicon. And as we like to say, we paid 482.32s - 487.44s | for the whole silicon and we want to use the whole silicon. And well, we had to do some reverse 487.44s - 493.44s | engineering on how to be able to disable these filters. And we were able to discover certain 493.44s - 500.40s | undocumented registers, some undocumented registers in the all-owner chip itself that let you put it 500.40s - 506.24s | into this special manufacturing test mode. See, making fast ADCs, the reason it's expensive 506.24s - 510.80s | and isolation is that it's kind of hard to fabricate and then verify the harmonic performance 510.80s - 517.12s | of. So the silicon manufacturer will put in these modes that let you basically bypass out 517.92s - 521.84s | the actual video, the H-sync and V-sync blocks, because those would probably work, 521.84s - 527.04s | but the ADC itself can then be isolated in the special test mode, which can get you the true 527.04s - 531.68s | raw samples out. And then when you have the true raw samples, you can verify the performance. 531.68s - 537.76s | So that's exactly what we want to be able to abuse this as a standalone, straightforward ADC. 538.96s - 545.76s | And that's exactly what we did. We did some reverse engineering, we found the registers, 545.76s - 551.84s | and when we put it into this test mode, as you can see from the trace, that is pulled from a 551.84s - 559.68s | badge with the RF front end attached, that is the ADS-B preamble and the start of a data packet 559.68s - 566.88s | being received as raw samples from the onboard ADC. And actually, I will go back. You see the 566.88s - 573.60s | preamble pattern, the 101-101, and that's exactly what we're seeing on the output


chunk_text:
manufacturer will put in these modes that let you basically bypass out 517.92s - 521.84s | the actual video, the H-sync and V-sync blocks, because those would probably work, 521.84s - 527.04s | but the ADC itself can then be isolated in the special test mode, which can get you the true 527.04s - 531.68s | raw samples out. And then when you have the true raw samples, you can verify the performance. 531.68s - 537.76s | So that's exactly what we want to be able to abuse this as a standalone, straightforward ADC. 538.96s - 545.76s | And that's exactly what we did. We did some reverse engineering, we found the registers, 545.76s - 551.84s | and when we put it into this test mode, as you can see from the trace, that is pulled from a 551.84s - 559.68s | badge with the RF front end attached, that is the ADS-B preamble and the start of a data packet 559.68s - 566.88s | being received as raw samples from the onboard ADC. And actually, I will go back. You see the 566.88s - 573.60s | preamble pattern, the 101-101, and that's exactly what we're seeing on the output of our ADC. 574.56s - 579.20s | And this was our proof of concept to say that, okay, we can actually do this. We can get away 579.20s - 585.60s | with not using any external ADC or SDR chips or really anything intended to be used in this way, 585.60s - 594.82s | except like the saw filters, and do it fully integrated on just the core Linux SoC. Now, 596.18s - 600.82s | as I said, the specs of the badge itself, outside of just the RF, we are running full 600.98s - 607.94s | mainline Linux 6.6. We thought it'd be really cool to bring basically a Linux dev kit on a board. 607.94s - 614.26s | And since we have the power of our SoC to do the RF decoding, and we have to write a bunch of 614.26s - 617.06s | software to manage the Wi-Fi and everything, we're like, hey, instead of writing all the 617.06s - 623.70s | drivers ourselves, mainline Linux is out there, and it's great. Let's use it. Our display is a 623.70s - 632.10s | 40 by 40 circular display, which we got custom manufactured for us. A lot


chunk_text:
of our ADC. 574.56s - 579.20s | And this was our proof of concept to say that, okay, we can actually do this. We can get away 579.20s - 585.60s | with not using any external ADC or SDR chips or really anything intended to be used in this way, 585.60s - 594.82s | except like the saw filters, and do it fully integrated on just the core Linux SoC. Now, 596.18s - 600.82s | as I said, the specs of the badge itself, outside of just the RF, we are running full 600.98s - 607.94s | mainline Linux 6.6. We thought it'd be really cool to bring basically a Linux dev kit on a board. 607.94s - 614.26s | And since we have the power of our SoC to do the RF decoding, and we have to write a bunch of 614.26s - 617.06s | software to manage the Wi-Fi and everything, we're like, hey, instead of writing all the 617.06s - 623.70s | drivers ourselves, mainline Linux is out there, and it's great. Let's use it. Our display is a 623.70s - 632.10s | 40 by 40 circular display, which we got custom manufactured for us. A lot of people actually 632.10s - 638.42s | thought it's like, it's not a smartwatch screen. We actually don't really know where it's from, 638.42s - 644.58s | but when our display manufacturer said, hey, guys, we have these cool, we have the circular 644.58s - 648.90s | displays you're talking about, and this 2.7-inch form factor, what do you think? We're like, 648.90s - 653.46s | this is perfect. It looks like a radarscope. It looks like an oscilloscope. Let's go. 654.66s - 661.70s | Outside of the ADC, on the core T113 SoC itself, we have the dual-core A7s running at 1.2 gigahertz 661.70s - 668.82s | each, and that's the application processor cluster that is running Linux. And then another bonus 668.82s - 674.66s | that we got on our silicon is the HiFi4 DSP, which we'll talk about a little bit more in a few 674.66s - 681.78s | slides, but that's a DSP core that's designed to be an audio coprocessor that we are, again, 682.02s - 686.50s | reprogramming outside the manufacturer's use case to actually do the demodulation, 686.50s - 695.22s | Manchester decode, and ADS-B bit slicing. In the package, we have embedded


chunk_text:
of people actually 632.10s - 638.42s | thought it's like, it's not a smartwatch screen. We actually don't really know where it's from, 638.42s - 644.58s | but when our display manufacturer said, hey, guys, we have these cool, we have the circular 644.58s - 648.90s | displays you're talking about, and this 2.7-inch form factor, what do you think? We're like, 648.90s - 653.46s | this is perfect. It looks like a radarscope. It looks like an oscilloscope. Let's go. 654.66s - 661.70s | Outside of the ADC, on the core T113 SoC itself, we have the dual-core A7s running at 1.2 gigahertz 661.70s - 668.82s | each, and that's the application processor cluster that is running Linux. And then another bonus 668.82s - 674.66s | that we got on our silicon is the HiFi4 DSP, which we'll talk about a little bit more in a few 674.66s - 681.78s | slides, but that's a DSP core that's designed to be an audio coprocessor that we are, again, 682.02s - 686.50s | reprogramming outside the manufacturer's use case to actually do the demodulation, 686.50s - 695.22s | Manchester decode, and ADS-B bit slicing. In the package, we have embedded 128 megs of DDR3 695.22s - 702.58s | SD-RAM, 8 gigabytes of eMMC onboard storage, and some other RF implementations. We have GPS 702.58s - 708.18s | and Wi-Fi, because why not? We're already going all out. We're already doing full custom RF and 709.06s - 713.46s | printed PCB antennas. Let's go for broke. Let's add GPS. Let's add Wi-Fi. 715.46s - 717.54s | So, that's all in theory. 718.98s - 722.50s | Before that, I think there's a badge giveaway that's going to... 722.50s - 724.90s | No, it's okay. I'll keep going. 724.90s - 725.70s | Okay, okay. 727.78s - 732.66s | So, now this is all what we had in theory. This is what came up with the designs, 732.66s - 736.98s | and then we get it manufactured by our manufacturer, and then they come back, 736.98s - 740.34s | and now we actually get to implement it, and go through all the crazy 741.46s - 745.30s | systems, and actually do the reverse engineering, and make sure that we can actually get this ADS-B 745.30s - 750.90s | receiver running inside of this badge. So, you'd think the most challenging part of this whole


chunk_text:
128 megs of DDR3 695.22s - 702.58s | SD-RAM, 8 gigabytes of eMMC onboard storage, and some other RF implementations. We have GPS 702.58s - 708.18s | and Wi-Fi, because why not? We're already going all out. We're already doing full custom RF and 709.06s - 713.46s | printed PCB antennas. Let's go for broke. Let's add GPS. Let's add Wi-Fi. 715.46s - 717.54s | So, that's all in theory. 718.98s - 722.50s | Before that, I think there's a badge giveaway that's going to... 722.50s - 724.90s | No, it's okay. I'll keep going. 724.90s - 725.70s | Okay, okay. 727.78s - 732.66s | So, now this is all what we had in theory. This is what came up with the designs, 732.66s - 736.98s | and then we get it manufactured by our manufacturer, and then they come back, 736.98s - 740.34s | and now we actually get to implement it, and go through all the crazy 741.46s - 745.30s | systems, and actually do the reverse engineering, and make sure that we can actually get this ADS-B 745.30s - 750.90s | receiver running inside of this badge. So, you'd think the most challenging part of this whole 750.90s - 757.06s | design process would be the fully custom ADS-B receiver running with an ADC in an undocumented 757.06s - 761.70s | test mode, and then piping it into an audio DSP, which was never designed with the goal of actually 761.70s - 769.14s | doing ADS-B decoding. But that was actually the easiest part. The RF, Adam being a mad lad, 769.14s - 775.22s | made a full zero to tri-band microwave RF in just four months. This is his first RF project. 778.74s - 783.14s | And then the TV decoder code, we got it working after a night of debugging, and we actually had 783.14s - 788.66s | a cool oscilloscope mode that we could actually read directly from the ADC in, and get it plotted 788.66s - 794.26s | on our screen. And then we got the DSP code execution in a week, and then after that we did 794.26s - 798.74s | a week for Linux kernel dev, and then a week for algorithms, and we got ADS-B. That was the easy 798.74s - 804.10s | part. It was everything else that should have just worked that didn't, mainly which, if any of


chunk_text:
750.90s - 757.06s | design process would be the fully custom ADS-B receiver running with an ADC in an undocumented 757.06s - 761.70s | test mode, and then piping it into an audio DSP, which was never designed with the goal of actually 761.70s - 769.14s | doing ADS-B decoding. But that was actually the easiest part. The RF, Adam being a mad lad, 769.14s - 775.22s | made a full zero to tri-band microwave RF in just four months. This is his first RF project. 778.74s - 783.14s | And then the TV decoder code, we got it working after a night of debugging, and we actually had 783.14s - 788.66s | a cool oscilloscope mode that we could actually read directly from the ADC in, and get it plotted 788.66s - 794.26s | on our screen. And then we got the DSP code execution in a week, and then after that we did 794.26s - 798.74s | a week for Linux kernel dev, and then a week for algorithms, and we got ADS-B. That was the easy 798.74s - 804.10s | part. It was everything else that should have just worked that didn't, mainly which, if any of you 804.10s - 809.06s | guys have ever worked with USB-C before, can probably understand why it's USB-C. And then, 809.06s - 814.66s | of course, the AXP2585 battery management chip, which we will go into more detail later about the 814.66s - 821.46s | whole experience with that. So, before we get into the more challenging parts, here's a quick 821.46s - 830.50s | guide on running code on your HiFi4 DSP. So, the Allwinner T113, it has a HiFi4 DSP, and they 830.50s - 834.34s | advertise it as, oh, you have a third core. But what they don't tell you is that they only give 834.34s - 838.98s | you the firmware as like a blob that gets loaded in, and it's only for audio processing, because 838.98s - 843.86s | it has an audio out, and it does all the codecs with that. And the mainline kernel doesn't even 844.82s - 851.78s | touch the DSP. But it is its own CPU core. It can be programmed, and if you find the right resources, 851.78s - 857.22s | you can actually program it. Because we're doing all of these ADS-B processing, we want to try and


chunk_text:
you 804.10s - 809.06s | guys have ever worked with USB-C before, can probably understand why it's USB-C. And then, 809.06s - 814.66s | of course, the AXP2585 battery management chip, which we will go into more detail later about the 814.66s - 821.46s | whole experience with that. So, before we get into the more challenging parts, here's a quick 821.46s - 830.50s | guide on running code on your HiFi4 DSP. So, the Allwinner T113, it has a HiFi4 DSP, and they 830.50s - 834.34s | advertise it as, oh, you have a third core. But what they don't tell you is that they only give 834.34s - 838.98s | you the firmware as like a blob that gets loaded in, and it's only for audio processing, because 838.98s - 843.86s | it has an audio out, and it does all the codecs with that. And the mainline kernel doesn't even 844.82s - 851.78s | touch the DSP. But it is its own CPU core. It can be programmed, and if you find the right resources, 851.78s - 857.22s | you can actually program it. Because we're doing all of these ADS-B processing, we want to try and 857.22s - 861.22s | get the maximum performance to get as high speed out as possible, so we can increase the sample 861.22s - 866.58s | rate and have better performance. So, we wanted to do the full SIMD vectorization, and actually 866.58s - 872.34s | use the real HiFi4 toolchain from the vendor, rather than using a lot of the open source ones 872.34s - 879.14s | you might find with ESP32 running with GCC. So, if you find the Extensa toolchain, which needs to, 879.70s - 883.46s | then you need to, you get the Extensa toolchain and compiler with the vendor tools, 883.46s - 888.90s | but you also need to actually get the custom vendor IP block, which was used to generate that 888.90s - 894.34s | exact silicon. The great part about HiFi4 is it can be exactly customized to the exact chip you 894.34s - 899.46s | want to build. So, if you want to have all of these advanced vector units, you can add them in. If not, 899.46s - 903.30s | you can remove them. You can have however many registers you want, and it's all configurable to 903.30s - 907.46s |


chunk_text:
857.22s - 861.22s | get the maximum performance to get as high speed out as possible, so we can increase the sample 861.22s - 866.58s | rate and have better performance. So, we wanted to do the full SIMD vectorization, and actually 866.58s - 872.34s | use the real HiFi4 toolchain from the vendor, rather than using a lot of the open source ones 872.34s - 879.14s | you might find with ESP32 running with GCC. So, if you find the Extensa toolchain, which needs to, 879.70s - 883.46s | then you need to, you get the Extensa toolchain and compiler with the vendor tools, 883.46s - 888.90s | but you also need to actually get the custom vendor IP block, which was used to generate that 888.90s - 894.34s | exact silicon. The great part about HiFi4 is it can be exactly customized to the exact chip you 894.34s - 899.46s | want to build. So, if you want to have all of these advanced vector units, you can add them in. If not, 899.46s - 903.30s | you can remove them. You can have however many registers you want, and it's all configurable to 903.30s - 907.46s | the silicon vendor, but that means that the compiler needs to know what it has available, 907.46s - 912.18s | and the way they do that is a full blob, which has full Verilog for the chip that actually gets 912.18s - 917.14s | produced, as just a giant zip file, and you load it all into the toolchain, and it figures out how 917.14s - 921.94s | to program for your chip. So, once you find that, then you have to compare that with the exact 921.94s - 927.62s | version of the Extensa toolchain that it was built with, and then you have to locate all the drivers 927.62s - 931.78s | from Allwinner, and source them, and gather them up to actually do the interrupt controller, timers, 931.78s - 936.26s | and mailbox, and then you just download the FreeRTOS port from GitHub, and you combine them 936.26s - 940.26s | all together, and you can actually get one of the most stable development environments we've had on 940.26s - 945.30s | this entire badge, where you just run Extensa Explorer, and it just works. So, that's kind of 945.30s - 953.94s | the process for getting


chunk_text:
the silicon vendor, but that means that the compiler needs to know what it has available, 907.46s - 912.18s | and the way they do that is a full blob, which has full Verilog for the chip that actually gets 912.18s - 917.14s | produced, as just a giant zip file, and you load it all into the toolchain, and it figures out how 917.14s - 921.94s | to program for your chip. So, once you find that, then you have to compare that with the exact 921.94s - 927.62s | version of the Extensa toolchain that it was built with, and then you have to locate all the drivers 927.62s - 931.78s | from Allwinner, and source them, and gather them up to actually do the interrupt controller, timers, 931.78s - 936.26s | and mailbox, and then you just download the FreeRTOS port from GitHub, and you combine them 936.26s - 940.26s | all together, and you can actually get one of the most stable development environments we've had on 940.26s - 945.30s | this entire badge, where you just run Extensa Explorer, and it just works. So, that's kind of 945.30s - 953.94s | the process for getting DSP. And now, actually, for Linux on the badge, we are, again, we mentioned 953.94s - 958.58s | we're using mainline Linux, and that actually drastically sped up the dev time, where you don't 958.58s - 963.86s | have to do, a lot of the drivers came pre-baked, you just have to configure them correctly. It just 963.86s - 969.06s | works, but you have to figure out how to configure it, so a lot of the time, it's finding magical 969.06s - 973.86s | incantations and device trees that you forget to set, that cause it to panic, all of that, and then 973.86s - 977.54s | if you put all the things together, and you figure out that it should be working, but it's not, 977.54s - 981.22s | then it's a bug, and then you spend three weeks doing advanced kernel debugging, figuring out why 981.22s - 987.70s | your display is not working. Speaking of which, display trivia. Take a guess, which of these four 987.70s - 991.86s | options caused the artifacting of the clock being messed up, you have too large of a back porch, 992.74s - 996.82s | there's an unknown silicon bug


chunk_text:
DSP. And now, actually, for Linux on the badge, we are, again, we mentioned 953.94s - 958.58s | we're using mainline Linux, and that actually drastically sped up the dev time, where you don't 958.58s - 963.86s | have to do, a lot of the drivers came pre-baked, you just have to configure them correctly. It just 963.86s - 969.06s | works, but you have to figure out how to configure it, so a lot of the time, it's finding magical 969.06s - 973.86s | incantations and device trees that you forget to set, that cause it to panic, all of that, and then 973.86s - 977.54s | if you put all the things together, and you figure out that it should be working, but it's not, 977.54s - 981.22s | then it's a bug, and then you spend three weeks doing advanced kernel debugging, figuring out why 981.22s - 987.70s | your display is not working. Speaking of which, display trivia. Take a guess, which of these four 987.70s - 991.86s | options caused the artifacting of the clock being messed up, you have too large of a back porch, 992.74s - 996.82s | there's an unknown silicon bug that only happens when the Linux driver sets an undocumented bit, 996.82s - 1001.46s | which just happens to exist in a sister chip, but is not on our system on chip, 1001.46s - 1004.82s | or the display controller registers were initialized in the wrong order, 1004.82s - 1010.98s | but they never tell you the right order. The answer is E, you didn't seat the cable properly 1010.98s - 1015.22s | when you're trying to solve all the other previous ones, and you're trying to debug the issue above. 1016.10s - 1022.90s | This is the silicon bug. So this was just a fun thing, and we spent three weeks trying to solve 1022.90s - 1027.46s | this silicon bug right here, where actually the display would turn green, and it was because 1027.46s - 1032.98s | they were setting some, the driver for the sister chip had a bit which they were setting, but it 1032.98s - 1038.66s | caused this chip to glitch in a weird way, causing the MSB of that green channel to be set high, 1039.22s - 1044.02s | but it only occurred on this one, and you have to go through all


chunk_text:
that only happens when the Linux driver sets an undocumented bit, 996.82s - 1001.46s | which just happens to exist in a sister chip, but is not on our system on chip, 1001.46s - 1004.82s | or the display controller registers were initialized in the wrong order, 1004.82s - 1010.98s | but they never tell you the right order. The answer is E, you didn't seat the cable properly 1010.98s - 1015.22s | when you're trying to solve all the other previous ones, and you're trying to debug the issue above. 1016.10s - 1022.90s | This is the silicon bug. So this was just a fun thing, and we spent three weeks trying to solve 1022.90s - 1027.46s | this silicon bug right here, where actually the display would turn green, and it was because 1027.46s - 1032.98s | they were setting some, the driver for the sister chip had a bit which they were setting, but it 1032.98s - 1038.66s | caused this chip to glitch in a weird way, causing the MSB of that green channel to be set high, 1039.22s - 1044.02s | but it only occurred on this one, and you have to go through all 10,000 lines of the display driver 1044.02s - 1048.58s | and find the exact line you have to comment out which caused the display not to turn green. 1048.58s - 1051.06s | But if you do that, then you have a working screen. 1053.94s - 1061.22s | So here's a continuation of the meme. The AXV2585 has been the thing that has been battling us and 1061.22s - 1069.06s | fighting us for the entire badge. So this chip, it's just a USB-C negotiator, battery charger, 1069.06s - 1072.82s | BME, all-in-one. It's actually a very unique chip, because there's not that many that do 1072.82s - 1076.10s | all of these. A lot of the time, you have to get several chips and stitch them together. 1076.66s - 1083.94s | So there's no firmware. It's not like some embedded 8051 core or all that. It's just 1083.94s - 1089.70s | basic I2C registers you need to configure. How difficult could it be to program? It's just flip 1089.70s - 1097.54s | flops, right? There were several bugs that we found in the AXV2585, and all of them battled 1097.54s - 1101.78s | us throughout development. From the first bring


chunk_text:
10,000 lines of the display driver 1044.02s - 1048.58s | and find the exact line you have to comment out which caused the display not to turn green. 1048.58s - 1051.06s | But if you do that, then you have a working screen. 1053.94s - 1061.22s | So here's a continuation of the meme. The AXV2585 has been the thing that has been battling us and 1061.22s - 1069.06s | fighting us for the entire badge. So this chip, it's just a USB-C negotiator, battery charger, 1069.06s - 1072.82s | BME, all-in-one. It's actually a very unique chip, because there's not that many that do 1072.82s - 1076.10s | all of these. A lot of the time, you have to get several chips and stitch them together. 1076.66s - 1083.94s | So there's no firmware. It's not like some embedded 8051 core or all that. It's just 1083.94s - 1089.70s | basic I2C registers you need to configure. How difficult could it be to program? It's just flip 1089.70s - 1097.54s | flops, right? There were several bugs that we found in the AXV2585, and all of them battled 1097.54s - 1101.78s | us throughout development. From the first bring up, we've had battery detection, which says it 1101.78s - 1106.74s | should try and detect if there's a battery and not try and charge it if it doesn't see one. But they 1106.74s - 1110.74s | say it should always try and do that by default, but all of the chips we get actually are cleared, 1110.74s - 1115.14s | and they assume a battery is present, causing weird instability until you program it in the 1115.14s - 1119.94s | bootloader and in Linux. There's also fun things where if you get power or any sort of hardware 1119.94s - 1125.62s | glitches, it causes very undefined results in the silicon, where certain registers stop working or 1125.62s - 1131.22s | things stop writing. There's also the joys of USB Type-C, where we learned that if you plug it into 1131.22s - 1135.78s | certain model MacBooks, instead of the MacBook charging the badge, the badge will try to charge 1135.78s - 1142.58s | the MacBook, which does not work. There's also the biggest thing that actually delayed us a lot 1142.58s - 1146.90s | right at DEF CON when we were trying to solve this, and we spent


chunk_text:
up, we've had battery detection, which says it 1101.78s - 1106.74s | should try and detect if there's a battery and not try and charge it if it doesn't see one. But they 1106.74s - 1110.74s | say it should always try and do that by default, but all of the chips we get actually are cleared, 1110.74s - 1115.14s | and they assume a battery is present, causing weird instability until you program it in the 1115.14s - 1119.94s | bootloader and in Linux. There's also fun things where if you get power or any sort of hardware 1119.94s - 1125.62s | glitches, it causes very undefined results in the silicon, where certain registers stop working or 1125.62s - 1131.22s | things stop writing. There's also the joys of USB Type-C, where we learned that if you plug it into 1131.22s - 1135.78s | certain model MacBooks, instead of the MacBook charging the badge, the badge will try to charge 1135.78s - 1142.58s | the MacBook, which does not work. There's also the biggest thing that actually delayed us a lot 1142.58s - 1146.90s | right at DEF CON when we were trying to solve this, and we spent a big part of the time when 1146.90s - 1152.02s | we were trying to get things ready, trying to debug why the actual IRQ pin to interrupt the 1152.02s - 1158.02s | Linux kernel and say data is available, actually not being going low. And this was all due to a 1158.02s - 1162.74s | certain manufacturing issue. It was not actually a bug in the chip or a configuration issue, 1162.74s - 1168.42s | but one of the pins was not soldered correctly by the board manufacturer. It passed all visual 1168.42s - 1173.22s | inspection, but one of the ground pins was not soldered well enough, and it got just enough of 1173.22s - 1179.06s | a ground pin connection through the other ground pad that it worked enough, but not enough to have 1179.06s - 1184.82s | a bunch of weird glitches and voltage dropping out and weird chip instability. So we have probably 1184.82s - 1191.78s | this AXP2585. It's a great chip for the cost and everything, but the true cost for this chip is 1191.78s - 1197.86s | really in the development hours of all these bugs trying to solve the USB-C issues


chunk_text:
a big part of the time when 1146.90s - 1152.02s | we were trying to get things ready, trying to debug why the actual IRQ pin to interrupt the 1152.02s - 1158.02s | Linux kernel and say data is available, actually not being going low. And this was all due to a 1158.02s - 1162.74s | certain manufacturing issue. It was not actually a bug in the chip or a configuration issue, 1162.74s - 1168.42s | but one of the pins was not soldered correctly by the board manufacturer. It passed all visual 1168.42s - 1173.22s | inspection, but one of the ground pins was not soldered well enough, and it got just enough of 1173.22s - 1179.06s | a ground pin connection through the other ground pad that it worked enough, but not enough to have 1179.06s - 1184.82s | a bunch of weird glitches and voltage dropping out and weird chip instability. So we have probably 1184.82s - 1191.78s | this AXP2585. It's a great chip for the cost and everything, but the true cost for this chip is 1191.78s - 1197.86s | really in the development hours of all these bugs trying to solve the USB-C issues and bring up and 1197.86s - 1202.58s | try and figure out why the chip isn't booting. But if we wrangled it enough to actually get the 1202.58s - 1207.30s | badge running and we have a stable system, just make sure you have a battery in when booting up 1207.30s - 1214.50s | because BMU gremlins will come up without it because of instabilities. So yeah, that's it. 1216.02s - 1218.02s | So yeah. All right. 1223.94s - 1226.90s | All right. So yeah, thank you so much for joining us for this overview. I know it's 1227.86s - 1232.98s | as you could see, we've been battling gremlins for untold amount of time. So everything is a 1232.98s - 1239.14s | little bit rushed, but we have zero minutes. So if you have any questions, we will be more than 1239.14s - 1244.66s | happy to chat after either here at the village. Basically, you can come find us. We'd love to chat 1244.66s - 1252.98s | some more. And yeah, if you have a badge out there, tag us on the Aerospace Village Twitter. 1252.98s - 1261.46s | We'd love to see where they travel to and


chunk_text:
and bring up and 1197.86s - 1202.58s | try and figure out why the chip isn't booting. But if we wrangled it enough to actually get the 1202.58s - 1207.30s | badge running and we have a stable system, just make sure you have a battery in when booting up 1207.30s - 1214.50s | because BMU gremlins will come up without it because of instabilities. So yeah, that's it. 1216.02s - 1218.02s | So yeah. All right. 1223.94s - 1226.90s | All right. So yeah, thank you so much for joining us for this overview. I know it's 1227.86s - 1232.98s | as you could see, we've been battling gremlins for untold amount of time. So everything is a 1232.98s - 1239.14s | little bit rushed, but we have zero minutes. So if you have any questions, we will be more than 1239.14s - 1244.66s | happy to chat after either here at the village. Basically, you can come find us. We'd love to chat 1244.66s - 1252.98s | some more. And yeah, if you have a badge out there, tag us on the Aerospace Village Twitter. 1252.98s - 1261.46s | We'd love to see where they travel to and what planes are picking up. And with that, thank you.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=YPcOwKtRuDQ", "title": "DEF CON 32 - Anyone can hack IoT- Beginner\u2019s Guide to Hacking Your First IoT Device - Andrew Bellini", "description": "Yes, anyone can hack IoT devices and I\u2019ll show you how! It doesn\u2019t matter if you\u2019re an experienced pen tester in other fields, completely new to cybersecurity or just IoT curious, by the end of this talk you\u2019ll have the knowledge to hack your first device. You might be thinking - but I thought IoT was complicated, required knowledge of hardware, and expensive tools. In this talk, I\u2019m here to dispel those myths by directly showing you the methodology, tools and tactics you can use to go and hack an IoT device today (or maybe when you get home). I\u2019ll cover what IoT devices are best for beginners, what tools you need (and don\u2019t need), how to build a small toolkit for less than $100, common tactics to get a foothold into IoT devices and how to find your first vulnerability or bug.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 3252, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.21s - 5.89s | This text was transcribed using whisper model: large-v2 Welcome everyone. My name is Andrew Bellini and I am here today to both 5.89s - 11.09s | convince you and show you that anyone can hack IOT devices. So in the talk 11.09s - 14.33s | today I'm hoping to both convince you that and I'm also going to walk you 14.33s - 19.11s | through a methodology that you can go take home, buy a cheap consumer IOT 19.11s - 23.69s | device and hopefully hack it. Before we get into the actual specifics of that I 23.69s - 28.65s | actually just want to start with a really quick joke and that joke is the 28.65s - 34.25s | S in IOT stands for security. Has anyone heard that joke before here? It's one 34.25s - 38.17s | that I hear, yeah I see some people are hearing it. It's one that I hear tossed 38.17s - 42.69s | around the cybersecurity community and usually when I hear that joke it's 42.69s - 47.41s | actually by folks that don't work specifically in IOT or embedded security 47.41s - 52.29s | but as someone who actually has a background working in industrial IOT 52.29s - 56.61s | devices and embedded devices I won't say I'm not salty


chunk_text:
here today to both 5.89s - 11.09s | convince you and show you that anyone can hack IOT devices. So in the talk 11.09s - 14.33s | today I'm hoping to both convince you that and I'm also going to walk you 14.33s - 19.11s | through a methodology that you can go take home, buy a cheap consumer IOT 19.11s - 23.69s | device and hopefully hack it. Before we get into the actual specifics of that I 23.69s - 28.65s | actually just want to start with a really quick joke and that joke is the 28.65s - 34.25s | S in IOT stands for security. Has anyone heard that joke before here? It's one 34.25s - 38.17s | that I hear, yeah I see some people are hearing it. It's one that I hear tossed 38.17s - 42.69s | around the cybersecurity community and usually when I hear that joke it's 42.69s - 47.41s | actually by folks that don't work specifically in IOT or embedded security 47.41s - 52.29s | but as someone who actually has a background working in industrial IOT 52.29s - 56.61s | devices and embedded devices I won't say I'm not salty about it I'll actually put 56.61s - 63.33s | my hand up and be the first to say that it is a well-deserved joke. So the thing 63.33s - 66.85s | about that joke is and we can all you know have a laugh at IOT devices and 66.85s - 71.49s | their lack of security but the reality is if you you know check out and look 71.49s - 75.93s | at how many estimates for IOT devices there are connected in the world right 75.93s - 80.17s | now you'll see greater than 15 billion you know estimates that's almost two per 80.17s - 86.21s | person of IOT devices and in addition to that we're expecting there to be a big 86.25s - 90.17s | surge of IOT devices because of AI and machine learning how they're going to be 90.17s - 94.85s | used for edge devices and it's estimated looking at the projections there could 94.85s - 101.21s | be 30 million by or 30 billion sorry by the end of the decade so that is a lot 101.21s - 105.05s | of things to secure and these are everywhere so it's not like they're


chunk_text:
about it I'll actually put 56.61s - 63.33s | my hand up and be the first to say that it is a well-deserved joke. So the thing 63.33s - 66.85s | about that joke is and we can all you know have a laugh at IOT devices and 66.85s - 71.49s | their lack of security but the reality is if you you know check out and look 71.49s - 75.93s | at how many estimates for IOT devices there are connected in the world right 75.93s - 80.17s | now you'll see greater than 15 billion you know estimates that's almost two per 80.17s - 86.21s | person of IOT devices and in addition to that we're expecting there to be a big 86.25s - 90.17s | surge of IOT devices because of AI and machine learning how they're going to be 90.17s - 94.85s | used for edge devices and it's estimated looking at the projections there could 94.85s - 101.21s | be 30 million by or 30 billion sorry by the end of the decade so that is a lot 101.21s - 105.05s | of things to secure and these are everywhere so it's not like they're just 105.05s - 109.97s | in our households from you know smart cameras to even smart toilets these are 109.97s - 114.13s | also in critical infrastructure they're in our cars they're essentially 114.13s - 120.22s | everywhere nowadays so one of the things that I kind of thought when I was 120.22s - 124.18s | starting to get interested in IOT security is there's so many devices and 124.18s - 128.74s | in addition to that there's this agreed-upon kind of thing in the security 128.74s - 133.46s | community that IOT devices are not secure so I figured there would be a lot 133.46s - 138.58s | of people doing IOT hacking and the cyber criminals are definitely taking 138.58s - 142.78s | advantage of this they love finding vulnerabilities and IOT devices and 142.78s - 146.98s | adding them to their botnets or using them for initial access but my 146.98s - 150.66s | experience was in the ethical hacking community when I started meeting hackers 150.66s - 155.10s | and things like that and asking them if they hack IOT devices a lot of times the 155.10s - 159.70s | answer was no and that was


chunk_text:
just 105.05s - 109.97s | in our households from you know smart cameras to even smart toilets these are 109.97s - 114.13s | also in critical infrastructure they're in our cars they're essentially 114.13s - 120.22s | everywhere nowadays so one of the things that I kind of thought when I was 120.22s - 124.18s | starting to get interested in IOT security is there's so many devices and 124.18s - 128.74s | in addition to that there's this agreed-upon kind of thing in the security 128.74s - 133.46s | community that IOT devices are not secure so I figured there would be a lot 133.46s - 138.58s | of people doing IOT hacking and the cyber criminals are definitely taking 138.58s - 142.78s | advantage of this they love finding vulnerabilities and IOT devices and 142.78s - 146.98s | adding them to their botnets or using them for initial access but my 146.98s - 150.66s | experience was in the ethical hacking community when I started meeting hackers 150.66s - 155.10s | and things like that and asking them if they hack IOT devices a lot of times the 155.10s - 159.70s | answer was no and that was kind of reaffirmed today too I've had a booth 159.70s - 162.70s | here where we've been doing IOT hacking and I had mostly beginners who had never 162.70s - 168.42s | done it and it was awesome to teach them that so one of the things that you know 168.42s - 171.82s | I when I ask people why aren't you doing IOT hacking there's a few 171.82s - 176.50s | misconceptions that I hear about it and I just want to try and dispel some of 176.50s - 180.82s | those so the very first one is that it's too expensive so you need to buy 180.82s - 185.02s | expensive gear you need like you know an oscilloscope or like a microscope or 185.02s - 189.30s | expensive tools to get into it when you're starting out and this is a 189.30s - 194.18s | reality you're probably going to need to buy the devices you want to hack on and 194.18s - 199.02s | then addition there was really a large lack of affordable training when I was 199.02s - 203.14s | looking to learn even you know five years back it was like $5,000 for


chunk_text:
kind of reaffirmed today too I've had a booth 159.70s - 162.70s | here where we've been doing IOT hacking and I had mostly beginners who had never 162.70s - 168.42s | done it and it was awesome to teach them that so one of the things that you know 168.42s - 171.82s | I when I ask people why aren't you doing IOT hacking there's a few 171.82s - 176.50s | misconceptions that I hear about it and I just want to try and dispel some of 176.50s - 180.82s | those so the very first one is that it's too expensive so you need to buy 180.82s - 185.02s | expensive gear you need like you know an oscilloscope or like a microscope or 185.02s - 189.30s | expensive tools to get into it when you're starting out and this is a 189.30s - 194.18s | reality you're probably going to need to buy the devices you want to hack on and 194.18s - 199.02s | then addition there was really a large lack of affordable training when I was 199.02s - 203.14s | looking to learn even you know five years back it was like $5,000 for a 203.14s - 208.66s | course a lot of them were in person and then the second misconception I hear is 208.66s - 212.10s | that it's very complicated you need to like have an engineering degree you need 212.10s - 217.02s | to know about electronics you need about hardware circuits all of that stuff you 217.02s - 220.50s | need to know about special protocols in addition to just the you know normal 220.50s - 225.78s | things that you need to know about hacking and in my opinion you know some 225.78s - 228.90s | of these are true there is some truth to it but I actually think there are ways 228.90s - 234.54s | that you can actually learn to hack IOT devices commercial IOT devices off the 234.54s - 238.10s | shelf without spending that much money and there is a lot of great resources to 238.10s - 243.42s | learn how to do it for free or for very limited amounts of money okay so I've 243.42s - 246.74s | been chatting for a little bit I just wanted to give a quick intro to who I 246.74s - 252.14s | am and


chunk_text:
a 203.14s - 208.66s | course a lot of them were in person and then the second misconception I hear is 208.66s - 212.10s | that it's very complicated you need to like have an engineering degree you need 212.10s - 217.02s | to know about electronics you need about hardware circuits all of that stuff you 217.02s - 220.50s | need to know about special protocols in addition to just the you know normal 220.50s - 225.78s | things that you need to know about hacking and in my opinion you know some 225.78s - 228.90s | of these are true there is some truth to it but I actually think there are ways 228.90s - 234.54s | that you can actually learn to hack IOT devices commercial IOT devices off the 234.54s - 238.10s | shelf without spending that much money and there is a lot of great resources to 238.10s - 243.42s | learn how to do it for free or for very limited amounts of money okay so I've 243.42s - 246.74s | been chatting for a little bit I just wanted to give a quick intro to who I 246.74s - 252.14s | am and why I know a little bit about IOT and IOT security so my name again is 252.14s - 257.30s | Andrew Bellini I go by digital Andrew on the socials my background is actually in 257.30s - 261.62s | electrical engineering so before I got into cybersecurity I did a lot of work 261.62s - 266.10s | actually designing embedded devices and industrial IOT devices so that's a 266.10s - 269.74s | little bit where I learned about it not specifically in security but just 269.74s - 275.10s | actually you know designing the devices that we use I now work as a content 275.10s - 280.30s | creator at TCM security so there I am the creator of our IOT hacking course 280.30s - 284.90s | it's a beginners IOT hacking course and I also created our practical junior IOT 284.90s - 288.62s | tester certification and if you do want to link up with me you want a copy of 288.62s - 291.86s | these slides you want to see what I'm working on I got lots of free blog 291.86s - 297.67s | resources or anything like that check out my website so a little bit of


chunk_text:
why I know a little bit about IOT and IOT security so my name again is 252.14s - 257.30s | Andrew Bellini I go by digital Andrew on the socials my background is actually in 257.30s - 261.62s | electrical engineering so before I got into cybersecurity I did a lot of work 261.62s - 266.10s | actually designing embedded devices and industrial IOT devices so that's a 266.10s - 269.74s | little bit where I learned about it not specifically in security but just 269.74s - 275.10s | actually you know designing the devices that we use I now work as a content 275.10s - 280.30s | creator at TCM security so there I am the creator of our IOT hacking course 280.30s - 284.90s | it's a beginners IOT hacking course and I also created our practical junior IOT 284.90s - 288.62s | tester certification and if you do want to link up with me you want a copy of 288.62s - 291.86s | these slides you want to see what I'm working on I got lots of free blog 291.86s - 297.67s | resources or anything like that check out my website so a little bit of 297.67s - 302.07s | motivation for this talk I have one specific goal and that is to provide you 302.07s - 307.71s | with a methodology specific tools and knowledge to vine vulnerabilities aka 307.71s - 313.35s | hack in commercial IOT devices and I have a couple messages here from some of my 313.35s - 316.99s | previous students just to give you some motivation and also proof that this 316.99s - 320.59s | methodology works so I had one student he actually just messaged me a couple 320.59s - 324.87s | weeks before Defcon I was super excited to see this I didn't know him before but 324.87s - 328.65s | he said I took I took your course and he had you know chatting with him I he had 328.65s - 333.39s | never done any IOT hacking he took my suggestion he went and got a cheap smart 333.39s - 337.95s | camera off Amazon and he actually was able to find three vulnerabilities in it 337.95s - 340.95s | got in touch with the vendor and he's got three CVS coming so super excited 340.95s - 343.99s | for about that and then there was


chunk_text:
297.67s - 302.07s | motivation for this talk I have one specific goal and that is to provide you 302.07s - 307.71s | with a methodology specific tools and knowledge to vine vulnerabilities aka 307.71s - 313.35s | hack in commercial IOT devices and I have a couple messages here from some of my 313.35s - 316.99s | previous students just to give you some motivation and also proof that this 316.99s - 320.59s | methodology works so I had one student he actually just messaged me a couple 320.59s - 324.87s | weeks before Defcon I was super excited to see this I didn't know him before but 324.87s - 328.65s | he said I took I took your course and he had you know chatting with him I he had 328.65s - 333.39s | never done any IOT hacking he took my suggestion he went and got a cheap smart 333.39s - 337.95s | camera off Amazon and he actually was able to find three vulnerabilities in it 337.95s - 340.95s | got in touch with the vendor and he's got three CVS coming so super excited 340.95s - 343.99s | for about that and then there was another message this person didn't want 343.99s - 346.91s | me to put their name up but he he took my course as well and then he bought a 346.91s - 351.63s | cheap router and he found a remote code execution vulnerability in it and I just 351.63s - 355.67s | was chatting with him about how he could submit that to a CNA because the vendor 355.67s - 360.62s | didn't want to talk to him about it but how he found a vulnerability so this 360.62s - 365.06s | chat is for everyone of course if you're here I'm glad you're here if you are if 365.06s - 369.98s | you're new to IOT or you're IOT curious as I say this talk is specifically 369.98s - 374.22s | catered to people who are new or just curious about IOT and it's going to 374.22s - 380.58s | assume you have limited or no experience with IOT or embedded systems so it's a 380.58s - 383.94s | really quick agenda of what we're in for today we'll start with some really 383.94s - 387.62s | quickly safety and and legal considerations we'll then talk about 387.62s -


chunk_text:
another message this person didn't want 343.99s - 346.91s | me to put their name up but he he took my course as well and then he bought a 346.91s - 351.63s | cheap router and he found a remote code execution vulnerability in it and I just 351.63s - 355.67s | was chatting with him about how he could submit that to a CNA because the vendor 355.67s - 360.62s | didn't want to talk to him about it but how he found a vulnerability so this 360.62s - 365.06s | chat is for everyone of course if you're here I'm glad you're here if you are if 365.06s - 369.98s | you're new to IOT or you're IOT curious as I say this talk is specifically 369.98s - 374.22s | catered to people who are new or just curious about IOT and it's going to 374.22s - 380.58s | assume you have limited or no experience with IOT or embedded systems so it's a 380.58s - 383.94s | really quick agenda of what we're in for today we'll start with some really 383.94s - 387.62s | quickly safety and and legal considerations we'll then talk about 387.62s - 391.90s | what device you should actually pick if you're getting started on so if you want 391.90s - 394.62s | to go home and buy something off Amazon what you should look for if you're gonna 394.62s - 398.66s | go dumpster diving for example we'll then talk about how you can build out an 398.66s - 401.94s | affordable toolkit and what stuff you should buy or what's up you should avoid 401.94s - 406.02s | and how to not you know break the bank doing this then I'm going to take a look 406.02s - 410.22s | at locating using and abusing hardware interfaces we'll then talk about 410.22s - 413.82s | acquiring firmware and then after that we get our hands on the firmware we'll 413.82s - 417.94s | talk about analyzing and reversing engineering it so just a really quick 417.94s - 421.02s | staying out of trouble this is kind of like the golden rule of ethical hacking 421.02s - 425.14s | in my opinion only test devices that you're authorized to and then this is my 425.18s - 429.02s | personal suggestion since I am giving a talk about potentially how to go


chunk_text:
391.90s | what device you should actually pick if you're getting started on so if you want 391.90s - 394.62s | to go home and buy something off Amazon what you should look for if you're gonna 394.62s - 398.66s | go dumpster diving for example we'll then talk about how you can build out an 398.66s - 401.94s | affordable toolkit and what stuff you should buy or what's up you should avoid 401.94s - 406.02s | and how to not you know break the bank doing this then I'm going to take a look 406.02s - 410.22s | at locating using and abusing hardware interfaces we'll then talk about 410.22s - 413.82s | acquiring firmware and then after that we get our hands on the firmware we'll 413.82s - 417.94s | talk about analyzing and reversing engineering it so just a really quick 417.94s - 421.02s | staying out of trouble this is kind of like the golden rule of ethical hacking 421.02s - 425.14s | in my opinion only test devices that you're authorized to and then this is my 425.18s - 429.02s | personal suggestion since I am giving a talk about potentially how to go out and 429.02s - 433.78s | find CVs and IOT devices but I always recommend being ethical and following 433.78s - 438.90s | responsible disclosure if you do find things unfortunately for a lot of IOT 438.90s - 442.38s | devices they don't have bug bounty programs but they do have responsible 442.38s - 446.34s | disclosure so you can at least report it get some credit and get a CV that way or 446.34s - 449.94s | something so last one's up to you but you know I would implore you to go that 449.94s - 454.38s | route if you find something okay so I did want to just give a little chat 454.38s - 458.02s | about staying safe because sometimes I give workshops or things like that and 458.02s - 461.42s | I teach people about IOT and hardware hacking and they're a little bit nervous 461.42s - 465.78s | about opening up a device and working on the hardware of it so the first thing I 465.78s - 471.86s | will say is IOT hacking is in itself very inherently safe so hardware hacking 471.86s - 476.74s | on commercial IOT devices and that's really


chunk_text:
out and 429.02s - 433.78s | find CVs and IOT devices but I always recommend being ethical and following 433.78s - 438.90s | responsible disclosure if you do find things unfortunately for a lot of IOT 438.90s - 442.38s | devices they don't have bug bounty programs but they do have responsible 442.38s - 446.34s | disclosure so you can at least report it get some credit and get a CV that way or 446.34s - 449.94s | something so last one's up to you but you know I would implore you to go that 449.94s - 454.38s | route if you find something okay so I did want to just give a little chat 454.38s - 458.02s | about staying safe because sometimes I give workshops or things like that and 458.02s - 461.42s | I teach people about IOT and hardware hacking and they're a little bit nervous 461.42s - 465.78s | about opening up a device and working on the hardware of it so the first thing I 465.78s - 471.86s | will say is IOT hacking is in itself very inherently safe so hardware hacking 471.86s - 476.74s | on commercial IOT devices and that's really if you just only follow one basic 476.74s - 480.02s | rule you'll be fine and that rule is that you should never work on anything 480.02s - 483.26s | high voltage so when you open up the device you're working on it most of 483.26s - 487.70s | these devices are going to be like 12 volts 9 volts 3.3 volts 5 volts operating 487.70s - 491.50s | voltage all of those are for the most part safe to work on you probably won't 491.50s - 495.06s | even feel it if you touch it the voltage from our walls and our house and stuff 495.06s - 499.06s | that stuff can really hurt you so just stay away from that stuff just work 499.06s - 503.58s | inside your device you'll be fine never use any damage or modified power 503.58s - 506.54s | supplies because that's how we can accidentally introduce those higher 506.54s - 510.62s | voltages into the device damage our device ourselves and then this last one 510.62s - 514.86s | is more about keeping your devices safe but when I give workshops I see people 514.86s - 518.62s | doing this all the


chunk_text:
if you just only follow one basic 476.74s - 480.02s | rule you'll be fine and that rule is that you should never work on anything 480.02s - 483.26s | high voltage so when you open up the device you're working on it most of 483.26s - 487.70s | these devices are going to be like 12 volts 9 volts 3.3 volts 5 volts operating 487.70s - 491.50s | voltage all of those are for the most part safe to work on you probably won't 491.50s - 495.06s | even feel it if you touch it the voltage from our walls and our house and stuff 495.06s - 499.06s | that stuff can really hurt you so just stay away from that stuff just work 499.06s - 503.58s | inside your device you'll be fine never use any damage or modified power 503.58s - 506.54s | supplies because that's how we can accidentally introduce those higher 506.54s - 510.62s | voltages into the device damage our device ourselves and then this last one 510.62s - 514.86s | is more about keeping your devices safe but when I give workshops I see people 514.86s - 518.62s | doing this all the time this is the most common way to brick or fry your device 518.62s - 521.82s | but if you have it open and you're working on it then that's not how the 521.82s - 526.74s | manufacturer intended you to be using it and if you're plugging in clips or wires 526.74s - 529.94s | or things like that if you have it powered on it's easy to bridge 529.94s - 533.42s | something and do a short circuit and that's the easiest way that I see people 533.42s - 536.36s | who are learning fry their device so it's just really good practice if 536.36s - 540.96s | you're not using it turn it off plug anything in you need then turn it on 540.96s - 543.64s | when you're done and if you need to unclip it you power it off then you work 543.64s - 547.08s | on it and it's easy to forget I'm always walking around my workshops warning 547.08s - 551.00s | people of that last thing I just want to give a really quick shout out to because 551.00s - 555.28s | people have gotten seriously injured from this or hurt doing


chunk_text:
time this is the most common way to brick or fry your device 518.62s - 521.82s | but if you have it open and you're working on it then that's not how the 521.82s - 526.74s | manufacturer intended you to be using it and if you're plugging in clips or wires 526.74s - 529.94s | or things like that if you have it powered on it's easy to bridge 529.94s - 533.42s | something and do a short circuit and that's the easiest way that I see people 533.42s - 536.36s | who are learning fry their device so it's just really good practice if 536.36s - 540.96s | you're not using it turn it off plug anything in you need then turn it on 540.96s - 543.64s | when you're done and if you need to unclip it you power it off then you work 543.64s - 547.08s | on it and it's easy to forget I'm always walking around my workshops warning 547.08s - 551.00s | people of that last thing I just want to give a really quick shout out to because 551.00s - 555.28s | people have gotten seriously injured from this or hurt doing this you aren't 555.28s - 557.92s | really gonna counter these and IOT devices but if you take your hardware 557.92s - 560.60s | hacking skills that you learn from this to other things I have larger power 560.60s - 564.76s | supplies is watch out for large capacitors because these can actually 564.76s - 568.92s | pack a punch as far as the amount of energy they store and also some people 568.92s - 572.88s | don't realize but when you unplug these devices or capacitors from the wall they 572.88s - 575.96s | can hold their charge for quite a while so you may think you're safe but they 575.96s - 580.20s | can zap you this is not common in pretty much all IOT devices but I just say this 580.20s - 583.36s | because a lot of people have this misconception if it's unplugged it's 583.36s - 588.28s | safe but if there's large capacitors that's not the case okay so now that 588.28s - 592.04s | we've got all of the preamble and everything out of the way we can get on 592.04s - 596.24s | to you know kind of my methodology for how


chunk_text:
this you aren't 555.28s - 557.92s | really gonna counter these and IOT devices but if you take your hardware 557.92s - 560.60s | hacking skills that you learn from this to other things I have larger power 560.60s - 564.76s | supplies is watch out for large capacitors because these can actually 564.76s - 568.92s | pack a punch as far as the amount of energy they store and also some people 568.92s - 572.88s | don't realize but when you unplug these devices or capacitors from the wall they 572.88s - 575.96s | can hold their charge for quite a while so you may think you're safe but they 575.96s - 580.20s | can zap you this is not common in pretty much all IOT devices but I just say this 580.20s - 583.36s | because a lot of people have this misconception if it's unplugged it's 583.36s - 588.28s | safe but if there's large capacitors that's not the case okay so now that 588.28s - 592.04s | we've got all of the preamble and everything out of the way we can get on 592.04s - 596.24s | to you know kind of my methodology for how you can go home get a cheap consumer 596.24s - 600.08s | IOT device and hack it so the first thing to do is actually to pick the 600.08s - 605.36s | right target if you're learning so I always suggest the cheaper the better 605.36s - 608.80s | when you're starting to learn and there's a couple reasons for this the 608.80s - 612.40s | first one is and this isn't always the case but usually you get what you pay 612.40s - 617.80s | for in terms of security and also hardware security so on cheaper devices 617.80s - 621.40s | you generally won't run into limitations on the hardware where the 621.40s - 626.08s | debug ports are locked down or the firmware is encrypted and then the 626.08s - 629.16s | second one which kind of goes with my second point here is I never hack 629.16s - 634.00s | anything that I don't mind bricking or destroying and if it's a cheap device 634.00s - 637.56s | then you're not gonna be as concerned or upset if you fry it and you know I'll 637.56s - 641.36s | raise my hand and say I still


chunk_text:
you can go home get a cheap consumer 596.24s - 600.08s | IOT device and hack it so the first thing to do is actually to pick the 600.08s - 605.36s | right target if you're learning so I always suggest the cheaper the better 605.36s - 608.80s | when you're starting to learn and there's a couple reasons for this the 608.80s - 612.40s | first one is and this isn't always the case but usually you get what you pay 612.40s - 617.80s | for in terms of security and also hardware security so on cheaper devices 617.80s - 621.40s | you generally won't run into limitations on the hardware where the 621.40s - 626.08s | debug ports are locked down or the firmware is encrypted and then the 626.08s - 629.16s | second one which kind of goes with my second point here is I never hack 629.16s - 634.00s | anything that I don't mind bricking or destroying and if it's a cheap device 634.00s - 637.56s | then you're not gonna be as concerned or upset if you fry it and you know I'll 637.56s - 641.36s | raise my hand and say I still you know fry or brick devices it happens I've 641.36s - 644.52s | been hardware hacking for a long time and it still happens and if you're a 644.52s - 648.28s | follower of Joe Grand for example probably one of the most famous hardware 648.28s - 652.20s | hackers he gave a talk a few DEF CONs ago he literally he literally just 652.20s - 656.52s | talked about all of the devices that he had bricked over the years so it happens 656.52s - 660.96s | to all of us if you're looking for a specific type of device my suggestion is 660.96s - 665.20s | to go with cheap routers or cheap smart cameras they're great to start on they 665.20s - 668.12s | usually have vulnerabilities that you can find and also more importantly they 668.12s - 674.20s | almost always run embedded Linux which in my opinion is a much easier type of 674.36s - 677.44s | device to hack on when you're learning than something with a microcontroller 677.44s - 682.24s | like ESP 32 or STM 32 that's gonna be running an RTOS those are a little bit 682.24s - 685.56s | more


chunk_text:
you know fry or brick devices it happens I've 641.36s - 644.52s | been hardware hacking for a long time and it still happens and if you're a 644.52s - 648.28s | follower of Joe Grand for example probably one of the most famous hardware 648.28s - 652.20s | hackers he gave a talk a few DEF CONs ago he literally he literally just 652.20s - 656.52s | talked about all of the devices that he had bricked over the years so it happens 656.52s - 660.96s | to all of us if you're looking for a specific type of device my suggestion is 660.96s - 665.20s | to go with cheap routers or cheap smart cameras they're great to start on they 665.20s - 668.12s | usually have vulnerabilities that you can find and also more importantly they 668.12s - 674.20s | almost always run embedded Linux which in my opinion is a much easier type of 674.36s - 677.44s | device to hack on when you're learning than something with a microcontroller 677.44s - 682.24s | like ESP 32 or STM 32 that's gonna be running an RTOS those are a little bit 682.24s - 685.56s | more advanced or harder when you're getting started and I will give another 685.56s - 690.56s | shout out to a dumpster diving so on my on this picture here this is one of many 690.56s - 694.48s | bins I have at my house are just full of old devices and I just kind of put it 694.48s - 698.10s | out into the universe like my friends and family know that I'm this dude that 698.10s - 701.92s | likes hacking weird electronic stuff so if they're throwing away their router or 701.92s - 706.60s | camera then they ask me or I find them in like disposal bins or whatever I 706.60s - 709.56s | can't resist so it's a great way to learn though because usually these 709.56s - 712.60s | devices work fine people are just they're obsolete or whatever but they 712.60s - 717.16s | don't have to worry about breaking them or anything okay so once we've got a 717.16s - 720.40s | device hopefully it's a smart camera or a router or something we've got to 720.40s - 725.48s | acquire a little bit of gear to go along with this methodology so


chunk_text:
advanced or harder when you're getting started and I will give another 685.56s - 690.56s | shout out to a dumpster diving so on my on this picture here this is one of many 690.56s - 694.48s | bins I have at my house are just full of old devices and I just kind of put it 694.48s - 698.10s | out into the universe like my friends and family know that I'm this dude that 698.10s - 701.92s | likes hacking weird electronic stuff so if they're throwing away their router or 701.92s - 706.60s | camera then they ask me or I find them in like disposal bins or whatever I 706.60s - 709.56s | can't resist so it's a great way to learn though because usually these 709.56s - 712.60s | devices work fine people are just they're obsolete or whatever but they 712.60s - 717.16s | don't have to worry about breaking them or anything okay so once we've got a 717.16s - 720.40s | device hopefully it's a smart camera or a router or something we've got to 720.40s - 725.48s | acquire a little bit of gear to go along with this methodology so I've got a 725.48s - 727.96s | couple of rules for that the first one is we don't want to break the bank when 727.96s - 731.00s | we're starting out you might not know if you want to do it or not we don't want 731.00s - 736.48s | this to be a limitation I also generally find that gear for IOT 736.48s - 740.88s | hacking follows the 80-20 rule so if you're not familiar with this with this 740.88s - 747.14s | rule it's kind of the idea that for any given input that's 20% of the inputs are 747.14s - 751.00s | responsible actually for 80% of the outputs and I find that to be true with 751.00s - 754.52s | IOT hacking tools you need to get a few of them and they'll do most of the heavy 754.52s - 758.68s | lifting and then you'll need to acquire the more specialized expensive tools for 758.68s - 764.20s | specific tasks sure at this point everyone's seen a lot of the meme of 764.20s - 767.84s | this Turkish shooter guy and I just wanted to demonstrate this I was kind of 767.84s - 771.52s


chunk_text:
I've got a 725.48s - 727.96s | couple of rules for that the first one is we don't want to break the bank when 727.96s - 731.00s | we're starting out you might not know if you want to do it or not we don't want 731.00s - 736.48s | this to be a limitation I also generally find that gear for IOT 736.48s - 740.88s | hacking follows the 80-20 rule so if you're not familiar with this with this 740.88s - 747.14s | rule it's kind of the idea that for any given input that's 20% of the inputs are 747.14s - 751.00s | responsible actually for 80% of the outputs and I find that to be true with 751.00s - 754.52s | IOT hacking tools you need to get a few of them and they'll do most of the heavy 754.52s - 758.68s | lifting and then you'll need to acquire the more specialized expensive tools for 758.68s - 764.20s | specific tasks sure at this point everyone's seen a lot of the meme of 764.20s - 767.84s | this Turkish shooter guy and I just wanted to demonstrate this I was kind of 767.84s - 771.52s | poking fun last week and like the IOT and hardware hacking community about how 771.52s - 774.88s | we all like to acquire gear and I'll be the first one to say like I'm addicted 774.88s - 778.64s | to buying gear I've got all the stuff in the left-hand side of this picture but 778.64s - 781.20s | really when you're starting out with cheaper devices you can probably get away 781.20s - 787.70s | with literally two things and spend ten dollars okay so the first piece of 787.70s - 790.86s | equipment that you should get if you don't have one already is a digital 790.86s - 795.18s | multimeter this is like the Swiss RB knife of electronics it can do things 795.18s - 799.98s | like measuring voltage current resistance do continuity testing mostly 799.98s - 804.46s | we will use this for verifying voltage levels and also we can actually use it 804.46s - 808.22s | to find a lot of common debug ports without special equipment we can 808.22s - 812.98s | actually you know ID those and then do further investigation into those ports 812.98s - 818.06s | you can literally


chunk_text:
| poking fun last week and like the IOT and hardware hacking community about how 771.52s - 774.88s | we all like to acquire gear and I'll be the first one to say like I'm addicted 774.88s - 778.64s | to buying gear I've got all the stuff in the left-hand side of this picture but 778.64s - 781.20s | really when you're starting out with cheaper devices you can probably get away 781.20s - 787.70s | with literally two things and spend ten dollars okay so the first piece of 787.70s - 790.86s | equipment that you should get if you don't have one already is a digital 790.86s - 795.18s | multimeter this is like the Swiss RB knife of electronics it can do things 795.18s - 799.98s | like measuring voltage current resistance do continuity testing mostly 799.98s - 804.46s | we will use this for verifying voltage levels and also we can actually use it 804.46s - 808.22s | to find a lot of common debug ports without special equipment we can 808.22s - 812.98s | actually you know ID those and then do further investigation into those ports 812.98s - 818.06s | you can literally spend $5 on this this yellow one on here that's $5 I got this 818.18s - 822.18s | off Aliexpress I've used it in my workshops before I mean I wouldn't use 822.18s - 825.70s | it for like commercial QA testing or anything but as far as learning IOT 825.70s - 830.22s | hacking getting started it's not bad I have five to a hundred dollars listed 830.22s - 833.22s | here I wouldn't recommend spending more than a hundred dollars but you can but 833.22s - 838.96s | your $5 one honestly it's not that bad the second piece of equipment you'll 838.96s - 845.36s | need is a USB to X adapter and by X I mean the protocols that our IOT devices 845.36s - 848.88s | are going to be talking at the hardware level so these are where those like 848.88s - 854.20s | debug and test ports come into play the most common ones are UART SPI or so 854.20s - 860.56s | you'll sometimes you're referred to a spy I2C JTAG and SWD the most common one 860.56s - 864.68s | you'll actually see and what we're gonna be focusing on is UART


chunk_text:
spend $5 on this this yellow one on here that's $5 I got this 818.18s - 822.18s | off Aliexpress I've used it in my workshops before I mean I wouldn't use 822.18s - 825.70s | it for like commercial QA testing or anything but as far as learning IOT 825.70s - 830.22s | hacking getting started it's not bad I have five to a hundred dollars listed 830.22s - 833.22s | here I wouldn't recommend spending more than a hundred dollars but you can but 833.22s - 838.96s | your $5 one honestly it's not that bad the second piece of equipment you'll 838.96s - 845.36s | need is a USB to X adapter and by X I mean the protocols that our IOT devices 845.36s - 848.88s | are going to be talking at the hardware level so these are where those like 848.88s - 854.20s | debug and test ports come into play the most common ones are UART SPI or so 854.20s - 860.56s | you'll sometimes you're referred to a spy I2C JTAG and SWD the most common one 860.56s - 864.68s | you'll actually see and what we're gonna be focusing on is UART so you can just 864.68s - 868.64s | go and get this $2 one and that will work for this methodology you get these 868.64s - 872.72s | off Aliexpress Amazon sometimes come like a pack of four for $10 you get in 872.72s - 877.28s | 250 so if you just want to go the cheap route you just buy this $2 one you'll be 877.28s - 881.52s | fine if you kind of want a future proof and you actually want a tool to work 881.52s - 885.60s | into I always recommend the Tigard board I really like their board and they have 885.60s - 888.92s | good training that's free that goes along with how to use it and it's gonna 888.92s - 892.00s | talk all of these common protocols actually so it'll do UART for you and 892.00s - 897.16s | then when you know if you need to jump up to something JTAG SWD or I2C 897.16s - 901.48s | then you can use this as well okay so the last this is the last thing that's 901.48s - 905.04s | gonna be in our toolkit is some sort of flash programmer you


chunk_text:
so you can just 864.68s - 868.64s | go and get this $2 one and that will work for this methodology you get these 868.64s - 872.72s | off Aliexpress Amazon sometimes come like a pack of four for $10 you get in 872.72s - 877.28s | 250 so if you just want to go the cheap route you just buy this $2 one you'll be 877.28s - 881.52s | fine if you kind of want a future proof and you actually want a tool to work 881.52s - 885.60s | into I always recommend the Tigard board I really like their board and they have 885.60s - 888.92s | good training that's free that goes along with how to use it and it's gonna 888.92s - 892.00s | talk all of these common protocols actually so it'll do UART for you and 892.00s - 897.16s | then when you know if you need to jump up to something JTAG SWD or I2C 897.16s - 901.48s | then you can use this as well okay so the last this is the last thing that's 901.48s - 905.04s | gonna be in our toolkit is some sort of flash programmer you can get these in 905.04s - 910.20s | all varying different levels but this is a cheap one for $10 and we will use 910.20s - 914.96s | these to mainly extract the firmware off the device if we can't get it from other 914.96s - 919.96s | methods so most of the cheap IOT devices I see and why I'm suggesting these 919.96s - 925.84s | routers and cameras they all use the same like standard SPI flash chip 8 pin 925.84s - 929.82s | so you can use a flash programmer generic one like this to read it if you 929.82s - 932.92s | did get the Tigard you don't even need to get one of these you can just use the 932.92s - 936.92s | the SPI connection on that and honestly you might not even need this so it might 936.92s - 940.04s | mean before you were seeing us we got the firmware from the vendor then you 940.04s - 944.96s | don't even need a flash programmer you can just download it all right so we got 944.96s - 948.08s | all our stuff we picked the device we've got our gear we're ready


chunk_text:
can get these in 905.04s - 910.20s | all varying different levels but this is a cheap one for $10 and we will use 910.20s - 914.96s | these to mainly extract the firmware off the device if we can't get it from other 914.96s - 919.96s | methods so most of the cheap IOT devices I see and why I'm suggesting these 919.96s - 925.84s | routers and cameras they all use the same like standard SPI flash chip 8 pin 925.84s - 929.82s | so you can use a flash programmer generic one like this to read it if you 929.82s - 932.92s | did get the Tigard you don't even need to get one of these you can just use the 932.92s - 936.92s | the SPI connection on that and honestly you might not even need this so it might 936.92s - 940.04s | mean before you were seeing us we got the firmware from the vendor then you 940.04s - 944.96s | don't even need a flash programmer you can just download it all right so we got 944.96s - 948.08s | all our stuff we picked the device we've got our gear we're ready to start 948.08s - 952.20s | hacking the first thing we're gonna take a look at is abusing debug ports and 952.20s - 958.28s | hardware interfaces so for the most part IOT and embedded devices they don't have 958.28s - 962.52s | any keyboard or mouse input they don't have a monitor they just kind of do 962.52s - 965.88s | something and if they're not doing that thing right then when you're designing 965.88s - 971.36s | it and as a designer your debug and test interfaces these are like your only link 971.36s - 974.84s | to that device to see what's going on what's going wrong what's happening 974.84s - 980.24s | making sure things are going properly so what happens in R&D of the cheap devices 980.24s - 983.92s | a lot of times is they will use these throughout the R&D design process we'll 983.92s - 986.68s | get to the end device will be ready to go and they don't want to do another 986.68s - 990.84s | revision of hardware and things like that or maybe firmware so they'll just 990.84s - 995.28s | leave these on the board open like they


chunk_text:
to start 948.08s - 952.20s | hacking the first thing we're gonna take a look at is abusing debug ports and 952.20s - 958.28s | hardware interfaces so for the most part IOT and embedded devices they don't have 958.28s - 962.52s | any keyboard or mouse input they don't have a monitor they just kind of do 962.52s - 965.88s | something and if they're not doing that thing right then when you're designing 965.88s - 971.36s | it and as a designer your debug and test interfaces these are like your only link 971.36s - 974.84s | to that device to see what's going on what's going wrong what's happening 974.84s - 980.24s | making sure things are going properly so what happens in R&D of the cheap devices 980.24s - 983.92s | a lot of times is they will use these throughout the R&D design process we'll 983.92s - 986.68s | get to the end device will be ready to go and they don't want to do another 986.68s - 990.84s | revision of hardware and things like that or maybe firmware so they'll just 990.84s - 995.28s | leave these on the board open like they were when they were testing in addition 995.28s - 998.40s | a lot of times they're actually used in production devices for things like 998.40s - 1003.48s | debugging doing logging QA testing and possibly even flashing memory or things 1003.48s - 1008.84s | like that the most two common ones I see are UART and JTAG we're just gonna be 1008.84s - 1014.14s | focusing on UART because on the majority of cheap consumer IOT devices that's the 1014.14s - 1020.12s | most present one and I almost always see UART that you can use and abuse so this 1020.12s - 1024.04s | talk is like the no BS no filler version of it so I'm not even gonna 1024.04s - 1027.20s | really teach you about what the UART protocol is only the things that you 1027.20s - 1031.44s | need to know to hack it it stands for universal asynchronous receiver 1031.44s - 1034.92s | transmitter that just basically means there's no clock and there's two lines 1034.92s - 1039.92s | one one for receiving and one for transmitting on it's a very old and 1039.92s - 1043.64s | common protocol for electrical communication it's a little


chunk_text:
were when they were testing in addition 995.28s - 998.40s | a lot of times they're actually used in production devices for things like 998.40s - 1003.48s | debugging doing logging QA testing and possibly even flashing memory or things 1003.48s - 1008.84s | like that the most two common ones I see are UART and JTAG we're just gonna be 1008.84s - 1014.14s | focusing on UART because on the majority of cheap consumer IOT devices that's the 1014.14s - 1020.12s | most present one and I almost always see UART that you can use and abuse so this 1020.12s - 1024.04s | talk is like the no BS no filler version of it so I'm not even gonna 1024.04s - 1027.20s | really teach you about what the UART protocol is only the things that you 1027.20s - 1031.44s | need to know to hack it it stands for universal asynchronous receiver 1031.44s - 1034.92s | transmitter that just basically means there's no clock and there's two lines 1034.92s - 1039.92s | one one for receiving and one for transmitting on it's a very old and 1039.92s - 1043.64s | common protocol for electrical communication it's a little bit more 1043.64s - 1047.68s | complicated than this but this the the basics of it is it literally just talks 1047.84s - 1053.52s | binary with voltage so it sends plus 3.3 volts or 5 volts for one zero volts for 1053.52s - 1057.48s | a zero and I got a little picture here of a capture if you're curious but 1057.48s - 1062.04s | that's literally all you need to know about it for the as far as hacking it on 1062.04s - 1067.84s | it so getting connection to a device as you are if you're doing like a pen test 1067.84s - 1070.96s | or something that would be a finding but for the most part the manufacturers 1070.96s - 1076.20s | don't actually care specifically about that however actually getting access to 1076.20s - 1081.20s | the UART will make it a lot easier for us to be able to find vulnerabilities 1081.20s - 1084.72s | like something that could be exploited from the web it's gonna make us a lot 1084.72s - 1089.52s | easier to find those and the reason for that is we can view the devices logging 1089.52s - 1093.76s |


chunk_text:
bit more 1043.64s - 1047.68s | complicated than this but this the the basics of it is it literally just talks 1047.84s - 1053.52s | binary with voltage so it sends plus 3.3 volts or 5 volts for one zero volts for 1053.52s - 1057.48s | a zero and I got a little picture here of a capture if you're curious but 1057.48s - 1062.04s | that's literally all you need to know about it for the as far as hacking it on 1062.04s - 1067.84s | it so getting connection to a device as you are if you're doing like a pen test 1067.84s - 1070.96s | or something that would be a finding but for the most part the manufacturers 1070.96s - 1076.20s | don't actually care specifically about that however actually getting access to 1076.20s - 1081.20s | the UART will make it a lot easier for us to be able to find vulnerabilities 1081.20s - 1084.72s | like something that could be exploited from the web it's gonna make us a lot 1084.72s - 1089.52s | easier to find those and the reason for that is we can view the devices logging 1089.52s - 1093.76s | so that's probably the most important thing in embedded devices there's 1093.76s - 1098.24s | usually not a lot of storage and they'll maybe be almost no actual writable 1098.24s - 1101.88s | storage that we have so there's no place to store logs so instead we're just 1101.88s - 1107.28s | going to dump that all out to UART in addition if we are encountering embedded 1107.28s - 1111.04s | Linux then usually we can actually use the UART connection to get a shell into 1111.04s - 1115.40s | the device we can do further enumeration that way sometimes we can access the 1115.40s - 1118.48s | bootloader which is responsible for it actually brings up the device and if we 1118.48s - 1121.48s | can get into the bootloader we can do things like dump the firmware see 1121.48s - 1125.32s | environment variables and so yeah getting you art is a great thing 1125.32s - 1129.48s | especially for the logging you can see in the picture here I'm just looking at 1129.48s - 1132.12s | some of the boot logs and there's actually quite a bit of detailed 1132.12s - 1139.23s | versioning information that we


chunk_text:
so that's probably the most important thing in embedded devices there's 1093.76s - 1098.24s | usually not a lot of storage and they'll maybe be almost no actual writable 1098.24s - 1101.88s | storage that we have so there's no place to store logs so instead we're just 1101.88s - 1107.28s | going to dump that all out to UART in addition if we are encountering embedded 1107.28s - 1111.04s | Linux then usually we can actually use the UART connection to get a shell into 1111.04s - 1115.40s | the device we can do further enumeration that way sometimes we can access the 1115.40s - 1118.48s | bootloader which is responsible for it actually brings up the device and if we 1118.48s - 1121.48s | can get into the bootloader we can do things like dump the firmware see 1121.48s - 1125.32s | environment variables and so yeah getting you art is a great thing 1125.32s - 1129.48s | especially for the logging you can see in the picture here I'm just looking at 1129.48s - 1132.12s | some of the boot logs and there's actually quite a bit of detailed 1132.12s - 1139.23s | versioning information that we can see already so once you start using you art 1139.23s - 1142.59s | and this happens to me like when I see a board it's very very easy to start 1142.59s - 1147.03s | picking them out like whenever I see a PCB now just subconsciously I'm like oh 1147.03s - 1151.75s | that's you are I can see it so I start looking for them and once you start 1151.75s - 1156.11s | noticing a few characteristics you'll be able to ID them so generally for full 1156.11s - 1160.43s | duplex you art so this means that you got two devices your IOT device and then 1160.43s - 1163.99s | maybe your computer that has your adapter they're talking to they're both 1163.99s - 1167.99s | talking to each other that means there's going to be a transmit line which you'll 1167.99s - 1172.31s | see abbreviated always as TX a receive line abbreviated as RX and a ground 1172.31s - 1176.19s | sometimes you'll see a VCC and I'm just calling that out because if you see four 1176.19s - 1179.87s | pins for our hacking purposes you can just ignore the VCC we don't we


chunk_text:
can see already so once you start using you art 1139.23s - 1142.59s | and this happens to me like when I see a board it's very very easy to start 1142.59s - 1147.03s | picking them out like whenever I see a PCB now just subconsciously I'm like oh 1147.03s - 1151.75s | that's you are I can see it so I start looking for them and once you start 1151.75s - 1156.11s | noticing a few characteristics you'll be able to ID them so generally for full 1156.11s - 1160.43s | duplex you art so this means that you got two devices your IOT device and then 1160.43s - 1163.99s | maybe your computer that has your adapter they're talking to they're both 1163.99s - 1167.99s | talking to each other that means there's going to be a transmit line which you'll 1167.99s - 1172.31s | see abbreviated always as TX a receive line abbreviated as RX and a ground 1172.31s - 1176.19s | sometimes you'll see a VCC and I'm just calling that out because if you see four 1176.19s - 1179.87s | pins for our hacking purposes you can just ignore the VCC we don't we don't 1179.87s - 1184.87s | even need to use it so unfortunately they won't always make it as easy like 1184.87s - 1189.55s | in this example here they've gone so nice as to label them for us and all the 1189.55s - 1192.95s | hardware hackers but they won't always make it this easy sometimes you'll have 1192.95s - 1198.27s | test pads like the ones here on this black circle PCB this is a camera that I 1198.27s - 1202.31s | was hacking and you'll notice there's only two pins together but seeing those 1202.31s - 1205.11s | two pins together and close to the processor I thought that they might be 1205.11s - 1208.95s | you art and then I just picked up a ground elsewhere and then we got another 1208.95s - 1213.27s | router here where they've got a connector here for you art and it's not 1213.27s - 1216.19s | labeled but you know as soon as you see those pins together like that it's a 1216.19s - 1220.83s | good indication that it's some sort of test interface so this is where we're 1220.83s - 1225.27s | gonna pull out our DMM and


chunk_text:
don't 1179.87s - 1184.87s | even need to use it so unfortunately they won't always make it as easy like 1184.87s - 1189.55s | in this example here they've gone so nice as to label them for us and all the 1189.55s - 1192.95s | hardware hackers but they won't always make it this easy sometimes you'll have 1192.95s - 1198.27s | test pads like the ones here on this black circle PCB this is a camera that I 1198.27s - 1202.31s | was hacking and you'll notice there's only two pins together but seeing those 1202.31s - 1205.11s | two pins together and close to the processor I thought that they might be 1205.11s - 1208.95s | you art and then I just picked up a ground elsewhere and then we got another 1208.95s - 1213.27s | router here where they've got a connector here for you art and it's not 1213.27s - 1216.19s | labeled but you know as soon as you see those pins together like that it's a 1216.19s - 1220.83s | good indication that it's some sort of test interface so this is where we're 1220.83s - 1225.27s | gonna pull out our DMM and we can use like our $5 DMM to actually pick up you 1225.27s - 1229.15s | art so what we're going to do is we're gonna take advantage of the fact that 1229.15s - 1233.63s | you art is extremely chatty on boot up so if you've ever booted up like your 1233.63s - 1237.03s | Linux computer even or some Windows ones and you see all the stuff come and 1237.03s - 1241.27s | scrolling through the screen telling you all those boot log information well 1241.27s - 1244.83s | embedded Linux is the same and that's going to happen on the you art as well 1244.83s - 1248.55s | and we can take advantage of that so what we can do is use our multimeter put 1248.55s - 1253.23s | it on the volts DC setting and measure our the pins of interest so if we think 1253.23s - 1257.71s | there might be a you are pin we'll just measure that from that from that 1257.71s - 1261.35s | connector whatever it is to ground and then after we're doing that we'll power 1261.35s - 1264.23s | on the device so I always like to have a


chunk_text:
we can use like our $5 DMM to actually pick up you 1225.27s - 1229.15s | art so what we're going to do is we're gonna take advantage of the fact that 1229.15s - 1233.63s | you art is extremely chatty on boot up so if you've ever booted up like your 1233.63s - 1237.03s | Linux computer even or some Windows ones and you see all the stuff come and 1237.03s - 1241.27s | scrolling through the screen telling you all those boot log information well 1241.27s - 1244.83s | embedded Linux is the same and that's going to happen on the you art as well 1244.83s - 1248.55s | and we can take advantage of that so what we can do is use our multimeter put 1248.55s - 1253.23s | it on the volts DC setting and measure our the pins of interest so if we think 1253.23s - 1257.71s | there might be a you are pin we'll just measure that from that from that 1257.71s - 1261.35s | connector whatever it is to ground and then after we're doing that we'll power 1261.35s - 1264.23s | on the device so I always like to have a power bar in my workstation that has a 1264.23s - 1268.79s | button it makes it a lot easier and what you're looking for is a fluctuating 1268.79s - 1272.07s | voltage after that boot up you'll usually be like a couple seconds after 1272.07s - 1276.59s | take a second for like the initial bootloader to load things up and then 1276.59s - 1281.03s | you'll start to see a bunch of voltage hopping up and down you won't see it go 1281.03s - 1285.35s | like 0 to 3.3 volts or 0 to 5 volts because it's gonna be too fast for our 1285.35s - 1289.63s | multimeter to read that so instead what you'll see is more of an average voltage 1289.63s - 1293.63s | kind of moving around a lot of times these devices operate at 3.3 volts so 1293.63s - 1298.07s | you'll see like 1.5 to 2.7 volts and you'll see that moving up and down so if 1298.07s - 1301.63s | you see that that's a really indication I should look further at this port it's 1301.63s - 1306.27s | probably transmitting something if you just power on the device and do this


chunk_text:
power bar in my workstation that has a 1264.23s - 1268.79s | button it makes it a lot easier and what you're looking for is a fluctuating 1268.79s - 1272.07s | voltage after that boot up you'll usually be like a couple seconds after 1272.07s - 1276.59s | take a second for like the initial bootloader to load things up and then 1276.59s - 1281.03s | you'll start to see a bunch of voltage hopping up and down you won't see it go 1281.03s - 1285.35s | like 0 to 3.3 volts or 0 to 5 volts because it's gonna be too fast for our 1285.35s - 1289.63s | multimeter to read that so instead what you'll see is more of an average voltage 1289.63s - 1293.63s | kind of moving around a lot of times these devices operate at 3.3 volts so 1293.63s - 1298.07s | you'll see like 1.5 to 2.7 volts and you'll see that moving up and down so if 1298.07s - 1301.63s | you see that that's a really indication I should look further at this port it's 1301.63s - 1306.27s | probably transmitting something if you just power on the device and do this you 1306.27s - 1309.39s | probably won't see anything because it's not going to be as chatty it'll maybe 1309.39s - 1312.83s | just send a couple messages and it'll be really hard to even see those blips of 1312.83s - 1317.75s | voltage you got to do it right at startup okay so we found this port we've 1317.75s - 1321.11s | identified it the next thing we're going to do is we can just it's as easy as we 1321.11s - 1325.15s | can just plug it into our computer basically we use our UART to USB bridge 1325.15s - 1329.07s | adapter plug that into our computer the only thing you need to keep in mind for 1329.07s - 1333.15s | it is it's really easy to put like names together so you want to put TX to 1333.15s - 1337.43s | TX but the way that it works is one device is TX goes to the other ones RX 1337.43s - 1341.99s | and vice versa so you just need to cross those lines grounds go to ground ignore 1341.99s - 1346.03s | the VCC you're all good so just for reference I got a little


chunk_text:
you 1306.27s - 1309.39s | probably won't see anything because it's not going to be as chatty it'll maybe 1309.39s - 1312.83s | just send a couple messages and it'll be really hard to even see those blips of 1312.83s - 1317.75s | voltage you got to do it right at startup okay so we found this port we've 1317.75s - 1321.11s | identified it the next thing we're going to do is we can just it's as easy as we 1321.11s - 1325.15s | can just plug it into our computer basically we use our UART to USB bridge 1325.15s - 1329.07s | adapter plug that into our computer the only thing you need to keep in mind for 1329.07s - 1333.15s | it is it's really easy to put like names together so you want to put TX to 1333.15s - 1337.43s | TX but the way that it works is one device is TX goes to the other ones RX 1337.43s - 1341.99s | and vice versa so you just need to cross those lines grounds go to ground ignore 1341.99s - 1346.03s | the VCC you're all good so just for reference I got a little picture here if 1346.03s - 1348.51s | you're looking at the slides later but that's the pin out that you would 1348.51s - 1353.51s | usually take so unfortunately sometimes they won't make it that easy they won't 1353.51s - 1356.51s | put the header pin on there won't be through-hole connectors so what do we do 1356.51s - 1360.51s | in that scenario the best option is to solder so hopefully you're hanging out 1360.51s - 1364.59s | at the soldering skill station but if not there's there's ways we can get 1364.59s - 1368.63s | around that so if you are lucky enough to have through-hole connectors like we 1368.63s - 1372.87s | did I showed in the one router the best way to do that is to actually attach 1372.87s - 1377.31s | some header pins to it and if you don't have those there's lots of clips clamps 1377.31s - 1382.03s | adapters and things like that where you can buy more specific to your device 1382.03s - 1385.03s | Google's your friend here and they're really not that expensive so just go out 1385.03s - 1388.79s | and take a look at your different options


chunk_text:
picture here if 1346.03s - 1348.51s | you're looking at the slides later but that's the pin out that you would 1348.51s - 1353.51s | usually take so unfortunately sometimes they won't make it that easy they won't 1353.51s - 1356.51s | put the header pin on there won't be through-hole connectors so what do we do 1356.51s - 1360.51s | in that scenario the best option is to solder so hopefully you're hanging out 1360.51s - 1364.59s | at the soldering skill station but if not there's there's ways we can get 1364.59s - 1368.63s | around that so if you are lucky enough to have through-hole connectors like we 1368.63s - 1372.87s | did I showed in the one router the best way to do that is to actually attach 1372.87s - 1377.31s | some header pins to it and if you don't have those there's lots of clips clamps 1377.31s - 1382.03s | adapters and things like that where you can buy more specific to your device 1382.03s - 1385.03s | Google's your friend here and they're really not that expensive so just go out 1385.03s - 1388.79s | and take a look at your different options and like just to show you if you 1388.79s - 1392.07s | don't want to do soldering here's two things I've done in a pinch and shown in 1392.07s - 1395.91s | classes where you can get away with generally with through-hole connectors 1395.91s - 1400.25s | they'll actually be like connectivity that goes through the actual pin so if 1400.25s - 1403.51s | you put a little pressure on what you're putting through it so kind of lean to 1403.51s - 1406.87s | the left or right that'll be enough to get good contact I did it here with a 1406.87s - 1411.15s | twist tie or that's some some sticky tack and obviously soldering is your 1411.31s - 1415.11s | option but I don't want that to be a barrier to you know hacking IOT if you 1415.11s - 1419.51s | don't have a soldering iron or to solder so this can be done in a pinch if you're 1419.51s - 1423.03s | running on a Linux host I mostly just included these commands here for people 1423.03s - 1426.81s | that are gonna be taking these slides afterwards but all we need to do to 1426.81s -


chunk_text:
and like just to show you if you 1388.79s - 1392.07s | don't want to do soldering here's two things I've done in a pinch and shown in 1392.07s - 1395.91s | classes where you can get away with generally with through-hole connectors 1395.91s - 1400.25s | they'll actually be like connectivity that goes through the actual pin so if 1400.25s - 1403.51s | you put a little pressure on what you're putting through it so kind of lean to 1403.51s - 1406.87s | the left or right that'll be enough to get good contact I did it here with a 1406.87s - 1411.15s | twist tie or that's some some sticky tack and obviously soldering is your 1411.31s - 1415.11s | option but I don't want that to be a barrier to you know hacking IOT if you 1415.11s - 1419.51s | don't have a soldering iron or to solder so this can be done in a pinch if you're 1419.51s - 1423.03s | running on a Linux host I mostly just included these commands here for people 1423.03s - 1426.81s | that are gonna be taking these slides afterwards but all we need to do to 1426.81s - 1431.47s | actually get a shell or connect to the device is we need to just check and see 1431.47s - 1435.23s | what the device ID is for our USB to UART adapter so we can do that with this 1435.23s - 1440.31s | command and you'll get the device ID back it'll most likely be TTY USB 0 but 1440.31s - 1444.79s | it could be 1 2 3 and then we can just launch a terminal emulator and use that 1444.79s - 1449.11s | to get a UART connection when you're starting out I suggest using screen 1449.11s - 1453.39s | because it's the easiest one there's lots of other ones Pico com minicom putty 1453.39s - 1457.43s | if you're on Windows they're all fine but screen in my opinion is the easiest 1457.43s - 1462.11s | one it requires very little setup the only two arguments you need is that USB 1462.11s - 1466.15s | device ID that I showed before and then you'll notice the last thing here I've 1466.15s - 1471.35s | got a number 115,200 that is the baud rate or speed that the UART is 1471.35s - 1476.43s | communicating at


chunk_text:
1431.47s | actually get a shell or connect to the device is we need to just check and see 1431.47s - 1435.23s | what the device ID is for our USB to UART adapter so we can do that with this 1435.23s - 1440.31s | command and you'll get the device ID back it'll most likely be TTY USB 0 but 1440.31s - 1444.79s | it could be 1 2 3 and then we can just launch a terminal emulator and use that 1444.79s - 1449.11s | to get a UART connection when you're starting out I suggest using screen 1449.11s - 1453.39s | because it's the easiest one there's lots of other ones Pico com minicom putty 1453.39s - 1457.43s | if you're on Windows they're all fine but screen in my opinion is the easiest 1457.43s - 1462.11s | one it requires very little setup the only two arguments you need is that USB 1462.11s - 1466.15s | device ID that I showed before and then you'll notice the last thing here I've 1466.15s - 1471.35s | got a number 115,200 that is the baud rate or speed that the UART is 1471.35s - 1476.43s | communicating at and since this is an OBS no filler talk I'm not even 1476.43s - 1482.43s | explain what baud rate is on 99% of IOT devices I see it is 115,200 so you can 1482.43s - 1486.23s | just use that if it's not it's probably 9600 and if it's not that you're 1486.23s - 1490.95s | probably doing something wrong there is also a very common list on Wikipedia you 1490.95s - 1498.45s | can look out of other ones but it's pretty much gonna be 115,200 okay so if 1498.45s - 1500.85s | everything worked with your connection you got screen running you power on 1500.85s - 1505.29s | device you should start to actually now see those boot logs that we saw with our 1505.29s - 1510.25s | multimeter actually start streaming through and do not discount the 1510.25s - 1513.61s | importance of actually reading through those boot logs and seeing what they are 1513.61s - 1517.05s | telling you they're gonna give you lots of versioning information that could be 1517.05s - 1520.77s | enough to even find a vulnerability on its own seeing that it's using you know 1520.77s - 1524.41s | underlying libraries


chunk_text:
and since this is an OBS no filler talk I'm not even 1476.43s - 1482.43s | explain what baud rate is on 99% of IOT devices I see it is 115,200 so you can 1482.43s - 1486.23s | just use that if it's not it's probably 9600 and if it's not that you're 1486.23s - 1490.95s | probably doing something wrong there is also a very common list on Wikipedia you 1490.95s - 1498.45s | can look out of other ones but it's pretty much gonna be 115,200 okay so if 1498.45s - 1500.85s | everything worked with your connection you got screen running you power on 1500.85s - 1505.29s | device you should start to actually now see those boot logs that we saw with our 1505.29s - 1510.25s | multimeter actually start streaming through and do not discount the 1510.25s - 1513.61s | importance of actually reading through those boot logs and seeing what they are 1513.61s - 1517.05s | telling you they're gonna give you lots of versioning information that could be 1517.05s - 1520.77s | enough to even find a vulnerability on its own seeing that it's using you know 1520.77s - 1524.41s | underlying libraries or things like that that are outdated and someone's 1524.41s - 1527.77s | already done the legwork and found a vulnerability in those will also give 1527.77s - 1531.61s | you details in this one for example near the bottom showing all the partition 1531.61s - 1536.45s | details about the flash EEPROM that's on it and that's gonna make it a lot 1536.45s - 1541.13s | easier for us later to identify the different parts of the firmware after 1541.13s - 1544.37s | the bootloader goes through and you know it's done streaming through the text you 1544.37s - 1548.09s | can hit enter and a lot of times on cheap IOT devices that can be enough to 1548.09s - 1551.21s | just get a shell they don't lock them down with a password or anything so then 1551.21s - 1555.37s | we'll be in a root shell generally an embedded Linux everything just runs as 1555.37s - 1558.89s | root there's no like least privileges or anything you'll just get a root shell 1558.89s - 1562.85s | again like in the manufacturers they're not as concerned about this as being a 1562.85s - 1566.33s | specific vulnerability so


chunk_text:
or things like that that are outdated and someone's 1524.41s - 1527.77s | already done the legwork and found a vulnerability in those will also give 1527.77s - 1531.61s | you details in this one for example near the bottom showing all the partition 1531.61s - 1536.45s | details about the flash EEPROM that's on it and that's gonna make it a lot 1536.45s - 1541.13s | easier for us later to identify the different parts of the firmware after 1541.13s - 1544.37s | the bootloader goes through and you know it's done streaming through the text you 1544.37s - 1548.09s | can hit enter and a lot of times on cheap IOT devices that can be enough to 1548.09s - 1551.21s | just get a shell they don't lock them down with a password or anything so then 1551.21s - 1555.37s | we'll be in a root shell generally an embedded Linux everything just runs as 1555.37s - 1558.89s | root there's no like least privileges or anything you'll just get a root shell 1558.89s - 1562.85s | again like in the manufacturers they're not as concerned about this as being a 1562.85s - 1566.33s | specific vulnerability so I wouldn't recommend reporting this or anything 1566.33s - 1569.93s | because they already know about it they just don't necessarily care but we're 1569.93s - 1574.01s | gonna abuse that to find something they do care about the majority of the 1574.01s - 1576.49s | routers and smart cameras they're running embedded Linux so that's where 1576.49s - 1581.57s | this is gonna make it easier to get that shell okay so I always mention this 1581.57s - 1585.29s | because you know in cybersecurity I feel like we all want to get a shell everyone 1585.29s - 1588.73s | loves getting shells and sometimes that's like the end all of what we're 1588.73s - 1592.37s | doing if we're doing like web app or you know other different types of network 1592.37s - 1597.21s | pen testing but for us actually connecting to the UART it's more 1597.21s - 1599.85s | important for us to see the logging that's actually what we're more 1599.85s - 1604.05s | we're more interested in or at least I am so if you don't get a shell that's 1604.05s - 1608.09s | okay if you're not able to get in that's fine


chunk_text:
I wouldn't recommend reporting this or anything 1566.33s - 1569.93s | because they already know about it they just don't necessarily care but we're 1569.93s - 1574.01s | gonna abuse that to find something they do care about the majority of the 1574.01s - 1576.49s | routers and smart cameras they're running embedded Linux so that's where 1576.49s - 1581.57s | this is gonna make it easier to get that shell okay so I always mention this 1581.57s - 1585.29s | because you know in cybersecurity I feel like we all want to get a shell everyone 1585.29s - 1588.73s | loves getting shells and sometimes that's like the end all of what we're 1588.73s - 1592.37s | doing if we're doing like web app or you know other different types of network 1592.37s - 1597.21s | pen testing but for us actually connecting to the UART it's more 1597.21s - 1599.85s | important for us to see the logging that's actually what we're more 1599.85s - 1604.05s | we're more interested in or at least I am so if you don't get a shell that's 1604.05s - 1608.09s | okay if you're not able to get in that's fine so sometimes there'll be a 1608.09s - 1612.05s | password if there is there's ways around that we can maybe get the hash from the 1612.05s - 1615.85s | firmware or Google it but even if you can't get a shell that's okay the way 1615.85s - 1619.13s | that you are it works is like you don't need to authenticate or log in it's a 1619.13s - 1623.49s | very like low-level protocol it's just going to stream those logging bits out 1623.49s - 1626.85s | to you no matter what you don't need to log in or anything like that you can 1626.85s - 1631.21s | still see the logging unless the device like sinks or tanks the UART which most 1631.21s - 1635.21s | don't so I got just got some pictures here showing some interesting things I 1635.21s - 1639.21s | see in logs one of them here is just showing the location of RSA keys as it's 1639.21s - 1643.37s | setting up drop arrow it's common SSH protocol and then the other two ones are 1643.37s - 1648.29s | interesting logging details about when I was actually interacting with the device 1648.29s - 1653.41s


chunk_text:
so sometimes there'll be a 1608.09s - 1612.05s | password if there is there's ways around that we can maybe get the hash from the 1612.05s - 1615.85s | firmware or Google it but even if you can't get a shell that's okay the way 1615.85s - 1619.13s | that you are it works is like you don't need to authenticate or log in it's a 1619.13s - 1623.49s | very like low-level protocol it's just going to stream those logging bits out 1623.49s - 1626.85s | to you no matter what you don't need to log in or anything like that you can 1626.85s - 1631.21s | still see the logging unless the device like sinks or tanks the UART which most 1631.21s - 1635.21s | don't so I got just got some pictures here showing some interesting things I 1635.21s - 1639.21s | see in logs one of them here is just showing the location of RSA keys as it's 1639.21s - 1643.37s | setting up drop arrow it's common SSH protocol and then the other two ones are 1643.37s - 1648.29s | interesting logging details about when I was actually interacting with the device 1648.29s - 1653.41s | and showing what could potentially be command injection or one is just showing 1653.41s - 1659.01s | how it sets up and saves the pre-shared keys and SS IDs for a router so if you 1659.01s - 1662.17s | are lucky enough to get a shell I mean I was saying it's not as important but it 1662.17s - 1666.97s | is always nice to get one we'll be good hackers then and do our enumeration so 1666.97s - 1671.45s | start poking around best places to actually start looking are the Etsy 1671.45s - 1674.21s | folders and the VAR folders those are probably some of the places where you'll 1674.21s - 1679.05s | find like interesting configuration details and things like that some some 1679.05s - 1682.89s | really quick wins are things I look for is their passwords hard-coded keys is 1682.89s - 1686.97s | their endpoints that maybe they don't want to expose or that we could see 1686.97s - 1690.29s | that's reaching out into the back end and of course a lot of times you'll have 1690.29s - 1693.85s | like things like PS or net stat so you can see what processes


chunk_text:
| and showing what could potentially be command injection or one is just showing 1653.41s - 1659.01s | how it sets up and saves the pre-shared keys and SS IDs for a router so if you 1659.01s - 1662.17s | are lucky enough to get a shell I mean I was saying it's not as important but it 1662.17s - 1666.97s | is always nice to get one we'll be good hackers then and do our enumeration so 1666.97s - 1671.45s | start poking around best places to actually start looking are the Etsy 1671.45s - 1674.21s | folders and the VAR folders those are probably some of the places where you'll 1674.21s - 1679.05s | find like interesting configuration details and things like that some some 1679.05s - 1682.89s | really quick wins are things I look for is their passwords hard-coded keys is 1682.89s - 1686.97s | their endpoints that maybe they don't want to expose or that we could see 1686.97s - 1690.29s | that's reaching out into the back end and of course a lot of times you'll have 1690.29s - 1693.85s | like things like PS or net stat so you can see what processes are running and 1693.85s - 1696.53s | what network connections are going out so that can give us a little bit of a 1696.53s - 1704.36s | lay of the land around the device okay so at this point you know we've got our 1704.36s - 1707.04s | device we've got our equipment we use our equipment to find our debug 1707.04s - 1711.68s | interface what's the next step that's going to be to get our hands on the 1711.68s - 1715.84s | firmware and in my opinion this is where my favorite part starts and where we can 1715.84s - 1720.20s | start having some fun and find some vulnerabilities if you're not familiar 1720.20s - 1723.84s | with what firmware is this essentially the software that is running on the 1723.84s - 1727.68s | device and kind of call it firmware and differentiate it from software and that 1727.68s - 1731.44s | it's kind of designed specifically for that device so that that device can 1731.44s - 1734.48s | fulfill one function it's not really changing you're not going to like 1734.48s - 1738.12s | install any software or anything on your router or smart camera we


chunk_text:
are running and 1693.85s - 1696.53s | what network connections are going out so that can give us a little bit of a 1696.53s - 1704.36s | lay of the land around the device okay so at this point you know we've got our 1704.36s - 1707.04s | device we've got our equipment we use our equipment to find our debug 1707.04s - 1711.68s | interface what's the next step that's going to be to get our hands on the 1711.68s - 1715.84s | firmware and in my opinion this is where my favorite part starts and where we can 1715.84s - 1720.20s | start having some fun and find some vulnerabilities if you're not familiar 1720.20s - 1723.84s | with what firmware is this essentially the software that is running on the 1723.84s - 1727.68s | device and kind of call it firmware and differentiate it from software and that 1727.68s - 1731.44s | it's kind of designed specifically for that device so that that device can 1731.44s - 1734.48s | fulfill one function it's not really changing you're not going to like 1734.48s - 1738.12s | install any software or anything on your router or smart camera we just get that 1738.12s - 1743.04s | one piece of firmware in embedded Linux that we're talking about today the 1743.04s - 1747.40s | firmware is generally comprised of four main parts we've got the boot loader 1747.40s - 1750.88s | that's responsible for actually like bringing up the device on boot up loading 1750.88s - 1754.20s | up the kernel we've got then got the Linux kernel itself that's going to be 1754.20s - 1759.08s | one partition we then got the root file system so that's actually where all of 1759.08s - 1762.68s | the interesting stuff is that make the device do what it's going to do all of 1762.68s - 1768.52s | the binary scripts configuration documents all of that stuff is going to 1768.52s - 1772.16s | be in the root file system well then possibly also have some sort of 1772.16s - 1776.28s | partition where we can store a little bit of writable data so we'll generally 1776.28s - 1778.68s | want to hunt for this as well because that's where you're going to find things 1778.68s - 1783.12s | like passwords that users configured or like the maybe pre-shared key for their


chunk_text:
just get that 1738.12s - 1743.04s | one piece of firmware in embedded Linux that we're talking about today the 1743.04s - 1747.40s | firmware is generally comprised of four main parts we've got the boot loader 1747.40s - 1750.88s | that's responsible for actually like bringing up the device on boot up loading 1750.88s - 1754.20s | up the kernel we've got then got the Linux kernel itself that's going to be 1754.20s - 1759.08s | one partition we then got the root file system so that's actually where all of 1759.08s - 1762.68s | the interesting stuff is that make the device do what it's going to do all of 1762.68s - 1768.52s | the binary scripts configuration documents all of that stuff is going to 1768.52s - 1772.16s | be in the root file system well then possibly also have some sort of 1772.16s - 1776.28s | partition where we can store a little bit of writable data so we'll generally 1776.28s - 1778.68s | want to hunt for this as well because that's where you're going to find things 1778.68s - 1783.12s | like passwords that users configured or like the maybe pre-shared key for their 1783.12s - 1786.60s | wireless or all that kind of stuff so a lot of times you'll see that at the end 1786.60s - 1792.32s | of the flash memory the root file system has the most goodies though by far so 1792.32s - 1796.00s | that's all we're going to focus on today you can find vulnerabilities in the 1796.00s - 1798.68s | other places in the boot loader and kernel but when you're starting out 1798.68s - 1802.12s | we'll just look at the root file system and its contents and that's honestly 1802.12s - 1807.84s | that where you'll find the majority of vulnerabilities anyway so there's three 1807.84s - 1811.16s | main ways that I usually get my hands on the firmware there are a few other ones 1811.16s - 1817.00s | that are more complicated but the easiest one is a lot of cheap IOT 1817.00s - 1821.64s | manufacturers they just put their firmware available on the Internet from 1821.64s - 1825.44s | the vendor to download the reason for this is that unfortunately they don't 1825.44s - 1830.16s | put any type of update mechanisms into their device so they kind of pass


chunk_text:
1783.12s - 1786.60s | wireless or all that kind of stuff so a lot of times you'll see that at the end 1786.60s - 1792.32s | of the flash memory the root file system has the most goodies though by far so 1792.32s - 1796.00s | that's all we're going to focus on today you can find vulnerabilities in the 1796.00s - 1798.68s | other places in the boot loader and kernel but when you're starting out 1798.68s - 1802.12s | we'll just look at the root file system and its contents and that's honestly 1802.12s - 1807.84s | that where you'll find the majority of vulnerabilities anyway so there's three 1807.84s - 1811.16s | main ways that I usually get my hands on the firmware there are a few other ones 1811.16s - 1817.00s | that are more complicated but the easiest one is a lot of cheap IOT 1817.00s - 1821.64s | manufacturers they just put their firmware available on the Internet from 1821.64s - 1825.44s | the vendor to download the reason for this is that unfortunately they don't 1825.44s - 1830.16s | put any type of update mechanisms into their device so they kind of pass that 1830.16s - 1834.96s | responsibility down on to the end users if there is security patching or things 1834.96s - 1838.72s | like that to go and hey make sure you go to our website check it every day 1838.72s - 1842.80s | download the firmware and then put it on the device yourself which I think 1842.80s - 1846.60s | unfortunately I would say like 99% of users don't do but to fulfill that 1846.60s - 1850.92s | obligation they put the firmware on their website on the support page and 1850.92s - 1854.04s | you can just google and find it and I love that because it's super easy to get 1854.04s - 1857.72s | our hands on the firmware and if you do that then you can even do IOT hacking 1857.72s - 1861.72s | for free you don't even need any gear you just download the firmware the 1861.72s - 1865.76s | second way is if you did get a UART shell I would say like 90% of the 1865.76s - 1871.00s | devices I see they have TFTP on them so it's trivial file transfer protocol this 1871.00s - 1875.48s | is there because


chunk_text:
that 1830.16s - 1834.96s | responsibility down on to the end users if there is security patching or things 1834.96s - 1838.72s | like that to go and hey make sure you go to our website check it every day 1838.72s - 1842.80s | download the firmware and then put it on the device yourself which I think 1842.80s - 1846.60s | unfortunately I would say like 99% of users don't do but to fulfill that 1846.60s - 1850.92s | obligation they put the firmware on their website on the support page and 1850.92s - 1854.04s | you can just google and find it and I love that because it's super easy to get 1854.04s - 1857.72s | our hands on the firmware and if you do that then you can even do IOT hacking 1857.72s - 1861.72s | for free you don't even need any gear you just download the firmware the 1861.72s - 1865.76s | second way is if you did get a UART shell I would say like 90% of the 1865.76s - 1871.00s | devices I see they have TFTP on them so it's trivial file transfer protocol this 1871.00s - 1875.48s | is there because it's actually baked into the functionality of a lot of those 1875.48s - 1879.16s | update mechanisms so if you have like a web app or a browser or something and 1879.16s - 1882.36s | allows you to do a firmware update through that in the back end it uses 1882.36s - 1887.00s | TFTP but we can you know abuse that or borrow it to set up our own TFTP server 1887.00s - 1890.68s | and then we can just bring back files of interest or if we're patient enough 1890.68s - 1894.64s | we can just bring the whole root file system back to our device over that and 1894.64s - 1897.98s | then we don't even really need to worry about dumping the firmware and then the 1897.98s - 1901.36s | last one which sometimes you'll need to do is you'll just dump the firmware off 1901.36s - 1907.04s | of the device so in these cheap commercial IOT devices I'm suggesting 1907.04s - 1913.84s | getting starting on they almost always use a 8 pin spy flash chip and these 1913.84s - 1919.16s | always follow the same pin out and we can use our flash


chunk_text:
it's actually baked into the functionality of a lot of those 1875.48s - 1879.16s | update mechanisms so if you have like a web app or a browser or something and 1879.16s - 1882.36s | allows you to do a firmware update through that in the back end it uses 1882.36s - 1887.00s | TFTP but we can you know abuse that or borrow it to set up our own TFTP server 1887.00s - 1890.68s | and then we can just bring back files of interest or if we're patient enough 1890.68s - 1894.64s | we can just bring the whole root file system back to our device over that and 1894.64s - 1897.98s | then we don't even really need to worry about dumping the firmware and then the 1897.98s - 1901.36s | last one which sometimes you'll need to do is you'll just dump the firmware off 1901.36s - 1907.04s | of the device so in these cheap commercial IOT devices I'm suggesting 1907.04s - 1913.84s | getting starting on they almost always use a 8 pin spy flash chip and these 1913.84s - 1919.16s | always follow the same pin out and we can use our flash raw or our flash 1919.16s - 1922.76s | reader that I suggested getting or the TiGuard to really do a really quick read 1922.76s - 1925.92s | of these and we don't even need to usually take them off of the device you 1925.92s - 1931.28s | can just read them in device in circuit and the way to do that is I generally 1931.28s - 1934.64s | recommend using flash ROMs free open source software that's great for 1934.64s - 1939.40s | interacting with flash chips so again command here for reference if you're 1939.40s - 1944.08s | just wanting to follow along later but if you get a ch341 a programmer which is 1944.08s - 1948.68s | that $10 one that I recommended from the start then you can just run this command 1948.68s - 1952.28s | after you put the clip on and it's as easy as that there's also other test 1952.28s - 1956.48s | clips you can do to use it but it's pretty straightforward it lists the 1956.48s - 1960.16s | different pins that match the pins on the chip you can just google standard 1960.16s - 1964.20s | SPI 8 pin flash and


chunk_text:
raw or our flash 1919.16s - 1922.76s | reader that I suggested getting or the TiGuard to really do a really quick read 1922.76s - 1925.92s | of these and we don't even need to usually take them off of the device you 1925.92s - 1931.28s | can just read them in device in circuit and the way to do that is I generally 1931.28s - 1934.64s | recommend using flash ROMs free open source software that's great for 1934.64s - 1939.40s | interacting with flash chips so again command here for reference if you're 1939.40s - 1944.08s | just wanting to follow along later but if you get a ch341 a programmer which is 1944.08s - 1948.68s | that $10 one that I recommended from the start then you can just run this command 1948.68s - 1952.28s | after you put the clip on and it's as easy as that there's also other test 1952.28s - 1956.48s | clips you can do to use it but it's pretty straightforward it lists the 1956.48s - 1960.16s | different pins that match the pins on the chip you can just google standard 1960.16s - 1964.20s | SPI 8 pin flash and you'll see all of the pins there's six of them that you 1964.20s - 1968.16s | need to use out of the eight pins just a heads up so if you did get the TiGuard 1968.16s - 1977.68s | you can do this with the TiGuard okay so we've all this basically everything 1977.68s - 1982.64s | we've been doing up until this point now has been to set us up for successful 1982.64s - 1988.36s | reverse engineering of the internals of the device to figure out what's going on 1988.36s - 1993.66s | and to hopefully find some vulnerabilities so that's what we're 1993.66s - 1997.76s | going to be taking a look at now and so one thing you can do too if you don't 1997.76s - 2002.36s | want to spend any money is you just can go and find the firmware for download 2002.36s - 2006.40s | and then you can do the majority of these steps as well and then you haven't 2006.40s - 2010.68s | even spent a dollar or you could also try and emulate the firmware as well 2010.68s - 2012.96s | it's not something we're going into today but I


chunk_text:
you'll see all of the pins there's six of them that you 1964.20s - 1968.16s | need to use out of the eight pins just a heads up so if you did get the TiGuard 1968.16s - 1977.68s | you can do this with the TiGuard okay so we've all this basically everything 1977.68s - 1982.64s | we've been doing up until this point now has been to set us up for successful 1982.64s - 1988.36s | reverse engineering of the internals of the device to figure out what's going on 1988.36s - 1993.66s | and to hopefully find some vulnerabilities so that's what we're 1993.66s - 1997.76s | going to be taking a look at now and so one thing you can do too if you don't 1997.76s - 2002.36s | want to spend any money is you just can go and find the firmware for download 2002.36s - 2006.40s | and then you can do the majority of these steps as well and then you haven't 2006.40s - 2010.68s | even spent a dollar or you could also try and emulate the firmware as well 2010.68s - 2012.96s | it's not something we're going into today but I just want to give that a 2012.96s - 2016.04s | call out like if you can't get your hands on a device you don't want to 2016.04s - 2019.52s | spend any money you just kind of want to get started you can do it for free just 2019.52s - 2023.64s | get your firmware try and reverse engineer it and emulation is your friend 2023.64s - 2029.47s | okay so the first thing we do once we get our hands on the firmware is it's 2029.47s - 2033.11s | generally going to be in like a kind of like a blob format so generally it's 2033.11s - 2037.71s | going to be in like a dot bin file or binary file or maybe a hex file possibly 2037.71s - 2042.03s | a dot IMG but it's not going to be probably readable for us at that point 2042.03s - 2046.19s | so we need to go ahead and actually unpack that firmware into the different 2046.19s - 2049.99s | sections and files that are actually in there that we'll be able to interact 2049.99s - 2053.95s | with better so the very first thing we do is cross our


chunk_text:
just want to give that a 2012.96s - 2016.04s | call out like if you can't get your hands on a device you don't want to 2016.04s - 2019.52s | spend any money you just kind of want to get started you can do it for free just 2019.52s - 2023.64s | get your firmware try and reverse engineer it and emulation is your friend 2023.64s - 2029.47s | okay so the first thing we do once we get our hands on the firmware is it's 2029.47s - 2033.11s | generally going to be in like a kind of like a blob format so generally it's 2033.11s - 2037.71s | going to be in like a dot bin file or binary file or maybe a hex file possibly 2037.71s - 2042.03s | a dot IMG but it's not going to be probably readable for us at that point 2042.03s - 2046.19s | so we need to go ahead and actually unpack that firmware into the different 2046.19s - 2049.99s | sections and files that are actually in there that we'll be able to interact 2049.99s - 2053.95s | with better so the very first thing we do is cross our fingers that it's not 2053.95s - 2057.91s | encrypted so again this is why I'm recommending when you're starting out go 2057.91s - 2061.87s | for those cheaper devices because most likely they're not going to use 2061.87s - 2066.91s | encryption for their firmware because it costs money both in software development 2066.91s - 2070.31s | and R&D but also you're most likely going to need to spend a little bit more 2070.31s - 2076.83s | on hardware to actually rely on that to handle that decryption at the startup if 2076.83s - 2080.39s | you do come across encrypted firmware and you're just getting started my 2080.39s - 2085.11s | suggestion would be just save that device for later down the road it's not 2085.11s - 2088.79s | like it can't be defeated there's lots of attacks and things like that that we 2088.79s - 2093.87s | can do to try and defeat the encryption and find the keys when the obviously 2093.87s - 2096.71s | when it's booting up it's going to need to actually do that decryption and we 2096.71s - 2099.79s | can possibly read the keys but it's a little bit more of an


chunk_text:
fingers that it's not 2053.95s - 2057.91s | encrypted so again this is why I'm recommending when you're starting out go 2057.91s - 2061.87s | for those cheaper devices because most likely they're not going to use 2061.87s - 2066.91s | encryption for their firmware because it costs money both in software development 2066.91s - 2070.31s | and R&D but also you're most likely going to need to spend a little bit more 2070.31s - 2076.83s | on hardware to actually rely on that to handle that decryption at the startup if 2076.83s - 2080.39s | you do come across encrypted firmware and you're just getting started my 2080.39s - 2085.11s | suggestion would be just save that device for later down the road it's not 2085.11s - 2088.79s | like it can't be defeated there's lots of attacks and things like that that we 2088.79s - 2093.87s | can do to try and defeat the encryption and find the keys when the obviously 2093.87s - 2096.71s | when it's booting up it's going to need to actually do that decryption and we 2096.71s - 2099.79s | can possibly read the keys but it's a little bit more of an advanced topic so 2099.79s - 2102.87s | I'd save that for down the road after you've done a few and go and find 2102.87s - 2106.99s | another device and see if you can make sure that its device is not encrypted so 2106.99s - 2110.43s | how do we check if it's encrypted and also how do we get the contents of that 2110.43s - 2115.95s | we will use a utility called binwalk so there's a bunch of tools to do this in 2115.95s - 2120.47s | various ones and you can take a manual approach but the easiest way and is to 2120.47s - 2126.11s | just go ahead and use binwalk if we pass it two options the capital M and the E 2126.11s - 2130.35s | it will just recursively go through and anything it identifies that it can pick 2130.35s - 2136.19s | up as a file type that it knows it will try and uncompress that or unzip it or 2136.19s - 2140.03s | whatever until it gets down to the actual it knows the file types whether 2140.03s - 2146.43s | that's a binary file shared object XML whatever and the E


chunk_text:
advanced topic so 2099.79s - 2102.87s | I'd save that for down the road after you've done a few and go and find 2102.87s - 2106.99s | another device and see if you can make sure that its device is not encrypted so 2106.99s - 2110.43s | how do we check if it's encrypted and also how do we get the contents of that 2110.43s - 2115.95s | we will use a utility called binwalk so there's a bunch of tools to do this in 2115.95s - 2120.47s | various ones and you can take a manual approach but the easiest way and is to 2120.47s - 2126.11s | just go ahead and use binwalk if we pass it two options the capital M and the E 2126.11s - 2130.35s | it will just recursively go through and anything it identifies that it can pick 2130.35s - 2136.19s | up as a file type that it knows it will try and uncompress that or unzip it or 2136.19s - 2140.03s | whatever until it gets down to the actual it knows the file types whether 2140.03s - 2146.43s | that's a binary file shared object XML whatever and the E is telling us to 2146.43s - 2149.43s | extract it actually so if you just run binwalk without any commands it'll 2149.43s - 2152.91s | actually just tell you what it sees and then if you pass in the E it'll go ahead 2152.91s - 2157.07s | and try and actually break those down so awesome tool it does a lot of the leg 2157.07s - 2161.51s | work for us alternatively we saw that we had those different partitions already 2161.51s - 2165.67s | actually listed out for us in the boot log so you can use DD as well if you 2165.67s - 2169.19s | want a manual approach just to carve it up and sometimes you have to but binwalk 2169.19s - 2176.28s | is your friend it most it works most of the time okay so this is where the fun 2176.28s - 2180.44s | starts so now that we've got the firmware we're going to go and actually 2180.44s - 2185.00s | focus on the root file system and see what we can find so some really low 2185.00s - 2188.80s | hanging fruit is just to look for the configuration files and poke through


chunk_text:
is telling us to 2146.43s - 2149.43s | extract it actually so if you just run binwalk without any commands it'll 2149.43s - 2152.91s | actually just tell you what it sees and then if you pass in the E it'll go ahead 2152.91s - 2157.07s | and try and actually break those down so awesome tool it does a lot of the leg 2157.07s - 2161.51s | work for us alternatively we saw that we had those different partitions already 2161.51s - 2165.67s | actually listed out for us in the boot log so you can use DD as well if you 2165.67s - 2169.19s | want a manual approach just to carve it up and sometimes you have to but binwalk 2169.19s - 2176.28s | is your friend it most it works most of the time okay so this is where the fun 2176.28s - 2180.44s | starts so now that we've got the firmware we're going to go and actually 2180.44s - 2185.00s | focus on the root file system and see what we can find so some really low 2185.00s - 2188.80s | hanging fruit is just to look for the configuration files and poke through 2188.80s - 2194.84s | those see if we can find anything that shouldn't be in there so a lot of times 2194.84s - 2198.48s | when I'm teaching IOT hacking people are surprised to see but the most popular 2198.48s - 2201.80s | the best tools I think are just some of the really easy basic Linux tools like 2201.80s - 2207.32s | find strings and grep they go a long way with IOT hacking and we can use find 2207.32s - 2212.60s | with the dash name argument and I like to just do like star dot extension so 2212.60s - 2217.96s | I'll do star dot XML start out text start out JSON and I'll just go through 2217.96s - 2221.28s | that and read through those documents a lot of times see XML and sometimes they 2221.28s - 2225.20s | have interesting details in there that's some low-hanging fruits we can also use 2225.20s - 2230.08s | strings so this is a tip that I teach if you use strings with a dash F the 2230.08s - 2234.24s | dash F tack on it it'll bring back the file name that's attached to that string 2234.24s -


chunk_text:
2188.80s - 2194.84s | those see if we can find anything that shouldn't be in there so a lot of times 2194.84s - 2198.48s | when I'm teaching IOT hacking people are surprised to see but the most popular 2198.48s - 2201.80s | the best tools I think are just some of the really easy basic Linux tools like 2201.80s - 2207.32s | find strings and grep they go a long way with IOT hacking and we can use find 2207.32s - 2212.60s | with the dash name argument and I like to just do like star dot extension so 2212.60s - 2217.96s | I'll do star dot XML start out text start out JSON and I'll just go through 2217.96s - 2221.28s | that and read through those documents a lot of times see XML and sometimes they 2221.28s - 2225.20s | have interesting details in there that's some low-hanging fruits we can also use 2225.20s - 2230.08s | strings so this is a tip that I teach if you use strings with a dash F the 2230.08s - 2234.24s | dash F tack on it it'll bring back the file name that's attached to that string 2234.24s - 2238.04s | and then we can run strings over like a whole file system or a whole group of 2238.04s - 2241.88s | files and if we and then we can pipe that into grep and look for things like 2241.88s - 2247.64s | password API key all of those things sometimes I'll look for like calm for 2247.64s - 2252.20s | example or various TLDs just to see if we can find any endpoints and that can 2252.20s - 2255.76s | just be an easy win as well using strings and piping it into grep it's one 2255.76s - 2262.94s | of my favorite tricks when IOT hacking is to to do that the next thing we'll 2262.94s - 2266.76s | take a look at that is like pretty easy because same with the the readable files 2266.76s - 2271.24s | all of the scripts so a lot of times since embedded Linux is gonna be bash or 2271.24s - 2275.24s | sh scripts you don't need to decompile them you can just take a look at them 2275.24s - 2278.68s | read through them a lot of times the developers will put really nice comments 2278.68s - 2281.40s


chunk_text:
2238.04s | and then we can run strings over like a whole file system or a whole group of 2238.04s - 2241.88s | files and if we and then we can pipe that into grep and look for things like 2241.88s - 2247.64s | password API key all of those things sometimes I'll look for like calm for 2247.64s - 2252.20s | example or various TLDs just to see if we can find any endpoints and that can 2252.20s - 2255.76s | just be an easy win as well using strings and piping it into grep it's one 2255.76s - 2262.94s | of my favorite tricks when IOT hacking is to to do that the next thing we'll 2262.94s - 2266.76s | take a look at that is like pretty easy because same with the the readable files 2266.76s - 2271.24s | all of the scripts so a lot of times since embedded Linux is gonna be bash or 2271.24s - 2275.24s | sh scripts you don't need to decompile them you can just take a look at them 2275.24s - 2278.68s | read through them a lot of times the developers will put really nice comments 2278.68s - 2281.40s | in there telling you what they're doing because they're being good developers 2281.40s - 2284.12s | and putting comments and things like that it's funny I've seen like even 2284.12s - 2287.44s | things like people's emails or like you know maybe if you find a problem with 2287.44s - 2291.76s | this email me at this email or things like that but the one scripts that I 2291.76s - 2295.44s | always suggest and you should look at right when you're getting started with a 2295.44s - 2301.20s | device and looking at it are the RCS scripts so most IOT devices use a tool 2301.20s - 2306.12s | called busy box which is a way to actually combine all of the binaries 2306.12s - 2311.28s | into one binary to shrink them down and then they use their init process and the 2311.28s - 2317.60s | way that busy box works is it runs all of the RCS scripts in Etsy slash init.d 2317.60s - 2321.68s | so after the boot loaders finished and Linux is done it hands off to the busy 2321.68s - 2326.08s | box init system and then it calls all of the


chunk_text:
| in there telling you what they're doing because they're being good developers 2281.40s - 2284.12s | and putting comments and things like that it's funny I've seen like even 2284.12s - 2287.44s | things like people's emails or like you know maybe if you find a problem with 2287.44s - 2291.76s | this email me at this email or things like that but the one scripts that I 2291.76s - 2295.44s | always suggest and you should look at right when you're getting started with a 2295.44s - 2301.20s | device and looking at it are the RCS scripts so most IOT devices use a tool 2301.20s - 2306.12s | called busy box which is a way to actually combine all of the binaries 2306.12s - 2311.28s | into one binary to shrink them down and then they use their init process and the 2311.28s - 2317.60s | way that busy box works is it runs all of the RCS scripts in Etsy slash init.d 2317.60s - 2321.68s | so after the boot loaders finished and Linux is done it hands off to the busy 2321.68s - 2326.08s | box init system and then it calls all of the scripts in there that start with RCS 2326.08s - 2330.76s | and it does them in alphanumeric order so it'll go like RCS 1 2 or if you have 2330.76s - 2335.32s | like sometimes you see like 1 and it tells you what they're doing and these 2335.32s - 2337.96s | scripts are great because they're responsible for actually setting up the 2337.96s - 2342.36s | device past Linux for what it actually does so if it's a camera or router then 2342.36s - 2346.04s | it's probably going to you know bring up binaries or things like that to actually 2346.04s - 2349.68s | do what the device does or sometimes they'll even reach out to like back-end 2349.68s - 2353.96s | infra or cloud infra to let it know it's up or pass back information and again 2353.96s - 2357.20s | these are human readable like they're just bash scripts so no decompiling no 2357.20s - 2361.32s | real reverse engineering and another tip too is if you're not familiar with bash 2361.32s - 2365.88s | like honestly chat GPT is really great at breaking down what bash scripts are 2365.88s - 2369.16s | so you can


chunk_text:
scripts in there that start with RCS 2326.08s - 2330.76s | and it does them in alphanumeric order so it'll go like RCS 1 2 or if you have 2330.76s - 2335.32s | like sometimes you see like 1 and it tells you what they're doing and these 2335.32s - 2337.96s | scripts are great because they're responsible for actually setting up the 2337.96s - 2342.36s | device past Linux for what it actually does so if it's a camera or router then 2342.36s - 2346.04s | it's probably going to you know bring up binaries or things like that to actually 2346.04s - 2349.68s | do what the device does or sometimes they'll even reach out to like back-end 2349.68s - 2353.96s | infra or cloud infra to let it know it's up or pass back information and again 2353.96s - 2357.20s | these are human readable like they're just bash scripts so no decompiling no 2357.20s - 2361.32s | real reverse engineering and another tip too is if you're not familiar with bash 2361.32s - 2365.88s | like honestly chat GPT is really great at breaking down what bash scripts are 2365.88s - 2369.16s | so you can just copy and paste these directly out of the firmware into our 2369.16s - 2372.88s | friend chat GPT and it can help you out and tell you what's going on as well 2372.88s - 2376.16s | yeah I frequently don't really find specific vulnerabilities in here 2376.16s - 2379.24s | sometimes you'll find things that shouldn't be in there but the most of 2379.24s - 2382.20s | the reason is just to get a lay of the land and it'll tell you about like 2382.20s - 2389.08s | what's going on what binaries are being executed things like that okay so now 2389.08s - 2393.20s | we're at in my opinion the most fun part and kind of like everything even the 2393.20s - 2396.14s | other stuff before that has been leading up to setting ourselves up to be 2396.14s - 2401.10s | successful at reverse engineering the binaries and libraries that are on the 2401.10s - 2405.26s | device so this is where you're honestly most likely to find some sort of 2405.26s - 2410.10s | vulnerability that you're going to report and the one complicated or thing 2410.10s - 2414.18s | that I see people get


chunk_text:
just copy and paste these directly out of the firmware into our 2369.16s - 2372.88s | friend chat GPT and it can help you out and tell you what's going on as well 2372.88s - 2376.16s | yeah I frequently don't really find specific vulnerabilities in here 2376.16s - 2379.24s | sometimes you'll find things that shouldn't be in there but the most of 2379.24s - 2382.20s | the reason is just to get a lay of the land and it'll tell you about like 2382.20s - 2389.08s | what's going on what binaries are being executed things like that okay so now 2389.08s - 2393.20s | we're at in my opinion the most fun part and kind of like everything even the 2393.20s - 2396.14s | other stuff before that has been leading up to setting ourselves up to be 2396.14s - 2401.10s | successful at reverse engineering the binaries and libraries that are on the 2401.10s - 2405.26s | device so this is where you're honestly most likely to find some sort of 2405.26s - 2410.10s | vulnerability that you're going to report and the one complicated or thing 2410.10s - 2414.18s | that I see people get stuck with on this is where do we actually start it's quite 2414.18s - 2418.58s | possible there's dozens to hundreds to maybe a thousand different libraries and 2418.58s - 2423.38s | binaries on the device it takes a lot of time to reverse engineer and understand 2423.38s - 2429.27s | these so which one do we pick and how do we start so the easiest way to 2429.27s - 2433.67s | actually do this is to avoid a needle in a haystack situation is to go with like 2433.67s - 2437.59s | a forward down approach and this is what I teach or the methodology I teach when 2437.59s - 2442.03s | people are starting and that is to start with the custom binaries and libraries 2442.03s - 2445.95s | that are actually unique to the device so a lot of the libraries and binaries 2445.95s - 2449.67s | are going to be Linux stuff so if you're familiar with using Linux you might be 2449.67s - 2453.73s | able to just discount quite a few of these but if you're not or sometimes it 2453.73s - 2457.25s | could be hard to tell especially with libraries did you


chunk_text:
stuck with on this is where do we actually start it's quite 2414.18s - 2418.58s | possible there's dozens to hundreds to maybe a thousand different libraries and 2418.58s - 2423.38s | binaries on the device it takes a lot of time to reverse engineer and understand 2423.38s - 2429.27s | these so which one do we pick and how do we start so the easiest way to 2429.27s - 2433.67s | actually do this is to avoid a needle in a haystack situation is to go with like 2433.67s - 2437.59s | a forward down approach and this is what I teach or the methodology I teach when 2437.59s - 2442.03s | people are starting and that is to start with the custom binaries and libraries 2442.03s - 2445.95s | that are actually unique to the device so a lot of the libraries and binaries 2445.95s - 2449.67s | are going to be Linux stuff so if you're familiar with using Linux you might be 2449.67s - 2453.73s | able to just discount quite a few of these but if you're not or sometimes it 2453.73s - 2457.25s | could be hard to tell especially with libraries did you know are these open 2457.25s - 2461.09s | source Linux things that do Linux or C stuff or are these ones that the 2461.09s - 2465.49s | designers of this device have actually created so then we run into the problem 2465.49s - 2468.33s | is how do we know they're custom and after you start to do this for quite a 2468.33s - 2470.89s | while you will start to pick out the names and stuff and go like oh yeah 2470.89s - 2475.25s | that's that's a custom one but if we don't then the thing that I suggest to 2475.25s - 2480.37s | do is to interact with a device and then follow that logging and trace that 2480.49s - 2485.77s | logging down to the underlying binaries and functions and this is in my opinion 2485.77s - 2491.93s | the easiest way when you're starting to actually find vulnerabilities so here in 2491.93s - 2497.01s | this picture I've got an example so this is a common router here that that I like 2497.01s - 2500.85s | to hack on and I went to the web browser of it so just like most routers it's got


chunk_text:
know are these open 2457.25s - 2461.09s | source Linux things that do Linux or C stuff or are these ones that the 2461.09s - 2465.49s | designers of this device have actually created so then we run into the problem 2465.49s - 2468.33s | is how do we know they're custom and after you start to do this for quite a 2468.33s - 2470.89s | while you will start to pick out the names and stuff and go like oh yeah 2470.89s - 2475.25s | that's that's a custom one but if we don't then the thing that I suggest to 2475.25s - 2480.37s | do is to interact with a device and then follow that logging and trace that 2480.49s - 2485.77s | logging down to the underlying binaries and functions and this is in my opinion 2485.77s - 2491.93s | the easiest way when you're starting to actually find vulnerabilities so here in 2491.93s - 2497.01s | this picture I've got an example so this is a common router here that that I like 2497.01s - 2500.85s | to hack on and I went to the web browser of it so just like most routers it's got 2500.85s - 2505.65s | a web browser where you can go on do lots of stuff set the pre-shared key set 2505.65s - 2511.21s | what type of WPA2 WAP or whatever you know set all that stuff it's got a 2511.21s - 2514.53s | bunch of utilities for some reason it's got a ping test thing you can make the 2514.53s - 2518.45s | router ping other stuff so in this example I'm just playing around with 2518.45s - 2522.45s | that because I kind of suspected that it might be you know doing bad things when 2522.45s - 2528.17s | we try and ping stuff and so I wanted to find the underlying binary or function 2528.17s - 2532.01s | or library that's actually responsible for that so what I do is I just go and 2532.01s - 2536.05s | play with all the functionality if there's something that you can do on the 2536.05s - 2539.85s | device to make it do something I do that and I don't specifically do that like 2539.85s - 2543.33s | trying injections or anything I just when I'm starting out just use the 2543.33s - 2548.09s | device how it's


chunk_text:
2500.85s - 2505.65s | a web browser where you can go on do lots of stuff set the pre-shared key set 2505.65s - 2511.21s | what type of WPA2 WAP or whatever you know set all that stuff it's got a 2511.21s - 2514.53s | bunch of utilities for some reason it's got a ping test thing you can make the 2514.53s - 2518.45s | router ping other stuff so in this example I'm just playing around with 2518.45s - 2522.45s | that because I kind of suspected that it might be you know doing bad things when 2522.45s - 2528.17s | we try and ping stuff and so I wanted to find the underlying binary or function 2528.17s - 2532.01s | or library that's actually responsible for that so what I do is I just go and 2532.01s - 2536.05s | play with all the functionality if there's something that you can do on the 2536.05s - 2539.85s | device to make it do something I do that and I don't specifically do that like 2539.85s - 2543.33s | trying injections or anything I just when I'm starting out just use the 2543.33s - 2548.09s | device how it's supposed to be used and I'll take a look at the logging and a 2548.09s - 2551.85s | lot of times the logging will be very verbose in IOT devices when you're 2551.85s - 2556.05s | interacting with things and then we can actually trace that logging back then to 2556.05s - 2560.17s | the underlying binaries or libraries so in this device and I actually see this 2560.17s - 2563.93s | in a decent amount of IOT devices they were nice enough to even just put the 2563.93s - 2568.97s | the function that's actually calling that it's actually being called when you 2568.97s - 2572.37s | try and run this ping test they put it in square brackets that's their like 2572.37s - 2577.85s | logging nomenclature or whatever so it was called util underscore exec system 2577.85s - 2581.29s | so I saw this immediately and if you're familiar with like you know web pen 2581.29s - 2584.09s | testing or something like that immediately looked like it was making a 2584.09s - 2587.09s | system call to me and then they put a bunch of details in it like they 2587.09s - 2590.93s | actually give


chunk_text:
supposed to be used and I'll take a look at the logging and a 2548.09s - 2551.85s | lot of times the logging will be very verbose in IOT devices when you're 2551.85s - 2556.05s | interacting with things and then we can actually trace that logging back then to 2556.05s - 2560.17s | the underlying binaries or libraries so in this device and I actually see this 2560.17s - 2563.93s | in a decent amount of IOT devices they were nice enough to even just put the 2563.93s - 2568.97s | the function that's actually calling that it's actually being called when you 2568.97s - 2572.37s | try and run this ping test they put it in square brackets that's their like 2572.37s - 2577.85s | logging nomenclature or whatever so it was called util underscore exec system 2577.85s - 2581.29s | so I saw this immediately and if you're familiar with like you know web pen 2581.29s - 2584.09s | testing or something like that immediately looked like it was making a 2584.09s - 2587.09s | system call to me and then they put a bunch of details in it like they 2587.09s - 2590.93s | actually give us how the command is being formatted so I didn't get to put 2590.93s - 2593.97s | the whole thing because I was running a out of room but if you can't see it it 2593.97s - 2599.09s | literally says oil start paying command is IP ping dash C and it gives the whole 2599.09s - 2603.81s | details and in that you can actually see the IP address that we put in so 2603.81s - 2606.93s | definitely is kind of like giving us a hint that there's possible command 2606.93s - 2613.04s | injection or something we should look at deeper there okay so now we have an idea 2613.04s - 2616.90s | that that function that util underscore exec system is of interest to us it 2616.90s - 2621.26s | could be a potential injection point and what we should do is you know on the 2621.26s - 2624.54s | past page or like when we're doing that like I will interact with everything I 2624.54s - 2628.90s | can and take a note of where all the logging is happening what binaries and 2628.90s - 2632.62s | functions that logging is coming from we'll just


chunk_text:
us how the command is being formatted so I didn't get to put 2590.93s - 2593.97s | the whole thing because I was running a out of room but if you can't see it it 2593.97s - 2599.09s | literally says oil start paying command is IP ping dash C and it gives the whole 2599.09s - 2603.81s | details and in that you can actually see the IP address that we put in so 2603.81s - 2606.93s | definitely is kind of like giving us a hint that there's possible command 2606.93s - 2613.04s | injection or something we should look at deeper there okay so now we have an idea 2613.04s - 2616.90s | that that function that util underscore exec system is of interest to us it 2616.90s - 2621.26s | could be a potential injection point and what we should do is you know on the 2621.26s - 2624.54s | past page or like when we're doing that like I will interact with everything I 2624.54s - 2628.90s | can and take a note of where all the logging is happening what binaries and 2628.90s - 2632.62s | functions that logging is coming from we'll just go back to our good friend 2632.62s - 2637.14s | strings piping into grep one of my favorite tools for IOT hacking and we 2637.14s - 2641.92s | can grep on that function name so a lot of times in less expensive IOT vices 2641.92s - 2645.34s | again they're making it easier for us they don't strip binaries and things 2645.34s - 2648.58s | like that so the function names will just end up compile in the compiled 2648.58s - 2653.46s | binaries and libraries so we can just pipe that into grep and put the function 2653.46s - 2657.70s | name in so in this example here I did that for a util exec system however what 2657.70s - 2661.38s | if they do strip it well if we just go back one page here you can see the 2661.38s - 2665.26s | printout here it kind of follows a format it says oil start paying command 2665.26s - 2669.86s | is and then gives the command so that's a string that's actually in there too 2669.86s - 2673.02s | and they're probably not going to obfuscate it it's not malware so we can 2673.02s - 2678.30s |


chunk_text:
go back to our good friend 2632.62s - 2637.14s | strings piping into grep one of my favorite tools for IOT hacking and we 2637.14s - 2641.92s | can grep on that function name so a lot of times in less expensive IOT vices 2641.92s - 2645.34s | again they're making it easier for us they don't strip binaries and things 2645.34s - 2648.58s | like that so the function names will just end up compile in the compiled 2648.58s - 2653.46s | binaries and libraries so we can just pipe that into grep and put the function 2653.46s - 2657.70s | name in so in this example here I did that for a util exec system however what 2657.70s - 2661.38s | if they do strip it well if we just go back one page here you can see the 2661.38s - 2665.26s | printout here it kind of follows a format it says oil start paying command 2665.26s - 2669.86s | is and then gives the command so that's a string that's actually in there too 2669.86s - 2673.02s | and they're probably not going to obfuscate it it's not malware so we can 2673.02s - 2678.30s | also just pipe common strings that we see so in this example I kind of thought 2678.30s - 2681.82s | it was using like a print app or sprint app or something like that so we look 2681.82s - 2686.46s | for a command is and we get the same hit you can see here that actual string how 2686.46s - 2690.42s | it is in that binary is percent s command is percent s so it's using that 2690.42s - 2693.86s | formatting so even if they do strip the function names there's still ways to get 2693.86s - 2701.29s | around it and find those underlying binaries and libraries okay so now that 2701.29s - 2706.29s | we've got our function name we know that it's in that so if I just go back 2706.29s - 2709.89s | and this one for example we see the hit because we use dash F it's in this lib 2709.89s - 2715.21s | CMM dot SO so that is a custom library that the makers of this router in this 2715.21s - 2719.45s | example wrote that has the majority of the functionality of that router baked 2719.45s - 2726.37s |


chunk_text:
also just pipe common strings that we see so in this example I kind of thought 2678.30s - 2681.82s | it was using like a print app or sprint app or something like that so we look 2681.82s - 2686.46s | for a command is and we get the same hit you can see here that actual string how 2686.46s - 2690.42s | it is in that binary is percent s command is percent s so it's using that 2690.42s - 2693.86s | formatting so even if they do strip the function names there's still ways to get 2693.86s - 2701.29s | around it and find those underlying binaries and libraries okay so now that 2701.29s - 2706.29s | we've got our function name we know that it's in that so if I just go back 2706.29s - 2709.89s | and this one for example we see the hit because we use dash F it's in this lib 2709.89s - 2715.21s | CMM dot SO so that is a custom library that the makers of this router in this 2715.21s - 2719.45s | example wrote that has the majority of the functionality of that router baked 2719.45s - 2726.37s | into it we can pop that into Ghidra and start decompiling it so one of the 2726.37s - 2730.25s | things that I find when I'm teaching IOT hacking or in my workshops is like this 2730.25s - 2733.09s | is the point where people usually get a little bit overwhelmed if they're not 2733.09s - 2737.09s | familiar with reverse engineering and it starts to look quite complicated because 2737.09s - 2742.13s | the output of Ghidra can be very verbose when it decompiles it it is in my 2742.13s - 2746.53s | opinion a little bit more complex than just looking at regular C code so it can 2746.53s - 2749.69s | be a little like discouraging and I see some people are like okay I can't do 2749.69s - 2753.65s | this I'm intimidated by it but I have a few tips that I think can make it a lot 2753.65s - 2757.61s | easier for you to understand and read the output in here and still find 2757.61s - 2760.77s | vulnerabilities even if you don't understand what the heck is going on and 2760.77s - 2765.53s | most of it doesn't make sense so the


chunk_text:
into it we can pop that into Ghidra and start decompiling it so one of the 2726.37s - 2730.25s | things that I find when I'm teaching IOT hacking or in my workshops is like this 2730.25s - 2733.09s | is the point where people usually get a little bit overwhelmed if they're not 2733.09s - 2737.09s | familiar with reverse engineering and it starts to look quite complicated because 2737.09s - 2742.13s | the output of Ghidra can be very verbose when it decompiles it it is in my 2742.13s - 2746.53s | opinion a little bit more complex than just looking at regular C code so it can 2746.53s - 2749.69s | be a little like discouraging and I see some people are like okay I can't do 2749.69s - 2753.65s | this I'm intimidated by it but I have a few tips that I think can make it a lot 2753.65s - 2757.61s | easier for you to understand and read the output in here and still find 2757.61s - 2760.77s | vulnerabilities even if you don't understand what the heck is going on and 2760.77s - 2765.53s | most of it doesn't make sense so the very first thing I always say and is 2765.53s - 2769.61s | because people who are in cybersecurity and have had a little bit of intro to 2769.61s - 2773.25s | Ghidra or reverse engineering is it's usually looking at malware and this is 2773.25s - 2778.01s | not malware so with malware usually good malware authors or majority of them are 2778.01s - 2781.01s | going to try and obfuscate what they're doing make it confusing for reverse 2781.01s - 2784.05s | engineering they're not going to use print statements if they have strings 2784.09s - 2788.33s | they're going to obfuscate those strings they're very hard to see instead for our 2788.33s - 2793.01s | IOT devices we have developers who are trying to be good helpful developers and 2793.01s - 2797.45s | write very clean readable code so that it's easy for someone else to pick up 2797.45s - 2801.45s | after them if someone's reading their code it's going to be testable debuggable 2801.45s - 2806.49s | doing all those good things that developers do and also in IOT devices we 2806.49s - 2811.21s | do a lot of printing out to UART to tell what's


chunk_text:
very first thing I always say and is 2765.53s - 2769.61s | because people who are in cybersecurity and have had a little bit of intro to 2769.61s - 2773.25s | Ghidra or reverse engineering is it's usually looking at malware and this is 2773.25s - 2778.01s | not malware so with malware usually good malware authors or majority of them are 2778.01s - 2781.01s | going to try and obfuscate what they're doing make it confusing for reverse 2781.01s - 2784.05s | engineering they're not going to use print statements if they have strings 2784.09s - 2788.33s | they're going to obfuscate those strings they're very hard to see instead for our 2788.33s - 2793.01s | IOT devices we have developers who are trying to be good helpful developers and 2793.01s - 2797.45s | write very clean readable code so that it's easy for someone else to pick up 2797.45s - 2801.45s | after them if someone's reading their code it's going to be testable debuggable 2801.45s - 2806.49s | doing all those good things that developers do and also in IOT devices we 2806.49s - 2811.21s | do a lot of printing out to UART to tell what's going on so that we can 2811.21s - 2815.29s | actually do almost debugging through print statements in a production device 2815.29s - 2820.53s | which is nice it makes it really easy for us to then go and trace those back 2820.53s - 2824.61s | so one of the first things I always suggest with that in mind is to take a 2824.61s - 2829.69s | look at the print statements and let those guide you to what is going on of 2829.69s - 2832.85s | course you can't always trust print statements if you're a programmer you 2832.85s - 2835.69s | know that it's not the best to always trust comments or print statements but 2835.69s - 2838.57s | when you're getting started reverse engineering I think it's okay just read 2838.57s - 2842.69s | the print statements the very first one that I have here that's in red it's just 2842.69s - 2845.61s | actually that print statement that we saw in the logging so it helps us 2845.61s - 2850.17s | confirm that we're in the right spot and then if you look down at line 32 it 2850.17s - 2852.89s | might be a little


chunk_text:
going on so that we can 2811.21s - 2815.29s | actually do almost debugging through print statements in a production device 2815.29s - 2820.53s | which is nice it makes it really easy for us to then go and trace those back 2820.53s - 2824.61s | so one of the first things I always suggest with that in mind is to take a 2824.61s - 2829.69s | look at the print statements and let those guide you to what is going on of 2829.69s - 2832.85s | course you can't always trust print statements if you're a programmer you 2832.85s - 2835.69s | know that it's not the best to always trust comments or print statements but 2835.69s - 2838.57s | when you're getting started reverse engineering I think it's okay just read 2838.57s - 2842.69s | the print statements the very first one that I have here that's in red it's just 2842.69s - 2845.61s | actually that print statement that we saw in the logging so it helps us 2845.61s - 2850.17s | confirm that we're in the right spot and then if you look down at line 32 it 2850.17s - 2852.89s | might be a little hard to read but essentially what it's saying there is 2852.89s - 2856.61s | it's just saying system fork failed and this we don't care about that it's not 2856.61s - 2861.21s | important to us but if you look at the program flow and the if statements well 2861.21s - 2864.73s | now you know what that program flow does it just checks if a system fork failed 2864.73s - 2871.53s | because before that it says you know if local 234 equals F F F F F F well if I 2871.53s - 2874.85s | saw that I have no idea what it was is it integral to the thing well if you 2874.85s - 2877.29s | look at the print statement it tells you exactly what it is you can just ignore 2877.29s - 2881.33s | that the second thing you can do with print statements that makes your life a 2881.33s - 2885.81s | lot easier is a lot of times they'll be like print F's or sprint F's and if 2885.81s - 2890.41s | you're not familiar with how those work essentially we have a slot holder for a 2890.41s - 2893.53s | variable that


chunk_text:
hard to read but essentially what it's saying there is 2852.89s - 2856.61s | it's just saying system fork failed and this we don't care about that it's not 2856.61s - 2861.21s | important to us but if you look at the program flow and the if statements well 2861.21s - 2864.73s | now you know what that program flow does it just checks if a system fork failed 2864.73s - 2871.53s | because before that it says you know if local 234 equals F F F F F F well if I 2871.53s - 2874.85s | saw that I have no idea what it was is it integral to the thing well if you 2874.85s - 2877.29s | look at the print statement it tells you exactly what it is you can just ignore 2877.29s - 2881.33s | that the second thing you can do with print statements that makes your life a 2881.33s - 2885.81s | lot easier is a lot of times they'll be like print F's or sprint F's and if 2885.81s - 2890.41s | you're not familiar with how those work essentially we have a slot holder for a 2890.41s - 2893.53s | variable that we're going to pass into that print statement and then the print 2893.53s - 2897.21s | statement basically tells you what that's what that variable is so in this 2897.21s - 2902.13s | top example here we have the percent command is percent and then we have two 2902.13s - 2905.61s | variables passed in that you know we wouldn't know what they were once param 2905.61s - 2909.21s | one and once underscore underscore s well if we look and you know we just go 2909.21s - 2912.01s | back a couple to that print statement well the first one this is that 2912.01s - 2915.89s | identifier OAL underscore start ping command so we know maybe that's like 2915.89s - 2920.05s | some sort of identifier and then the second one though now we know of our 2920.05s - 2924.93s | interest well that's the actual string that we manipulate that we can pass the 2924.93s - 2929.81s | IP address in and because of that sprint F or that print F function well now we 2929.81s - 2932.69s | know that underscore underscore s variable we know what it is and that's 2932.69s - 2938.01s | just


chunk_text:
we're going to pass into that print statement and then the print 2893.53s - 2897.21s | statement basically tells you what that's what that variable is so in this 2897.21s - 2902.13s | top example here we have the percent command is percent and then we have two 2902.13s - 2905.61s | variables passed in that you know we wouldn't know what they were once param 2905.61s - 2909.21s | one and once underscore underscore s well if we look and you know we just go 2909.21s - 2912.01s | back a couple to that print statement well the first one this is that 2912.01s - 2915.89s | identifier OAL underscore start ping command so we know maybe that's like 2915.89s - 2920.05s | some sort of identifier and then the second one though now we know of our 2920.05s - 2924.93s | interest well that's the actual string that we manipulate that we can pass the 2924.93s - 2929.81s | IP address in and because of that sprint F or that print F function well now we 2929.81s - 2932.69s | know that underscore underscore s variable we know what it is and that's 2932.69s - 2938.01s | just through those print commands the next thing I'll call out or that's kind 2938.01s - 2941.25s | of like the final thing that we've been working towards is to just start getting 2941.25s - 2948.01s | used to seeing unsafe things being done so that the easiest one to actually find 2948.01s - 2952.25s | is system command so you can see that's in the second square there we have a 2952.25s - 2954.97s | system command and if you're not familiar with that when you're 2954.97s - 2959.21s | programming C essentially that's a way for you to just pass down to Linux to 2959.21s - 2963.05s | say like hey I want you to run this like shell command so it's essentially the 2963.05s - 2965.93s | same as if you know you're at the terminal and you type in if you have a 2965.93s - 2969.29s | shell whatever you pass in the system it's the same way so if you're not 2969.29s - 2973.37s | already thinking this like this is an extremely dangerous thing to do in your 2973.37s - 2977.25s | programming if you're using user variables and especially if you're not 2977.25s -


chunk_text:
through those print commands the next thing I'll call out or that's kind 2938.01s - 2941.25s | of like the final thing that we've been working towards is to just start getting 2941.25s - 2948.01s | used to seeing unsafe things being done so that the easiest one to actually find 2948.01s - 2952.25s | is system command so you can see that's in the second square there we have a 2952.25s - 2954.97s | system command and if you're not familiar with that when you're 2954.97s - 2959.21s | programming C essentially that's a way for you to just pass down to Linux to 2959.21s - 2963.05s | say like hey I want you to run this like shell command so it's essentially the 2963.05s - 2965.93s | same as if you know you're at the terminal and you type in if you have a 2965.93s - 2969.29s | shell whatever you pass in the system it's the same way so if you're not 2969.29s - 2973.37s | already thinking this like this is an extremely dangerous thing to do in your 2973.37s - 2977.25s | programming if you're using user variables and especially if you're not 2977.25s - 2981.85s | going to be sanitizing those variables so in this one for example this util 2981.85s - 2985.17s | underscore exec system function that they've written to make it easier to do 2985.17s - 2992.21s | system calls it does no sanitization or checking however in this example the 2992.21s - 2998.03s | caller of that that actually initially takes in that IP address well it does do 2998.03s - 3003.57s | the sanitization but if you look on this device for example there are about 500 3003.57s - 3008.73s | calls to this util underscore exec system and the person that wrote that 3008.73s - 3011.81s | function this util underscore exec system that knows okay I need to 3011.81s - 3015.77s | sanitize my inputs further down the chain they might not be the same ones 3015.77s - 3019.93s | writing the code so you can actually see how it can happen to slip through where 3019.93s - 3024.09s | user supplied input gets into a system call so that's one of the easiest things 3024.09s - 3028.87s | when you're starting out is to just go interact with the device chase down the 3028.87s - 3032.97s


chunk_text:
2981.85s | going to be sanitizing those variables so in this one for example this util 2981.85s - 2985.17s | underscore exec system function that they've written to make it easier to do 2985.17s - 2992.21s | system calls it does no sanitization or checking however in this example the 2992.21s - 2998.03s | caller of that that actually initially takes in that IP address well it does do 2998.03s - 3003.57s | the sanitization but if you look on this device for example there are about 500 3003.57s - 3008.73s | calls to this util underscore exec system and the person that wrote that 3008.73s - 3011.81s | function this util underscore exec system that knows okay I need to 3011.81s - 3015.77s | sanitize my inputs further down the chain they might not be the same ones 3015.77s - 3019.93s | writing the code so you can actually see how it can happen to slip through where 3019.93s - 3024.09s | user supplied input gets into a system call so that's one of the easiest things 3024.09s - 3028.87s | when you're starting out is to just go interact with the device chase down the 3028.87s - 3032.97s | inputs that you do because you know and see where do they end up in the code and 3032.97s - 3036.43s | if they end up in a system call then I really need to look into this deeper and 3036.43s - 3041.75s | see if there's a way that I can do some sort of command injection so of course 3041.75s - 3045.11s | what's next after we know this well we keep interacting with the device and 3045.11s - 3049.07s | tracing the logging back to the binaries or libraries so of course there's other 3049.07s - 3051.99s | ways to approach this you could just start with the library and look at all 3051.99s - 3054.95s | the system calls and go backwards but when you're getting started I think it's 3054.95s - 3057.83s | a lot easier to understand and conceptualize and not get lost in 3057.83s - 3062.27s | Ghidra to try and start at the source which is how we interact with it and we 3062.27s - 3066.43s | know that there's like an injection point there and then see if that 3066.43s - 3071.03s | actually filters down to something so don't


chunk_text:
| inputs that you do because you know and see where do they end up in the code and 3032.97s - 3036.43s | if they end up in a system call then I really need to look into this deeper and 3036.43s - 3041.75s | see if there's a way that I can do some sort of command injection so of course 3041.75s - 3045.11s | what's next after we know this well we keep interacting with the device and 3045.11s - 3049.07s | tracing the logging back to the binaries or libraries so of course there's other 3049.07s - 3051.99s | ways to approach this you could just start with the library and look at all 3051.99s - 3054.95s | the system calls and go backwards but when you're getting started I think it's 3054.95s - 3057.83s | a lot easier to understand and conceptualize and not get lost in 3057.83s - 3062.27s | Ghidra to try and start at the source which is how we interact with it and we 3062.27s - 3066.43s | know that there's like an injection point there and then see if that 3066.43s - 3071.03s | actually filters down to something so don't just use web browsers like a lot 3071.03s - 3075.35s | of IOT apps they have a mobile or IOT devices they have a mobile app so we can 3075.35s - 3078.43s | go use that mobile app like do everything in the mobile app do all the 3078.43s - 3082.15s | setup check all of that because it's gonna be like a lot of times one of 3082.15s - 3085.87s | those lesser used places where there's some obscure setting or something you 3085.87s - 3089.87s | can set do all of that and see what logging you can get and trace that back 3089.87s - 3093.23s | and see where it goes like one example I found where I was able to crash a 3093.23s - 3098.31s | device is it was a camera and if you wanted to pair it to your mobile app you 3098.31s - 3101.95s | put the QR code up to the camera and you compare it to the mobile app and I was 3101.95s - 3105.43s | never able to like get any buffer overflow or anything but I was able to 3105.43s - 3110.03s | crash the camera by doing like


chunk_text:
just use web browsers like a lot 3071.03s - 3075.35s | of IOT apps they have a mobile or IOT devices they have a mobile app so we can 3075.35s - 3078.43s | go use that mobile app like do everything in the mobile app do all the 3078.43s - 3082.15s | setup check all of that because it's gonna be like a lot of times one of 3082.15s - 3085.87s | those lesser used places where there's some obscure setting or something you 3085.87s - 3089.87s | can set do all of that and see what logging you can get and trace that back 3089.87s - 3093.23s | and see where it goes like one example I found where I was able to crash a 3093.23s - 3098.31s | device is it was a camera and if you wanted to pair it to your mobile app you 3098.31s - 3101.95s | put the QR code up to the camera and you compare it to the mobile app and I was 3101.95s - 3105.43s | never able to like get any buffer overflow or anything but I was able to 3105.43s - 3110.03s | crash the camera by doing like a malformed QR code so just be creative if 3110.03s - 3113.67s | there's cloud like somewhere you can sign up in the cloud and then interact 3113.67s - 3117.55s | with your device do that like usually there's a free 30 days or something and 3117.55s - 3120.71s | you know we're not actually pen testing the cloud thing we don't want to be like 3120.71s - 3124.51s | trying to break that but just interact with it how you're supposed to and see 3124.51s - 3129.25s | how that filters down into the device and then what we're looking for is when 3129.25s - 3132.61s | you're starting out there's two main things I suggest to look for so the 3132.61s - 3137.35s | first one is what we already looked at does it end up in an unvalidated or 3137.35s - 3143.07s | unsanitized system call and like if you look at this router and go back and look 3143.07s - 3147.23s | at the CVS for this one that I'm showing or lots of IOT devices you'll see lots 3147.23s - 3151.75s | of command injections being done because in cheap IOT devices they want 3151.75s


chunk_text:
a malformed QR code so just be creative if 3110.03s - 3113.67s | there's cloud like somewhere you can sign up in the cloud and then interact 3113.67s - 3117.55s | with your device do that like usually there's a free 30 days or something and 3117.55s - 3120.71s | you know we're not actually pen testing the cloud thing we don't want to be like 3120.71s - 3124.51s | trying to break that but just interact with it how you're supposed to and see 3124.51s - 3129.25s | how that filters down into the device and then what we're looking for is when 3129.25s - 3132.61s | you're starting out there's two main things I suggest to look for so the 3132.61s - 3137.35s | first one is what we already looked at does it end up in an unvalidated or 3137.35s - 3143.07s | unsanitized system call and like if you look at this router and go back and look 3143.07s - 3147.23s | at the CVS for this one that I'm showing or lots of IOT devices you'll see lots 3147.23s - 3151.75s | of command injections being done because in cheap IOT devices they want 3151.75s - 3154.95s | to save money they don't want to write their own functionality it's way easier 3154.95s - 3159.83s | to just use the built-in stuff in Linux and just hand it off to a system call so 3159.83s - 3163.27s | it's not like these don't exist you can definitely find them the second one 3163.27s - 3167.71s | that's probably a little bit more common but a little bit harder to find and 3167.71s - 3173.27s | abuse is if it gets your input user input gets put into an unsafe C 3173.27s - 3177.43s | function so there's a few examples of those are mem copy string copy string 3177.43s - 3182.51s | cat print F that next one supposed to be sprint F get scan F so essentially what 3182.51s - 3185.67s | these are doing though is they're going to be copying your data into some sort 3185.67s - 3190.11s | of buffer and again memory is limited on IOT devices so we're always trying to be 3190.11s - 3194.43s | kind of stingy with our buffers and a lot of times if you're not if you're not 3194.43s - 3198.87s | sanitizing or


chunk_text:
- 3154.95s | to save money they don't want to write their own functionality it's way easier 3154.95s - 3159.83s | to just use the built-in stuff in Linux and just hand it off to a system call so 3159.83s - 3163.27s | it's not like these don't exist you can definitely find them the second one 3163.27s - 3167.71s | that's probably a little bit more common but a little bit harder to find and 3167.71s - 3173.27s | abuse is if it gets your input user input gets put into an unsafe C 3173.27s - 3177.43s | function so there's a few examples of those are mem copy string copy string 3177.43s - 3182.51s | cat print F that next one supposed to be sprint F get scan F so essentially what 3182.51s - 3185.67s | these are doing though is they're going to be copying your data into some sort 3185.67s - 3190.11s | of buffer and again memory is limited on IOT devices so we're always trying to be 3190.11s - 3194.43s | kind of stingy with our buffers and a lot of times if you're not if you're not 3194.43s - 3198.87s | sanitizing or validating those inputs then it can end up in a buffer where we 3198.87s - 3203.63s | can overflow it and you know at the worst case buffer overflow or maybe just 3203.63s - 3207.27s | crash the device and have some sort of denial of service so I could give a 3207.27s - 3210.39s | whole another talk then about where to go from that from here and how to 3210.39s - 3215.39s | actually then abuse these are actually exploit buffer overflows but if you do 3215.39s - 3219.11s | get this far and you find this and like you'll be able to maybe crash the device 3219.11s - 3223.59s | or get some seg faults or something then send me a message or just go out and do 3223.59s - 3227.35s | some further research and there's a lot of great resources then for how to 3227.43s - 3232.19s | identify these buffer overflows so that's where I'll end today I just want 3232.19s - 3235.35s | to wrap up with a thank you thanks everyone for coming I hope you learned 3235.35s - 3239.75s | something I hope you go home and go buy a cheap


chunk_text:
validating those inputs then it can end up in a buffer where we 3198.87s - 3203.63s | can overflow it and you know at the worst case buffer overflow or maybe just 3203.63s - 3207.27s | crash the device and have some sort of denial of service so I could give a 3207.27s - 3210.39s | whole another talk then about where to go from that from here and how to 3210.39s - 3215.39s | actually then abuse these are actually exploit buffer overflows but if you do 3215.39s - 3219.11s | get this far and you find this and like you'll be able to maybe crash the device 3219.11s - 3223.59s | or get some seg faults or something then send me a message or just go out and do 3223.59s - 3227.35s | some further research and there's a lot of great resources then for how to 3227.43s - 3232.19s | identify these buffer overflows so that's where I'll end today I just want 3232.19s - 3235.35s | to wrap up with a thank you thanks everyone for coming I hope you learned 3235.35s - 3239.75s | something I hope you go home and go buy a cheap IOT device when you get home 3239.75s - 3244.51s | hack it if you do let me know I love to hear when people hack it and if you want 3244.51s - 3248.71s | a copy of these slides stay in touch with me link up resources anything you 3248.71s - 3252.75s | can reach me at andrewbellini.com thanks everyone


chunk_text:
IOT device when you get home 3239.75s - 3244.51s | hack it if you do let me know I love to hear when people hack it and if you want 3244.51s - 3248.71s | a copy of these slides stay in touch with me link up resources anything you 3248.71s - 3252.75s | can reach me at andrewbellini.com thanks everyone


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=WscuQr5X1kc", "title": "DEF CON 32 - Access Control Done Right the First Time - Tim Clevenger", "description": "Are you looking to install or upgrade a physical access control system? Having installed, repaired and upgraded dozens of large and small access control system installations, I have found that many vendors install a minimum viable product that can leave your new system unreliable and trivial to bypass.\n\nThis session will give you the tools and knowledge you need to work with your installer to implement your system using best practices in the following areas:\n\nWiring, supervision, encryption and tamper-resistance\nChoosing clone-resistant badges and securely programming badge readers\nSecuring controller equipment and managing issued badges\nMaintaining the system for maximum security and uptime", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1461, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 5.84s | This text was transcribed using whisper model: large-v2 All right. Hello. Wow, that's loud. Hi, this is access control done right the first time. My name 5.84s - 12.00s | is Tim Clevenger. A little bit about me. I'm a network cybersecurity engineer by day. By night, 12.00s - 16.48s | I'm a low voltage hardware junkie, vintage computing enthusiast. In a previous life, 16.48s - 22.40s | I was certified with Linnell and S2 access and video. And I got to drive around in a truck and 22.40s - 29.04s | look at other systems available in Southern California. I'm on the Physical Security 29.04s - 33.36s | Village Discord. My handle is NSFW. No, I will not tell you why it's my handle. 34.64s - 38.72s | A little bit about this talk. You know, we have a lot of talks about bypasses. 38.72s - 44.64s | My talk is more about the installation of a system. I'm looking to give some tips and tricks 44.64s - 49.92s | based on the kind of systems that I had seen and had to work on. A lot of vendors out there, 49.92s - 54.64s | you know, it's a low bid situation and you get a minimal viable product. You know, it kind of does 54.64s - 60.72s | a job but it's not particularly maintainable, reliable, or even secure. I'm focusing more on 60.72s - 65.52s | large facilities. You know, if you're a small gym with a single door, some of this will apply 65.52s - 72.96s | to you but maybe not quite as


chunk_text:
I was certified with Linnell and S2 access and video. And I got to drive around in a truck and 22.40s - 29.04s | look at other systems available in Southern California. I'm on the Physical Security 29.04s - 33.36s | Village Discord. My handle is NSFW. No, I will not tell you why it's my handle. 34.64s - 38.72s | A little bit about this talk. You know, we have a lot of talks about bypasses. 38.72s - 44.64s | My talk is more about the installation of a system. I'm looking to give some tips and tricks 44.64s - 49.92s | based on the kind of systems that I had seen and had to work on. A lot of vendors out there, 49.92s - 54.64s | you know, it's a low bid situation and you get a minimal viable product. You know, it kind of does 54.64s - 60.72s | a job but it's not particularly maintainable, reliable, or even secure. I'm focusing more on 60.72s - 65.52s | large facilities. You know, if you're a small gym with a single door, some of this will apply 65.52s - 72.96s | to you but maybe not quite as much. Just starting off, I have an RFP based on this talk and some 72.96s - 77.52s | other stuff that I've learned. I'll put this QR code up again at the end in case you can't catch 77.52s - 84.96s | it right now. So choosing a system, most of the larger vendors use equipment created by a company 84.96s - 90.08s | called Mercury Security. They're kind of the big gorilla. They have local storage and independent 90.08s - 96.48s | processing so you don't have to worry about having to pry open your server room door if your DNS goes 96.48s - 103.04s | down Facebook. They have multiple vendor support and they are reflashable. The cool thing about 103.04s - 107.52s | that is if you decide you're tired of Linnell and you want to go with Genentech or Honeywell, 107.52s - 112.08s | they can reflash the firmware on most of your existing equipment and it reduces the amount 112.08s - 118.16s | of hardware that you have to buy to switch vendors. So a little bit about system layout 118.16s - 124.32s | considerations. So depending on where you're going to do this installation,


chunk_text:
much. Just starting off, I have an RFP based on this talk and some 72.96s - 77.52s | other stuff that I've learned. I'll put this QR code up again at the end in case you can't catch 77.52s - 84.96s | it right now. So choosing a system, most of the larger vendors use equipment created by a company 84.96s - 90.08s | called Mercury Security. They're kind of the big gorilla. They have local storage and independent 90.08s - 96.48s | processing so you don't have to worry about having to pry open your server room door if your DNS goes 96.48s - 103.04s | down Facebook. They have multiple vendor support and they are reflashable. The cool thing about 103.04s - 107.52s | that is if you decide you're tired of Linnell and you want to go with Genentech or Honeywell, 107.52s - 112.08s | they can reflash the firmware on most of your existing equipment and it reduces the amount 112.08s - 118.16s | of hardware that you have to buy to switch vendors. So a little bit about system layout 118.16s - 124.32s | considerations. So depending on where you're going to do this installation, you'll have a couple of 124.32s - 130.16s | different installation options. I'll start here with kind of a basic four-door layout. So this 130.16s - 135.36s | is a typical enclosure right here. The top board is your access panel that has all the brains of 135.36s - 141.20s | the operation. It makes all of the decisions about whether to let somebody in based on their card 141.20s - 146.40s | number and access rights. The board below it is an additional door controller that's connected. 146.40s - 152.32s | That additional controller doesn't have a lot of brains on its own. It will communicate with that 152.32s - 157.60s | main panel board and that's where the decision happens. What that means is if you lose communication 157.60s - 163.04s | between those two boards, any of those dumber, cheaper door controller boards become suddenly 163.04s - 170.00s | very dumb. They will either lock down, lock open, or they'll just use a facility code to grant access, 170.00s - 175.84s | which isn't always the best as far as security goes. There's an enclosure here obviously that 175.84s - 182.80s | houses all of this. There's


chunk_text:
you'll have a couple of 124.32s - 130.16s | different installation options. I'll start here with kind of a basic four-door layout. So this 130.16s - 135.36s | is a typical enclosure right here. The top board is your access panel that has all the brains of 135.36s - 141.20s | the operation. It makes all of the decisions about whether to let somebody in based on their card 141.20s - 146.40s | number and access rights. The board below it is an additional door controller that's connected. 146.40s - 152.32s | That additional controller doesn't have a lot of brains on its own. It will communicate with that 152.32s - 157.60s | main panel board and that's where the decision happens. What that means is if you lose communication 157.60s - 163.04s | between those two boards, any of those dumber, cheaper door controller boards become suddenly 163.04s - 170.00s | very dumb. They will either lock down, lock open, or they'll just use a facility code to grant access, 170.00s - 175.84s | which isn't always the best as far as security goes. There's an enclosure here obviously that 175.84s - 182.80s | houses all of this. There's a power supply and then there are batteries. So when you go to place 182.80s - 188.40s | this enclosure with your panels in it, there are a couple things to consider. Kind of the obvious 188.40s - 195.28s | stuff like environment, heat, humidity, power, physical security. Is this going to be on a wall 195.28s - 201.36s | that people can walk by and pry the door open on it? Accessibility. Is this going to be up 201.36s - 206.00s | on a ceiling somewhere where maybe your batteries aren't going to get changed regularly because you 206.00s - 211.44s | have to get out a long step ladder or something? And then the future, and I'll talk about that here 211.44s - 219.12s | in just a second. So for wiring considerations, so the main access panel connects to your server 219.12s - 224.00s | computer that runs the software with Ethernet typically. Ethernet as we know is kind of a 224.00s - 232.08s | shorter range communications medium. So what they have between your access panel and your individual 232.08s - 240.32s | door controllers is called RS-485. It's an older four-wire communications protocol. Theoretically 240.32s


chunk_text:
a power supply and then there are batteries. So when you go to place 182.80s - 188.40s | this enclosure with your panels in it, there are a couple things to consider. Kind of the obvious 188.40s - 195.28s | stuff like environment, heat, humidity, power, physical security. Is this going to be on a wall 195.28s - 201.36s | that people can walk by and pry the door open on it? Accessibility. Is this going to be up 201.36s - 206.00s | on a ceiling somewhere where maybe your batteries aren't going to get changed regularly because you 206.00s - 211.44s | have to get out a long step ladder or something? And then the future, and I'll talk about that here 211.44s - 219.12s | in just a second. So for wiring considerations, so the main access panel connects to your server 219.12s - 224.00s | computer that runs the software with Ethernet typically. Ethernet as we know is kind of a 224.00s - 232.08s | shorter range communications medium. So what they have between your access panel and your individual 232.08s - 240.32s | door controllers is called RS-485. It's an older four-wire communications protocol. Theoretically 240.32s - 246.72s | it's good to 4,000 feet. However, it's much more sensitive to interference than, you know, Ethernet 246.72s - 252.72s | or some of the newer communications technologies. There's also, there's a foil shield in the wire 252.72s - 257.36s | that you have to deal with. There's termination at the end of a string of devices. So what that 257.36s - 262.40s | means is that RS-485 is substantially, in my opinion, as somebody who's had to go and crawl 262.40s - 268.64s | into spaces and replace wire, it's less reliable over long distances. But we will see in a minute 268.64s - 274.16s | there are some places that you just really don't have a choice. So next up we think about our 274.16s - 280.40s | distances to doors. So for something like a magnetic lock or a motorized crash bar, that's 280.40s - 286.80s | going to take a lot more amperage than just, you know, a kind of a simple relay-based door opener. 286.80s - 291.20s | And if that door also happens to be a long way from where you want to place your panel, 291.20s - 296.88s | then you


chunk_text:
- 246.72s | it's good to 4,000 feet. However, it's much more sensitive to interference than, you know, Ethernet 246.72s - 252.72s | or some of the newer communications technologies. There's also, there's a foil shield in the wire 252.72s - 257.36s | that you have to deal with. There's termination at the end of a string of devices. So what that 257.36s - 262.40s | means is that RS-485 is substantially, in my opinion, as somebody who's had to go and crawl 262.40s - 268.64s | into spaces and replace wire, it's less reliable over long distances. But we will see in a minute 268.64s - 274.16s | there are some places that you just really don't have a choice. So next up we think about our 274.16s - 280.40s | distances to doors. So for something like a magnetic lock or a motorized crash bar, that's 280.40s - 286.80s | going to take a lot more amperage than just, you know, a kind of a simple relay-based door opener. 286.80s - 291.20s | And if that door also happens to be a long way from where you want to place your panel, 291.20s - 296.88s | then you end up with a voltage drop which causes the locks to either not unlock when you want them 296.88s - 302.80s | to, or in the case of a magnetic lock, the magnet becomes so weak from low voltage that you could 302.80s - 307.76s | just pull the door open anyway. And what will happen is when you go to do your installation, 307.76s - 311.84s | the vendor will figure this out after they've already installed the door and installed the 311.84s - 316.32s | panel and run all the wire, and they'll go, okay, well we're going to need to do a remote power 316.32s - 321.04s | supply. And what they'll do is they'll find a place up in the ceiling nearest to the door 321.04s - 326.88s | and put the cheapest power supply they possibly can, not having any consideration for the 326.88s - 330.64s | environment it's going to be in. It's not going to have batteries. They're not going to tell you 330.64s - 336.24s | where it is. It's going to be up in a soffit where when you do need to get to it, you're like ripping 336.24s - 342.00s


chunk_text:
end up with a voltage drop which causes the locks to either not unlock when you want them 296.88s - 302.80s | to, or in the case of a magnetic lock, the magnet becomes so weak from low voltage that you could 302.80s - 307.76s | just pull the door open anyway. And what will happen is when you go to do your installation, 307.76s - 311.84s | the vendor will figure this out after they've already installed the door and installed the 311.84s - 316.32s | panel and run all the wire, and they'll go, okay, well we're going to need to do a remote power 316.32s - 321.04s | supply. And what they'll do is they'll find a place up in the ceiling nearest to the door 321.04s - 326.88s | and put the cheapest power supply they possibly can, not having any consideration for the 326.88s - 330.64s | environment it's going to be in. It's not going to have batteries. They're not going to tell you 330.64s - 336.24s | where it is. It's going to be up in a soffit where when you do need to get to it, you're like ripping 336.24s - 342.00s | out drywall or something even more expensive. So part of your system layout considerations with 342.00s - 347.28s | your project manager is to say, okay, this door is way over here. Are we going to need a remote 347.28s - 356.14s | power supply? If so, let's get this going now. In addition, again, hard lid. So if you've got 356.14s - 361.42s | that drywall above your closet where you're going to be doing your installation, that's going to 361.42s - 367.42s | affect your installation. Block walls or concrete walls, like maybe don't put this in a hallway 367.42s - 370.86s | where you're going to have to tunnel through concrete to get all your wiring to your doors. 372.70s - 377.82s | Integrity and security, I'm going to make sure that if I'm going to have wiring run 377.90s - 382.94s | from my suite over here through a public hallway to this suite over here above a drop ceiling, 382.94s - 388.70s | maybe I'll put that in conduit so it's not easy to get in either tamper with or cut or 389.58s - 395.98s | other shenanigans. So here's one of the two


chunk_text:
| out drywall or something even more expensive. So part of your system layout considerations with 342.00s - 347.28s | your project manager is to say, okay, this door is way over here. Are we going to need a remote 347.28s - 356.14s | power supply? If so, let's get this going now. In addition, again, hard lid. So if you've got 356.14s - 361.42s | that drywall above your closet where you're going to be doing your installation, that's going to 361.42s - 367.42s | affect your installation. Block walls or concrete walls, like maybe don't put this in a hallway 367.42s - 370.86s | where you're going to have to tunnel through concrete to get all your wiring to your doors. 372.70s - 377.82s | Integrity and security, I'm going to make sure that if I'm going to have wiring run 377.90s - 382.94s | from my suite over here through a public hallway to this suite over here above a drop ceiling, 382.94s - 388.70s | maybe I'll put that in conduit so it's not easy to get in either tamper with or cut or 389.58s - 395.98s | other shenanigans. So here's one of the two kind of situations that I'm going to talk about. This 395.98s - 403.98s | is a warehouse. We have 65, 70 doors for trucks to back into. And then every few doors you have 403.98s - 409.42s | a person door so that somebody can get in and out of the warehouse. And you want to do access 409.42s - 415.10s | control on these. Well, you know, we're talking 700 or 800 feet here or maybe more to go from 415.66s - 421.90s | where your access panel might be at the far end across to each one of these drops to these doors. 421.90s - 427.42s | So what you might do is you might go ahead and use that RS-485. It's not in a harsh environment, 427.42s - 431.02s | so it's probably safe to use. It's going to be exposed there. So if something happens, 431.42s - 438.54s | you can get to it. But it allows you to do this without having to run multiple Ethernet drops or 439.82s - 444.30s | fiber with media converters or whatever it takes to get Ethernet 700 feet down that doorway. 446.86s - 453.97s | Excuse me. Here's


chunk_text:
kind of situations that I'm going to talk about. This 395.98s - 403.98s | is a warehouse. We have 65, 70 doors for trucks to back into. And then every few doors you have 403.98s - 409.42s | a person door so that somebody can get in and out of the warehouse. And you want to do access 409.42s - 415.10s | control on these. Well, you know, we're talking 700 or 800 feet here or maybe more to go from 415.66s - 421.90s | where your access panel might be at the far end across to each one of these drops to these doors. 421.90s - 427.42s | So what you might do is you might go ahead and use that RS-485. It's not in a harsh environment, 427.42s - 431.02s | so it's probably safe to use. It's going to be exposed there. So if something happens, 431.42s - 438.54s | you can get to it. But it allows you to do this without having to run multiple Ethernet drops or 439.82s - 444.30s | fiber with media converters or whatever it takes to get Ethernet 700 feet down that doorway. 446.86s - 453.97s | Excuse me. Here's kind of a typical Class A office space. You know, this is a floor in 453.97s - 458.45s | pretty much any Class A building that you'd be into. So this right here, you know, it's a 458.45s - 463.49s | relatively small space here. What you probably want to do is a centralized panel somewhere near 463.49s - 470.29s | the elevators where you kind of fan out to all of the doors that you need access to from there. 471.97s - 476.77s | But something to consider for the future, you know, there might be, I don't know, a pandemic 476.77s - 483.57s | and suddenly companies are trying to get rid of excess space because people are working from home. 483.57s - 487.17s | So if you plan this out ahead of time when you're first moving into the space, you can say, you know 487.17s - 491.89s | what, these are pretty much, you know, they're two half offices essentially. They each have their own 491.89s - 500.13s | elevators, have their own entrance doors. Maybe I'll go ahead and put a panel on each side and 500.13s - 505.65s | then RS-485 to my doors


chunk_text:
kind of a typical Class A office space. You know, this is a floor in 453.97s - 458.45s | pretty much any Class A building that you'd be into. So this right here, you know, it's a 458.45s - 463.49s | relatively small space here. What you probably want to do is a centralized panel somewhere near 463.49s - 470.29s | the elevators where you kind of fan out to all of the doors that you need access to from there. 471.97s - 476.77s | But something to consider for the future, you know, there might be, I don't know, a pandemic 476.77s - 483.57s | and suddenly companies are trying to get rid of excess space because people are working from home. 483.57s - 487.17s | So if you plan this out ahead of time when you're first moving into the space, you can say, you know 487.17s - 491.89s | what, these are pretty much, you know, they're two half offices essentially. They each have their own 491.89s - 500.13s | elevators, have their own entrance doors. Maybe I'll go ahead and put a panel on each side and 500.13s - 505.65s | then RS-485 to my doors from there. And that way, if for some reason we need to get rid of half of 505.65s - 510.69s | this floor, it's real easy to just put up some drywall, cut access to that half of the system, 510.69s - 514.93s | and whoever moves in can handle that. So again, it's just something to consider if you're looking 514.93s - 519.25s | at a space. Look at how you need to do it today, but also maybe look at the future. 521.46s - 527.14s | This is a larger installation. I'm just showing this here for you. Again, power supply, batteries. 527.14s - 531.46s | Here we have the access panel at the top with the Ethernet drop and then two door controller 531.46s - 535.94s | boards that are below this. This is kind of, when you're talking about these centralized panel 535.94s - 542.18s | situations, this is what you typically do. Use an enclosure. You have six or eight door controllers. 542.18s - 546.42s | Each one can control two doors and you kind of keep them in one enclosure or two enclosures 546.42s - 551.54s | right next to each other. The RS-485


chunk_text:
from there. And that way, if for some reason we need to get rid of half of 505.65s - 510.69s | this floor, it's real easy to just put up some drywall, cut access to that half of the system, 510.69s - 514.93s | and whoever moves in can handle that. So again, it's just something to consider if you're looking 514.93s - 519.25s | at a space. Look at how you need to do it today, but also maybe look at the future. 521.46s - 527.14s | This is a larger installation. I'm just showing this here for you. Again, power supply, batteries. 527.14s - 531.46s | Here we have the access panel at the top with the Ethernet drop and then two door controller 531.46s - 535.94s | boards that are below this. This is kind of, when you're talking about these centralized panel 535.94s - 542.18s | situations, this is what you typically do. Use an enclosure. You have six or eight door controllers. 542.18s - 546.42s | Each one can control two doors and you kind of keep them in one enclosure or two enclosures 546.42s - 551.54s | right next to each other. The RS-485 runs are really short. In this case, it's a pre-wired 551.54s - 555.78s | panel, so you don't even have to mess with it. And it just gives you that kind of extra security to 557.06s - 561.22s | have that there instead of saying, I'm going to run a door controller way over on the other side 561.22s - 566.74s | of the building. And that means that all of that wire from here to there can be a problem in the 566.74s - 572.90s | future. Now let's talk a little bit about wiring to the doors. Some of this is a repeat if you've 572.90s - 578.98s | seen some of the bypass stuff already, but I'll try to warp through that part because I think we 579.62s - 585.06s | know how to bypass some of this stuff. So when you're wiring from your panels to the doors 585.06s - 590.18s | themselves, so some of your wiring considerations, so you're going to need a power, some heavier 590.18s - 595.46s | gauge wires to the door hardware, whatever unlocks the door. Motion sensors are going to need a power 595.46s - 600.74s | in addition


chunk_text:
runs are really short. In this case, it's a pre-wired 551.54s - 555.78s | panel, so you don't even have to mess with it. And it just gives you that kind of extra security to 557.06s - 561.22s | have that there instead of saying, I'm going to run a door controller way over on the other side 561.22s - 566.74s | of the building. And that means that all of that wire from here to there can be a problem in the 566.74s - 572.90s | future. Now let's talk a little bit about wiring to the doors. Some of this is a repeat if you've 572.90s - 578.98s | seen some of the bypass stuff already, but I'll try to warp through that part because I think we 579.62s - 585.06s | know how to bypass some of this stuff. So when you're wiring from your panels to the doors 585.06s - 590.18s | themselves, so some of your wiring considerations, so you're going to need a power, some heavier 590.18s - 595.46s | gauge wires to the door hardware, whatever unlocks the door. Motion sensors are going to need a power 595.46s - 600.74s | in addition to their contacts. You're going to need some kind of shielded cable to the badge 600.74s - 606.10s | reader. That could be RS-485 or it could be Wigan cable. You're going to have your door contact and 606.10s - 610.66s | your request to exit wiring is going to need to go on there. And then it's a good idea to have 610.66s - 616.26s | extra cables, extra conductors there for tamper switches, auxiliary inputs and outputs, and that 616.26s - 623.22s | type of thing. The wrong way to do this is to let your vendors just decide because what they will do 623.22s - 627.78s | is they will find the cheapest wire, often it's what they have on the truck, and they will run 627.86s - 633.46s | undersized power connectors to doors they think don't need it. That could be a fire hazard in 633.46s - 639.86s | addition to just having door opening problems. They could use unshielded splice cable. They could 639.86s - 645.62s | use Ethernet or Cat 3 telephone wire if that's what they have access to, and that causes 645.62s - 650.58s | communications issues. And then if they


chunk_text:
to their contacts. You're going to need some kind of shielded cable to the badge 600.74s - 606.10s | reader. That could be RS-485 or it could be Wigan cable. You're going to have your door contact and 606.10s - 610.66s | your request to exit wiring is going to need to go on there. And then it's a good idea to have 610.66s - 616.26s | extra cables, extra conductors there for tamper switches, auxiliary inputs and outputs, and that 616.26s - 623.22s | type of thing. The wrong way to do this is to let your vendors just decide because what they will do 623.22s - 627.78s | is they will find the cheapest wire, often it's what they have on the truck, and they will run 627.86s - 633.46s | undersized power connectors to doors they think don't need it. That could be a fire hazard in 633.46s - 639.86s | addition to just having door opening problems. They could use unshielded splice cable. They could 639.86s - 645.62s | use Ethernet or Cat 3 telephone wire if that's what they have access to, and that causes 645.62s - 650.58s | communications issues. And then if they don't have those extra conductors in there, that means that 650.58s - 655.06s | in the future if your receptionist needs a push button to be able to open the door without getting 655.06s - 660.90s | up, I mean that could involve tunneling under the concrete or up in the ceiling or, you know, 660.90s - 665.54s | it's a lot of extra work that you could have avoided if you had that already pre-wired with 665.54s - 671.78s | those additional conductors. So the right way to do this is to specify composite access control 671.78s - 678.98s | cable. So this is all together in one cable. It's produced by manufacturers who specialize in this. 679.70s - 682.98s | It comes in multiple options depending on how many extra conductors you want, 683.38s - 688.66s | what kind of locks you're using. It comes with the right card reader communications cable that's 688.66s - 693.78s | shielded properly, has all the spare conductors, and then it has that thick extra jacket on the 693.78s - 697.94s | outside. So if they're pulling it through a drop ceiling and they just grind, you know, 697.94s - 703.14s |


chunk_text:
don't have those extra conductors in there, that means that 650.58s - 655.06s | in the future if your receptionist needs a push button to be able to open the door without getting 655.06s - 660.90s | up, I mean that could involve tunneling under the concrete or up in the ceiling or, you know, 660.90s - 665.54s | it's a lot of extra work that you could have avoided if you had that already pre-wired with 665.54s - 671.78s | those additional conductors. So the right way to do this is to specify composite access control 671.78s - 678.98s | cable. So this is all together in one cable. It's produced by manufacturers who specialize in this. 679.70s - 682.98s | It comes in multiple options depending on how many extra conductors you want, 683.38s - 688.66s | what kind of locks you're using. It comes with the right card reader communications cable that's 688.66s - 693.78s | shielded properly, has all the spare conductors, and then it has that thick extra jacket on the 693.78s - 697.94s | outside. So if they're pulling it through a drop ceiling and they just grind, you know, 697.94s - 703.14s | the cable against a sharp piece of metal, it's less likely to cause damage to the conductors 703.14s - 707.86s | inside. It's also unique. You know, a thick yellow cable, they're not going to just go cutting 707.86s - 712.26s | through that, you know, with, you know, willy-nilly like they might a bunch of thin white 713.22s - 719.14s | cables. A little bit about power supplies and enclosures. So the way the power works in this 719.14s - 725.54s | situation is typically AC or DC, 12 volts or 24 volts or accommodation of 12 and 24 volts. 725.54s - 731.30s | Your project manager can help you pick the right system as far as voltage goes. You want to make 731.30s - 736.90s | sure that they specify one that has a power supply with a charger. Batteries are extremely 736.90s - 740.10s | important. The last thing you want is to get locked out of your building when the power goes 740.10s - 746.82s | out because you didn't have batteries on this and all your doors are locked. Verify the amperage 746.82s - 750.50s | and the temperature range. This is particularly important if


chunk_text:
the cable against a sharp piece of metal, it's less likely to cause damage to the conductors 703.14s - 707.86s | inside. It's also unique. You know, a thick yellow cable, they're not going to just go cutting 707.86s - 712.26s | through that, you know, with, you know, willy-nilly like they might a bunch of thin white 713.22s - 719.14s | cables. A little bit about power supplies and enclosures. So the way the power works in this 719.14s - 725.54s | situation is typically AC or DC, 12 volts or 24 volts or accommodation of 12 and 24 volts. 725.54s - 731.30s | Your project manager can help you pick the right system as far as voltage goes. You want to make 731.30s - 736.90s | sure that they specify one that has a power supply with a charger. Batteries are extremely 736.90s - 740.10s | important. The last thing you want is to get locked out of your building when the power goes 740.10s - 746.82s | out because you didn't have batteries on this and all your doors are locked. Verify the amperage 746.82s - 750.50s | and the temperature range. This is particularly important if you're going to be putting that 750.50s - 758.18s | enclosure in a hot room. And then also AC fail and battery fail outputs on the power supply that 758.18s - 763.38s | you can run back to your system and it'll alert you if your batteries are dead or if you're about 763.38s - 768.50s | to or if you have an AC fail and it's running on batteries, it's good to catch that stuff before 768.50s - 776.06s | your batteries die. The enclosure, you know, there are different sizes, single or multiple panels in 776.06s - 779.90s | a single enclosure. You can also chain them together so that you can run multiple stuff in, 779.90s - 785.26s | you know, multiple enclosures. They're typically sold as a kit with the power supply. So again, 785.26s - 791.02s | make sure that you get that specified to what you need. You can get them pre-wired like the one that 791.02s - 796.70s | we saw a couple slides ago or you can DIY if you want to wire your own. Make sure you get one that 796.70s - 801.82s | has a tamper switch like you could


chunk_text:
you're going to be putting that 750.50s - 758.18s | enclosure in a hot room. And then also AC fail and battery fail outputs on the power supply that 758.18s - 763.38s | you can run back to your system and it'll alert you if your batteries are dead or if you're about 763.38s - 768.50s | to or if you have an AC fail and it's running on batteries, it's good to catch that stuff before 768.50s - 776.06s | your batteries die. The enclosure, you know, there are different sizes, single or multiple panels in 776.06s - 779.90s | a single enclosure. You can also chain them together so that you can run multiple stuff in, 779.90s - 785.26s | you know, multiple enclosures. They're typically sold as a kit with the power supply. So again, 785.26s - 791.02s | make sure that you get that specified to what you need. You can get them pre-wired like the one that 791.02s - 796.70s | we saw a couple slides ago or you can DIY if you want to wire your own. Make sure you get one that 796.70s - 801.82s | has a tamper switch like you could see in the picture here and a key lock so that you can lock 801.82s - 806.78s | that enclosure. If it's going to be in a public area, go ahead and change the lock on that because 806.78s - 811.66s | all these enclosures have the same key. And then optionally weatherproof, if you've got a parking 811.66s - 816.86s | lot with a gate on it way out in the, you know, at the other end of the property, maybe put it in a 816.86s - 821.90s | weatherproof enclosure if you don't have a guard shack or someplace to install the panel out there. 823.26s - 827.66s | And then a little bit about batteries. I cannot tell you how many times I've seen either no 827.66s - 833.26s | batteries or dead batteries because they hadn't been changed since the system was installed. 833.26s - 838.78s | They're right in the enclosure so they're hard to remember sometimes. Again, you have to have 838.78s - 843.42s | a power supply with charging capability. What I like to do is write that install date on the 843.42s - 847.10s | battery so if you're ever in that


chunk_text:
see in the picture here and a key lock so that you can lock 801.82s - 806.78s | that enclosure. If it's going to be in a public area, go ahead and change the lock on that because 806.78s - 811.66s | all these enclosures have the same key. And then optionally weatherproof, if you've got a parking 811.66s - 816.86s | lot with a gate on it way out in the, you know, at the other end of the property, maybe put it in a 816.86s - 821.90s | weatherproof enclosure if you don't have a guard shack or someplace to install the panel out there. 823.26s - 827.66s | And then a little bit about batteries. I cannot tell you how many times I've seen either no 827.66s - 833.26s | batteries or dead batteries because they hadn't been changed since the system was installed. 833.26s - 838.78s | They're right in the enclosure so they're hard to remember sometimes. Again, you have to have 838.78s - 843.42s | a power supply with charging capability. What I like to do is write that install date on the 843.42s - 847.10s | battery so if you're ever in that enclosure in the future, you can look at and see, you know, 847.10s - 851.74s | how far ahead those batteries are going to need to be replaced. Typically, I do it every three to 851.74s - 855.90s | five years. If it's in a nice air-conditioned server room, then I'll replace them every five 855.90s - 861.50s | years. If they're out in a hot, you know, garage or something, then I'll replace them every three 861.50s - 865.34s | years. You can usually tell because when you pick up the battery and shake it, you'll hear rattling 865.34s - 869.58s | because the electrolytes drying up when the batteries are going dead. And again, use those 869.58s - 875.66s | battery fail outputs. I grabbed this out of a hardware guide. Connect that and run it back to 875.66s - 883.18s | your panels so that you can see when either the batteries are no longer chargeable or if the AC 883.18s - 889.22s | has failed, maybe a breaker has tripped somewhere and you need to go take care of that. A little bit 889.22s - 894.66s | about those remote power supplies. Again, for those power-hungry


chunk_text:
enclosure in the future, you can look at and see, you know, 847.10s - 851.74s | how far ahead those batteries are going to need to be replaced. Typically, I do it every three to 851.74s - 855.90s | five years. If it's in a nice air-conditioned server room, then I'll replace them every five 855.90s - 861.50s | years. If they're out in a hot, you know, garage or something, then I'll replace them every three 861.50s - 865.34s | years. You can usually tell because when you pick up the battery and shake it, you'll hear rattling 865.34s - 869.58s | because the electrolytes drying up when the batteries are going dead. And again, use those 869.58s - 875.66s | battery fail outputs. I grabbed this out of a hardware guide. Connect that and run it back to 875.66s - 883.18s | your panels so that you can see when either the batteries are no longer chargeable or if the AC 883.18s - 889.22s | has failed, maybe a breaker has tripped somewhere and you need to go take care of that. A little bit 889.22s - 894.66s | about those remote power supplies. Again, for those power-hungry locks, make sure that you get those 894.66s - 898.90s | specified out ahead of time during the planning phase. That way, you know where those are going 898.90s - 903.14s | to go. You know they're going to be in a place that you can get to and not have to cut through 903.14s - 907.62s | drywall. You're going to make sure then that it still has the power supply, the charger, and the 907.62s - 913.70s | batteries. You know, having that exterior door on its own power supply with no batteries in it does 913.70s - 920.21s | you no good because that's the door you want to get in when the power goes out. A little bit about 920.21s - 927.73s | fire safety. Your doors, the locking mechanism on your door can be either fail safe or fail secure. 927.81s - 933.97s | What that means is if your access system crashes and it does happen, you want to know whether you 933.97s - 938.21s | can actually get out of the building or not. If it fails secure, then that door is not going to 938.21s - 943.33s | open when the software


chunk_text:
locks, make sure that you get those 894.66s - 898.90s | specified out ahead of time during the planning phase. That way, you know where those are going 898.90s - 903.14s | to go. You know they're going to be in a place that you can get to and not have to cut through 903.14s - 907.62s | drywall. You're going to make sure then that it still has the power supply, the charger, and the 907.62s - 913.70s | batteries. You know, having that exterior door on its own power supply with no batteries in it does 913.70s - 920.21s | you no good because that's the door you want to get in when the power goes out. A little bit about 920.21s - 927.73s | fire safety. Your doors, the locking mechanism on your door can be either fail safe or fail secure. 927.81s - 933.97s | What that means is if your access system crashes and it does happen, you want to know whether you 933.97s - 938.21s | can actually get out of the building or not. If it fails secure, then that door is not going to 938.21s - 943.33s | open when the software is crashed. If it's fail safe, then the door is going to go unlocked. Now, 943.33s - 947.65s | there's different reasons that people would choose a fail safe versus a fail secure depending on what 947.65s - 952.69s | you're protecting. I would just say that if you choose to do something that is a fail secure, 952.69s - 957.89s | make sure that people who are in that room can get out in the case of a fire, a power outage, 957.89s - 964.69s | a software crash. It's not worth life safety to protect assets. Find another way to do it. 965.65s - 971.65s | Make sure that your system is going to comply with the local fire code and the authority having 971.65s - 975.81s | jurisdiction. That's sometimes a fire marshal. Sometimes it's a building inspector. It depends 975.81s - 981.09s | on your jurisdiction. And also, if you're particularly in a class A building, you may 981.09s - 986.29s | be required by your lease to tie your system into a building fire alarm using a relay like 986.29s - 994.05s | one of these that opens the door or unlocks the lock when


chunk_text:
is crashed. If it's fail safe, then the door is going to go unlocked. Now, 943.33s - 947.65s | there's different reasons that people would choose a fail safe versus a fail secure depending on what 947.65s - 952.69s | you're protecting. I would just say that if you choose to do something that is a fail secure, 952.69s - 957.89s | make sure that people who are in that room can get out in the case of a fire, a power outage, 957.89s - 964.69s | a software crash. It's not worth life safety to protect assets. Find another way to do it. 965.65s - 971.65s | Make sure that your system is going to comply with the local fire code and the authority having 971.65s - 975.81s | jurisdiction. That's sometimes a fire marshal. Sometimes it's a building inspector. It depends 975.81s - 981.09s | on your jurisdiction. And also, if you're particularly in a class A building, you may 981.09s - 986.29s | be required by your lease to tie your system into a building fire alarm using a relay like 986.29s - 994.05s | one of these that opens the door or unlocks the lock when the fire alarm goes off. Again, make 994.05s - 999.57s | sure that you take care of that. And then finally, there's a box in the U.S. at least on the outside 999.57s - 1004.93s | of most of these buildings. It's called a Knox box. It's a little hardened metal box that the 1004.93s - 1010.21s | fire department can open up to get a key into the building. I typically will put a badge in there 1010.21s - 1015.33s | because I don't have keys. We don't do keys. But if you do, make sure that's in there. I strongly 1015.33s - 1020.45s | recommend that you put a tamper switch in that so that if somebody uses the probably well-known 1021.41s - 1026.13s | Knox box common keys out there, that you know that that's been tampered with. 1027.65s - 1032.77s | A little bit about door hardware. I'm not going to go through these. These are pretty standard. 1033.33s - 1037.73s | The electrified strike is the one that you see here. That's the one that makes a nasty buzzing 1037.73s - 1044.21s | sound and the door never closes quite right. Solenoids are the more


chunk_text:
the fire alarm goes off. Again, make 994.05s - 999.57s | sure that you take care of that. And then finally, there's a box in the U.S. at least on the outside 999.57s - 1004.93s | of most of these buildings. It's called a Knox box. It's a little hardened metal box that the 1004.93s - 1010.21s | fire department can open up to get a key into the building. I typically will put a badge in there 1010.21s - 1015.33s | because I don't have keys. We don't do keys. But if you do, make sure that's in there. I strongly 1015.33s - 1020.45s | recommend that you put a tamper switch in that so that if somebody uses the probably well-known 1021.41s - 1026.13s | Knox box common keys out there, that you know that that's been tampered with. 1027.65s - 1032.77s | A little bit about door hardware. I'm not going to go through these. These are pretty standard. 1033.33s - 1037.73s | The electrified strike is the one that you see here. That's the one that makes a nasty buzzing 1037.73s - 1044.21s | sound and the door never closes quite right. Solenoids are the more common ones that you see 1044.21s - 1049.09s | on office doors. The only thing with those is if your door is set to stay open 8 to 10 or 12 hours 1049.09s - 1055.73s | a day, that solenoid is staying engaged that entire time and those things can fail prematurely and then 1055.73s - 1061.65s | you can't open the door. So it's just something to keep an eye on. Magnetic locks typically need 1061.65s - 1067.49s | more power than standard locks because the electromagnet requires that voltage in order to 1067.49s - 1073.49s | have the holding power. And those will always fail safe. So maybe don't use those for your front doors 1073.49s - 1078.61s | because if the power goes out, they're going to open. And then finally, motorized crash bars, 1078.61s - 1082.77s | which I've only seen in one place, but they're expensive, but they're pretty good. 1084.77s - 1090.21s | So quick thing about door hardware. So you have two sensors on a door. Typically, 1090.29s - 1094.05s | you'll have the door contact that tells you whether the door is open or closed. 1094.05s - 1100.53s | That can be


chunk_text:
common ones that you see 1044.21s - 1049.09s | on office doors. The only thing with those is if your door is set to stay open 8 to 10 or 12 hours 1049.09s - 1055.73s | a day, that solenoid is staying engaged that entire time and those things can fail prematurely and then 1055.73s - 1061.65s | you can't open the door. So it's just something to keep an eye on. Magnetic locks typically need 1061.65s - 1067.49s | more power than standard locks because the electromagnet requires that voltage in order to 1067.49s - 1073.49s | have the holding power. And those will always fail safe. So maybe don't use those for your front doors 1073.49s - 1078.61s | because if the power goes out, they're going to open. And then finally, motorized crash bars, 1078.61s - 1082.77s | which I've only seen in one place, but they're expensive, but they're pretty good. 1084.77s - 1090.21s | So quick thing about door hardware. So you have two sensors on a door. Typically, 1090.29s - 1094.05s | you'll have the door contact that tells you whether the door is open or closed. 1094.05s - 1100.53s | That can be a reed switch up in the door frame. It can be integrated into the lock set itself. 1101.41s - 1106.69s | And then the request to exit, that's what tells the access control system that this door is being 1106.69s - 1111.49s | opened legitimately from the inside by the correct person and not being jimmied open 1111.49s - 1117.09s | from the outside. So it detects if that door is being forced or bypassed and it still allows the 1117.09s - 1122.85s | door to open from the secure side. There's also in cases where you have, for instance, a mag lock 1122.85s - 1126.85s | that request to exit switch will actually unlock the door because there's not really any other way 1126.85s - 1133.89s | to do it. And then typically, your other options are a button, a buzzer, a motion detector, or 1133.89s - 1139.09s | a switch integrated into the handle for your Rex. The reason I mentioned these is because we need 1139.09s - 1144.37s | to talk a little bit about supervision. Supervision is a set of resistors in series or parallel 1144.37s - 1150.21s | that need to be as close to


chunk_text:
a reed switch up in the door frame. It can be integrated into the lock set itself. 1101.41s - 1106.69s | And then the request to exit, that's what tells the access control system that this door is being 1106.69s - 1111.49s | opened legitimately from the inside by the correct person and not being jimmied open 1111.49s - 1117.09s | from the outside. So it detects if that door is being forced or bypassed and it still allows the 1117.09s - 1122.85s | door to open from the secure side. There's also in cases where you have, for instance, a mag lock 1122.85s - 1126.85s | that request to exit switch will actually unlock the door because there's not really any other way 1126.85s - 1133.89s | to do it. And then typically, your other options are a button, a buzzer, a motion detector, or 1133.89s - 1139.09s | a switch integrated into the handle for your Rex. The reason I mentioned these is because we need 1139.09s - 1144.37s | to talk a little bit about supervision. Supervision is a set of resistors in series or parallel 1144.37s - 1150.21s | that need to be as close to the door contact or Rex contact as possible. And what they do is they 1150.21s - 1156.29s | change your situation from either these wires are open or closed, the circuit is open or closed, 1156.29s - 1161.73s | it gives you now four different readings depending on whether the door is open, the door is closed, 1161.73s - 1167.25s | or if the wires are cut or the wires are shorted. And that's very important because the last thing 1167.25s - 1171.81s | you need is the door contact falling off and then people can just open the door and go in and out 1171.81s - 1179.73s | and you don't know what's happened. Motion detectors, again, there's attack examples here. 1179.73s - 1183.73s | We've talked about this quite a bit. You can come to Physical Security Village and we'll talk you 1183.73s - 1190.93s | through it. They're often used to trigger and unlock, again, on motion, I'm sorry, on mag lock 1190.93s - 1196.53s | doors and some other types. So not only do they, are they a security risk, but they can actually 1196.53s - 1202.37s | open the door if you can bypass them.


chunk_text:
the door contact or Rex contact as possible. And what they do is they 1150.21s - 1156.29s | change your situation from either these wires are open or closed, the circuit is open or closed, 1156.29s - 1161.73s | it gives you now four different readings depending on whether the door is open, the door is closed, 1161.73s - 1167.25s | or if the wires are cut or the wires are shorted. And that's very important because the last thing 1167.25s - 1171.81s | you need is the door contact falling off and then people can just open the door and go in and out 1171.81s - 1179.73s | and you don't know what's happened. Motion detectors, again, there's attack examples here. 1179.73s - 1183.73s | We've talked about this quite a bit. You can come to Physical Security Village and we'll talk you 1183.73s - 1190.93s | through it. They're often used to trigger and unlock, again, on motion, I'm sorry, on mag lock 1190.93s - 1196.53s | doors and some other types. So not only do they, are they a security risk, but they can actually 1196.53s - 1202.37s | open the door if you can bypass them. And then door handle attacks, I know that we just had a 1202.37s - 1207.25s | presentation on this. Some of those mitigations, you know, dual Rex, so you have to have something 1207.25s - 1212.21s | where they pull the door handle on the inside and there's a motion detector or a second badge reader 1212.21s - 1217.01s | or a push button. Again, if you're going to use a badge reader to exit, make sure you have a way to 1217.01s - 1221.81s | get out. Typically you get one of those plastic covers that you rip off and pull the handle and 1221.81s - 1226.45s | they'll let you out while also setting off an alarm. That's what that's for is so that you can 1226.45s - 1232.69s | get out in case of a fire and you don't happen to have your badge. A little bit about badges 1232.69s - 1237.17s | and readers. So, you know, badges come in multiple sizes and shapes, you know, you got the fobs, you 1237.17s - 1241.65s | got the smart card readers. If you're from the 80s, you got mag stripe cards, like there's all kinds. 1242.45s -


chunk_text:
And then door handle attacks, I know that we just had a 1202.37s - 1207.25s | presentation on this. Some of those mitigations, you know, dual Rex, so you have to have something 1207.25s - 1212.21s | where they pull the door handle on the inside and there's a motion detector or a second badge reader 1212.21s - 1217.01s | or a push button. Again, if you're going to use a badge reader to exit, make sure you have a way to 1217.01s - 1221.81s | get out. Typically you get one of those plastic covers that you rip off and pull the handle and 1221.81s - 1226.45s | they'll let you out while also setting off an alarm. That's what that's for is so that you can 1226.45s - 1232.69s | get out in case of a fire and you don't happen to have your badge. A little bit about badges 1232.69s - 1237.17s | and readers. So, you know, badges come in multiple sizes and shapes, you know, you got the fobs, you 1237.17s - 1241.65s | got the smart card readers. If you're from the 80s, you got mag stripe cards, like there's all kinds. 1242.45s - 1247.33s | Additional factors, biometrics and pin entry. This thing here is called a scramble pad. It's cool 1247.33s - 1250.53s | every time you hit the button, all the numbers are in a different order so people watch you put 1250.53s - 1256.77s | your pin in and they still can't figure out what it is. The badges, the most common types of badges, 1257.41s - 1263.81s | 125 kilohertz prox, that's what your gym gives you. 1356 megahertz I-class are what you typically 1263.81s - 1269.97s | get in an office situation. They're pretty trivially broken and clonable. The MyFairDes 1269.97s - 1275.17s | fire and the COs are not broken directly but there are downgrade attacks on those. 1276.13s - 1284.21s | Prox and I-class, they have a facility code and a badge ID in a 26-bit format. The facility code 1284.21s - 1291.09s | is 0 to 255 and you can buy any badges from eBay or any other vendor with whatever 1293.33s - 1297.89s | facility code that you want. So, for instance, most of the places that I've worked, 1297.89s - 1304.45s | for whatever reason, and this is Texas, California, Utah, the code


chunk_text:
1247.33s | Additional factors, biometrics and pin entry. This thing here is called a scramble pad. It's cool 1247.33s - 1250.53s | every time you hit the button, all the numbers are in a different order so people watch you put 1250.53s - 1256.77s | your pin in and they still can't figure out what it is. The badges, the most common types of badges, 1257.41s - 1263.81s | 125 kilohertz prox, that's what your gym gives you. 1356 megahertz I-class are what you typically 1263.81s - 1269.97s | get in an office situation. They're pretty trivially broken and clonable. The MyFairDes 1269.97s - 1275.17s | fire and the COs are not broken directly but there are downgrade attacks on those. 1276.13s - 1284.21s | Prox and I-class, they have a facility code and a badge ID in a 26-bit format. The facility code 1284.21s - 1291.09s | is 0 to 255 and you can buy any badges from eBay or any other vendor with whatever 1293.33s - 1297.89s | facility code that you want. So, for instance, most of the places that I've worked, 1297.89s - 1304.45s | for whatever reason, and this is Texas, California, Utah, the code 132 is the most 1304.45s - 1310.21s | common facility code. I have no idea why but if you bought a batch of 132 codes or cards from 1311.09s - 1317.17s | eBay and just walked up to a random building, you have a fair chance of getting in. 1317.89s - 1323.41s | Again, the 26-bit prox and I-class is pretty trivial. Any compatible reader can 1323.41s - 1329.25s | read it. So you can just go buy an HID reader off of eBay, attach it to an ESP32, 1330.13s - 1332.85s | touch your badge to it, it'll give you the facility code and the badge number. 1333.73s - 1339.81s | You can also do portable readers. I know we've had talks about, you know, the clipboard thing 1339.81s - 1344.69s | where you put a badge reader in your clipboard and you just read people's badges with it. 1346.05s - 1351.65s | So the solution is custom badges. Like I said, there are, there's the MyFair ones. I've never 1351.65s - 1358.53s | used those. I've only used the HIDs. So they have a format, excuse me, a format called HID 1358.53s - 1364.53s | Corporate 1000. It's


chunk_text:
132 is the most 1304.45s - 1310.21s | common facility code. I have no idea why but if you bought a batch of 132 codes or cards from 1311.09s - 1317.17s | eBay and just walked up to a random building, you have a fair chance of getting in. 1317.89s - 1323.41s | Again, the 26-bit prox and I-class is pretty trivial. Any compatible reader can 1323.41s - 1329.25s | read it. So you can just go buy an HID reader off of eBay, attach it to an ESP32, 1330.13s - 1332.85s | touch your badge to it, it'll give you the facility code and the badge number. 1333.73s - 1339.81s | You can also do portable readers. I know we've had talks about, you know, the clipboard thing 1339.81s - 1344.69s | where you put a badge reader in your clipboard and you just read people's badges with it. 1346.05s - 1351.65s | So the solution is custom badges. Like I said, there are, there's the MyFair ones. I've never 1351.65s - 1358.53s | used those. I've only used the HIDs. So they have a format, excuse me, a format called HID 1358.53s - 1364.53s | Corporate 1000. It's CO's protected, so it's more secure. It has a dedicated facility code. 1364.53s - 1368.45s | When you sign up, your company gets its own facility code because there's millions of 1368.45s - 1373.33s | possibilities. And then only you can order more cards with that particular facility code. 1373.33s - 1378.85s | They use a 48-bit format. So for each facility code, you can have 8.3 million badge numbers, 1378.85s - 1383.17s | which is cool because you can pick a number in the high range and not worry about if you acquire 1383.17s - 1391.57s | another company, those badge numbers coinciding with somebody else's. I'm going to warp through 1391.57s - 1396.13s | this real quick because my time's out. Make sure you disable older formats on your readers. That's 1396.13s - 1402.29s | the downgraded. Badge reader communications weakens the low speed protocol from 1975. 1402.77s - 1411.57s | The mitigation is called OSDP. OSDP has very few compromises that are pretty easy to avoid. 1412.13s - 1419.49s | The biggest problem with OSDP is that 84% of installers never or seldom use it. So it's almost 1419.49s - 1427.25s | never used these. And this


chunk_text:
CO's protected, so it's more secure. It has a dedicated facility code. 1364.53s - 1368.45s | When you sign up, your company gets its own facility code because there's millions of 1368.45s - 1373.33s | possibilities. And then only you can order more cards with that particular facility code. 1373.33s - 1378.85s | They use a 48-bit format. So for each facility code, you can have 8.3 million badge numbers, 1378.85s - 1383.17s | which is cool because you can pick a number in the high range and not worry about if you acquire 1383.17s - 1391.57s | another company, those badge numbers coinciding with somebody else's. I'm going to warp through 1391.57s - 1396.13s | this real quick because my time's out. Make sure you disable older formats on your readers. That's 1396.13s - 1402.29s | the downgraded. Badge reader communications weakens the low speed protocol from 1975. 1402.77s - 1411.57s | The mitigation is called OSDP. OSDP has very few compromises that are pretty easy to avoid. 1412.13s - 1419.49s | The biggest problem with OSDP is that 84% of installers never or seldom use it. So it's almost 1419.49s - 1427.25s | never used these. And this is from 2015. So what else should I do? Test your regulars. Yeah, test 1427.25s - 1432.77s | your readers regularly. Set up alerts in your software. Again, so many people have software and 1432.77s - 1436.93s | they've never set up alerts in it. Document everything. I put a sticker on the bottom of 1436.93s - 1441.25s | every reader that has a number and I match that number to my access control system. So when they 1441.25s - 1447.41s | say reader number 24 is not working, I can just go fix it. Check your batteries. Batteries die. 1447.41s - 1453.01s | They don't do you any good. Audit your user list regularly and then come visit us in the physical 1453.01s - 1455.89s | security village. I'm actually going to be volunteering over there right after this if 1455.89s - 1460.37s | you have any questions for me. Thank you very much.


chunk_text:
is from 2015. So what else should I do? Test your regulars. Yeah, test 1427.25s - 1432.77s | your readers regularly. Set up alerts in your software. Again, so many people have software and 1432.77s - 1436.93s | they've never set up alerts in it. Document everything. I put a sticker on the bottom of 1436.93s - 1441.25s | every reader that has a number and I match that number to my access control system. So when they 1441.25s - 1447.41s | say reader number 24 is not working, I can just go fix it. Check your batteries. Batteries die. 1447.41s - 1453.01s | They don't do you any good. Audit your user list regularly and then come visit us in the physical 1453.01s - 1455.89s | security village. I'm actually going to be volunteering over there right after this if 1455.89s - 1460.37s | you have any questions for me. Thank you very much.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=YvqWlZK_fks", "title": "DEF CON 32 - 3DU Homo ex Machina - Lacey Harbour", "description": "The future of healthcare is precise, personalized, and involves point of care with a wide variety of applications. Each application has its own unique set of challenges that change based on risk and the stakeholders\u2019 perspective. Foreseeing these challenges, in 2021 FDA issued the discussion paper 3D Printing Medical Devices at the Point of Care to expound upon pertinent challenges and request stakeholder feedback. Within this paper, the concept of the 3D Printing medical device production system (MDPS) as a medical device was presented. In this session, we will investigate the concept of the MDPS from the perspective of different stakeholders, the necessity of AI to make this in-hospital MDPS POC solution a reality, and the unique relationship the MDM and HDO must have to support the MDPS.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1423, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 2.16s | This text was transcribed using whisper model: large-v2 Hi, everyone. 2.16s - 5.32s | Thank you so much for coming to my talk. 5.32s - 7.76s | If you'd like to, I have some detailed slides. 7.76s - 10.28s | So if you'd like to get into those details, 10.28s - 12.08s | please feel free to click the QR code. 12.08s - 13.64s | I promise it's safe. 13.64s - 16.88s | I don't know how to make it not safe. 16.88s - 20.36s | And follow along for your use. 20.36s - 21.76s | My name is Lacey Harbour. 21.76s - 24.40s | I have a background in molecular biology, 24.40s - 27.00s | but fell, unfortunately or fortunately, 27.00s - 30.04s | into regulatory and quality and clinical studies. 30.04s - 34.48s | And today, I want to present some ideas to everyone 34.48s - 39.28s | here about how medical devices are being made 39.28s - 41.84s | and how they're going to be made in the future. 41.84s - 44.32s | And during this process, I'm going 44.32s - 46.54s | to highlight some areas of concern 46.54s - 50.60s | that is particularly applicable to our cybersecurity partners 50.60s - 54.24s | and how we're not really ready for the future 54.24s - 58.12s | of the medical device world. 58.12s - 63.56s | So it goes without saying that AI is changing everything. 63.56s


chunk_text:
if you'd like to get into those details, 10.28s - 12.08s | please feel free to click the QR code. 12.08s - 13.64s | I promise it's safe. 13.64s - 16.88s | I don't know how to make it not safe. 16.88s - 20.36s | And follow along for your use. 20.36s - 21.76s | My name is Lacey Harbour. 21.76s - 24.40s | I have a background in molecular biology, 24.40s - 27.00s | but fell, unfortunately or fortunately, 27.00s - 30.04s | into regulatory and quality and clinical studies. 30.04s - 34.48s | And today, I want to present some ideas to everyone 34.48s - 39.28s | here about how medical devices are being made 39.28s - 41.84s | and how they're going to be made in the future. 41.84s - 44.32s | And during this process, I'm going 44.32s - 46.54s | to highlight some areas of concern 46.54s - 50.60s | that is particularly applicable to our cybersecurity partners 50.60s - 54.24s | and how we're not really ready for the future 54.24s - 58.12s | of the medical device world. 58.12s - 63.56s | So it goes without saying that AI is changing everything. 63.56s - 68.12s | AI is particularly changing the health care ecosystem. 68.12s - 73.68s | And this is a good thing for us because us as a population, 73.68s - 74.92s | we're aging. 74.92s - 77.72s | And our population isn't growing with new members 77.72s - 79.88s | as much as it used to. 79.88s - 85.20s | With that, we're going to need a new point of care, new care, 85.20s - 87.64s | standard of care treatments. 87.64s - 91.80s | And that's not going to be doable without AI. 91.80s - 96.24s | So AI, being integrated into the products 96.24s - 98.68s | are changing the scope of these products. 98.68s - 100.60s | And my world is regulatory. 100.60s - 103.84s | We like to bucket products into regulated and unregulated 103.84s - 104.64s | product. 104.64s - 106.98s | You can have the exact same instrument or device 106.98s - 108.12s | or whatever. 108.12s - 110.28s | And if you define it to be intended 110.28s - 112.28s | for a medical purpose like diagnosis, 112.28s - 113.24s | it's a medical device. 113.24s - 115.28s | So you have all


chunk_text:
- 68.12s | AI is particularly changing the health care ecosystem. 68.12s - 73.68s | And this is a good thing for us because us as a population, 73.68s - 74.92s | we're aging. 74.92s - 77.72s | And our population isn't growing with new members 77.72s - 79.88s | as much as it used to. 79.88s - 85.20s | With that, we're going to need a new point of care, new care, 85.20s - 87.64s | standard of care treatments. 87.64s - 91.80s | And that's not going to be doable without AI. 91.80s - 96.24s | So AI, being integrated into the products 96.24s - 98.68s | are changing the scope of these products. 98.68s - 100.60s | And my world is regulatory. 100.60s - 103.84s | We like to bucket products into regulated and unregulated 103.84s - 104.64s | product. 104.64s - 106.98s | You can have the exact same instrument or device 106.98s - 108.12s | or whatever. 108.12s - 110.28s | And if you define it to be intended 110.28s - 112.28s | for a medical purpose like diagnosis, 112.28s - 113.24s | it's a medical device. 113.24s - 115.28s | So you have all these controls in place 115.28s - 118.80s | to deal with that product, to develop it, to manage it, 118.80s - 120.84s | to monitor it. 120.84s - 123.32s | But if it's not a medical device, 123.32s - 124.80s | then you don't have to monitor it 124.80s - 126.64s | to the same level of scrutiny. 126.64s - 132.01s | And that can be a concern. 132.01s - 136.61s | So when something is called a medical device, 136.61s - 138.69s | particularly in the US, it's all depending 138.69s - 141.25s | on its intended use. 141.25s - 144.53s | Now, with the ecosystem changing, 144.53s - 146.25s | with the scope of the products changing, 146.25s - 148.49s | the intended use is not just the only thing 148.49s - 151.53s | we need to be worried about or be mindful of. 151.53s - 154.85s | We need to be mindful of how it's being used in the health 154.85s - 158.21s | care system, what data sources and attributes it's 158.21s - 160.25s | plugging into. 160.25s - 161.57s | Who are the end users? 161.57s - 163.25s | It's not just the physician anymore.


chunk_text:
these controls in place 115.28s - 118.80s | to deal with that product, to develop it, to manage it, 118.80s - 120.84s | to monitor it. 120.84s - 123.32s | But if it's not a medical device, 123.32s - 124.80s | then you don't have to monitor it 124.80s - 126.64s | to the same level of scrutiny. 126.64s - 132.01s | And that can be a concern. 132.01s - 136.61s | So when something is called a medical device, 136.61s - 138.69s | particularly in the US, it's all depending 138.69s - 141.25s | on its intended use. 141.25s - 144.53s | Now, with the ecosystem changing, 144.53s - 146.25s | with the scope of the products changing, 146.25s - 148.49s | the intended use is not just the only thing 148.49s - 151.53s | we need to be worried about or be mindful of. 151.53s - 154.85s | We need to be mindful of how it's being used in the health 154.85s - 158.21s | care system, what data sources and attributes it's 158.21s - 160.25s | plugging into. 160.25s - 161.57s | Who are the end users? 161.57s - 163.25s | It's not just the physician anymore. 163.25s - 164.77s | There's different voice of customers 164.77s - 166.81s | that need to be paid attention to, 166.85s - 168.73s | especially when you're building a product that 168.73s - 172.97s | should be secure and safe and effective 172.97s - 179.25s | across the entire use and its entire ecosystem. 179.25s - 181.89s | In the past, I used to have to be worried just 181.89s - 184.61s | about the FDA in the US market. 184.61s - 187.81s | Now, I have to be mindful of all of these entities, 187.81s - 191.81s | these regulatory entities that are listed on the screen. 191.81s - 195.05s | And that's just the US market. 195.05s - 196.89s | I'm part of an FDA collaborative community. 196.89s - 199.05s | I'm one of the co-leaders of it. 199.05s - 203.61s | And we have an NLP that just scans the internet, 203.61s - 207.09s | picking up sources that we've deemed reliable, 207.09s - 210.17s | and allowing us to analyze all these global sources 210.17s - 212.57s | into a one-stop shop. 212.57s - 214.89s | Within this year alone, there have 214.89s - 219.49s |


chunk_text:
163.25s - 164.77s | There's different voice of customers 164.77s - 166.81s | that need to be paid attention to, 166.85s - 168.73s | especially when you're building a product that 168.73s - 172.97s | should be secure and safe and effective 172.97s - 179.25s | across the entire use and its entire ecosystem. 179.25s - 181.89s | In the past, I used to have to be worried just 181.89s - 184.61s | about the FDA in the US market. 184.61s - 187.81s | Now, I have to be mindful of all of these entities, 187.81s - 191.81s | these regulatory entities that are listed on the screen. 191.81s - 195.05s | And that's just the US market. 195.05s - 196.89s | I'm part of an FDA collaborative community. 196.89s - 199.05s | I'm one of the co-leaders of it. 199.05s - 203.61s | And we have an NLP that just scans the internet, 203.61s - 207.09s | picking up sources that we've deemed reliable, 207.09s - 210.17s | and allowing us to analyze all these global sources 210.17s - 212.57s | into a one-stop shop. 212.57s - 214.89s | Within this year alone, there have 214.89s - 219.49s | been 85 sources or materials that we, 219.49s - 221.21s | as a regulatory equality partners, 221.21s - 224.61s | must analyze and communicate to our companies 224.65s - 226.25s | to take action upon. 226.25s - 228.21s | And I don't know if you really appreciate 228.21s - 231.61s | how much freaking work that is and how damn near impossible 231.61s - 234.61s | that is, because not only do I have to analyze it, 234.61s - 237.57s | and then I have to teach the executives this information, 237.57s - 240.41s | then I have to get buy-in that they need to update procedures 240.41s - 241.49s | and policies. 241.49s - 243.41s | We have to do a business risk impact 243.41s - 246.05s | and see how much it just keeps going and going and going. 246.05s - 249.09s | Ultimately, you have to train the people 249.09s - 251.57s | within the manufacturing line even what they can and cannot 251.57s - 252.09s | do. 252.09s - 253.93s | This is a huge task. 253.93s - 255.77s | And of course, it's going to be easier 255.77s - 259.65s | based on the size


chunk_text:
been 85 sources or materials that we, 219.49s - 221.21s | as a regulatory equality partners, 221.21s - 224.61s | must analyze and communicate to our companies 224.65s - 226.25s | to take action upon. 226.25s - 228.21s | And I don't know if you really appreciate 228.21s - 231.61s | how much freaking work that is and how damn near impossible 231.61s - 234.61s | that is, because not only do I have to analyze it, 234.61s - 237.57s | and then I have to teach the executives this information, 237.57s - 240.41s | then I have to get buy-in that they need to update procedures 240.41s - 241.49s | and policies. 241.49s - 243.41s | We have to do a business risk impact 243.41s - 246.05s | and see how much it just keeps going and going and going. 246.05s - 249.09s | Ultimately, you have to train the people 249.09s - 251.57s | within the manufacturing line even what they can and cannot 251.57s - 252.09s | do. 252.09s - 253.93s | This is a huge task. 253.93s - 255.77s | And of course, it's going to be easier 255.77s - 259.65s | based on the size of your company, or maybe not. 259.65s - 263.61s | Each company has their own problems with this. 263.61s - 267.05s | It's not just the regulatory ecosystem. 267.05s - 270.05s | It's also the relationship with our customers. 270.05s - 272.89s | So as medical device manufacturers, 272.89s - 276.21s | you always think the customer is the physician or the patient. 276.21s - 278.09s | But that's not always the case. 278.09s - 281.17s | We are plugging in our products into health delivery 281.17s - 282.13s | organizations. 282.49s - 285.97s | And they have to navigate their own set of regulations. 285.97s - 288.57s | And they have their requirements. 288.57s - 291.01s | And so we have to make sure that our products interact 291.01s - 292.41s | with that. 292.41s - 294.73s | Also, with the future of these products, 294.73s - 298.69s | again, AI enablement is a really data-hungry process, 298.69s - 300.73s | no matter where it's plugged into. 300.73s - 302.29s | And who owns the data? 302.29s - 305.09s | Well, the EHR companies like Epic. 305.09s - 307.37s | You think they want to share that data with


chunk_text:
of your company, or maybe not. 259.65s - 263.61s | Each company has their own problems with this. 263.61s - 267.05s | It's not just the regulatory ecosystem. 267.05s - 270.05s | It's also the relationship with our customers. 270.05s - 272.89s | So as medical device manufacturers, 272.89s - 276.21s | you always think the customer is the physician or the patient. 276.21s - 278.09s | But that's not always the case. 278.09s - 281.17s | We are plugging in our products into health delivery 281.17s - 282.13s | organizations. 282.49s - 285.97s | And they have to navigate their own set of regulations. 285.97s - 288.57s | And they have their requirements. 288.57s - 291.01s | And so we have to make sure that our products interact 291.01s - 292.41s | with that. 292.41s - 294.73s | Also, with the future of these products, 294.73s - 298.69s | again, AI enablement is a really data-hungry process, 298.69s - 300.73s | no matter where it's plugged into. 300.73s - 302.29s | And who owns the data? 302.29s - 305.09s | Well, the EHR companies like Epic. 305.09s - 307.37s | You think they want to share that data with the medical 307.37s - 310.97s | device manufacturers so that we can have good quality outputs? 310.97s - 312.29s | Not necessarily. 312.29s - 314.49s | So we have to build those relationships 314.49s - 317.05s | with the medical device manufacturers, the EMR, 317.05s - 319.41s | and any other applications that are 319.41s - 325.49s | plugging in to the hospital delivery organization, or HDOs. 325.49s - 327.57s | So FDA is seeing this. 327.57s - 332.37s | And they're not the only agency globally 332.37s - 333.85s | that's really making progress. 333.85s - 336.45s | But they are really being public about it. 336.45s - 337.29s | And it's accessible. 337.29s - 339.85s | Any of you guys can go on the FDA website 339.85s - 341.53s | and see all sorts of initiatives 341.53s - 344.81s | that they're putting into place to make sure 344.81s - 346.21s | that the public is being heard. 346.21s - 348.25s | And they're actually engaging patients, even. 348.25s - 351.05s | They're really paying attention to the voice of customer 351.05s - 353.61s | and how these products are truly used. 353.61s - 359.13s | For example,


chunk_text:
the medical 307.37s - 310.97s | device manufacturers so that we can have good quality outputs? 310.97s - 312.29s | Not necessarily. 312.29s - 314.49s | So we have to build those relationships 314.49s - 317.05s | with the medical device manufacturers, the EMR, 317.05s - 319.41s | and any other applications that are 319.41s - 325.49s | plugging in to the hospital delivery organization, or HDOs. 325.49s - 327.57s | So FDA is seeing this. 327.57s - 332.37s | And they're not the only agency globally 332.37s - 333.85s | that's really making progress. 333.85s - 336.45s | But they are really being public about it. 336.45s - 337.29s | And it's accessible. 337.29s - 339.85s | Any of you guys can go on the FDA website 339.85s - 341.53s | and see all sorts of initiatives 341.53s - 344.81s | that they're putting into place to make sure 344.81s - 346.21s | that the public is being heard. 346.21s - 348.25s | And they're actually engaging patients, even. 348.25s - 351.05s | They're really paying attention to the voice of customer 351.05s - 353.61s | and how these products are truly used. 353.61s - 359.13s | For example, they'll even ask about the workflow 359.13s - 361.89s | in a laboratory, even. 361.89s - 364.65s | And so I highly recommend and encourage everyone 364.65s - 366.97s | to go check out these resources. 366.97s - 369.53s | But when the FDA is, in particular, 369.53s - 371.77s | and they're working with an international group called 371.77s - 376.29s | the IMDRF, when the FDA is hearing and seeing 376.29s - 380.89s | where the industry is going, they're 380.89s - 384.41s | trying to grow along with industry 384.41s - 387.49s | so that they're not holding us back. 387.49s - 389.85s | And one particular use case I'm going to talk to you guys 389.85s - 392.61s | about today is called the medical device production 392.61s - 394.77s | system. 394.77s - 399.13s | But before I can get into this future device, essentially, 399.13s - 402.69s | I want to level set everybody. 402.69s - 407.81s | Who's here familiar with the total product lifecycle? 407.81s - 409.53s | I have a handful of people. 409.53s - 412.53s | All right, so the total product lifecycle 412.53s - 415.13s | is basically the


chunk_text:
they'll even ask about the workflow 359.13s - 361.89s | in a laboratory, even. 361.89s - 364.65s | And so I highly recommend and encourage everyone 364.65s - 366.97s | to go check out these resources. 366.97s - 369.53s | But when the FDA is, in particular, 369.53s - 371.77s | and they're working with an international group called 371.77s - 376.29s | the IMDRF, when the FDA is hearing and seeing 376.29s - 380.89s | where the industry is going, they're 380.89s - 384.41s | trying to grow along with industry 384.41s - 387.49s | so that they're not holding us back. 387.49s - 389.85s | And one particular use case I'm going to talk to you guys 389.85s - 392.61s | about today is called the medical device production 392.61s - 394.77s | system. 394.77s - 399.13s | But before I can get into this future device, essentially, 399.13s - 402.69s | I want to level set everybody. 402.69s - 407.81s | Who's here familiar with the total product lifecycle? 407.81s - 409.53s | I have a handful of people. 409.53s - 412.53s | All right, so the total product lifecycle 412.53s - 415.13s | is basically the inception of a product 415.13s - 418.57s | all the way to the end of life of a product. 418.57s - 422.69s | And so I put together here a representation 422.69s - 425.65s | of any kind of QMS or quality management system 425.65s - 428.33s | that represents a total product lifecycle. 428.33s - 429.69s | And it looks like a cell. 429.69s - 433.57s | And maybe the biologist is being a little biased in me, 433.57s - 435.77s | but it really is like feedback loops, 435.77s - 437.53s | like what you get in a cellular function. 437.53s - 440.81s | So you could break it down, in my mind, 440.81s - 443.73s | a total product lifecycle into design controls, production 443.73s - 445.65s | and process controls, and then there's 445.65s - 447.11s | feedback loops for improvements. 447.11s - 449.77s | And any of those improvements could be failure on the field. 449.77s - 452.41s | It could be a non-conformance from a manufacturing line. 452.41s - 453.97s | It could be a corrective action that's 453.97s - 457.89s | discovered from anything else or regulatory updates. 457.93s - 462.61s | But


chunk_text:
inception of a product 415.13s - 418.57s | all the way to the end of life of a product. 418.57s - 422.69s | And so I put together here a representation 422.69s - 425.65s | of any kind of QMS or quality management system 425.65s - 428.33s | that represents a total product lifecycle. 428.33s - 429.69s | And it looks like a cell. 429.69s - 433.57s | And maybe the biologist is being a little biased in me, 433.57s - 435.77s | but it really is like feedback loops, 435.77s - 437.53s | like what you get in a cellular function. 437.53s - 440.81s | So you could break it down, in my mind, 440.81s - 443.73s | a total product lifecycle into design controls, production 443.73s - 445.65s | and process controls, and then there's 445.65s - 447.11s | feedback loops for improvements. 447.11s - 449.77s | And any of those improvements could be failure on the field. 449.77s - 452.41s | It could be a non-conformance from a manufacturing line. 452.41s - 453.97s | It could be a corrective action that's 453.97s - 457.89s | discovered from anything else or regulatory updates. 457.93s - 462.61s | But this is too complicated to really talk about and use. 462.61s - 467.01s | So I further simplified the total product lifecycle 467.01s - 470.45s | schema into these two basic buckets. 470.45s - 473.33s | So you can see where I have the QMS, 473.33s - 477.41s | and then I've broken it down to design controls and production 477.41s - 481.57s | and process controls, where you have a prototype of a device. 481.57s - 484.81s | It can be a digital device or a cyber device, 484.81s - 486.65s | as they call it in the US. 486.65s - 492.33s | It could be a tongue depressor, depending on the classification. 492.33s - 497.13s | But say that you have the prototype. 497.13s - 498.09s | You test it. 498.09s - 499.29s | Hey, it's good. 499.29s - 503.29s | I'm going to now scale up and manufacture this. 503.29s - 506.45s | So then you transfer it to manufacturing. 506.45s - 507.05s | You test it. 507.05s - 508.73s | Hey, the manufacturing is working well. 508.73s - 512.69s | Now we can actually start mass-producing these products. 512.69s - 515.85s | And then you manufacture,


chunk_text:
this is too complicated to really talk about and use. 462.61s - 467.01s | So I further simplified the total product lifecycle 467.01s - 470.45s | schema into these two basic buckets. 470.45s - 473.33s | So you can see where I have the QMS, 473.33s - 477.41s | and then I've broken it down to design controls and production 477.41s - 481.57s | and process controls, where you have a prototype of a device. 481.57s - 484.81s | It can be a digital device or a cyber device, 484.81s - 486.65s | as they call it in the US. 486.65s - 492.33s | It could be a tongue depressor, depending on the classification. 492.33s - 497.13s | But say that you have the prototype. 497.13s - 498.09s | You test it. 498.09s - 499.29s | Hey, it's good. 499.29s - 503.29s | I'm going to now scale up and manufacture this. 503.29s - 506.45s | So then you transfer it to manufacturing. 506.45s - 507.05s | You test it. 507.05s - 508.73s | Hey, the manufacturing is working well. 508.73s - 512.69s | Now we can actually start mass-producing these products. 512.69s - 515.85s | And then you manufacture, and then you test it again. 515.85s - 519.01s | And then finally, if they match all the quality control or QC 519.01s - 521.73s | checks, that device is released out into the wild, 521.73s - 524.05s | or software, or whatever. 524.05s - 526.45s | Within each of these steps, there's feedback loops. 526.45s - 529.69s | So something bad can happen during this process 529.69s - 533.53s | to kick you all the way back to design of feasibility 533.53s - 536.01s | and design phase. 536.01s - 538.05s | But at the end of the day, the take-home message 538.05s - 541.45s | is the output, the final device, is 541.45s - 543.65s | from that whole end-to-end total product 543.65s - 547.79s | lifecycle within the QMS. 547.79s - 550.99s | So now that I've kind of given you 550.99s - 555.27s | a very high level of the basics of what currently exists, 555.27s - 557.35s | let's talk about the future. 557.35s - 562.47s | The future of our products are going to be precise. 562.47s - 563.75s | It's going to be personalized. 563.75s - 565.79s | It's going to be at


chunk_text:
and then you test it again. 515.85s - 519.01s | And then finally, if they match all the quality control or QC 519.01s - 521.73s | checks, that device is released out into the wild, 521.73s - 524.05s | or software, or whatever. 524.05s - 526.45s | Within each of these steps, there's feedback loops. 526.45s - 529.69s | So something bad can happen during this process 529.69s - 533.53s | to kick you all the way back to design of feasibility 533.53s - 536.01s | and design phase. 536.01s - 538.05s | But at the end of the day, the take-home message 538.05s - 541.45s | is the output, the final device, is 541.45s - 543.65s | from that whole end-to-end total product 543.65s - 547.79s | lifecycle within the QMS. 547.79s - 550.99s | So now that I've kind of given you 550.99s - 555.27s | a very high level of the basics of what currently exists, 555.27s - 557.35s | let's talk about the future. 557.35s - 562.47s | The future of our products are going to be precise. 562.47s - 563.75s | It's going to be personalized. 563.75s - 565.79s | It's going to be at the point of care. 565.79s - 569.95s | And there are several different industries, and sectors, 569.95s - 573.03s | and technologies that are helping pushing 573.03s - 577.03s | our standard of care practice to this point. 577.03s - 582.99s | But the orthopedic sector has really 582.99s - 586.67s | been leveraging the 3D printing technology 586.67s - 591.79s | to bring us closer to that precise, personalized, 591.79s - 593.67s | and point-of-care product. 593.67s - 597.47s | And I'm going to reintroduce the idea of a medical device 597.47s - 599.47s | production system to you. 599.47s - 602.91s | And so this isn't the only use case involved 603.79s - 608.11s | that does this, but these orthopedics, I guess because, 608.11s - 610.39s | I mean, to be honest, it's human carpentry. 610.39s - 614.07s | So the complexity isn't as much as maybe other devices. 614.07s - 616.75s | So they're moving at a very fast pace. 616.75s - 619.23s | And the FDA saw that, and so the IMDRF. 619.23s - 622.11s | So they've started to put together some loose guidelines 622.11s - 627.47s | to help lead this medical device


chunk_text:
the point of care. 565.79s - 569.95s | And there are several different industries, and sectors, 569.95s - 573.03s | and technologies that are helping pushing 573.03s - 577.03s | our standard of care practice to this point. 577.03s - 582.99s | But the orthopedic sector has really 582.99s - 586.67s | been leveraging the 3D printing technology 586.67s - 591.79s | to bring us closer to that precise, personalized, 591.79s - 593.67s | and point-of-care product. 593.67s - 597.47s | And I'm going to reintroduce the idea of a medical device 597.47s - 599.47s | production system to you. 599.47s - 602.91s | And so this isn't the only use case involved 603.79s - 608.11s | that does this, but these orthopedics, I guess because, 608.11s - 610.39s | I mean, to be honest, it's human carpentry. 610.39s - 614.07s | So the complexity isn't as much as maybe other devices. 614.07s - 616.75s | So they're moving at a very fast pace. 616.75s - 619.23s | And the FDA saw that, and so the IMDRF. 619.23s - 622.11s | So they've started to put together some loose guidelines 622.11s - 627.47s | to help lead this medical device production system. 627.47s - 631.51s | So what is the medical device production system, or MDPS? 631.51s - 635.47s | So let's go back, again, to the schema I showed you all before. 635.47s - 639.31s | Again, the output is a device, right? 639.31s - 642.75s | It's pretty simple, of a total product lifecycle of the QMS. 642.75s - 647.47s | Well, a medical production system turns that on its head. 647.47s - 652.83s | Now, the output, the device, isn't the final component. 652.83s - 655.63s | And this is a little hard to wrap your head around. 655.63s - 657.79s | It includes the manufacturing. 657.79s - 660.23s | It includes the design phase. 660.23s - 663.63s | So what happens is, I'm a medical device manufacturer, 663.63s - 667.07s | and I'm going to make a medical device production system, an MDPS. 667.07s - 672.47s | I'm going to design the production line just as I would before, 672.47s - 676.87s | except now I'm going to realize that this production system 676.87s - 681.35s | is going to be part of the device in the healthcare delivery organization. 681.35s - 685.59s | So there


chunk_text:
production system. 627.47s - 631.51s | So what is the medical device production system, or MDPS? 631.51s - 635.47s | So let's go back, again, to the schema I showed you all before. 635.47s - 639.31s | Again, the output is a device, right? 639.31s - 642.75s | It's pretty simple, of a total product lifecycle of the QMS. 642.75s - 647.47s | Well, a medical production system turns that on its head. 647.47s - 652.83s | Now, the output, the device, isn't the final component. 652.83s - 655.63s | And this is a little hard to wrap your head around. 655.63s - 657.79s | It includes the manufacturing. 657.79s - 660.23s | It includes the design phase. 660.23s - 663.63s | So what happens is, I'm a medical device manufacturer, 663.63s - 667.07s | and I'm going to make a medical device production system, an MDPS. 667.07s - 672.47s | I'm going to design the production line just as I would before, 672.47s - 676.87s | except now I'm going to realize that this production system 676.87s - 681.35s | is going to be part of the device in the healthcare delivery organization. 681.35s - 685.59s | So there will be manufacturing in the hospital. 685.59s - 689.35s | And then I will allow a certain range of scope 689.35s - 694.75s | or specs that can be allowed for the hospital to manufacture. 694.75s - 698.31s | And so from that end-to-end process, they can design the product, 698.31s - 703.31s | and they can manufacture it, and then the output is part of the entire device. 703.31s - 706.47s | The output alone is no longer the singular device. 706.47s - 712.07s | So if any of you are familiar with the quality system regulation, 712.07s - 715.51s | or 13485 standards, your wheels may be turning, 715.51s - 717.71s | like, how the hell do you control this? 717.71s - 720.07s | And that is a big question. 720.07s - 725.83s | But the precursors to this are existing right now. 725.83s - 733.07s | Here I have an image of some 3D-printed EBM joint implants made. 733.07s - 736.67s | They're called trabecular titanium, and they allow for bone engrowth. 736.67s - 738.99s | And they are all patient-matched. 738.99s - 742.95s | And these are printed in the hospital as we speak 742.95s -


chunk_text:
will be manufacturing in the hospital. 685.59s - 689.35s | And then I will allow a certain range of scope 689.35s - 694.75s | or specs that can be allowed for the hospital to manufacture. 694.75s - 698.31s | And so from that end-to-end process, they can design the product, 698.31s - 703.31s | and they can manufacture it, and then the output is part of the entire device. 703.31s - 706.47s | The output alone is no longer the singular device. 706.47s - 712.07s | So if any of you are familiar with the quality system regulation, 712.07s - 715.51s | or 13485 standards, your wheels may be turning, 715.51s - 717.71s | like, how the hell do you control this? 717.71s - 720.07s | And that is a big question. 720.07s - 725.83s | But the precursors to this are existing right now. 725.83s - 733.07s | Here I have an image of some 3D-printed EBM joint implants made. 733.07s - 736.67s | They're called trabecular titanium, and they allow for bone engrowth. 736.67s - 738.99s | And they are all patient-matched. 738.99s - 742.95s | And these are printed in the hospital as we speak 742.95s - 745.83s | from a medical device manufacturer. 745.83s - 752.99s | And so I'm going to kind of introduce at a high level this current process. 752.99s - 756.39s | And then we're going to talk about how this is going to become 756.39s - 759.43s | the medical device production system. 759.43s - 762.19s | So say I'm a patient. 762.19s - 765.23s | I have a really janked-up shoulder. 765.23s - 769.39s | And the physician says, hey, the standard products on the market, 769.39s - 770.83s | they're not going to work for you. 770.83s - 772.51s | We need to give you a custom device. 772.51s - 775.95s | So they're going to send me to get a fresh CT scan. 775.95s - 777.59s | I'm going to get my fresh CT scan. 777.59s - 782.03s | And that DICOM file is going to go to the radiologist, to the surgeons. 782.03s - 786.11s | And they're going to segment that file with the medical device 786.11s - 789.51s | manufacturer or the designer. 789.51s - 792.19s | They will identify the defects. 792.19s - 796.39s | And then they will agree on how the physician


chunk_text:
745.83s | from a medical device manufacturer. 745.83s - 752.99s | And so I'm going to kind of introduce at a high level this current process. 752.99s - 756.39s | And then we're going to talk about how this is going to become 756.39s - 759.43s | the medical device production system. 759.43s - 762.19s | So say I'm a patient. 762.19s - 765.23s | I have a really janked-up shoulder. 765.23s - 769.39s | And the physician says, hey, the standard products on the market, 769.39s - 770.83s | they're not going to work for you. 770.83s - 772.51s | We need to give you a custom device. 772.51s - 775.95s | So they're going to send me to get a fresh CT scan. 775.95s - 777.59s | I'm going to get my fresh CT scan. 777.59s - 782.03s | And that DICOM file is going to go to the radiologist, to the surgeons. 782.03s - 786.11s | And they're going to segment that file with the medical device 786.11s - 789.51s | manufacturer or the designer. 789.51s - 792.19s | They will identify the defects. 792.19s - 796.39s | And then they will agree on how the physician wants to approach it. 796.39s - 799.35s | So the physician is really close with the designer 799.35s - 802.51s | through this whole process. 802.51s - 807.39s | After they discuss it, the designer will then take that DICOM file 807.39s - 811.99s | and convert it to an STL file within a 3D CAD program like Magix 811.99s - 814.55s | or something similar to that. 814.55s - 819.19s | And then they will propose potential designs. 819.19s - 820.91s | And the designs don't come out of anywhere. 820.91s - 825.71s | It's based off of historical data, recall data from standard devices. 825.75s - 829.55s | But it'll be matching how the physician wants to perform the surgery 829.55s - 831.87s | and what the physician actually wants to do. 831.87s - 834.67s | And so there's a feedback loop there until the physician gives the green light. 834.67s - 838.19s | And then it is released. 838.19s - 840.67s | But just because you can design something 840.67s - 842.87s | doesn't mean you can actually print it. 842.87s - 847.07s | Within a 3D printer, there's XYZ zones. 847.07s - 849.43s | And each


chunk_text:
wants to approach it. 796.39s - 799.35s | So the physician is really close with the designer 799.35s - 802.51s | through this whole process. 802.51s - 807.39s | After they discuss it, the designer will then take that DICOM file 807.39s - 811.99s | and convert it to an STL file within a 3D CAD program like Magix 811.99s - 814.55s | or something similar to that. 814.55s - 819.19s | And then they will propose potential designs. 819.19s - 820.91s | And the designs don't come out of anywhere. 820.91s - 825.71s | It's based off of historical data, recall data from standard devices. 825.75s - 829.55s | But it'll be matching how the physician wants to perform the surgery 829.55s - 831.87s | and what the physician actually wants to do. 831.87s - 834.67s | And so there's a feedback loop there until the physician gives the green light. 834.67s - 838.19s | And then it is released. 838.19s - 840.67s | But just because you can design something 840.67s - 842.87s | doesn't mean you can actually print it. 842.87s - 847.07s | Within a 3D printer, there's XYZ zones. 847.07s - 849.43s | And each zone has a different behavior. 849.43s - 852.23s | It's their own animal. 852.23s - 856.59s | And so what happens is that the designer will give the STL file 856.59s - 858.87s | to the production engineer. 858.87s - 860.83s | And then they will convert it to a machine file 860.83s - 865.15s | and determine if it's possible to actually 3D print that geometry. 865.15s - 867.19s | And some of that may be tied to demand planning 867.19s - 871.35s | because you obviously, you'll have a large bed. 871.35s - 874.67s | And you may be printing more than one patient's devices at a time. 874.67s - 878.99s | And so you may have to strategize that. 878.99s - 882.27s | But it's not uncommon for that device to be kicked back to the physician, 882.27s - 887.43s | essentially, if the production engineer says, no, we can't do that. 887.43s - 892.35s | After it's printed, there are a lot of supports that need to be removed. 892.35s - 897.07s | And so typically, it's like a CNC or a saw that helps remove those products. 897.07s - 899.23s | And then it goes


chunk_text:
zone has a different behavior. 849.43s - 852.23s | It's their own animal. 852.23s - 856.59s | And so what happens is that the designer will give the STL file 856.59s - 858.87s | to the production engineer. 858.87s - 860.83s | And then they will convert it to a machine file 860.83s - 865.15s | and determine if it's possible to actually 3D print that geometry. 865.15s - 867.19s | And some of that may be tied to demand planning 867.19s - 871.35s | because you obviously, you'll have a large bed. 871.35s - 874.67s | And you may be printing more than one patient's devices at a time. 874.67s - 878.99s | And so you may have to strategize that. 878.99s - 882.27s | But it's not uncommon for that device to be kicked back to the physician, 882.27s - 887.43s | essentially, if the production engineer says, no, we can't do that. 887.43s - 892.35s | After it's printed, there are a lot of supports that need to be removed. 892.35s - 897.07s | And so typically, it's like a CNC or a saw that helps remove those products. 897.07s - 899.23s | And then it goes to a QC check. 899.23s - 903.91s | And the QC check is just not the outside dimension, but the inside integrity. 903.91s - 908.39s | These devices have to resist weight and movement. 908.39s - 912.59s | And so if there's any kind of flaw internally, that can cause device failure. 912.59s - 918.52s | So there's a lot of checks that have to be happened with QC samples. 918.52s - 923.48s | So what might be of interest is let's dissect a little bit more detail 923.48s - 928.32s | of the first half of that from the relationship of the health delivery 928.32s - 933.00s | organization and the medical device manufacturer. 933.00s - 937.00s | I'm not going to go into all the detail of every bit of the schema. 937.08s - 943.20s | But this is just a representation of what that data interaction might look like. 943.20s - 946.68s | But what I really want to highlight, and I see some of you shaking your head 946.68s - 950.64s | or maybe have some concerns, you might have noticed that there's something 950.64s - 951.80s | called a PACS server. 951.80s - 956.36s |


chunk_text:
to a QC check. 899.23s - 903.91s | And the QC check is just not the outside dimension, but the inside integrity. 903.91s - 908.39s | These devices have to resist weight and movement. 908.39s - 912.59s | And so if there's any kind of flaw internally, that can cause device failure. 912.59s - 918.52s | So there's a lot of checks that have to be happened with QC samples. 918.52s - 923.48s | So what might be of interest is let's dissect a little bit more detail 923.48s - 928.32s | of the first half of that from the relationship of the health delivery 928.32s - 933.00s | organization and the medical device manufacturer. 933.00s - 937.00s | I'm not going to go into all the detail of every bit of the schema. 937.08s - 943.20s | But this is just a representation of what that data interaction might look like. 943.20s - 946.68s | But what I really want to highlight, and I see some of you shaking your head 946.68s - 950.64s | or maybe have some concerns, you might have noticed that there's something 950.64s - 951.80s | called a PACS server. 951.80s - 956.36s | And that holds all of the DICOM data for pretty much everything. 956.36s - 959.80s | And how does that data get to the medical device manufacturer will depend 959.80s - 963.00s | on the relationship the medical device manufacturer has with the health 963.00s - 964.60s | delivery organization. 964.60s - 966.36s | It could be a nurse downloading it. 966.36s - 970.64s | It can be on a flash drive and handing it to the device manufacturer. 970.64s - 972.04s | It could be an email. 972.04s - 973.52s | It could be a CD. 973.52s - 980.08s | Or it could be connected directly into the medical device's server. 980.08s - 984.04s | The medical device manufacturer may have a software that sits on top of the PACS 984.04s - 990.16s | server, or they may have a relationship where they have access to the EMR. 990.16s - 992.92s | And now if they have access with the EMR, they have to have a relationship 992.92s - 993.64s | with the EMR. 993.64s - 1001.12s | So the problem is that I want to highlight is I just want to make a note 1001.12s - 1006.96s |


chunk_text:
And that holds all of the DICOM data for pretty much everything. 956.36s - 959.80s | And how does that data get to the medical device manufacturer will depend 959.80s - 963.00s | on the relationship the medical device manufacturer has with the health 963.00s - 964.60s | delivery organization. 964.60s - 966.36s | It could be a nurse downloading it. 966.36s - 970.64s | It can be on a flash drive and handing it to the device manufacturer. 970.64s - 972.04s | It could be an email. 972.04s - 973.52s | It could be a CD. 973.52s - 980.08s | Or it could be connected directly into the medical device's server. 980.08s - 984.04s | The medical device manufacturer may have a software that sits on top of the PACS 984.04s - 990.16s | server, or they may have a relationship where they have access to the EMR. 990.16s - 992.92s | And now if they have access with the EMR, they have to have a relationship 992.92s - 993.64s | with the EMR. 993.64s - 1001.12s | So the problem is that I want to highlight is I just want to make a note 1001.12s - 1006.96s | that medical device manufacturers are not HIPAA covered entities. 1006.96s - 1009.52s | And I'm just going to leave that there and let you kind of think 1009.52s - 1011.64s | on what that means. 1011.64s - 1022.44s | So once the design is considered safe, at least from a failure mode analysis 1022.48s - 1028.36s | perspective, then it goes back to the internally. 1028.36s - 1032.12s | So now we're completely inside the medical device manufacturer's side 1032.12s - 1035.24s | of the network. 1035.24s - 1039.04s | Many device manufacturers are moving forward to using what's called machine 1039.04s - 1040.60s | learning operations. 1040.60s - 1047.40s | And this is just a high-level example of how that can look within the network. 1047.40s - 1052.16s | You have the containers, of course, that are cross-talking with different 1052.16s - 1053.28s | instruments. 1053.28s - 1056.96s | And then you can also have these containers cross-talking with other 1056.96s - 1061.20s | systems, like your product lifecycle management system, your quality 1061.20s - 1067.84s | management system, or your ERPs, or even other sites, if you have multiple 1067.84s - 1069.56s | sites interacting. 1069.56s - 1072.16s


chunk_text:
that medical device manufacturers are not HIPAA covered entities. 1006.96s - 1009.52s | And I'm just going to leave that there and let you kind of think 1009.52s - 1011.64s | on what that means. 1011.64s - 1022.44s | So once the design is considered safe, at least from a failure mode analysis 1022.48s - 1028.36s | perspective, then it goes back to the internally. 1028.36s - 1032.12s | So now we're completely inside the medical device manufacturer's side 1032.12s - 1035.24s | of the network. 1035.24s - 1039.04s | Many device manufacturers are moving forward to using what's called machine 1039.04s - 1040.60s | learning operations. 1040.60s - 1047.40s | And this is just a high-level example of how that can look within the network. 1047.40s - 1052.16s | You have the containers, of course, that are cross-talking with different 1052.16s - 1053.28s | instruments. 1053.28s - 1056.96s | And then you can also have these containers cross-talking with other 1056.96s - 1061.20s | systems, like your product lifecycle management system, your quality 1061.20s - 1067.84s | management system, or your ERPs, or even other sites, if you have multiple 1067.84s - 1069.56s | sites interacting. 1069.56s - 1072.16s | And that's something that would be a goal for medical device manufacturers 1072.16s - 1075.84s | with MDPS, so that it'd be nice to have communications to see the success 1075.84s - 1081.84s | of the products across all of your deployed MDPSs. 1081.84s - 1089.28s | And so you can see here that there, again, you may be the design engineer. 1089.28s - 1091.44s | How did you get the data from the designer? 1091.44s - 1093.64s | Well, it could have been put up on a server. 1093.64s - 1098.08s | It could have been a flash drive handed to you, and you work on this product 1098.08s - 1102.32s | for the machine file, the machine planning, on your personal laptop or on 1102.32s - 1107.56s | your work laptop, because the data processing for this is quite substantial. 1107.56s - 1111.48s | And then how does that data get to the EBM in the first place? 1111.48s - 1113.40s | Again, it could be a flash drive. 1113.40s - 1116.92s | There's a lot of flash drives used in manufacturing, especially with smaller 1116.92s - 1119.72s | firms. 1119.72s - 1124.89s | So there's concerns


chunk_text:
| And that's something that would be a goal for medical device manufacturers 1072.16s - 1075.84s | with MDPS, so that it'd be nice to have communications to see the success 1075.84s - 1081.84s | of the products across all of your deployed MDPSs. 1081.84s - 1089.28s | And so you can see here that there, again, you may be the design engineer. 1089.28s - 1091.44s | How did you get the data from the designer? 1091.44s - 1093.64s | Well, it could have been put up on a server. 1093.64s - 1098.08s | It could have been a flash drive handed to you, and you work on this product 1098.08s - 1102.32s | for the machine file, the machine planning, on your personal laptop or on 1102.32s - 1107.56s | your work laptop, because the data processing for this is quite substantial. 1107.56s - 1111.48s | And then how does that data get to the EBM in the first place? 1111.48s - 1113.40s | Again, it could be a flash drive. 1113.40s - 1116.92s | There's a lot of flash drives used in manufacturing, especially with smaller 1116.92s - 1119.72s | firms. 1119.72s - 1124.89s | So there's concerns there. 1124.89s - 1126.25s | But this isn't MDPS. 1126.25s - 1130.49s | This whole workflow that I presented, it's precursor to MDPS. 1130.49s - 1131.81s | And it exists right now. 1131.81s - 1134.29s | Here are just some firms that are doing this right now. 1134.29s - 1136.73s | And this isn't even all of them. 1136.73s - 1140.49s | There's a lot of research going into how to get the MDPS. 1140.49s - 1144.57s | And so what is the MDPS? 1144.57s - 1149.73s | Well, just for simplicity purposes, think about that whole workflow 1149.73s - 1151.61s | and put it in a box. 1151.61s - 1153.17s | You get the CT scan. 1153.17s - 1155.73s | You plug that DICOM in this box. 1155.73s - 1159.69s | There might be people remote, like designers or even people 1159.69s - 1163.37s | monitoring the success of the instrument remotely. 1163.37s - 1168.53s | And the physician is working with some kind of software interface 1168.53s - 1171.89s | to say, hey, I want the design to look this way. 1171.89s - 1176.49s | And then they press Go, and out pops your final device. 1176.49s -


chunk_text:
there. 1124.89s - 1126.25s | But this isn't MDPS. 1126.25s - 1130.49s | This whole workflow that I presented, it's precursor to MDPS. 1130.49s - 1131.81s | And it exists right now. 1131.81s - 1134.29s | Here are just some firms that are doing this right now. 1134.29s - 1136.73s | And this isn't even all of them. 1136.73s - 1140.49s | There's a lot of research going into how to get the MDPS. 1140.49s - 1144.57s | And so what is the MDPS? 1144.57s - 1149.73s | Well, just for simplicity purposes, think about that whole workflow 1149.73s - 1151.61s | and put it in a box. 1151.61s - 1153.17s | You get the CT scan. 1153.17s - 1155.73s | You plug that DICOM in this box. 1155.73s - 1159.69s | There might be people remote, like designers or even people 1159.69s - 1163.37s | monitoring the success of the instrument remotely. 1163.37s - 1168.53s | And the physician is working with some kind of software interface 1168.53s - 1171.89s | to say, hey, I want the design to look this way. 1171.89s - 1176.49s | And then they press Go, and out pops your final device. 1176.49s - 1179.01s | Now, if anyone's familiar with 3D printing, 1179.01s - 1182.17s | the post-processing is going to be a problem for the future MDPS. 1182.17s - 1186.61s | But it's not going to be unattainable. 1186.61s - 1187.73s | We are working. 1187.73s - 1189.01s | Technology is being researched. 1189.01s - 1190.77s | Mineralization is being researched. 1190.77s - 1195.69s | This is not like it's going to be 50 years from now. 1195.69s - 1197.53s | What's going to make this even more powerful 1197.53s - 1201.65s | is that you're going to have feedback from the surgical suite into the MDPS. 1201.65s - 1203.77s | So you're going to get clinical outcomes. 1203.77s - 1206.45s | But again, to get that, you have to have the relationship 1206.45s - 1210.38s | with the medical device manufacturer. 1210.38s - 1214.86s | So AI is going to be necessary to do this. 1214.86s - 1218.54s | There's no way that you're not going to be able to have this without. 1218.54s - 1222.62s | So let's highlight some of the areas where AI is being researched even 1222.62s - 1225.10s | right now and where it's going to


chunk_text:
1179.01s | Now, if anyone's familiar with 3D printing, 1179.01s - 1182.17s | the post-processing is going to be a problem for the future MDPS. 1182.17s - 1186.61s | But it's not going to be unattainable. 1186.61s - 1187.73s | We are working. 1187.73s - 1189.01s | Technology is being researched. 1189.01s - 1190.77s | Mineralization is being researched. 1190.77s - 1195.69s | This is not like it's going to be 50 years from now. 1195.69s - 1197.53s | What's going to make this even more powerful 1197.53s - 1201.65s | is that you're going to have feedback from the surgical suite into the MDPS. 1201.65s - 1203.77s | So you're going to get clinical outcomes. 1203.77s - 1206.45s | But again, to get that, you have to have the relationship 1206.45s - 1210.38s | with the medical device manufacturer. 1210.38s - 1214.86s | So AI is going to be necessary to do this. 1214.86s - 1218.54s | There's no way that you're not going to be able to have this without. 1218.54s - 1222.62s | So let's highlight some of the areas where AI is being researched even 1222.62s - 1225.10s | right now and where it's going to be plugged into this MDPS. 1225.10s - 1227.62s | And I mean, if you look this up online, you're 1227.62s - 1231.50s | going to see a slew of papers because this is the low-hanging fruit. 1231.50s - 1235.18s | Again, human carpentry, everyone's going for this. 1235.18s - 1238.70s | First place, automatic segmentation. 1238.70s - 1242.70s | Have a mask, highlight the defect, give you recommendations on the defect. 1242.70s - 1246.78s | The radiologist, the surgeon, or whomever can look at that 1246.78s - 1249.02s | and give yes or no feedback. 1249.02s - 1254.86s | The next place is the design. 1254.86s - 1260.10s | You can have all of your data from your field feedback 1260.10s - 1262.70s | from the designs that exist that are standard 1262.70s - 1264.30s | to automatically generate design. 1264.30s - 1268.82s | And all the designer has to do is say go, no go. 1268.82s - 1271.34s | And the physician have their inputs as well. 1271.34s - 1274.46s | And you can use LLMs to generate the surgical technique, which 1274.46s - 1276.46s | is also considered part of the labeling, which 1276.46s - 1280.10s | is


