# MediaChunks

chunk_text:
1390.86s - 1392.70s | so they're kind of just mapping the whole world 1392.70s - 1394.78s | with their robot vacuums. 1394.78s - 1398.62s | There's also the HelloYiku traffic logs, 1398.62s - 1401.42s | which are, that's their voice assistant. 1401.46s - 1404.98s | So keeping track of what you say to your robot. 1404.98s - 1407.86s | So always keep in mind that if you're selling a used device 1407.86s - 1409.82s | that even if you factory reset it, 1409.82s - 1413.70s | there's a risk to your privacy. 1413.70s - 1417.50s | And additionally, Flashware leveling will always be a problem 1417.50s - 1419.10s | but that's for a different talk. 1420.02s - 1423.38s | So one of our big findings was that 1423.38s - 1427.22s | they did not configure their TLS properly. 1427.22s - 1429.14s | So the EchoVax home app 1429.14s - 1432.18s | mobile application correctly checks certificates, 1432.18s - 1435.78s | but the robot specific plugins don't always do that. 1435.78s - 1439.74s | So the plugins sometimes accept self-signed certificates, 1439.74s - 1443.30s | which is very risky to use on an insecure Wi-Fi network, 1443.30s - 1446.66s | like at an airport, hotel, or the DEF CON open Wi-Fi, 1446.66s - 1447.90s | please don't do that. 1448.90s - 1451.90s | There's no warning or error shown in the app. 1451.90s - 1456.90s | And this traffic will leak your authentication tokens 1456.98s - 1458.66s | and will allow the attacker to have access 1458.66s - 1461.18s | to your account for up to seven days 1461.18s - 1463.70s | and access to video feeds, like everything. 1464.82s - 1466.02s | Here's an example of the traffic 1466.02s - 1467.38s | that we were able to intercept. 1467.38s - 1472.02s | We've redacted the authentication token 1472.02s - 1473.74s | just for good measure. 1475.66s - 1477.82s | And additionally, they misconfigured TLS 1477.82s - 1480.18s | in their robots themselves as well. 1480.18s - 1481.98s | The MQTT and TLS connections, 1481.98s - 1484.90s | they accept self-signed certificates on some devices, 1485.86s - 1489.98s | which allows for man in the middle attacks 1490.02s - 1493.70s | and over the OTA updates can be injected. 1496.30s - 1498.98s | The tool that we use for this is CertMidim by Apple Oxman. 1498.98s - 1500.38s | It's highly


chunk_text:
at an airport, hotel, or the DEF CON open Wi-Fi, 1446.66s - 1447.90s | please don't do that. 1448.90s - 1451.90s | There's no warning or error shown in the app. 1451.90s - 1456.90s | And this traffic will leak your authentication tokens 1456.98s - 1458.66s | and will allow the attacker to have access 1458.66s - 1461.18s | to your account for up to seven days 1461.18s - 1463.70s | and access to video feeds, like everything. 1464.82s - 1466.02s | Here's an example of the traffic 1466.02s - 1467.38s | that we were able to intercept. 1467.38s - 1472.02s | We've redacted the authentication token 1472.02s - 1473.74s | just for good measure. 1475.66s - 1477.82s | And additionally, they misconfigured TLS 1477.82s - 1480.18s | in their robots themselves as well. 1480.18s - 1481.98s | The MQTT and TLS connections, 1481.98s - 1484.90s | they accept self-signed certificates on some devices, 1485.86s - 1489.98s | which allows for man in the middle attacks 1490.02s - 1493.70s | and over the OTA updates can be injected. 1496.30s - 1498.98s | The tool that we use for this is CertMidim by Apple Oxman. 1498.98s - 1500.38s | It's highly recommended. 1500.38s - 1503.63s | It's pretty fun. 1503.63s - 1506.07s | And this is partially one of the reasons 1506.07s - 1506.99s | why this is happening. 1506.99s - 1510.03s | They are running bash scripts from the robot 1510.03s - 1515.03s | with no check certificate on WGIT, not ideal. 1516.93s - 1519.19s | So another thing that we found was that 1519.75s - 1521.83s | the robots have audio warnings 1521.83s - 1523.91s | when the camera is accessed from the mobile app 1523.91s - 1527.27s | at the start of access and every five minutes afterwards, 1527.27s - 1528.75s | a sound file is played. 1529.67s - 1532.43s | So the problem is that local sound files 1532.43s - 1534.23s | are stored on the data partition, 1534.23s - 1537.39s | which isn't encrypted and can just generally be accessed. 1537.39s - 1540.07s | So the sound files can be deleted and replaced. 1541.71s - 1546.03s | So we can replace the warning audio with an empty file. 1546.03s - 1549.07s | So nothing will happen when you access the live video feed, 1549.95s - 1552.79s | we'll tell you why that's a huge problem in


chunk_text:
recommended. 1500.38s - 1503.63s | It's pretty fun. 1503.63s - 1506.07s | And this is partially one of the reasons 1506.07s - 1506.99s | why this is happening. 1506.99s - 1510.03s | They are running bash scripts from the robot 1510.03s - 1515.03s | with no check certificate on WGIT, not ideal. 1516.93s - 1519.19s | So another thing that we found was that 1519.75s - 1521.83s | the robots have audio warnings 1521.83s - 1523.91s | when the camera is accessed from the mobile app 1523.91s - 1527.27s | at the start of access and every five minutes afterwards, 1527.27s - 1528.75s | a sound file is played. 1529.67s - 1532.43s | So the problem is that local sound files 1532.43s - 1534.23s | are stored on the data partition, 1534.23s - 1537.39s | which isn't encrypted and can just generally be accessed. 1537.39s - 1540.07s | So the sound files can be deleted and replaced. 1541.71s - 1546.03s | So we can replace the warning audio with an empty file. 1546.03s - 1549.07s | So nothing will happen when you access the live video feed, 1549.95s - 1552.79s | we'll tell you why that's a huge problem in a second. 1552.79s - 1560.22s | So this finding was reported at CCC last year, 1560.54s - 1562.94s | but they fixed it and then we broke it again. 1562.94s - 1565.14s | So we're going to tell you about it again. 1565.14s - 1567.10s | So the app allows for live video 1567.10s - 1569.18s | and audio access on the robot. 1569.18s - 1572.42s | And this functionality is provided by AWS Kinesis. 1572.42s - 1574.98s | The owner and shared users of the EchoVax account 1574.98s - 1577.02s | can access this feature. 1577.02s - 1578.78s | It is protected by a pin 1578.82s - 1581.90s | and the pin will be asked for before connecting. 1581.90s - 1584.82s | And it can only be changed and reset by the account owner. 1584.82s - 1587.58s | And the reset requires account credentials. 1587.58s - 1589.90s | So here's how the pin works. 1589.90s - 1592.50s | Mobile app will ask the user for the pin. 1593.94s - 1596.94s | The EchoVax cloud will act as a kind of broker. 1596.94s - 1598.74s | So now we ask the robot, 1598.74s - 1601.86s | hey, does this pin


chunk_text:
a second. 1552.79s - 1560.22s | So this finding was reported at CCC last year, 1560.54s - 1562.94s | but they fixed it and then we broke it again. 1562.94s - 1565.14s | So we're going to tell you about it again. 1565.14s - 1567.10s | So the app allows for live video 1567.10s - 1569.18s | and audio access on the robot. 1569.18s - 1572.42s | And this functionality is provided by AWS Kinesis. 1572.42s - 1574.98s | The owner and shared users of the EchoVax account 1574.98s - 1577.02s | can access this feature. 1577.02s - 1578.78s | It is protected by a pin 1578.82s - 1581.90s | and the pin will be asked for before connecting. 1581.90s - 1584.82s | And it can only be changed and reset by the account owner. 1584.82s - 1587.58s | And the reset requires account credentials. 1587.58s - 1589.90s | So here's how the pin works. 1589.90s - 1592.50s | Mobile app will ask the user for the pin. 1593.94s - 1596.94s | The EchoVax cloud will act as a kind of broker. 1596.94s - 1598.74s | So now we ask the robot, 1598.74s - 1601.86s | hey, does this pin hash match with your local hash 1601.86s - 1603.22s | that's stored on the robot? 1603.22s - 1607.10s | If yes, the robot decides that it is correct, 1607.10s - 1609.22s | sends that response to the mobile app, 1610.10s - 1615.10s | and then the WebRTC session over AWS Kinesis will be started 1616.14s - 1621.29s | and both will join the AWS Kinesis session. 1621.29s - 1623.85s | So what happens if the pin is incorrect? 1623.85s - 1626.81s | We go through that same process, but with an incorrect pin. 1627.97s - 1631.52s | Why? 1631.52s - 1636.41s | Sorry, I don't know how to use PowerPoint. 1636.41s - 1641.33s | Okay, so what is it doing? 1642.21s - 1647.21s | Okay, sorry about that. 1653.91s - 1656.91s | Okay, so we asked ourselves, 1656.91s - 1660.19s | are the pin verification and WebRTC session tied together? 1660.19s - 1666.27s | So why is it, this is truly annoying. 1667.35s - 1668.55s | Why is it doing this? 1673.57s - 1681.90s | Okay, sorry, animations have a mind of their own right now. 1681.94s - 1684.14s | It's fine, just continue. 1684.14s - 1686.02s | It's slides


chunk_text:
hash match with your local hash 1601.86s - 1603.22s | that's stored on the robot? 1603.22s - 1607.10s | If yes, the robot decides that it is correct, 1607.10s - 1609.22s | sends that response to the mobile app, 1610.10s - 1615.10s | and then the WebRTC session over AWS Kinesis will be started 1616.14s - 1621.29s | and both will join the AWS Kinesis session. 1621.29s - 1623.85s | So what happens if the pin is incorrect? 1623.85s - 1626.81s | We go through that same process, but with an incorrect pin. 1627.97s - 1631.52s | Why? 1631.52s - 1636.41s | Sorry, I don't know how to use PowerPoint. 1636.41s - 1641.33s | Okay, so what is it doing? 1642.21s - 1647.21s | Okay, sorry about that. 1653.91s - 1656.91s | Okay, so we asked ourselves, 1656.91s - 1660.19s | are the pin verification and WebRTC session tied together? 1660.19s - 1666.27s | So why is it, this is truly annoying. 1667.35s - 1668.55s | Why is it doing this? 1673.57s - 1681.90s | Okay, sorry, animations have a mind of their own right now. 1681.94s - 1684.14s | It's fine, just continue. 1684.14s - 1686.02s | It's slides by themselves. 1686.02s - 1689.05s | I can't stop it. 1689.05s - 1690.65s | This is entirely automated. 1690.65s - 1691.49s | There's like a button 1691.49s - 1694.25s | that's pressed down right now automatically. 1694.25s - 1695.09s | Sorry for that. 1706.15s - 1707.51s | You need to turn animations on. 1707.51s - 1715.39s | I don't know how to. 1715.39s - 1716.31s | Okay, it's just. 1716.31s - 1717.51s | No, it's not. 1726.28s - 1728.24s | Anyway, the takeaway message here is, 1728.24s - 1729.52s | we don't know why the animations are broken, 1729.52s - 1732.16s | but basically it doesn't matter 1732.16s - 1733.64s | if the pin is correct or not correct. 1733.64s - 1735.76s | You can convince the app that the pin is still correct 1735.76s - 1738.08s | and we'll just establish a session. 1738.08s - 1739.44s | And we have a demo here. 1743.88s - 1745.64s | Do you know how to disable? 1745.64s - 1760.72s | Sorry. 1760.72s - 1761.72s | Dennis, disable the track. 1761.72s - 1779.10s | Sorry, I swear it worked before. 1779.10s - 1780.06s | Have you seen that? 1780.06s - 1786.36s | It


chunk_text:
by themselves. 1686.02s - 1689.05s | I can't stop it. 1689.05s - 1690.65s | This is entirely automated. 1690.65s - 1691.49s | There's like a button 1691.49s - 1694.25s | that's pressed down right now automatically. 1694.25s - 1695.09s | Sorry for that. 1706.15s - 1707.51s | You need to turn animations on. 1707.51s - 1715.39s | I don't know how to. 1715.39s - 1716.31s | Okay, it's just. 1716.31s - 1717.51s | No, it's not. 1726.28s - 1728.24s | Anyway, the takeaway message here is, 1728.24s - 1729.52s | we don't know why the animations are broken, 1729.52s - 1732.16s | but basically it doesn't matter 1732.16s - 1733.64s | if the pin is correct or not correct. 1733.64s - 1735.76s | You can convince the app that the pin is still correct 1735.76s - 1738.08s | and we'll just establish a session. 1738.08s - 1739.44s | And we have a demo here. 1743.88s - 1745.64s | Do you know how to disable? 1745.64s - 1760.72s | Sorry. 1760.72s - 1761.72s | Dennis, disable the track. 1761.72s - 1779.10s | Sorry, I swear it worked before. 1779.10s - 1780.06s | Have you seen that? 1780.06s - 1786.36s | It might be on our slides. 1786.36s - 1788.36s | Just try the slideshow again. 1790.36s - 1791.20s | I mean, they're fine. 1791.20s - 1792.04s | I think there's something to that. 1792.04s - 1794.04s | Yeah, just try the slideshow. 1794.04s - 1797.38s | See something? 1797.38s - 1798.82s | That starts from the beginning. 1798.82s - 1800.06s | No, no, just wait. 1800.06s - 1800.90s | This one? 1800.90s - 1801.74s | Yeah. 1801.74s - 1806.90s | Okay. 1807.74s - 1808.70s | Okay, we have automated slides for some reason, 1808.70s - 1810.30s | so we're just gonna work with it. 1810.30s - 1812.50s | Okay, we can't work with this. 1812.50s - 1814.06s | Fuck me. 1814.06s - 1815.78s | Why is this happening? 1815.78s - 1834.05s | This is really awful. 1834.05s - 1834.89s | Okay, now it's working. 1834.89s - 1835.85s | Okay. 1835.85s - 1836.85s | Trust Microsoft. 1838.65s - 1839.61s | Sorry about that. 1839.61s - 1840.81s | Okay, so. 1842.21s - 1843.05s | Right. 1843.05s - 1845.61s | So, as we were trying to go through. 1849.32s - 1861.88s | Oh my God. 1861.88s - 1863.60s | Okay, so we're trying to


chunk_text:
might be on our slides. 1786.36s - 1788.36s | Just try the slideshow again. 1790.36s - 1791.20s | I mean, they're fine. 1791.20s - 1792.04s | I think there's something to that. 1792.04s - 1794.04s | Yeah, just try the slideshow. 1794.04s - 1797.38s | See something? 1797.38s - 1798.82s | That starts from the beginning. 1798.82s - 1800.06s | No, no, just wait. 1800.06s - 1800.90s | This one? 1800.90s - 1801.74s | Yeah. 1801.74s - 1806.90s | Okay. 1807.74s - 1808.70s | Okay, we have automated slides for some reason, 1808.70s - 1810.30s | so we're just gonna work with it. 1810.30s - 1812.50s | Okay, we can't work with this. 1812.50s - 1814.06s | Fuck me. 1814.06s - 1815.78s | Why is this happening? 1815.78s - 1834.05s | This is really awful. 1834.05s - 1834.89s | Okay, now it's working. 1834.89s - 1835.85s | Okay. 1835.85s - 1836.85s | Trust Microsoft. 1838.65s - 1839.61s | Sorry about that. 1839.61s - 1840.81s | Okay, so. 1842.21s - 1843.05s | Right. 1843.05s - 1845.61s | So, as we were trying to go through. 1849.32s - 1861.88s | Oh my God. 1861.88s - 1863.60s | Okay, so we're trying to verify the pin, 1863.60s - 1865.16s | but the pin is incorrect. 1865.16s - 1867.88s | So, are these tied together? 1867.88s - 1869.04s | The WebRTC session. 1869.04s - 1872.28s | So, can we intercept this request 1872.28s - 1875.04s | or the response that pin is incorrect 1875.04s - 1878.52s | and tell the app that the pin is actually correct? 1878.52s - 1880.72s | And the answer was yes, we were able to do that. 1880.72s - 1883.04s | So, now we have a malicious session 1883.04s - 1885.52s | and we have an AWS Kinesis stream. 1886.56s - 1888.96s | So, can we bypass that altogether 1888.96s - 1891.00s | and just patch the pin query out of the app? 1891.00s - 1893.24s | And again, yes, we were able to do that, 1893.24s - 1895.08s | but we just wanna make it abundantly clear 1896.00s - 1898.48s | that this is an issue with Echo of Access implementation. 1898.48s - 1900.24s | This is not an issue with AWS. 1900.24s - 1903.24s | So, don't sue us AWS, please. 1903.24s - 1905.64s | So, in short, the pin protection. 1905.64s - 1907.52s | Pin protection


chunk_text:
verify the pin, 1863.60s - 1865.16s | but the pin is incorrect. 1865.16s - 1867.88s | So, are these tied together? 1867.88s - 1869.04s | The WebRTC session. 1869.04s - 1872.28s | So, can we intercept this request 1872.28s - 1875.04s | or the response that pin is incorrect 1875.04s - 1878.52s | and tell the app that the pin is actually correct? 1878.52s - 1880.72s | And the answer was yes, we were able to do that. 1880.72s - 1883.04s | So, now we have a malicious session 1883.04s - 1885.52s | and we have an AWS Kinesis stream. 1886.56s - 1888.96s | So, can we bypass that altogether 1888.96s - 1891.00s | and just patch the pin query out of the app? 1891.00s - 1893.24s | And again, yes, we were able to do that, 1893.24s - 1895.08s | but we just wanna make it abundantly clear 1896.00s - 1898.48s | that this is an issue with Echo of Access implementation. 1898.48s - 1900.24s | This is not an issue with AWS. 1900.24s - 1903.24s | So, don't sue us AWS, please. 1903.24s - 1905.64s | So, in short, the pin protection. 1905.64s - 1907.52s | Pin protection is implemented in the app, 1907.52s - 1910.76s | but it's client-based authentication and ACL enforcement. 1910.76s - 1912.04s | So, the robot doesn't keep track 1912.04s - 1913.84s | of successful authentications. 1913.84s - 1915.36s | The log of the video stream access 1915.36s - 1917.36s | relies on the honesty of the app. 1917.36s - 1919.56s | And this is really bad in combination 1919.56s - 1922.68s | with the TLS issues that we just touched upon. 1922.68s - 1924.28s | And it's even worse if the sound files 1924.28s - 1925.68s | have been tampered with. 1925.68s - 1927.48s | So, here's just a video demo. 1927.48s - 1929.56s | This was reported in 2023. 1929.56s - 1931.84s | An unsuccessful fix was pushed. 1931.84s - 1935.16s | Some plugins were updated and no firmware fixes, 1935.16s - 1937.64s | which is where the real problem was. 1937.64s - 1942.28s | So, we can downgrade the app with a bad plugin 1942.28s - 1943.72s | and it still works. 1943.72s - 1945.20s | So, here's just a quick video demo. 1945.20s - 1946.60s | This is just Burp Suite. 1946.60s - 1949.24s | We have some find


chunk_text:
is implemented in the app, 1907.52s - 1910.76s | but it's client-based authentication and ACL enforcement. 1910.76s - 1912.04s | So, the robot doesn't keep track 1912.04s - 1913.84s | of successful authentications. 1913.84s - 1915.36s | The log of the video stream access 1915.36s - 1917.36s | relies on the honesty of the app. 1917.36s - 1919.56s | And this is really bad in combination 1919.56s - 1922.68s | with the TLS issues that we just touched upon. 1922.68s - 1924.28s | And it's even worse if the sound files 1924.28s - 1925.68s | have been tampered with. 1925.68s - 1927.48s | So, here's just a video demo. 1927.48s - 1929.56s | This was reported in 2023. 1929.56s - 1931.84s | An unsuccessful fix was pushed. 1931.84s - 1935.16s | Some plugins were updated and no firmware fixes, 1935.16s - 1937.64s | which is where the real problem was. 1937.64s - 1942.28s | So, we can downgrade the app with a bad plugin 1942.28s - 1943.72s | and it still works. 1943.72s - 1945.20s | So, here's just a quick video demo. 1945.20s - 1946.60s | This is just Burp Suite. 1946.60s - 1949.24s | We have some find and replace queries to simplify it. 1950.28s - 1953.20s | We enter a wrong pin, 111, a couple of times. 1954.76s - 1956.24s | Not the right pin. 1956.24s - 1957.72s | So, we continue. 1957.72s - 1961.48s | Then we enable our find and replace queries in Burp Suite. 1961.48s - 1963.68s | Enter again the wrong pin. 1963.68s - 1967.12s | And we are dropped into a video streaming session 1967.12s - 1971.72s | and successfully bypass the pin mechanism. 1971.72s - 1975.66s | And here we are. 1975.66s - 1976.50s | Cool. 1976.50s - 1978.79s | So? 1978.79s - 1979.63s | All right. 1979.63s - 1981.19s | So, let's talk about free lawnmowers. 1981.19s - 1983.15s | Who wants a free lawnmower? 1983.15s - 1984.59s | Okay, now you learn how. 1984.59s - 1985.87s | Actually, please don't. 1985.87s - 1987.15s | We're not free. 1987.19s - 1990.63s | So, the ECOWAS G1 has an anti-theft mechanism 1990.63s - 1992.71s | where, basically, if you pick up the robot 1992.71s - 1997.27s | and you don't trigger the alarm, basically, 1997.27s - 1999.47s | you need to enter a pin to unlock it. 1999.47s - 2001.15s |


chunk_text:
and replace queries to simplify it. 1950.28s - 1953.20s | We enter a wrong pin, 111, a couple of times. 1954.76s - 1956.24s | Not the right pin. 1956.24s - 1957.72s | So, we continue. 1957.72s - 1961.48s | Then we enable our find and replace queries in Burp Suite. 1961.48s - 1963.68s | Enter again the wrong pin. 1963.68s - 1967.12s | And we are dropped into a video streaming session 1967.12s - 1971.72s | and successfully bypass the pin mechanism. 1971.72s - 1975.66s | And here we are. 1975.66s - 1976.50s | Cool. 1976.50s - 1978.79s | So? 1978.79s - 1979.63s | All right. 1979.63s - 1981.19s | So, let's talk about free lawnmowers. 1981.19s - 1983.15s | Who wants a free lawnmower? 1983.15s - 1984.59s | Okay, now you learn how. 1984.59s - 1985.87s | Actually, please don't. 1985.87s - 1987.15s | We're not free. 1987.19s - 1990.63s | So, the ECOWAS G1 has an anti-theft mechanism 1990.63s - 1992.71s | where, basically, if you pick up the robot 1992.71s - 1997.27s | and you don't trigger the alarm, basically, 1997.27s - 1999.47s | you need to enter a pin to unlock it. 1999.47s - 2001.15s | As an owner, you can also enable alarms. 2001.15s - 2002.07s | So, basically, if you pick it up, 2002.07s - 2004.55s | or if someone picks it up, some alarm will go off. 2004.55s - 2006.67s | The problem here is, well, the pin is implemented 2006.67s - 2008.67s | basically in the SOC in the Linux operation system 2008.67s - 2012.03s | and the pin is stored just on a plain text file on the robot. 2012.87s - 2014.99s | The thing, generally, with lawnmowers 2014.99s - 2018.31s | is that other lawnmowers have the same issue. 2018.31s - 2020.07s | So, as a general recommendation, 2020.07s - 2022.79s | do not keep your mowers outside unprotected. 2022.79s - 2026.31s | And, you know, we kind of hope that Equivax 2026.31s - 2027.75s | and other vendors would somehow find 2027.75s - 2030.19s | a more secure location for the pin, 2030.19s - 2031.83s | for example, like in one of the MCUs, 2031.83s - 2035.39s | so to kind of, you know, have a better locking mechanism. 2035.39s - 2037.99s | So, let's talk about our main point today 2037.99s - 2040.47s | and this is the


chunk_text:
As an owner, you can also enable alarms. 2001.15s - 2002.07s | So, basically, if you pick it up, 2002.07s - 2004.55s | or if someone picks it up, some alarm will go off. 2004.55s - 2006.67s | The problem here is, well, the pin is implemented 2006.67s - 2008.67s | basically in the SOC in the Linux operation system 2008.67s - 2012.03s | and the pin is stored just on a plain text file on the robot. 2012.87s - 2014.99s | The thing, generally, with lawnmowers 2014.99s - 2018.31s | is that other lawnmowers have the same issue. 2018.31s - 2020.07s | So, as a general recommendation, 2020.07s - 2022.79s | do not keep your mowers outside unprotected. 2022.79s - 2026.31s | And, you know, we kind of hope that Equivax 2026.31s - 2027.75s | and other vendors would somehow find 2027.75s - 2030.19s | a more secure location for the pin, 2030.19s - 2031.83s | for example, like in one of the MCUs, 2031.83s - 2035.39s | so to kind of, you know, have a better locking mechanism. 2035.39s - 2037.99s | So, let's talk about our main point today 2037.99s - 2040.47s | and this is the Bluetooth remote code execution, 2040.47s - 2042.91s | which we found at some point last year, 2042.91s - 2044.91s | which we were hoping that we would patch until today, 2045.87s - 2046.87s | but we didn't. 2046.87s - 2048.63s | So, what's it about? 2048.63s - 2051.99s | So, newer vacuum robots and all lawnmowing robots so far 2051.99s - 2054.91s | use BLE, Bluetooth LE, basically for their provisioning. 2054.91s - 2056.67s | So, if you initially, like, kind of pushed 2056.67s - 2057.83s | your Wi-Fi credentials onto it, 2057.83s - 2059.35s | they have a mechanism for that. 2060.87s - 2063.31s | For lawnmowers in particular, the Bluetooth is always active 2063.31s - 2066.31s | because we use it as a fallback way to control them. 2066.31s - 2068.35s | And for vacuums, it's typically active 2068.35s - 2070.19s | for the first 20 minutes after booting. 2070.19s - 2073.19s | And every time they reboot in the middle of the night 2073.19s - 2076.23s | for, like, memory cleaning purposes. 2076.23s - 2077.07s | There's also a different way 2077.07s - 2078.75s | to kind of force a robot to reboot remotely, 2078.75s - 2081.15s


chunk_text:
Bluetooth remote code execution, 2040.47s - 2042.91s | which we found at some point last year, 2042.91s - 2044.91s | which we were hoping that we would patch until today, 2045.87s - 2046.87s | but we didn't. 2046.87s - 2048.63s | So, what's it about? 2048.63s - 2051.99s | So, newer vacuum robots and all lawnmowing robots so far 2051.99s - 2054.91s | use BLE, Bluetooth LE, basically for their provisioning. 2054.91s - 2056.67s | So, if you initially, like, kind of pushed 2056.67s - 2057.83s | your Wi-Fi credentials onto it, 2057.83s - 2059.35s | they have a mechanism for that. 2060.87s - 2063.31s | For lawnmowers in particular, the Bluetooth is always active 2063.31s - 2066.31s | because we use it as a fallback way to control them. 2066.31s - 2068.35s | And for vacuums, it's typically active 2068.35s - 2070.19s | for the first 20 minutes after booting. 2070.19s - 2073.19s | And every time they reboot in the middle of the night 2073.19s - 2076.23s | for, like, memory cleaning purposes. 2076.23s - 2077.07s | There's also a different way 2077.07s - 2078.75s | to kind of force a robot to reboot remotely, 2078.75s - 2081.15s | but we don't want to talk about that yet. 2081.15s - 2083.39s | So, the communication between the app 2083.39s - 2085.23s | and the robots over Bluetooth 2085.23s - 2088.95s | is done by the GAT protocol, basically. 2088.95s - 2091.19s | And the payload is encrypted with a static AES key, 2091.19s - 2093.39s | which is something similar, it's not exactly that one, 2093.39s - 2095.35s | but it's like one, two, three, four, five, six, seven, 2095.35s - 2098.15s | eight ECOVACs, like something of that nature. 2099.23s - 2101.75s | And the input validation of whatever happens 2101.75s - 2105.31s | with the data afterwards is, let's say, not great. 2105.31s - 2107.15s | And that's kind of bad if you think about 2107.15s - 2108.07s | that they kind of say like, 2108.07s - 2109.55s | oh, hey, our robots have cameras, 2109.55s - 2113.11s | but trust us because we have been certified by the TÜV. 2114.47s - 2115.91s | So, and as a quick reminder, 2115.91s - 2118.43s | these devices have cameras and microphones. 2118.43s - 2120.51s | So, let's create a payload. 2120.51s - 2122.67s | First, what do


chunk_text:
| but we don't want to talk about that yet. 2081.15s - 2083.39s | So, the communication between the app 2083.39s - 2085.23s | and the robots over Bluetooth 2085.23s - 2088.95s | is done by the GAT protocol, basically. 2088.95s - 2091.19s | And the payload is encrypted with a static AES key, 2091.19s - 2093.39s | which is something similar, it's not exactly that one, 2093.39s - 2095.35s | but it's like one, two, three, four, five, six, seven, 2095.35s - 2098.15s | eight ECOVACs, like something of that nature. 2099.23s - 2101.75s | And the input validation of whatever happens 2101.75s - 2105.31s | with the data afterwards is, let's say, not great. 2105.31s - 2107.15s | And that's kind of bad if you think about 2107.15s - 2108.07s | that they kind of say like, 2108.07s - 2109.55s | oh, hey, our robots have cameras, 2109.55s - 2113.11s | but trust us because we have been certified by the TÜV. 2114.47s - 2115.91s | So, and as a quick reminder, 2115.91s - 2118.43s | these devices have cameras and microphones. 2118.43s - 2120.51s | So, let's create a payload. 2120.51s - 2122.67s | First, what do we want to execute is basically, 2122.67s - 2124.83s | we want to play the boot music, 2124.83s - 2126.83s | which you heard before, on the robot. 2126.83s - 2129.03s | So, we take the command which causes that, 2129.03s - 2131.03s | be embedded in some JSON payload, 2131.03s - 2134.15s | and we generate encrypted payload. 2134.15s - 2135.83s | The payload looks something like this. 2135.83s - 2138.75s | Basically, there's some, a bunch of tech stuff. 2138.75s - 2141.79s | What happens if you send it to one of the robots, 2141.79s - 2144.11s | basically, it will receive the payload, 2144.11s - 2147.95s | it will decrypt it, it will basically extract 2147.95s - 2150.43s | one particular argument from there, 2150.43s - 2151.75s | and will generate a command line 2151.75s - 2154.19s | and put the argument which is extracted 2154.19s - 2156.59s | into the environment variable there. 2156.59s - 2158.35s | So, the command line which we get at the end of the day 2158.35s - 2159.23s | is something like this. 2159.23s - 2161.79s | As you see, we basically use command injection there. 2161.79s - 2164.39s | And


chunk_text:
we want to execute is basically, 2122.67s - 2124.83s | we want to play the boot music, 2124.83s - 2126.83s | which you heard before, on the robot. 2126.83s - 2129.03s | So, we take the command which causes that, 2129.03s - 2131.03s | be embedded in some JSON payload, 2131.03s - 2134.15s | and we generate encrypted payload. 2134.15s - 2135.83s | The payload looks something like this. 2135.83s - 2138.75s | Basically, there's some, a bunch of tech stuff. 2138.75s - 2141.79s | What happens if you send it to one of the robots, 2141.79s - 2144.11s | basically, it will receive the payload, 2144.11s - 2147.95s | it will decrypt it, it will basically extract 2147.95s - 2150.43s | one particular argument from there, 2150.43s - 2151.75s | and will generate a command line 2151.75s - 2154.19s | and put the argument which is extracted 2154.19s - 2156.59s | into the environment variable there. 2156.59s - 2158.35s | So, the command line which we get at the end of the day 2158.35s - 2159.23s | is something like this. 2159.23s - 2161.79s | As you see, we basically use command injection there. 2161.79s - 2164.39s | And then, it will happily execute a thing as root. 2165.47s - 2166.75s | And we tested this attack, basically, 2166.75s - 2168.63s | over a 50 meters distance, 2168.63s - 2171.59s | and even longer, like 100 meters for lawnmowers 2171.59s - 2174.31s | because we have a more powerful Bluetooth antenna. 2174.31s - 2177.91s | So, and we have a demo here for like the G1, 2177.91s - 2179.91s | which is like the lawnmowing robot. 2179.91s - 2184.59s | What we do here is we send the payload from an Android phone 2184.59s - 2187.27s | and you will see that we will get a succession back 2187.27s - 2188.11s | in a second. 2188.11s - 2189.35s | So, we're sending a payload now. 2189.35s - 2191.71s | You saw it connected back to us, a reverse shell, 2191.71s - 2193.91s | and now we can type on the robot 2193.91s - 2196.51s | and we see that we are root, 2196.51s - 2198.23s | we see what kind of version we're running, 2198.23s - 2200.63s | and so the robot basically connected back to us. 2201.51s - 2203.15s | We have also another demo, 2204.55s - 2206.11s


chunk_text:
then, it will happily execute a thing as root. 2165.47s - 2166.75s | And we tested this attack, basically, 2166.75s - 2168.63s | over a 50 meters distance, 2168.63s - 2171.59s | and even longer, like 100 meters for lawnmowers 2171.59s - 2174.31s | because we have a more powerful Bluetooth antenna. 2174.31s - 2177.91s | So, and we have a demo here for like the G1, 2177.91s - 2179.91s | which is like the lawnmowing robot. 2179.91s - 2184.59s | What we do here is we send the payload from an Android phone 2184.59s - 2187.27s | and you will see that we will get a succession back 2187.27s - 2188.11s | in a second. 2188.11s - 2189.35s | So, we're sending a payload now. 2189.35s - 2191.71s | You saw it connected back to us, a reverse shell, 2191.71s - 2193.91s | and now we can type on the robot 2193.91s - 2196.51s | and we see that we are root, 2196.51s - 2198.23s | we see what kind of version we're running, 2198.23s - 2200.63s | and so the robot basically connected back to us. 2201.51s - 2203.15s | We have also another demo, 2204.55s - 2206.11s | more of the robot, 2206.11s - 2208.23s | but I will skip that out of timing issues. 2209.15s - 2211.55s | And we have also a live demo, potentially. 2212.71s - 2213.55s | It takes one. 2213.55s - 2214.39s | Okay, I skipped that too. 2214.39s - 2215.39s | I will do it. 2215.39s - 2216.83s | Okay, we have three minutes left. 2217.83s - 2218.75s | So, what can you do with that 2218.75s - 2222.51s | if you have a BLE code execution fail? 2222.51s - 2223.95s | So, what we thought about is like, 2223.95s - 2225.35s | hey, how can we chain that? 2225.35s - 2227.99s | So, generally, if you live in a very close populated area, 2227.99s - 2229.27s | there might be more Equivax users 2229.27s - 2230.47s | because especially like Equivax 2230.47s - 2232.03s | is like one of the market leaders. 2232.03s - 2234.47s | So, what we can do is like we just attack an initial object 2234.47s - 2237.27s | like a vacuum robot, sorry, lawnmowing robot, 2237.27s - 2238.31s | put a payload onto that, 2238.31s - 2240.11s | and then the robot has all the


chunk_text:
| more of the robot, 2206.11s - 2208.23s | but I will skip that out of timing issues. 2209.15s - 2211.55s | And we have also a live demo, potentially. 2212.71s - 2213.55s | It takes one. 2213.55s - 2214.39s | Okay, I skipped that too. 2214.39s - 2215.39s | I will do it. 2215.39s - 2216.83s | Okay, we have three minutes left. 2217.83s - 2218.75s | So, what can you do with that 2218.75s - 2222.51s | if you have a BLE code execution fail? 2222.51s - 2223.95s | So, what we thought about is like, 2223.95s - 2225.35s | hey, how can we chain that? 2225.35s - 2227.99s | So, generally, if you live in a very close populated area, 2227.99s - 2229.27s | there might be more Equivax users 2229.27s - 2230.47s | because especially like Equivax 2230.47s - 2232.03s | is like one of the market leaders. 2232.03s - 2234.47s | So, what we can do is like we just attack an initial object 2234.47s - 2237.27s | like a vacuum robot, sorry, lawnmowing robot, 2237.27s - 2238.31s | put a payload onto that, 2238.31s - 2240.11s | and then the robot has all the tools 2240.11s - 2241.75s | which it needs to talk to other devices. 2241.75s - 2244.23s | So, it can infect the next robot which has some distance 2244.23s - 2246.55s | and that one can infect again the next one. 2247.23s - 2248.07s | And then it becomes a problem 2248.07s - 2248.95s | because the third one might start 2248.95s - 2251.47s | to infect back the lawnmower. 2251.47s - 2253.67s | So, we just had it as a proof of concept. 2253.67s - 2255.59s | We didn't want to have a whole routing protocol 2255.59s - 2256.43s | to figure it out. 2256.43s - 2258.35s | So, you know, sorry about that. 2259.55s - 2261.75s | Let's talk about routing very, very quickly. 2261.75s - 2264.39s | So, there is a lot of countermeasures in there 2264.39s - 2265.23s | in the software. 2265.23s - 2268.19s | They use a lot of XOR and byte shifting to hide strings. 2268.19s - 2269.55s | They have a lot of anti-debugging features. 2269.55s - 2272.11s | For example, they detect LD preload in the buggers 2272.11s - 2274.79s | and they use, for some of the device, not all


chunk_text:
tools 2240.11s - 2241.75s | which it needs to talk to other devices. 2241.75s - 2244.23s | So, it can infect the next robot which has some distance 2244.23s - 2246.55s | and that one can infect again the next one. 2247.23s - 2248.07s | And then it becomes a problem 2248.07s - 2248.95s | because the third one might start 2248.95s - 2251.47s | to infect back the lawnmower. 2251.47s - 2253.67s | So, we just had it as a proof of concept. 2253.67s - 2255.59s | We didn't want to have a whole routing protocol 2255.59s - 2256.43s | to figure it out. 2256.43s - 2258.35s | So, you know, sorry about that. 2259.55s - 2261.75s | Let's talk about routing very, very quickly. 2261.75s - 2264.39s | So, there is a lot of countermeasures in there 2264.39s - 2265.23s | in the software. 2265.23s - 2268.19s | They use a lot of XOR and byte shifting to hide strings. 2268.19s - 2269.55s | They have a lot of anti-debugging features. 2269.55s - 2272.11s | For example, they detect LD preload in the buggers 2272.11s - 2274.79s | and they use, for some of the device, not all of them, 2274.79s - 2277.51s | Secure Boot and Android Verified Boot. 2277.51s - 2278.83s | So, to get a root shell, 2278.83s - 2280.51s | well, you can connect over UART, 2280.51s - 2282.83s | but the problem is every device has a different password 2282.83s - 2284.71s | and it's hard-coded and it's, sorry, 2284.71s - 2287.15s | it's not hard-coded, it's set at boot time. 2287.15s - 2289.23s | And the function is very obfuscated, 2290.11s - 2291.83s | but there's one particular tool which generates that 2291.83s - 2293.23s | and this is how it's basically generated. 2293.23s - 2295.47s | So, they take a bunch of like random MAC addresses 2295.47s - 2297.59s | probably from the developer's computer at some point, 2297.59s - 2299.43s | put the serial number in there, the model number, 2299.43s - 2301.95s | create a SHA-256 and then make it base64 2301.95s - 2303.99s | and that's the root password. 2303.99s - 2305.87s | If you want to generate it for your own robot, 2305.87s - 2307.15s | there's a tool, you can just go there, 2307.15s - 2308.15s | just enter your serial number, 2308.15s - 2310.15s |


chunk_text:
of them, 2274.79s - 2277.51s | Secure Boot and Android Verified Boot. 2277.51s - 2278.83s | So, to get a root shell, 2278.83s - 2280.51s | well, you can connect over UART, 2280.51s - 2282.83s | but the problem is every device has a different password 2282.83s - 2284.71s | and it's hard-coded and it's, sorry, 2284.71s - 2287.15s | it's not hard-coded, it's set at boot time. 2287.15s - 2289.23s | And the function is very obfuscated, 2290.11s - 2291.83s | but there's one particular tool which generates that 2291.83s - 2293.23s | and this is how it's basically generated. 2293.23s - 2295.47s | So, they take a bunch of like random MAC addresses 2295.47s - 2297.59s | probably from the developer's computer at some point, 2297.59s - 2299.43s | put the serial number in there, the model number, 2299.43s - 2301.95s | create a SHA-256 and then make it base64 2301.95s - 2303.99s | and that's the root password. 2303.99s - 2305.87s | If you want to generate it for your own robot, 2305.87s - 2307.15s | there's a tool, you can just go there, 2307.15s - 2308.15s | just enter your serial number, 2308.15s - 2310.15s | it will kind of give you a password. 2310.15s - 2313.15s | For firmware updates, they're encrypted but not signed. 2313.15s - 2315.59s | The key is kind of dynamically generated 2315.59s - 2317.03s | and it's like, was kind of very difficult 2317.03s - 2320.43s | to reverse engineer it, but it's basically AS128. 2320.43s - 2322.03s | And this is the format string which we use 2322.03s - 2323.71s | to kind of generate a key, 2323.71s - 2325.95s | which is like someone's random email address. 2325.95s - 2327.51s | So, we use like a bunch of random stuff, 2327.51s - 2329.39s | mix it together and that's the AS key. 2330.43s - 2333.75s | So, as mentioned, some root file systems 2334.51s - 2335.51s | are not protected, so we can just modify them, 2335.51s - 2337.75s | especially on X1 and Z1. 2337.75s - 2340.15s | We can just repack it and have like our own system. 2340.15s - 2341.75s | One thing which was kind of interesting for us 2341.75s - 2344.83s | is we can get persistence in autostart. 2344.83s - 2347.03s | We left the debugging feature on some of the devices


chunk_text:
it will kind of give you a password. 2310.15s - 2313.15s | For firmware updates, they're encrypted but not signed. 2313.15s - 2315.59s | The key is kind of dynamically generated 2315.59s - 2317.03s | and it's like, was kind of very difficult 2317.03s - 2320.43s | to reverse engineer it, but it's basically AS128. 2320.43s - 2322.03s | And this is the format string which we use 2322.03s - 2323.71s | to kind of generate a key, 2323.71s - 2325.95s | which is like someone's random email address. 2325.95s - 2327.51s | So, we use like a bunch of random stuff, 2327.51s - 2329.39s | mix it together and that's the AS key. 2330.43s - 2333.75s | So, as mentioned, some root file systems 2334.51s - 2335.51s | are not protected, so we can just modify them, 2335.51s - 2337.75s | especially on X1 and Z1. 2337.75s - 2340.15s | We can just repack it and have like our own system. 2340.15s - 2341.75s | One thing which was kind of interesting for us 2341.75s - 2344.83s | is we can get persistence in autostart. 2344.83s - 2347.03s | We left the debugging feature on some of the devices 2347.03s - 2349.91s | where if there's autostart folder exists on data, 2349.91s - 2352.31s | which is not protected, you can put a shell file into it 2352.31s - 2354.47s | and it will just happily execute it next time. 2354.47s - 2355.87s | So, it's not protected in any way, 2355.87s - 2357.83s | so it's persistent forever. 2358.95s - 2360.39s | Problem is, for whatever reason, 2360.39s - 2361.87s | on some of the devices, we disabled it 2361.87s - 2364.99s | and some of them not, I mean, it's kind of random. 2364.99s - 2367.43s | If you wanna be persistent over factory sets, 2367.43s - 2370.03s | well, they only delete the files, 2370.03s - 2372.55s | so what you think you can do is like basically, 2372.55s - 2374.43s | because we don't recreate the file system, 2374.43s - 2377.07s | just make files immutable with chatter 2377.07s - 2380.07s | and that way, you know, they will stay there forever. 2380.07s - 2382.63s | Okay, I will talk really quick about the takeaway lessons. 2382.63s - 2384.91s | First, can you rely on certifications? 2384.91s - 2387.31s | No, you can't, bad news.


chunk_text:
2347.03s - 2349.91s | where if there's autostart folder exists on data, 2349.91s - 2352.31s | which is not protected, you can put a shell file into it 2352.31s - 2354.47s | and it will just happily execute it next time. 2354.47s - 2355.87s | So, it's not protected in any way, 2355.87s - 2357.83s | so it's persistent forever. 2358.95s - 2360.39s | Problem is, for whatever reason, 2360.39s - 2361.87s | on some of the devices, we disabled it 2361.87s - 2364.99s | and some of them not, I mean, it's kind of random. 2364.99s - 2367.43s | If you wanna be persistent over factory sets, 2367.43s - 2370.03s | well, they only delete the files, 2370.03s - 2372.55s | so what you think you can do is like basically, 2372.55s - 2374.43s | because we don't recreate the file system, 2374.43s - 2377.07s | just make files immutable with chatter 2377.07s - 2380.07s | and that way, you know, they will stay there forever. 2380.07s - 2382.63s | Okay, I will talk really quick about the takeaway lessons. 2382.63s - 2384.91s | First, can you rely on certifications? 2384.91s - 2387.31s | No, you can't, bad news. 2387.31s - 2389.43s | If you have vulnerable devices, 2389.43s - 2391.67s | like the lawnmower, make sure that you turn it off 2392.47s - 2394.03s | until we push a fix. 2394.03s - 2396.67s | Don't use them, turn them off if you don't use them. 2396.67s - 2398.87s | For devices which don't have BLE, 2398.87s - 2401.31s | just don't update them if you wanna keep root access. 2401.31s - 2404.15s | For vulnerable apps, don't connect to DEF CON Open. 2404.15s - 2405.75s | Bad idea. 2405.75s - 2407.95s | Used devices, be very careful with used devices. 2407.95s - 2409.99s | They might come with a compromised firmware. 2409.99s - 2412.07s | It's very difficult to verify. 2412.07s - 2413.75s | If you do factory set before selling, 2413.75s - 2415.47s | you know, do that definitely, 2415.47s - 2418.27s | but be aware that it might not help against everything. 2419.35s - 2420.99s | One thing, choose your partners wisely. 2420.99s - 2422.95s | You can use those things as stalker tools. 2422.95s - 2423.99s | I will skip that really quick 2423.99s - 2425.87s | and just finish with the summary. 2425.87s -


chunk_text:
2387.31s - 2389.43s | If you have vulnerable devices, 2389.43s - 2391.67s | like the lawnmower, make sure that you turn it off 2392.47s - 2394.03s | until we push a fix. 2394.03s - 2396.67s | Don't use them, turn them off if you don't use them. 2396.67s - 2398.87s | For devices which don't have BLE, 2398.87s - 2401.31s | just don't update them if you wanna keep root access. 2401.31s - 2404.15s | For vulnerable apps, don't connect to DEF CON Open. 2404.15s - 2405.75s | Bad idea. 2405.75s - 2407.95s | Used devices, be very careful with used devices. 2407.95s - 2409.99s | They might come with a compromised firmware. 2409.99s - 2412.07s | It's very difficult to verify. 2412.07s - 2413.75s | If you do factory set before selling, 2413.75s - 2415.47s | you know, do that definitely, 2415.47s - 2418.27s | but be aware that it might not help against everything. 2419.35s - 2420.99s | One thing, choose your partners wisely. 2420.99s - 2422.95s | You can use those things as stalker tools. 2422.95s - 2423.99s | I will skip that really quick 2423.99s - 2425.87s | and just finish with the summary. 2425.87s - 2428.91s | So we have a root access on most of the released, 2428.91s - 2431.35s | or I think actually all of the released Ecovacs robots. 2431.35s - 2433.15s | So we can use the UART interface 2433.15s - 2435.15s | and authentication to get into the device. 2435.15s - 2437.59s | We can use the BLE remote code execution right now 2437.59s - 2440.31s | to get initial access on devices remotely, 2440.31s - 2441.59s | hopefully your own. 2441.59s - 2444.91s | You can get persistence and run some custom firmware 2444.91s - 2447.31s | on some of the devices which don't have protections. 2447.31s - 2450.83s | We were able to verify the claims of the vendors 2451.67s - 2454.63s | and we found a lot of like security and privacy issues. 2454.63s - 2457.27s | And this both applies to the app, robots, clouds, 2457.27s - 2459.19s | and the certification for whatever reason 2459.19s - 2460.43s | even didn't prevent that. 2460.43s - 2464.27s | So I am not a firm believer in certifications nowadays. 2464.27s - 2468.11s | And, but this allows you to look further into IoT devices 2468.11s - 2469.15s |


chunk_text:
2428.91s | So we have a root access on most of the released, 2428.91s - 2431.35s | or I think actually all of the released Ecovacs robots. 2431.35s - 2433.15s | So we can use the UART interface 2433.15s - 2435.15s | and authentication to get into the device. 2435.15s - 2437.59s | We can use the BLE remote code execution right now 2437.59s - 2440.31s | to get initial access on devices remotely, 2440.31s - 2441.59s | hopefully your own. 2441.59s - 2444.91s | You can get persistence and run some custom firmware 2444.91s - 2447.31s | on some of the devices which don't have protections. 2447.31s - 2450.83s | We were able to verify the claims of the vendors 2451.67s - 2454.63s | and we found a lot of like security and privacy issues. 2454.63s - 2457.27s | And this both applies to the app, robots, clouds, 2457.27s - 2459.19s | and the certification for whatever reason 2459.19s - 2460.43s | even didn't prevent that. 2460.43s - 2464.27s | So I am not a firm believer in certifications nowadays. 2464.27s - 2468.11s | And, but this allows you to look further into IoT devices 2468.11s - 2469.15s | and into AI. 2469.15s - 2472.55s | And so hopefully this will be for our security, 2472.55s - 2474.11s | for everyone's security. 2474.11s - 2475.19s | Some quick acknowledgements. 2475.19s - 2476.99s | I would like to thank Daniel, Chris, 2476.99s - 2478.71s | as well as Timster and Apple. 2478.71s - 2479.83s | And if you have any questions, 2479.83s - 2481.23s | I think we have time. 2481.23s - 2482.31s | Maybe we have time. 2482.31s - 2483.15s | Actually, okay. 2483.15s - 2485.39s | You can ask us questions when we are basically done. 2485.39s - 2486.83s | Sorry for the problems. 2486.83s - 2488.83s | Thank you for being here. 2488.83s - 2491.71s | If you have any other questions like remote, 2491.71s - 2492.67s | this is our email addresses. 2492.67s - 2493.83s | Feel free to reach out. 2494.87s - 2496.19s | Yeah, thank you very much.


chunk_text:
and into AI. 2469.15s - 2472.55s | And so hopefully this will be for our security, 2472.55s - 2474.11s | for everyone's security. 2474.11s - 2475.19s | Some quick acknowledgements. 2475.19s - 2476.99s | I would like to thank Daniel, Chris, 2476.99s - 2478.71s | as well as Timster and Apple. 2478.71s - 2479.83s | And if you have any questions, 2479.83s - 2481.23s | I think we have time. 2481.23s - 2482.31s | Maybe we have time. 2482.31s - 2483.15s | Actually, okay. 2483.15s - 2485.39s | You can ask us questions when we are basically done. 2485.39s - 2486.83s | Sorry for the problems. 2486.83s - 2488.83s | Thank you for being here. 2488.83s - 2491.71s | If you have any other questions like remote, 2491.71s - 2492.67s | this is our email addresses. 2492.67s - 2493.83s | Feel free to reach out. 2494.87s - 2496.19s | Yeah, thank you very much.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=h86p7pcZmL8", "title": "DEF CON 32 - Reflections on a Decade in Bug Bounties - Nikhil Shrivastava & Charlie Waterhouse", "description": "In this talk, I will share my journey from a novice to a seasoned hunter. I will explore how I used to report low-impact, informative bugs when I first started, and how I progressively improved by learning from the community, embracing failures/duplicates, and incorporating feedback from triage teams and clients. This journey of continuous learning and adaptation led me from reporting low vulnerabilities to effectively chaining and converting them into critical impacts.\n\nThis session is designed for both aspiring and experienced bug bounty hunters. By reflecting on a decade of lessons learned, I will aim to provide valuable takeaways that can help others navigate their own paths in bug bounty hunting and enhance their skills.\n\nAdditionally, one Synack triage team member will join me on this talk to help differentiate triage thinking from bug bounty hunters' thinking, providing valuable insights into the collaborative process of vulnerability reporting to acceptance.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 3552, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 3.92s | This text was transcribed using whisper model: large-v2 Okay guys, we'd like to welcome you and thank you guys for showing up. Hopefully everybody's 3.92s - 8.72s | having a really great DEF CON. A lot of great talks out there. We're hoping that ours is at 8.72s - 13.60s | least mediocre for you guys. We're going to be discussing 10 years in bug bounties 14.24s - 20.32s | and what we've learned, how we've learned from my perspective as a triage and the enemy, so to speak. 21.36s - 24.88s | If anybody has submitted stuff, who all has submitted stuff to bug bounties? 25.84s - 31.44s | Right. Now who all has been frustrated with triage? Okay. So yeah, I'll be the bad guy today. 32.64s - 37.12s | Nick's here. He is one of the top hackers. He'll introduce himself and his credentials also. 37.12s - 41.12s | And he's going to be speaking from the researcher side that said, I'm also a researcher. So we're 41.12s - 46.96s | going to be kind of having a discussion as to how can you have the best experience as a bug bounty 46.96s - 52.08s | hunter and have the best chance of success and what does success look like? So that's going


chunk_text:
thank you guys for showing up. Hopefully everybody's 3.92s - 8.72s | having a really great DEF CON. A lot of great talks out there. We're hoping that ours is at 8.72s - 13.60s | least mediocre for you guys. We're going to be discussing 10 years in bug bounties 14.24s - 20.32s | and what we've learned, how we've learned from my perspective as a triage and the enemy, so to speak. 21.36s - 24.88s | If anybody has submitted stuff, who all has submitted stuff to bug bounties? 25.84s - 31.44s | Right. Now who all has been frustrated with triage? Okay. So yeah, I'll be the bad guy today. 32.64s - 37.12s | Nick's here. He is one of the top hackers. He'll introduce himself and his credentials also. 37.12s - 41.12s | And he's going to be speaking from the researcher side that said, I'm also a researcher. So we're 41.12s - 46.96s | going to be kind of having a discussion as to how can you have the best experience as a bug bounty 46.96s - 52.08s | hunter and have the best chance of success and what does success look like? So that's going to 52.16s - 55.04s | be what we're going through with this talk. So hopefully you guys get something out of it. 57.09s - 63.09s | So how many of you are full-time bug bounty hunter here? Just one. 63.09s - 63.49s | Sort of. 66.29s - 74.69s | So we kind of doing this talk because I've been into bug bounty since a decade. So 75.49s - 82.61s | I'm just trying to explain all the experiences and how a bug bounty can be a full-time carrier 82.61s - 92.45s | for you as well. So it's kind of a daytime job as well and nighttime too. So I've been 94.45s - 103.25s | doing a lot of bug bounties on SYNAC platform. And I recently been awarded as a SYNAC Red Team 103.25s - 110.93s | legend. I also a founder of B-Sides Ahmedabad. It's the conference and it's biggest conference 110.93s - 118.85s | in India. And I also have been advisor to an ASM product. So Charlie. 119.73s - 126.69s | Guys, generally I'd like to say hi. I have a really unusual background. A lot of people in 126.69s - 130.85s | the security space


chunk_text:
to 52.16s - 55.04s | be what we're going through with this talk. So hopefully you guys get something out of it. 57.09s - 63.09s | So how many of you are full-time bug bounty hunter here? Just one. 63.09s - 63.49s | Sort of. 66.29s - 74.69s | So we kind of doing this talk because I've been into bug bounty since a decade. So 75.49s - 82.61s | I'm just trying to explain all the experiences and how a bug bounty can be a full-time carrier 82.61s - 92.45s | for you as well. So it's kind of a daytime job as well and nighttime too. So I've been 94.45s - 103.25s | doing a lot of bug bounties on SYNAC platform. And I recently been awarded as a SYNAC Red Team 103.25s - 110.93s | legend. I also a founder of B-Sides Ahmedabad. It's the conference and it's biggest conference 110.93s - 118.85s | in India. And I also have been advisor to an ASM product. So Charlie. 119.73s - 126.69s | Guys, generally I'd like to say hi. I have a really unusual background. A lot of people in 126.69s - 130.85s | the security space do. A lot of us are not just coming straight out of school as bug bounty 130.85s - 137.17s | hunters, as Red Team. I spent over two decades in customer service and dealing with as an 137.17s - 142.53s | international translator and international manager for an airline. Then decided I love 142.53s - 148.45s | technology. It's always been a passion of mine. I was the guy who built Napster servers. I got my 148.45s - 154.85s | MCSE for amusement one time. So I was that guy who grew up with these old systems and 154.85s - 158.85s | just loved it enough that then I started really studying coming back into the field 158.85s - 164.13s | and was really, really blessed to have an opportunity to come in as a triager 164.13s - 172.05s | and in SYNAC's vulnerability operations team. I have also helped go over 2,400 different 172.05s - 178.29s | assessments and have probably, I think last poll was somewhere around 40,000 individual reports. 178.85s - 182.93s | So I've seen quite a few things. I've talked to some people who I have actually triaged their 182.93s - 191.33s | reports. So


chunk_text:
do. A lot of us are not just coming straight out of school as bug bounty 130.85s - 137.17s | hunters, as Red Team. I spent over two decades in customer service and dealing with as an 137.17s - 142.53s | international translator and international manager for an airline. Then decided I love 142.53s - 148.45s | technology. It's always been a passion of mine. I was the guy who built Napster servers. I got my 148.45s - 154.85s | MCSE for amusement one time. So I was that guy who grew up with these old systems and 154.85s - 158.85s | just loved it enough that then I started really studying coming back into the field 158.85s - 164.13s | and was really, really blessed to have an opportunity to come in as a triager 164.13s - 172.05s | and in SYNAC's vulnerability operations team. I have also helped go over 2,400 different 172.05s - 178.29s | assessments and have probably, I think last poll was somewhere around 40,000 individual reports. 178.85s - 182.93s | So I've seen quite a few things. I've talked to some people who I have actually triaged their 182.93s - 191.33s | reports. So few of them in the audience. I have headed developments on some products around OWASP, 191.33s - 197.17s | NIST, OSINT, API, headless API, and most recently some AI testing. 197.17s - 200.53s | So a lot of breadth on our testing and how we go about these things. 202.13s - 211.73s | So I'll walk you through my journey, how I started and how I continue my full-time bug bounty 212.45s - 224.05s | stuff, and what are my experiences and what are my failures, how I keep on continuing and finding 224.05s - 237.81s | bugs and earning from it. So I started in 2013. So I wasn't aware about bug bounties at that time 237.81s - 246.93s | because there is not much exposures of bug bounties at that time. Only Google and PayPal 246.93s - 257.17s | was running bug bounty programs at that time. And it's not that much visible to anybody like 257.73s - 271.81s | a non-bug bounty person. So I dropped out from college because I do not like much of, I do not 271.81s - 282.05s | have much interest in their knowledge and stuff like that. So I dropped in


chunk_text:
few of them in the audience. I have headed developments on some products around OWASP, 191.33s - 197.17s | NIST, OSINT, API, headless API, and most recently some AI testing. 197.17s - 200.53s | So a lot of breadth on our testing and how we go about these things. 202.13s - 211.73s | So I'll walk you through my journey, how I started and how I continue my full-time bug bounty 212.45s - 224.05s | stuff, and what are my experiences and what are my failures, how I keep on continuing and finding 224.05s - 237.81s | bugs and earning from it. So I started in 2013. So I wasn't aware about bug bounties at that time 237.81s - 246.93s | because there is not much exposures of bug bounties at that time. Only Google and PayPal 246.93s - 257.17s | was running bug bounty programs at that time. And it's not that much visible to anybody like 257.73s - 271.81s | a non-bug bounty person. So I dropped out from college because I do not like much of, I do not 271.81s - 282.05s | have much interest in their knowledge and stuff like that. So I dropped in 2012 and I started 282.05s - 293.09s | looking for the job. So I accidentally joined an ethical hacking training company. And I usually 293.09s - 303.09s | go out of money like in less than a month. And I had no idea about bug bounties and stuff. 303.09s - 315.57s | And so one day, one of my co-workers, he was sitting on a computer and he was submitting some 315.57s - 325.41s | accesses to PayPal. And after a few days, he got some bounty from the PayPal. So he posted an image 325.41s - 333.17s | on Facebook. So Facebook was quite used application at that time. So he posted a photo on 333.17s - 342.37s | Facebook. And after a few days, I've seen that photo. And next day, I went to the office and asked 342.37s - 352.93s | him what exactly is this. So he described me that some companies pay bounties if you submit some 352.93s - 367.97s | vulnerabilities to them. So then from there, I got introduced to bug bounties. And since then, I 367.97s - 374.77s | started doing a lot of research on what other companies are there to,


chunk_text:
2012 and I started 282.05s - 293.09s | looking for the job. So I accidentally joined an ethical hacking training company. And I usually 293.09s - 303.09s | go out of money like in less than a month. And I had no idea about bug bounties and stuff. 303.09s - 315.57s | And so one day, one of my co-workers, he was sitting on a computer and he was submitting some 315.57s - 325.41s | accesses to PayPal. And after a few days, he got some bounty from the PayPal. So he posted an image 325.41s - 333.17s | on Facebook. So Facebook was quite used application at that time. So he posted a photo on 333.17s - 342.37s | Facebook. And after a few days, I've seen that photo. And next day, I went to the office and asked 342.37s - 352.93s | him what exactly is this. So he described me that some companies pay bounties if you submit some 352.93s - 367.97s | vulnerabilities to them. So then from there, I got introduced to bug bounties. And since then, I 367.97s - 374.77s | started doing a lot of research on what other companies are there to, which is running the 374.85s - 384.53s | independent programs. And I only get like two companies, Google and PayPal during that time. And 384.53s - 390.85s | no other companies was running an independent program. So there was no, there was, right now, 390.85s - 403.01s | there is a lot of bug bounty platforms that are running a lot of programs over them. But there was 403.01s - 412.85s | not much, not much exposure of bug bounty platforms during that time. But more of independent 412.85s - 416.61s | programs running on, running their bug bounty themselves. 418.85s - 424.61s | I think there was an interesting point you made there is that the bug bounty space is very much a 424.61s - 431.81s | show me thing. You can be the guy who is a doctorate, cert it up, has every cert out there, you've run 431.81s - 437.81s | SANS, you've been the SANS instructor. But if you can't put rubber on the road, the guy who doesn't 437.81s - 443.01s | even have a high school degree is going to beat you. This is a very egalitarian space. I can say 443.01s - 447.89s


chunk_text:
which is running the 374.85s - 384.53s | independent programs. And I only get like two companies, Google and PayPal during that time. And 384.53s - 390.85s | no other companies was running an independent program. So there was no, there was, right now, 390.85s - 403.01s | there is a lot of bug bounty platforms that are running a lot of programs over them. But there was 403.01s - 412.85s | not much, not much exposure of bug bounty platforms during that time. But more of independent 412.85s - 416.61s | programs running on, running their bug bounty themselves. 418.85s - 424.61s | I think there was an interesting point you made there is that the bug bounty space is very much a 424.61s - 431.81s | show me thing. You can be the guy who is a doctorate, cert it up, has every cert out there, you've run 431.81s - 437.81s | SANS, you've been the SANS instructor. But if you can't put rubber on the road, the guy who doesn't 437.81s - 443.01s | even have a high school degree is going to beat you. This is a very egalitarian space. I can say 443.01s - 447.89s | on our end as a triage team, we don't look at that. I don't care what your certs are. I care what you 447.89s - 453.49s | found. So this is a space that all that stuff is a matter of your skill set and what you do. 454.05s - 458.77s | And so I think there's a really good thought there is that none of that matters. And this is a chance 458.77s - 462.53s | for you guys to start working and get some of the best in the world at biting Google engineers and 462.53s - 466.93s | seeing if you're smarter. The good news is they have to be right 100%. We only have to be right 466.93s - 479.46s | once. So when I was searching for Google bug bounties, I came across a lot of blogs. And there 479.46s - 487.22s | was one blog and this guy, this guy is a good friend of mine now. But at that time, it was 487.22s - 496.02s | unknown. But he just went to the some Google application and he writes some 499.06s - 505.38s | simple access payload and the payload got triggered.


chunk_text:
| on our end as a triage team, we don't look at that. I don't care what your certs are. I care what you 447.89s - 453.49s | found. So this is a space that all that stuff is a matter of your skill set and what you do. 454.05s - 458.77s | And so I think there's a really good thought there is that none of that matters. And this is a chance 458.77s - 462.53s | for you guys to start working and get some of the best in the world at biting Google engineers and 462.53s - 466.93s | seeing if you're smarter. The good news is they have to be right 100%. We only have to be right 466.93s - 479.46s | once. So when I was searching for Google bug bounties, I came across a lot of blogs. And there 479.46s - 487.22s | was one blog and this guy, this guy is a good friend of mine now. But at that time, it was 487.22s - 496.02s | unknown. But he just went to the some Google application and he writes some 499.06s - 505.38s | simple access payload and the payload got triggered. So he got bounty out of it. So I was 505.38s - 516.66s | like, he got a very simple bug, simple bug from the Google and got a bounty out of it. So I got 516.74s - 523.86s | really motivated out of it. So I thought that let's try, let's try these things on other Google 523.86s - 534.26s | products as well. But I later realized that these, these stuff looks simple, but you have to dig a 534.26s - 542.10s | lot deeper and you have to know about Google products and services to actually, actually get 542.10s - 550.10s | these issues. But these are, I mean, these are just old stuff. You can't find them nowadays. 551.30s - 563.46s | Only if you are lucky. So, so I thought of give it a try to Google bug bounty first. So I was, 564.26s - 569.78s | during that time I was no idea about the bug, just submitting a simple, any random stuff 570.42s - 582.42s | without any logic and simply getting either rejected, no impact, duplicates or Hall of Fame 582.42s - 593.70s | only. So I reported like whole year to


chunk_text:
So he got bounty out of it. So I was 505.38s - 516.66s | like, he got a very simple bug, simple bug from the Google and got a bounty out of it. So I got 516.74s - 523.86s | really motivated out of it. So I thought that let's try, let's try these things on other Google 523.86s - 534.26s | products as well. But I later realized that these, these stuff looks simple, but you have to dig a 534.26s - 542.10s | lot deeper and you have to know about Google products and services to actually, actually get 542.10s - 550.10s | these issues. But these are, I mean, these are just old stuff. You can't find them nowadays. 551.30s - 563.46s | Only if you are lucky. So, so I thought of give it a try to Google bug bounty first. So I was, 564.26s - 569.78s | during that time I was no idea about the bug, just submitting a simple, any random stuff 570.42s - 582.42s | without any logic and simply getting either rejected, no impact, duplicates or Hall of Fame 582.42s - 593.70s | only. So I reported like whole year to Google and I just got duplicates or rejected reports. 594.58s - 599.78s | So one of the interesting things on this is that when we're out hunting and I'm just as guilty of 599.78s - 604.74s | it as anybody else, you see something, you get excited. Let me ask this. How many blue teamers 604.74s - 612.10s | do we have in developers on the backend that are in the room? Few guys, right? As a researcher, 612.10s - 616.34s | it's really easy to sit and say, oh my gosh, I just found this and go, it's not a duplicate. 616.34s - 620.02s | It's another path. But you got to ask yourself, is that the same code on the backend? Because 620.50s - 625.54s | Amazon doesn't code each product separately, guys. We know that. So it's the same things. 625.54s - 628.82s | We've got to kind of ask ourselves as a researcher, wait a minute, is this really a duplicate? Is the 628.82s - 632.90s | same code on the backend? You've got to get a little critical. You've also got to think, 632.90s - 638.66s | and he'd said about impact. The problem with


chunk_text:
Google and I just got duplicates or rejected reports. 594.58s - 599.78s | So one of the interesting things on this is that when we're out hunting and I'm just as guilty of 599.78s - 604.74s | it as anybody else, you see something, you get excited. Let me ask this. How many blue teamers 604.74s - 612.10s | do we have in developers on the backend that are in the room? Few guys, right? As a researcher, 612.10s - 616.34s | it's really easy to sit and say, oh my gosh, I just found this and go, it's not a duplicate. 616.34s - 620.02s | It's another path. But you got to ask yourself, is that the same code on the backend? Because 620.50s - 625.54s | Amazon doesn't code each product separately, guys. We know that. So it's the same things. 625.54s - 628.82s | We've got to kind of ask ourselves as a researcher, wait a minute, is this really a duplicate? Is the 628.82s - 632.90s | same code on the backend? You've got to get a little critical. You've also got to think, 632.90s - 638.66s | and he'd said about impact. The problem with this is, let me ask this. If you're looking at say an 638.66s - 645.30s | HSTS flag missing, what's the malicious use case? What are you going to do with it? Probably 645.30s - 651.14s | nothing. If you can do something, show me. And so very much when you talk to a triager, 651.14s - 655.54s | show me the malicious use case. If you've got a cross-site scripting, but it's unauthenticated, 655.54s - 659.54s | what are you going to really do with that? Show me that you can pop a document.cookie, 659.54s - 666.02s | document.domain, and then explain to me, yeah, that way I can get their credentials out. I would 666.02s - 670.74s | just have to send that to my server. That way I can clearly see the malicious use. Make sure you 670.74s - 676.26s | show that impact. I would say 80% of our rejections are probably because of low impact. 677.06s - 680.58s | And that it's just, you haven't proven what that malicious use case is, 680.58s - 684.18s | that now I need to go to my client and tell them, I need you to spend engineering time,


chunk_text:
this is, let me ask this. If you're looking at say an 638.66s - 645.30s | HSTS flag missing, what's the malicious use case? What are you going to do with it? Probably 645.30s - 651.14s | nothing. If you can do something, show me. And so very much when you talk to a triager, 651.14s - 655.54s | show me the malicious use case. If you've got a cross-site scripting, but it's unauthenticated, 655.54s - 659.54s | what are you going to really do with that? Show me that you can pop a document.cookie, 659.54s - 666.02s | document.domain, and then explain to me, yeah, that way I can get their credentials out. I would 666.02s - 670.74s | just have to send that to my server. That way I can clearly see the malicious use. Make sure you 670.74s - 676.26s | show that impact. I would say 80% of our rejections are probably because of low impact. 677.06s - 680.58s | And that it's just, you haven't proven what that malicious use case is, 680.58s - 684.18s | that now I need to go to my client and tell them, I need you to spend engineering time, 684.74s - 688.82s | not only money on this bounty, but now I need you to spend cycles off your engineering 688.82s - 694.50s | to fix this. And that's my business use case I need to make as a triage or isn't this worth fixing. 695.78s - 699.78s | So whenever you're looking at these things, we can't just look at it as a pure security thing. 700.98s - 707.06s | As security practitioners, we want every last I dot and D crossed and perfection. But some of 707.06s - 710.98s | these things are just acceptable risk and we have to think about it and go, is it really okay? 710.98s - 715.86s | It might be. Unfortunately, we've had to look at it and say Google API keys are very similar 715.86s - 721.38s | to this process. The fix is extremely expensive. Google has said it's not something that they're 721.38s - 725.62s | particularly interested in and nobody's done it and it's going to cost them a lot of money to fix it 726.58s - 732.10s | when the risk is pretty minimal. So we have to kind of consider those things as security 732.10s


chunk_text:
684.74s - 688.82s | not only money on this bounty, but now I need you to spend cycles off your engineering 688.82s - 694.50s | to fix this. And that's my business use case I need to make as a triage or isn't this worth fixing. 695.78s - 699.78s | So whenever you're looking at these things, we can't just look at it as a pure security thing. 700.98s - 707.06s | As security practitioners, we want every last I dot and D crossed and perfection. But some of 707.06s - 710.98s | these things are just acceptable risk and we have to think about it and go, is it really okay? 710.98s - 715.86s | It might be. Unfortunately, we've had to look at it and say Google API keys are very similar 715.86s - 721.38s | to this process. The fix is extremely expensive. Google has said it's not something that they're 721.38s - 725.62s | particularly interested in and nobody's done it and it's going to cost them a lot of money to fix it 726.58s - 732.10s | when the risk is pretty minimal. So we have to kind of consider those things as security 732.10s - 736.66s | practitioners and just not say we have to fix everything. Let's fix the important things. 736.66s - 741.78s | And so when we're looking at a report, I always have to ask myself, and I'm as guilty as anybody 741.78s - 746.90s | when I'm doing my own reports is getting excited about the flaw. I have to come back and go, 746.90s - 752.50s | is this really a risk? What's my impact? And so a lot of what Nick was saying here at the beginning 752.74s - 759.62s | is duplicate, no impact. And those are what people run into all the time as beginning bounty hunters. 761.14s - 765.22s | I know a couple of people in this room that have had the same experience as me. 765.22s - 769.14s | Somebody new will come in. They'll get excited. They're going to submit a dozen reports. 769.14s - 772.18s | That's Friday night. They're going out with their buddies going, I'm going to quit my job because I 772.18s - 779.46s | just wanted $6,000 in bounties. I am the most badass mofo on this planet. I'm quitting my job. 779.94s - 783.78s |


chunk_text:
- 736.66s | practitioners and just not say we have to fix everything. Let's fix the important things. 736.66s - 741.78s | And so when we're looking at a report, I always have to ask myself, and I'm as guilty as anybody 741.78s - 746.90s | when I'm doing my own reports is getting excited about the flaw. I have to come back and go, 746.90s - 752.50s | is this really a risk? What's my impact? And so a lot of what Nick was saying here at the beginning 752.74s - 759.62s | is duplicate, no impact. And those are what people run into all the time as beginning bounty hunters. 761.14s - 765.22s | I know a couple of people in this room that have had the same experience as me. 765.22s - 769.14s | Somebody new will come in. They'll get excited. They're going to submit a dozen reports. 769.14s - 772.18s | That's Friday night. They're going out with their buddies going, I'm going to quit my job because I 772.18s - 779.46s | just wanted $6,000 in bounties. I am the most badass mofo on this planet. I'm quitting my job. 779.94s - 783.78s | He goes out, he parties Saturday, he parties, he maxes out the credit card because I've got 783.78s - 792.02s | $7,000 in bounties and money I rejected all in 10 minutes. He does not have happy words for me. 792.58s - 795.78s | And I'm going, yeah, this is all on our low impact list. Did you read the documentation? 797.46s - 802.26s | And so these are the things you have to think through is just slow down and ask yourself, 803.54s - 806.98s | what do I need to do? What is that triage you're going to do? Because their job is to be a little 806.98s - 810.34s | critical and to force you to get better. So show the impact. 814.64s - 824.40s | So if something didn't work out, you have to move on from that particular thing. And you have to, 824.40s - 830.40s | I mean, there are a lot of stuff in the world, so you can move on and do other stuff too. 830.40s - 839.04s | So maybe you will get lucky to have more success on that particular program 839.04s - 850.64s | rather than the previous one.


chunk_text:
He goes out, he parties Saturday, he parties, he maxes out the credit card because I've got 783.78s - 792.02s | $7,000 in bounties and money I rejected all in 10 minutes. He does not have happy words for me. 792.58s - 795.78s | And I'm going, yeah, this is all on our low impact list. Did you read the documentation? 797.46s - 802.26s | And so these are the things you have to think through is just slow down and ask yourself, 803.54s - 806.98s | what do I need to do? What is that triage you're going to do? Because their job is to be a little 806.98s - 810.34s | critical and to force you to get better. So show the impact. 814.64s - 824.40s | So if something didn't work out, you have to move on from that particular thing. And you have to, 824.40s - 830.40s | I mean, there are a lot of stuff in the world, so you can move on and do other stuff too. 830.40s - 839.04s | So maybe you will get lucky to have more success on that particular program 839.04s - 850.64s | rather than the previous one. So I moved on at that time and I heard about Nokia phone was, 851.28s - 858.80s | there was a Nokia phone coming at that time. So they were running a VDP program, but their VDP 858.80s - 863.92s | program is something like that. If you're finding any critical vulnerabilities on their program, 863.92s - 874.24s | so they're giving out their smartphones to hackers. So what I did, I listed out all their 875.20s - 883.36s | assets and I started fuzzing for just for a SQLite because I was kind of more proficient 883.36s - 890.48s | into finding a SQLite at that time. So this is how we react when a new program, when we see a 890.48s - 902.00s | new program. So like I said, I listed all their assets and started testing the SQLite. And one of 902.00s - 911.60s | their assets I got a SQL error and further I went ahead and just one or two commands and I was able 911.60s - 920.80s | to dump their whole DB. So from here they actually sent me some Lumia 820 devices. 924.08s - 928.72s | So I think the one


chunk_text:
So I moved on at that time and I heard about Nokia phone was, 851.28s - 858.80s | there was a Nokia phone coming at that time. So they were running a VDP program, but their VDP 858.80s - 863.92s | program is something like that. If you're finding any critical vulnerabilities on their program, 863.92s - 874.24s | so they're giving out their smartphones to hackers. So what I did, I listed out all their 875.20s - 883.36s | assets and I started fuzzing for just for a SQLite because I was kind of more proficient 883.36s - 890.48s | into finding a SQLite at that time. So this is how we react when a new program, when we see a 890.48s - 902.00s | new program. So like I said, I listed all their assets and started testing the SQLite. And one of 902.00s - 911.60s | their assets I got a SQL error and further I went ahead and just one or two commands and I was able 911.60s - 920.80s | to dump their whole DB. So from here they actually sent me some Lumia 820 devices. 924.08s - 928.72s | So I think the one thing that we can take from this part of what Nix did and you heard him say 928.72s - 934.64s | this was an area I was interested in. If you have an area that you have an interest in or that you 934.64s - 940.88s | have experience in your full-time job, if you're a SQL database engineer, you're in good shape 941.76s - 949.20s | because you know what to do with those databases to get SQL injections. If you are a web designer, 949.20s - 955.36s | you've got a lot of that stuff to understand how to abuse HTML. So use the stuff that you're 955.36s - 959.84s | interested in and all of a sudden he said, I focus on just SQLite. Focus on that one thing. 960.88s - 965.44s | Then take that one thing, run with it until you become the expert at it. You're going to start 965.44s - 969.60s | getting to where you feel it. I've heard these guys a lot of times just say, I felt this, 969.60s - 974.72s | I just knew it was there. That sixth sense is developed by repetition and doing it over and


chunk_text:
thing that we can take from this part of what Nix did and you heard him say 928.72s - 934.64s | this was an area I was interested in. If you have an area that you have an interest in or that you 934.64s - 940.88s | have experience in your full-time job, if you're a SQL database engineer, you're in good shape 941.76s - 949.20s | because you know what to do with those databases to get SQL injections. If you are a web designer, 949.20s - 955.36s | you've got a lot of that stuff to understand how to abuse HTML. So use the stuff that you're 955.36s - 959.84s | interested in and all of a sudden he said, I focus on just SQLite. Focus on that one thing. 960.88s - 965.44s | Then take that one thing, run with it until you become the expert at it. You're going to start 965.44s - 969.60s | getting to where you feel it. I've heard these guys a lot of times just say, I felt this, 969.60s - 974.72s | I just knew it was there. That sixth sense is developed by repetition and doing it over and 974.72s - 980.08s | over. And when you do that, you become really proficient in that thing. And so what you're 980.08s - 986.24s | seeing, I think that Nix is describing is focus on that subject. Don't let yourself go for 986.24s - 991.04s | everything. The field is huge. Focus on one or two things until you get proficient at it, 991.04s - 995.76s | then you can add a new thing. And so yeah, smartphones are not bad. Also he's shifted 995.76s - 1000.32s | to a program that had less competition. Sometimes, especially if you're new, 1001.12s - 1007.20s | going up against guys like this, it's going to be a tough road. If you can go against the people 1007.20s - 1010.72s | who are a little less skilled because he's not going out for smartphones today, 1011.68s - 1017.68s | maybe their recognition programs, there may be a good point to going there and learning 1017.68s - 1027.73s | and using that as an education tool. So key takeaways from this is don't give up 1027.73s - 1040.21s | anytime. And when one opportunity closes, another opens up. So if you find any critical


chunk_text:
974.72s - 980.08s | over. And when you do that, you become really proficient in that thing. And so what you're 980.08s - 986.24s | seeing, I think that Nix is describing is focus on that subject. Don't let yourself go for 986.24s - 991.04s | everything. The field is huge. Focus on one or two things until you get proficient at it, 991.04s - 995.76s | then you can add a new thing. And so yeah, smartphones are not bad. Also he's shifted 995.76s - 1000.32s | to a program that had less competition. Sometimes, especially if you're new, 1001.12s - 1007.20s | going up against guys like this, it's going to be a tough road. If you can go against the people 1007.20s - 1010.72s | who are a little less skilled because he's not going out for smartphones today, 1011.68s - 1017.68s | maybe their recognition programs, there may be a good point to going there and learning 1017.68s - 1027.73s | and using that as an education tool. So key takeaways from this is don't give up 1027.73s - 1040.21s | anytime. And when one opportunity closes, another opens up. So if you find any critical 1040.21s - 1052.37s | vulnerabilities on any of the assets and if you get a good bug and a good reward, so you will get 1052.37s - 1061.33s | a lot of motivation out of it. So what motivation do? Motivation actually do a lot of big things. 1063.89s - 1069.97s | In bug bounties, motivation counts a lot because if you are motivated, then you will be able to 1069.97s - 1080.45s | find more impactful vulnerabilities. So I got motivated because of the last critical bug I 1080.45s - 1092.61s | found on the Nokia program. And I continued. So in mid-2013, there was more programs come up 1093.57s - 1106.05s | such as Mozilla started their web services bug bounties. Baracuda Labs also has a web application 1106.05s - 1116.13s | firewall bug bounties running. And they actually given out live devices on a virtual platform. And 1117.17s - 1128.93s | the PayPal is running since 2009. All of these running independent programs. So I was able to get 1129.33s - 1142.05s | some issues on these programs and get some bounties out of it. So like I said, these are all 1142.61s - 1153.41s | things


chunk_text:
1040.21s - 1052.37s | vulnerabilities on any of the assets and if you get a good bug and a good reward, so you will get 1052.37s - 1061.33s | a lot of motivation out of it. So what motivation do? Motivation actually do a lot of big things. 1063.89s - 1069.97s | In bug bounties, motivation counts a lot because if you are motivated, then you will be able to 1069.97s - 1080.45s | find more impactful vulnerabilities. So I got motivated because of the last critical bug I 1080.45s - 1092.61s | found on the Nokia program. And I continued. So in mid-2013, there was more programs come up 1093.57s - 1106.05s | such as Mozilla started their web services bug bounties. Baracuda Labs also has a web application 1106.05s - 1116.13s | firewall bug bounties running. And they actually given out live devices on a virtual platform. And 1117.17s - 1128.93s | the PayPal is running since 2009. All of these running independent programs. So I was able to get 1129.33s - 1142.05s | some issues on these programs and get some bounties out of it. So like I said, these are all 1142.61s - 1153.41s | things which I did when I got some motivation from the last bugs. So it's kind of thing that if I 1153.41s - 1163.01s | continue doing Google, I might get about $500 or $1,000 bounty after two or three years. But I 1163.01s - 1171.09s | lost, I can loss all my motivation until then because you are doing bug bounties till three years 1171.09s - 1181.09s | and you are only getting $500 or $1,000 or something like that. But what I did, I keep on 1181.09s - 1191.81s | learning things from my rejections. So I get a failure from Google but I also ask them why you 1191.81s - 1202.69s | rejected my bug. So they actually explain you that why we rejected. So they also tells you that if 1202.69s - 1214.53s | you can do this, then we can accept that bug and move it to the award category. So that is how the 1214.53s - 1215.57s | motivation works. Yeah. 1216.21s - 1221.89s | Yeah. One important note here from the triage side, it's your triagers are always happy to tell 1221.89s - 1226.93s | you why something wasn't accepted. I don't think any


chunk_text:
which I did when I got some motivation from the last bugs. So it's kind of thing that if I 1153.41s - 1163.01s | continue doing Google, I might get about $500 or $1,000 bounty after two or three years. But I 1163.01s - 1171.09s | lost, I can loss all my motivation until then because you are doing bug bounties till three years 1171.09s - 1181.09s | and you are only getting $500 or $1,000 or something like that. But what I did, I keep on 1181.09s - 1191.81s | learning things from my rejections. So I get a failure from Google but I also ask them why you 1191.81s - 1202.69s | rejected my bug. So they actually explain you that why we rejected. So they also tells you that if 1202.69s - 1214.53s | you can do this, then we can accept that bug and move it to the award category. So that is how the 1214.53s - 1215.57s | motivation works. Yeah. 1216.21s - 1221.89s | Yeah. One important note here from the triage side, it's your triagers are always happy to tell 1221.89s - 1226.93s | you why something wasn't accepted. I don't think any of our triagers just go, I don't have time, 1226.93s - 1233.25s | go away. Because what we're trying to do is show you what number one did not work. So that way, 1233.25s - 1237.65s | quite frankly, you don't fill up my inbox with junk and keep doing the same thing again. 1238.77s - 1244.29s | So if you get a rejection, ask and try and understand why. And a lot of times they'll be 1244.29s - 1250.85s | able to tell you, but if you can do this, now I'll take it. So that's your kind of explanation. And 1250.85s - 1255.57s | this usually resolves around impact, but they'll be able to tell you, hey, this is just, we're 1255.57s - 1260.13s | going to be low impact. We kind of don't care about this. You had an eye door. Yeah. You could 1260.13s - 1264.21s | get into somebody else's account, but you know what? You weren't logged in. You're just changing 1264.21s - 1270.29s | their basket at the pizza place and get rid of a pizza. Who cares? You're not getting them to pay 1270.29s - 1276.13s | for your pizza. So understand


chunk_text:
of our triagers just go, I don't have time, 1226.93s - 1233.25s | go away. Because what we're trying to do is show you what number one did not work. So that way, 1233.25s - 1237.65s | quite frankly, you don't fill up my inbox with junk and keep doing the same thing again. 1238.77s - 1244.29s | So if you get a rejection, ask and try and understand why. And a lot of times they'll be 1244.29s - 1250.85s | able to tell you, but if you can do this, now I'll take it. So that's your kind of explanation. And 1250.85s - 1255.57s | this usually resolves around impact, but they'll be able to tell you, hey, this is just, we're 1255.57s - 1260.13s | going to be low impact. We kind of don't care about this. You had an eye door. Yeah. You could 1260.13s - 1264.21s | get into somebody else's account, but you know what? You weren't logged in. You're just changing 1264.21s - 1270.29s | their basket at the pizza place and get rid of a pizza. Who cares? You're not getting them to pay 1270.29s - 1276.13s | for your pizza. So understand why they're looking at it the way they are. For example, cross-site 1276.13s - 1280.29s | scripting. If you're not logged in, there's no data to come out of it. No, there's no malicious 1280.29s - 1286.13s | use. And they'll be clearly just happy to say, hey, it's an unauthenticated cross-site scripting. 1286.13s - 1291.09s | I can't take that. There's no impact. So ask them, communicate. They are very happy to communicate 1291.09s - 1295.73s | these things. And part of their job is to think through them and go, okay, why won't I accept 1295.73s - 1301.81s | this? So they know the reason. So talk to them, take that feedback and learn. I've seen way too 1301.81s - 1307.49s | many people come in and just say, I submit the flaw. It gets rejected. And I tell you why. 1307.49s - 1313.41s | And next week you submit the same flaw and it gets rejected. And I tell you why. And a few days 1313.41s - 1319.25s | later, you submit a flaw. So just the same. And we go through this process and it keeps knocking 1319.25s - 1324.05s | down the researcher's motivation, which


chunk_text:
why they're looking at it the way they are. For example, cross-site 1276.13s - 1280.29s | scripting. If you're not logged in, there's no data to come out of it. No, there's no malicious 1280.29s - 1286.13s | use. And they'll be clearly just happy to say, hey, it's an unauthenticated cross-site scripting. 1286.13s - 1291.09s | I can't take that. There's no impact. So ask them, communicate. They are very happy to communicate 1291.09s - 1295.73s | these things. And part of their job is to think through them and go, okay, why won't I accept 1295.73s - 1301.81s | this? So they know the reason. So talk to them, take that feedback and learn. I've seen way too 1301.81s - 1307.49s | many people come in and just say, I submit the flaw. It gets rejected. And I tell you why. 1307.49s - 1313.41s | And next week you submit the same flaw and it gets rejected. And I tell you why. And a few days 1313.41s - 1319.25s | later, you submit a flaw. So just the same. And we go through this process and it keeps knocking 1319.25s - 1324.05s | down the researcher's motivation, which is not at all what we want to do, but it's taking that 1324.05s - 1329.57s | feedback and understanding what they're saying. They are now your teachers to help educate you 1329.57s - 1334.29s | to how to make yourself a better pen tester in your normal day job, how to become a better bug 1334.29s - 1339.41s | bounty hunter, how to do, how to improve overall. It may be that we're saying, improve your reporting 1339.41s - 1343.73s | techniques, you know, that I need more detailed steps. A lot of times you guys will be in that 1343.73s - 1350.05s | app for hours. I have never seen it before. I'm walking into a blind to reproduce your volume 1350.05s - 1353.97s | and try and understand, does it have impact? If you haven't clearly explained it clearly showed me, 1355.57s - 1359.33s | maybe I can't do it because I don't have the details and the knowledge of, oh, I redid this. 1360.13s - 1365.01s | So make sure you're very clear to us, explain it, understand why we rejected it and ask questions. 1367.97s - 1376.45s | So, uh, so in, uh, in 2014


chunk_text:
is not at all what we want to do, but it's taking that 1324.05s - 1329.57s | feedback and understanding what they're saying. They are now your teachers to help educate you 1329.57s - 1334.29s | to how to make yourself a better pen tester in your normal day job, how to become a better bug 1334.29s - 1339.41s | bounty hunter, how to do, how to improve overall. It may be that we're saying, improve your reporting 1339.41s - 1343.73s | techniques, you know, that I need more detailed steps. A lot of times you guys will be in that 1343.73s - 1350.05s | app for hours. I have never seen it before. I'm walking into a blind to reproduce your volume 1350.05s - 1353.97s | and try and understand, does it have impact? If you haven't clearly explained it clearly showed me, 1355.57s - 1359.33s | maybe I can't do it because I don't have the details and the knowledge of, oh, I redid this. 1360.13s - 1365.01s | So make sure you're very clear to us, explain it, understand why we rejected it and ask questions. 1367.97s - 1376.45s | So, uh, so in, uh, in 2014 or mid 2014, there was, uh, uh, I got to know about, uh, these three 1376.45s - 1385.25s | platforms running, uh, some bug bounty programs on their platform. And, uh, um, and, uh, well, 1385.25s - 1391.01s | well, uh, HackerOne and BugCrowd was available to sign up directly. And, uh, and the SINAC was 1391.01s - 1396.61s | doing some, uh, hands-on assessment, uh, which includes, uh, written and, uh, ID verification 1396.61s - 1405.60s | or something like that. And, uh, uh, and, uh, uh, once you, uh, once you, uh, once you passed on 1405.60s - 1411.04s | the written and, uh, ID verification, you, uh, you will be onboarded on the, on the platform. 1411.04s - 1417.12s | But, uh, but, but, uh, other two platforms, uh, they are, uh, directly available for signup. I 1417.12s - 1425.28s | guess, uh, HackerOne, HackerOne do not have, uh, uh, do not have, uh, uh, uh, a web application 1425.28s - 1433.04s | bug bounty platform, bug bounty program until, uh, the Yahoo comes in, uh, in 2014 end, I guess. 1433.04s - 1435.68s | It just knows it's vintage logo. I haven't seen that forever. 1436.56s


chunk_text:
or mid 2014, there was, uh, uh, I got to know about, uh, these three 1376.45s - 1385.25s | platforms running, uh, some bug bounty programs on their platform. And, uh, um, and, uh, well, 1385.25s - 1391.01s | well, uh, HackerOne and BugCrowd was available to sign up directly. And, uh, and the SINAC was 1391.01s - 1396.61s | doing some, uh, hands-on assessment, uh, which includes, uh, written and, uh, ID verification 1396.61s - 1405.60s | or something like that. And, uh, uh, and, uh, uh, once you, uh, once you, uh, once you passed on 1405.60s - 1411.04s | the written and, uh, ID verification, you, uh, you will be onboarded on the, on the platform. 1411.04s - 1417.12s | But, uh, but, but, uh, other two platforms, uh, they are, uh, directly available for signup. I 1417.12s - 1425.28s | guess, uh, HackerOne, HackerOne do not have, uh, uh, do not have, uh, uh, uh, a web application 1425.28s - 1433.04s | bug bounty platform, bug bounty program until, uh, the Yahoo comes in, uh, in 2014 end, I guess. 1433.04s - 1435.68s | It just knows it's vintage logo. I haven't seen that forever. 1436.56s - 1442.00s | So one of the things that kind of is interesting about the bug bounty model, and a lot of you guys 1442.00s - 1446.16s | are kind of like, why did those companies exist? First of all, for you guys, it consolidates it. 1446.72s - 1449.84s | Gives you one place you can find a bunch of targets instead of having to Google all over the 1449.84s - 1454.32s | place. Additionally, you don't have to send it to the company and hope that they don't just go, 1454.32s - 1457.92s | yeah, I'm going to reject that, but, uh, thank you. And I'm going to fix it anyway. 1457.92s - 1461.68s | You know, we're kind of your middleman there to protect you. Um, but that said, 1461.68s - 1467.28s | we're also hired for the company's protection to reduce the noise, um, and go through and say, 1467.28s - 1471.28s | is this valid for them on their behalf? And we're an impartial third party. 1471.28s - 1475.36s | I can tell you that when I paid a vol, there was nothing. It doesn't come out of my pocket. 1475.36s - 1479.28s | Um, it


chunk_text:
- 1442.00s | So one of the things that kind of is interesting about the bug bounty model, and a lot of you guys 1442.00s - 1446.16s | are kind of like, why did those companies exist? First of all, for you guys, it consolidates it. 1446.72s - 1449.84s | Gives you one place you can find a bunch of targets instead of having to Google all over the 1449.84s - 1454.32s | place. Additionally, you don't have to send it to the company and hope that they don't just go, 1454.32s - 1457.92s | yeah, I'm going to reject that, but, uh, thank you. And I'm going to fix it anyway. 1457.92s - 1461.68s | You know, we're kind of your middleman there to protect you. Um, but that said, 1461.68s - 1467.28s | we're also hired for the company's protection to reduce the noise, um, and go through and say, 1467.28s - 1471.28s | is this valid for them on their behalf? And we're an impartial third party. 1471.28s - 1475.36s | I can tell you that when I paid a vol, there was nothing. It doesn't come out of my pocket. 1475.36s - 1479.28s | Um, it was a big joke to a lot of people like, oh, they're lowering my CVSS. They don't want to 1479.28s - 1483.84s | pay this. They don't want to pay that. We're in the business to pay vols. If I don't pay any vols 1483.84s - 1489.28s | on the target, my client gets mad. So I need to pay these volts. I need, if I've got a bonus out 1489.28s - 1494.00s | there, I need to kind of pay it. That's why I'm putting a bonus on it. The money it becomes, 1494.00s - 1499.04s | I can say this after paying thousands and thousands, probably well over a couple, 1499.04s - 1504.00s | probably half a million dollars out that I've spent personally. It's monopoly money to me. 1504.00s - 1509.68s | I press that button. It's not 500. It's not a thousand. It's not $4,000. It's just a button. 1511.04s - 1514.72s | It doesn't matter to me. It never processes in my head that I just spent $10,000. 1515.12s - 1520.16s | So your triagers are not sitting and thinking, you go, I need to hold on to this money. 1520.16s - 1524.00s | That's


chunk_text:
was a big joke to a lot of people like, oh, they're lowering my CVSS. They don't want to 1479.28s - 1483.84s | pay this. They don't want to pay that. We're in the business to pay vols. If I don't pay any vols 1483.84s - 1489.28s | on the target, my client gets mad. So I need to pay these volts. I need, if I've got a bonus out 1489.28s - 1494.00s | there, I need to kind of pay it. That's why I'm putting a bonus on it. The money it becomes, 1494.00s - 1499.04s | I can say this after paying thousands and thousands, probably well over a couple, 1499.04s - 1504.00s | probably half a million dollars out that I've spent personally. It's monopoly money to me. 1504.00s - 1509.68s | I press that button. It's not 500. It's not a thousand. It's not $4,000. It's just a button. 1511.04s - 1514.72s | It doesn't matter to me. It never processes in my head that I just spent $10,000. 1515.12s - 1520.16s | So your triagers are not sitting and thinking, you go, I need to hold on to this money. 1520.16s - 1524.00s | That's not how it works for us. We don't even get really accountable for it. It's just, 1524.00s - 1528.24s | do we do it right? Was it a valid vol? Yeah. Did you pay what it's supposed to be paid? Yep. Okay, 1528.24s - 1533.52s | good. So your triagers are not trying to hold this money back. We don't get bonuses based off 1533.52s - 1538.96s | what I didn't pay you guys. You know, that's not the whole different game if it was, but 1539.60s - 1543.60s | so understand that the bounty platforms are actually here to number one, 1543.68s - 1547.52s | show you where everything's at so that you can be efficient with your time and not have to search 1547.52s - 1552.64s | new projects. Number two, we're your impartial third party to make sure that what you're 1552.64s - 1556.56s | submitting is good for our clients and that the clients are being fair to you. 1559.50s - 1568.14s | So when HackerOne started their first program, that is Yahoo. So I got the first book and that 1568.14s - 1575.42s | is, uh, uh, Yahoo mail, uh, Yahoo mobile mail accesses. And,


chunk_text:
not how it works for us. We don't even get really accountable for it. It's just, 1524.00s - 1528.24s | do we do it right? Was it a valid vol? Yeah. Did you pay what it's supposed to be paid? Yep. Okay, 1528.24s - 1533.52s | good. So your triagers are not trying to hold this money back. We don't get bonuses based off 1533.52s - 1538.96s | what I didn't pay you guys. You know, that's not the whole different game if it was, but 1539.60s - 1543.60s | so understand that the bounty platforms are actually here to number one, 1543.68s - 1547.52s | show you where everything's at so that you can be efficient with your time and not have to search 1547.52s - 1552.64s | new projects. Number two, we're your impartial third party to make sure that what you're 1552.64s - 1556.56s | submitting is good for our clients and that the clients are being fair to you. 1559.50s - 1568.14s | So when HackerOne started their first program, that is Yahoo. So I got the first book and that 1568.14s - 1575.42s | is, uh, uh, Yahoo mail, uh, Yahoo mobile mail accesses. And, uh, uh, they paid me only two, 1575.42s - 1582.94s | seven, seven dollars. And, uh, so I was, I was confused at why it is paid so low because it was 1582.94s - 1590.86s | under their, uh, Yahoo mobile email. That is their main application. So, uh, I think, uh, then, 1590.86s - 1596.46s | then, uh, I thought I, I probably lacked that demonstrating the impact here. And, uh, that's 1596.46s - 1605.58s | why, uh, the bounty was so low. Then, uh, the bug crowd, I submitted like, uh, uh, 48 plus 29. 1605.58s - 1612.86s | I don't know how, how much it is. And, uh, uh, so just 29 accepted and 48 was duplicate. So 1613.74s - 1620.54s | when you do a bug bounty, duplicates are part of it. And, uh, uh, you, uh, you just have to, 1620.54s - 1626.06s | uh, take, uh, take into consideration that you will get the duplicates because someone will 1626.14s - 1630.70s | be faster than you, uh, in submitted vulnerabilities. If, if someone has automation, 1630.70s - 1639.42s | uh, automation, they will be more faster than you. And then the last, the report


chunk_text:
uh, uh, they paid me only two, 1575.42s - 1582.94s | seven, seven dollars. And, uh, so I was, I was confused at why it is paid so low because it was 1582.94s - 1590.86s | under their, uh, Yahoo mobile email. That is their main application. So, uh, I think, uh, then, 1590.86s - 1596.46s | then, uh, I thought I, I probably lacked that demonstrating the impact here. And, uh, that's 1596.46s - 1605.58s | why, uh, the bounty was so low. Then, uh, the bug crowd, I submitted like, uh, uh, 48 plus 29. 1605.58s - 1612.86s | I don't know how, how much it is. And, uh, uh, so just 29 accepted and 48 was duplicate. So 1613.74s - 1620.54s | when you do a bug bounty, duplicates are part of it. And, uh, uh, you, uh, you just have to, 1620.54s - 1626.06s | uh, take, uh, take into consideration that you will get the duplicates because someone will 1626.14s - 1630.70s | be faster than you, uh, in submitted vulnerabilities. If, if someone has automation, 1630.70s - 1639.42s | uh, automation, they will be more faster than you. And then the last, the report writing. So, 1639.42s - 1648.14s | so, uh, I had a worst report writing, uh, at that time. And, uh, uh, it was, it was causing, 1648.14s - 1655.58s | uh, it was causing a lot of problems to me. Uh, so, uh, that, that is, that is the struggle. So 1656.54s - 1662.78s | yeah, I'm going to say this on report writing. Um, I've worked with a lot of our top guys. Um, 1662.78s - 1668.38s | and if said, some of them come back and said, at first I hated y'all, you know, I thought y'all 1668.38s - 1671.50s | were just running me through the ringer. I felt you were going to have to do all this stuff, 1671.50s - 1677.50s | jumping through all the hoops. And later they said, you know, at my day job, I'm now 10 times 1677.50s - 1682.46s | better at writing a report because of what you made me do. Um, we don't want these reports that 1682.46s - 1690.70s | say there's an injection. Here's your line impact. I took your stuff. I got to give me 1690.70s - 1695.82s | more than that. You've got to write


chunk_text:
writing. So, 1639.42s - 1648.14s | so, uh, I had a worst report writing, uh, at that time. And, uh, uh, it was, it was causing, 1648.14s - 1655.58s | uh, it was causing a lot of problems to me. Uh, so, uh, that, that is, that is the struggle. So 1656.54s - 1662.78s | yeah, I'm going to say this on report writing. Um, I've worked with a lot of our top guys. Um, 1662.78s - 1668.38s | and if said, some of them come back and said, at first I hated y'all, you know, I thought y'all 1668.38s - 1671.50s | were just running me through the ringer. I felt you were going to have to do all this stuff, 1671.50s - 1677.50s | jumping through all the hoops. And later they said, you know, at my day job, I'm now 10 times 1677.50s - 1682.46s | better at writing a report because of what you made me do. Um, we don't want these reports that 1682.46s - 1690.70s | say there's an injection. Here's your line impact. I took your stuff. I got to give me 1690.70s - 1695.82s | more than that. You've got to write it as a compelling story. Because when I go to a CISO 1696.46s - 1701.50s | and particularly if I go to a CEO, I hate to tell you guys, he doesn't know, nor care what an idol 1701.50s - 1707.18s | is. He doesn't care what SQL is. He doesn't know. That's not his job to know those things. He goes 1707.18s - 1712.22s | to SQL. I don't whatever. If I tell him, I just downloaded your entire database and could delete 1712.22s - 1717.90s | your entire production database. And I know who all your customers are. Are you caring now? Now 1717.90s - 1724.54s | he cares because he knows that that's a newsworthy item. Tell me that scary story. Do this in detail. 1724.54s - 1728.62s | Show me what can happen. You don't have to actually go out and publish it on the dark web, 1728.62s - 1734.22s | of course, that wouldn't work out well for us. Um, but if you go ahead and you just say, look, 1734.22s - 1741.34s | cross-site scripting, I've got document.cookie. I can send this out to my server and now harvest 1741.34s - 1745.82s | credentials.


chunk_text:
it as a compelling story. Because when I go to a CISO 1696.46s - 1701.50s | and particularly if I go to a CEO, I hate to tell you guys, he doesn't know, nor care what an idol 1701.50s - 1707.18s | is. He doesn't care what SQL is. He doesn't know. That's not his job to know those things. He goes 1707.18s - 1712.22s | to SQL. I don't whatever. If I tell him, I just downloaded your entire database and could delete 1712.22s - 1717.90s | your entire production database. And I know who all your customers are. Are you caring now? Now 1717.90s - 1724.54s | he cares because he knows that that's a newsworthy item. Tell me that scary story. Do this in detail. 1724.54s - 1728.62s | Show me what can happen. You don't have to actually go out and publish it on the dark web, 1728.62s - 1734.22s | of course, that wouldn't work out well for us. Um, but if you go ahead and you just say, look, 1734.22s - 1741.34s | cross-site scripting, I've got document.cookie. I can send this out to my server and now harvest 1741.34s - 1745.82s | credentials. And it's, you know, now it's persistent. Any logged in user, I can pull 1745.82s - 1750.22s | that from them. If they go to that page, I can get your leads. I can get your engineers. I can 1750.22s - 1755.66s | get your creds too. Now you've told me a scary story that I can take to the client. You've also 1755.66s - 1760.70s | made it clear to the triage team who may not be as clear on that type of bond as you are, because 1760.70s - 1765.34s | like we said, you're working to become that world-class expert in it. You may actually know 1765.34s - 1770.94s | more about that impact. So clarify your impact, write those reports, take a little bit longer and 1770.94s - 1776.86s | write a more verbose story, really give us extremely detailed steps as our reproduce, 1778.14s - 1781.98s | and then give us some good feedback on how to fix this thing. Because you may know more than 1781.98s - 1785.26s | the engineering team because to be blunt, they screwed it up in the first place. 1786.30s - 1791.42s | So tell us, talk to us,


chunk_text:
And it's, you know, now it's persistent. Any logged in user, I can pull 1745.82s - 1750.22s | that from them. If they go to that page, I can get your leads. I can get your engineers. I can 1750.22s - 1755.66s | get your creds too. Now you've told me a scary story that I can take to the client. You've also 1755.66s - 1760.70s | made it clear to the triage team who may not be as clear on that type of bond as you are, because 1760.70s - 1765.34s | like we said, you're working to become that world-class expert in it. You may actually know 1765.34s - 1770.94s | more about that impact. So clarify your impact, write those reports, take a little bit longer and 1770.94s - 1776.86s | write a more verbose story, really give us extremely detailed steps as our reproduce, 1778.14s - 1781.98s | and then give us some good feedback on how to fix this thing. Because you may know more than 1781.98s - 1785.26s | the engineering team because to be blunt, they screwed it up in the first place. 1786.30s - 1791.42s | So tell us, talk to us, be that story writer. I know as technical people, we want to keep it 1791.42s - 1796.54s | concise to the point and no extra fat. In this case, sometimes getting a little wordier is worth 1796.62s - 1802.06s | time and will significantly improve your reporting. When you have a report that I love, 1803.42s - 1807.82s | it's clear to me, and now I can start accepting it a lot more. If you start giving me garbage 1807.82s - 1811.58s | reports that are real brief and real short, it's real easy for me to miss your point 1812.54s - 1815.90s | and what you're actually getting at. So make sure you explain it, 1815.90s - 1819.26s | over explain it a little bit. Tell me those scary stories and the impact. 1820.14s - 1827.26s | Yeah. So I figured out that whatever the shortcomings, it's like always looking, 1827.26s - 1833.26s | I'm always looking for low-hanging fruits. Worst report writing, like in chaining the report to 1833.26s - 1839.66s | make it more impactful, and obviously not so fast in reporting and the target approach. 1840.38s - 1844.70s | Nix, I'm going to say one thing


chunk_text:
be that story writer. I know as technical people, we want to keep it 1791.42s - 1796.54s | concise to the point and no extra fat. In this case, sometimes getting a little wordier is worth 1796.62s - 1802.06s | time and will significantly improve your reporting. When you have a report that I love, 1803.42s - 1807.82s | it's clear to me, and now I can start accepting it a lot more. If you start giving me garbage 1807.82s - 1811.58s | reports that are real brief and real short, it's real easy for me to miss your point 1812.54s - 1815.90s | and what you're actually getting at. So make sure you explain it, 1815.90s - 1819.26s | over explain it a little bit. Tell me those scary stories and the impact. 1820.14s - 1827.26s | Yeah. So I figured out that whatever the shortcomings, it's like always looking, 1827.26s - 1833.26s | I'm always looking for low-hanging fruits. Worst report writing, like in chaining the report to 1833.26s - 1839.66s | make it more impactful, and obviously not so fast in reporting and the target approach. 1840.38s - 1844.70s | Nix, I'm going to say one thing about low-hanging fruit. When I first started, 1844.70s - 1848.70s | I thought Metasploit was the answer to everything. Great tool, a lot of fun, 1849.82s - 1853.42s | in two and a half years, I saw exactly one ball that was found with Metasploit. I was doing 1853.42s - 1859.02s | dozens a day. It's a very well-known tool that's a low-hanging fruit. Your dev team should be 1859.02s - 1864.30s | using it. If they're not, they need to be, right? These scanners, we're going to have to go deeper. 1865.42s - 1869.58s | You're going to have to really learn about the exploit, not just depend on the low-hanging 1869.58s - 1874.54s | fruit popping from the scanners. If that's what you're depending on, you got a long road. 1875.34s - 1880.46s | You've got to get a little more creative and do a little more. Some things are easy. Yeah, 1880.46s - 1885.18s | there's a few. Sometimes things are really simple, but sometimes they're not. You've got to go a 1885.18s - 1889.10s | little farther and the scanners may not point it out to you. You may have to start thinking 1889.10s - 1896.14s


chunk_text:
about low-hanging fruit. When I first started, 1844.70s - 1848.70s | I thought Metasploit was the answer to everything. Great tool, a lot of fun, 1849.82s - 1853.42s | in two and a half years, I saw exactly one ball that was found with Metasploit. I was doing 1853.42s - 1859.02s | dozens a day. It's a very well-known tool that's a low-hanging fruit. Your dev team should be 1859.02s - 1864.30s | using it. If they're not, they need to be, right? These scanners, we're going to have to go deeper. 1865.42s - 1869.58s | You're going to have to really learn about the exploit, not just depend on the low-hanging 1869.58s - 1874.54s | fruit popping from the scanners. If that's what you're depending on, you got a long road. 1875.34s - 1880.46s | You've got to get a little more creative and do a little more. Some things are easy. Yeah, 1880.46s - 1885.18s | there's a few. Sometimes things are really simple, but sometimes they're not. You've got to go a 1885.18s - 1889.10s | little farther and the scanners may not point it out to you. You may have to start thinking 1889.10s - 1896.14s | through it and get a little more creative. I kind of started taking things a little 1896.14s - 1903.10s | seriously and I was delving into more impactful findings and blogs by other researchers, 1903.10s - 1909.02s | learning from the community, and exploring other pen test reports, excellently written reports 1909.02s - 1915.58s | to figure out what's actually going wrong from my end, and adapting the platforms, 1915.58s - 1926.38s | how platforms are working, what are the target rotations, and what programs are less eyes and 1926.38s - 1934.70s | what programs has more eyes. Obviously, the CTF and labs are quite helpful because 1934.70s - 1941.82s | you will get to learn how the exploits is working. The one more thing, the one target, 1941.82s - 1949.42s | you have to target one at a time, so you will get a better idea about how the target is working and 1950.22s - 1956.54s | how their business logic is. Yeah, so learning from the community, 1956.54s - 1960.22s | one of the big things I've seen, and I'm going to say something a little blasphemous right now, 1961.34s - 1964.30s | if you come into


chunk_text:
| through it and get a little more creative. I kind of started taking things a little 1896.14s - 1903.10s | seriously and I was delving into more impactful findings and blogs by other researchers, 1903.10s - 1909.02s | learning from the community, and exploring other pen test reports, excellently written reports 1909.02s - 1915.58s | to figure out what's actually going wrong from my end, and adapting the platforms, 1915.58s - 1926.38s | how platforms are working, what are the target rotations, and what programs are less eyes and 1926.38s - 1934.70s | what programs has more eyes. Obviously, the CTF and labs are quite helpful because 1934.70s - 1941.82s | you will get to learn how the exploits is working. The one more thing, the one target, 1941.82s - 1949.42s | you have to target one at a time, so you will get a better idea about how the target is working and 1950.22s - 1956.54s | how their business logic is. Yeah, so learning from the community, 1956.54s - 1960.22s | one of the big things I've seen, and I'm going to say something a little blasphemous right now, 1961.34s - 1964.30s | if you come into bug bounty hunting and you're looking for the money, 1965.58s - 1970.22s | you're probably going to have a hard road. If you come into it and say, I have paid thousands 1970.22s - 1975.34s | on courses, I have paid thousands for school, and I paid a lot of money to get certifications, 1975.34s - 1980.38s | this is free. You're going to be in the right mind space. Let the money come when it will, 1980.38s - 1985.18s | right? That's a bonus. This is free training that you may actually get a little bit of money for. 1986.38s - 1989.98s | As you start seeing that, you're going to start finding success. The people who I know who came 1989.98s - 1994.46s | into it who said, I just want to sharpen my skills are very successful. The people who come 1994.46s - 1999.50s | into it and immediately I'm like, I need to pay a bill next weekend. I need to have beer for Friday. 2000.14s - 2003.74s | You're going to have a hard time. You're going to get frustrated. So come into it 2003.82s - 2010.30s | mind space wise and say, I'm wanting


chunk_text:
bug bounty hunting and you're looking for the money, 1965.58s - 1970.22s | you're probably going to have a hard road. If you come into it and say, I have paid thousands 1970.22s - 1975.34s | on courses, I have paid thousands for school, and I paid a lot of money to get certifications, 1975.34s - 1980.38s | this is free. You're going to be in the right mind space. Let the money come when it will, 1980.38s - 1985.18s | right? That's a bonus. This is free training that you may actually get a little bit of money for. 1986.38s - 1989.98s | As you start seeing that, you're going to start finding success. The people who I know who came 1989.98s - 1994.46s | into it who said, I just want to sharpen my skills are very successful. The people who come 1994.46s - 1999.50s | into it and immediately I'm like, I need to pay a bill next weekend. I need to have beer for Friday. 2000.14s - 2003.74s | You're going to have a hard time. You're going to get frustrated. So come into it 2003.82s - 2010.30s | mind space wise and say, I'm wanting to learn and use the community. Whether it is Discord, 2011.02s - 2015.58s | the different channels that we have set up, we have Slack channels that you can actually just 2015.58s - 2019.98s | reach out and say, hey, Nix, I'm kind of stuck. Now he's not going to go and say, hey, here's 2019.98s - 2024.62s | a cross that script and go find it because he's also looking for it, right? But if you're stuck 2024.62s - 2028.62s | and you have a good idea, you're like, I just don't have this payload. Where can I look for 2028.62s - 2033.98s | more info? That's where you can reach out for help from the community. Nobody's going to give 2033.98s - 2039.26s | you the free answer, but you can start getting, figure out how to get better. And you've got 2039.26s - 2045.02s | access to world-class trainers because they are doing it. So reach out, educate yourself, 2045.02s - 2051.10s | use this as an education tool, use the community. Each of the platforms has a community person 2051.74s - 2055.74s | who is there to help you succeed. That's their job. So use that.


chunk_text:
to learn and use the community. Whether it is Discord, 2011.02s - 2015.58s | the different channels that we have set up, we have Slack channels that you can actually just 2015.58s - 2019.98s | reach out and say, hey, Nix, I'm kind of stuck. Now he's not going to go and say, hey, here's 2019.98s - 2024.62s | a cross that script and go find it because he's also looking for it, right? But if you're stuck 2024.62s - 2028.62s | and you have a good idea, you're like, I just don't have this payload. Where can I look for 2028.62s - 2033.98s | more info? That's where you can reach out for help from the community. Nobody's going to give 2033.98s - 2039.26s | you the free answer, but you can start getting, figure out how to get better. And you've got 2039.26s - 2045.02s | access to world-class trainers because they are doing it. So reach out, educate yourself, 2045.02s - 2051.10s | use this as an education tool, use the community. Each of the platforms has a community person 2051.74s - 2055.74s | who is there to help you succeed. That's their job. So use that. 2056.54s - 2067.02s | So in my previous point, I delve into target approach and platform adoption. So what I mean 2067.02s - 2074.38s | to say from the platform adoption is, let's say H1, HackerOne and Buckrowd was accepting reports 2074.46s - 2081.82s | on first come first services, but the other platform like Sennac is using a quality rule 2082.38s - 2090.14s | during 2016 to 2023. And the quality rule is something like that, that you have, they choose 2090.14s - 2101.34s | the best written report during that time. And even if you submitted last and the report is fine, 2101.34s - 2109.58s | then they submit the last report on the basis of just the report writing. But this has been 2109.58s - 2117.42s | remote now and they start using first come first serve only. So that is the platform adoption 2117.42s - 2128.62s | because you have to know what is going on on the platform and how to work on the particular 2129.34s - 2134.86s | platform. Yeah, each platform is a little different. And so when you're working with 2134.86s - 2139.42s | them, make sure you know what your rules


chunk_text:
2056.54s - 2067.02s | So in my previous point, I delve into target approach and platform adoption. So what I mean 2067.02s - 2074.38s | to say from the platform adoption is, let's say H1, HackerOne and Buckrowd was accepting reports 2074.46s - 2081.82s | on first come first services, but the other platform like Sennac is using a quality rule 2082.38s - 2090.14s | during 2016 to 2023. And the quality rule is something like that, that you have, they choose 2090.14s - 2101.34s | the best written report during that time. And even if you submitted last and the report is fine, 2101.34s - 2109.58s | then they submit the last report on the basis of just the report writing. But this has been 2109.58s - 2117.42s | remote now and they start using first come first serve only. So that is the platform adoption 2117.42s - 2128.62s | because you have to know what is going on on the platform and how to work on the particular 2129.34s - 2134.86s | platform. Yeah, each platform is a little different. And so when you're working with 2134.86s - 2139.42s | them, make sure you know what your rules are. The first thing when you get on a platform, 2139.42s - 2145.50s | read all the rules. And that's really kind of simple. I'll say this Sennac setup is fairly 2145.50s - 2150.38s | complicated because you've got a VPN, you've got a VM, and you've got dedicated IPs that you're 2150.38s - 2155.90s | coming from. When you're going with some others, maybe you need to note, I'm a researcher in there 2155.90s - 2160.46s | because you're not on that secured network. They don't know who you are. And you're sending 2160.46s - 2165.42s | attack traffic and live target guys. If they don't know who you are, that may alarm them. 2165.42s - 2169.66s | So go and find out the rules. Make sure you're really clear before you go start sending attack 2169.66s - 2174.22s | traffic and figure out which platform works for you. There is no one answer. There is different 2174.22s - 2178.54s | platforms because they have different strengths and weaknesses. So find out what works for you. 2178.54s - 2184.38s | And a lot of people work on all of them. There's no downside to that. One interesting note, 2184.38s


chunk_text:
are. The first thing when you get on a platform, 2139.42s - 2145.50s | read all the rules. And that's really kind of simple. I'll say this Sennac setup is fairly 2145.50s - 2150.38s | complicated because you've got a VPN, you've got a VM, and you've got dedicated IPs that you're 2150.38s - 2155.90s | coming from. When you're going with some others, maybe you need to note, I'm a researcher in there 2155.90s - 2160.46s | because you're not on that secured network. They don't know who you are. And you're sending 2160.46s - 2165.42s | attack traffic and live target guys. If they don't know who you are, that may alarm them. 2165.42s - 2169.66s | So go and find out the rules. Make sure you're really clear before you go start sending attack 2169.66s - 2174.22s | traffic and figure out which platform works for you. There is no one answer. There is different 2174.22s - 2178.54s | platforms because they have different strengths and weaknesses. So find out what works for you. 2178.54s - 2184.38s | And a lot of people work on all of them. There's no downside to that. One interesting note, 2184.38s - 2190.62s | even though the quality rule, the QR is now not a thing. The reason why that happened was to make 2190.62s - 2198.38s | sure that the reports had good quality and that they were written well. So you go back to remember 2198.38s - 2203.42s | what I said about write the report well. That was what we were trying to get out there. So it was 2203.42s - 2209.34s | that important that we actually had an entire rule around this and have platform-based stuff on it. 2209.34s - 2214.14s | So just remember that the triage is going to very favorably respond to that good report writing. 2215.02s - 2224.70s | So when I have all of this in mind and I refine my skills, I actually able to find some good 2224.70s - 2233.58s | vulnerabilities starting from the HelloSign one. This was found in 2015. It was straight 2234.62s - 2241.18s | an SSRF that is called through the event callback functionality. And I was able to 2241.18s - 2250.86s | call back their past WD file. So and the Microsoft started their bug bounty program 2250.86s - 2261.18s | for online


chunk_text:
- 2190.62s | even though the quality rule, the QR is now not a thing. The reason why that happened was to make 2190.62s - 2198.38s | sure that the reports had good quality and that they were written well. So you go back to remember 2198.38s - 2203.42s | what I said about write the report well. That was what we were trying to get out there. So it was 2203.42s - 2209.34s | that important that we actually had an entire rule around this and have platform-based stuff on it. 2209.34s - 2214.14s | So just remember that the triage is going to very favorably respond to that good report writing. 2215.02s - 2224.70s | So when I have all of this in mind and I refine my skills, I actually able to find some good 2224.70s - 2233.58s | vulnerabilities starting from the HelloSign one. This was found in 2015. It was straight 2234.62s - 2241.18s | an SSRF that is called through the event callback functionality. And I was able to 2241.18s - 2250.86s | call back their past WD file. So and the Microsoft started their bug bounty program 2250.86s - 2261.18s | for online services in 2014, late 2014. I submitted multiple reports and 90% reports 2261.18s - 2273.58s | got accepted while 10% got duplicate only. So I was pretty fast. I understand what to do 2274.46s - 2282.30s | for a particular program. And I target only one program at a time. And I focus more on 2282.86s - 2292.62s | high-impact vulnerabilities. And then later I got listed into MSRC top 100 and also 2293.98s - 2303.39s | awarded with this laptop. Then I came in full-time pursuit because I created a 2303.39s - 2309.87s | financial backup out of whatever bug bounties I have got. I stepped away from 9-to-5 job. 2310.43s - 2318.83s | And I turned into the full-time bug bounty hunter. So that's how you can start being a 2318.83s - 2325.63s | full-time bug bounty hunter. You create a backup for yourself. And then only you can step away 2325.63s - 2334.91s | from a daily job and start doing a full-time bug bounty. Because bug bounty has a lot of money. 2334.91s - 2341.71s | But it also gives you a lot of stress too. Yeah. So one thing I'll say is that we've noticed


chunk_text:
services in 2014, late 2014. I submitted multiple reports and 90% reports 2261.18s - 2273.58s | got accepted while 10% got duplicate only. So I was pretty fast. I understand what to do 2274.46s - 2282.30s | for a particular program. And I target only one program at a time. And I focus more on 2282.86s - 2292.62s | high-impact vulnerabilities. And then later I got listed into MSRC top 100 and also 2293.98s - 2303.39s | awarded with this laptop. Then I came in full-time pursuit because I created a 2303.39s - 2309.87s | financial backup out of whatever bug bounties I have got. I stepped away from 9-to-5 job. 2310.43s - 2318.83s | And I turned into the full-time bug bounty hunter. So that's how you can start being a 2318.83s - 2325.63s | full-time bug bounty hunter. You create a backup for yourself. And then only you can step away 2325.63s - 2334.91s | from a daily job and start doing a full-time bug bounty. Because bug bounty has a lot of money. 2334.91s - 2341.71s | But it also gives you a lot of stress too. Yeah. So one thing I'll say is that we've noticed 2341.71s - 2346.83s | that first of all, he started incorporating these techniques of listening, improving his reporting, 2346.83s - 2351.95s | focusing, and starting to see success. One thing really important to notice, and I've told people 2351.95s - 2355.55s | this a lot of times, if you're going to go out and Saturday you're going to go, yep, I'm going 2355.55s - 2358.91s | to go bug hunt. I'm going to spend four hours on it. And I'm going to do a few hours on Sunday 2358.91s - 2364.27s | and see what happens. Your odds of success are almost zero, okay? If that's your first time 2364.27s - 2369.23s | out there, it's going to take you a while, guys. Average vols come in. Your first average vol is 2369.23s - 2374.27s | 20 hours of research, okay? But then as he said, it keeps getting faster. Then it becomes 10. Then 2374.27s - 2378.11s | it becomes five. Then it becomes two. Then it becomes 30 minutes. Then it becomes 10 minutes 2378.11s - 2384.11s | to find a single lie. But you have to put in the time. If you're planning on doing this, I'd


chunk_text:
2341.71s - 2346.83s | that first of all, he started incorporating these techniques of listening, improving his reporting, 2346.83s - 2351.95s | focusing, and starting to see success. One thing really important to notice, and I've told people 2351.95s - 2355.55s | this a lot of times, if you're going to go out and Saturday you're going to go, yep, I'm going 2355.55s - 2358.91s | to go bug hunt. I'm going to spend four hours on it. And I'm going to do a few hours on Sunday 2358.91s - 2364.27s | and see what happens. Your odds of success are almost zero, okay? If that's your first time 2364.27s - 2369.23s | out there, it's going to take you a while, guys. Average vols come in. Your first average vol is 2369.23s - 2374.27s | 20 hours of research, okay? But then as he said, it keeps getting faster. Then it becomes 10. Then 2374.27s - 2378.11s | it becomes five. Then it becomes two. Then it becomes 30 minutes. Then it becomes 10 minutes 2378.11s - 2384.11s | to find a single lie. But you have to put in the time. If you're planning on doing this, I'd say 2384.11s - 2389.95s | there's a 40-hour rule here. Then if you're going to have a 98% chance of success, plan on spending 2389.95s - 2396.67s | 40 hours dedicated and have most of it on one to two targets. Get to know that thing really well. 2397.47s - 2401.87s | You know, spend that 40 hours, then assess whether this is for you or not. Because if you quit too 2401.87s - 2406.67s | soon, you're not going to really benefit from it. You've got to be persistent. You're going to start 2406.67s - 2411.31s | doing that and start seeing income coming in. Now, you may have a little shoebox of income 2411.31s - 2415.95s | that you're like, okay, I'm making enough to take my family to a really nice dinner this month. 2415.95s - 2421.39s | That's what I got off bug bounty is that really nice dinner, you know, great steakhouse, great. 2421.95s - 2425.63s | And you may be happy with that. Maybe that's the, you want the little bucket that's enough 2425.63s - 2431.87s | to make a car payment. Maybe you start realizing it's getting bigger. We had one of our


chunk_text:
say 2384.11s - 2389.95s | there's a 40-hour rule here. Then if you're going to have a 98% chance of success, plan on spending 2389.95s - 2396.67s | 40 hours dedicated and have most of it on one to two targets. Get to know that thing really well. 2397.47s - 2401.87s | You know, spend that 40 hours, then assess whether this is for you or not. Because if you quit too 2401.87s - 2406.67s | soon, you're not going to really benefit from it. You've got to be persistent. You're going to start 2406.67s - 2411.31s | doing that and start seeing income coming in. Now, you may have a little shoebox of income 2411.31s - 2415.95s | that you're like, okay, I'm making enough to take my family to a really nice dinner this month. 2415.95s - 2421.39s | That's what I got off bug bounty is that really nice dinner, you know, great steakhouse, great. 2421.95s - 2425.63s | And you may be happy with that. Maybe that's the, you want the little bucket that's enough 2425.63s - 2431.87s | to make a car payment. Maybe you start realizing it's getting bigger. We had one of our analysts, 2432.91s - 2437.87s | really bright guy, senior analyst, paid him fairly well, of course. And he was bug hunting on the 2437.87s - 2444.59s | side. And on very limited, very hardened targets, we started seeing he was making a lot of money 2444.59s - 2450.19s | to the point that he was making more as a bug hunter than he was as a full-time security analyst. 2450.19s - 2453.23s | And everybody asked him, why don't you quit? He goes, well, I like this, you know, 2453.23s - 2458.51s | guaranteed income, right? Okay. Fair enough. Finally, he got to the point that, and he had 2458.51s - 2464.43s | the money bank back sitting in the bank to float him for a while. But he realized that he was 2464.43s - 2469.47s | actually losing money by working full-time as a security analyst. And that was when he decided 2469.47s - 2476.27s | to quit and go full-time. So wait on the money and use the education time and start watching 2476.27s - 2480.27s | where that bucket of money is doing, how often it comes in, and then you can make those decisions. 2480.99s -


chunk_text:
analysts, 2432.91s - 2437.87s | really bright guy, senior analyst, paid him fairly well, of course. And he was bug hunting on the 2437.87s - 2444.59s | side. And on very limited, very hardened targets, we started seeing he was making a lot of money 2444.59s - 2450.19s | to the point that he was making more as a bug hunter than he was as a full-time security analyst. 2450.19s - 2453.23s | And everybody asked him, why don't you quit? He goes, well, I like this, you know, 2453.23s - 2458.51s | guaranteed income, right? Okay. Fair enough. Finally, he got to the point that, and he had 2458.51s - 2464.43s | the money bank back sitting in the bank to float him for a while. But he realized that he was 2464.43s - 2469.47s | actually losing money by working full-time as a security analyst. And that was when he decided 2469.47s - 2476.27s | to quit and go full-time. So wait on the money and use the education time and start watching 2476.27s - 2480.27s | where that bucket of money is doing, how often it comes in, and then you can make those decisions. 2480.99s - 2486.91s | Please do not jump off next week and go, I'm that good. I've got my OSCP. I've got my OSCE. 2486.91s - 2491.15s | I'm going to become a full-time bounty hunter because that very well may turn out to be a 2491.15s - 2495.47s | very bad financial decision. Even if you're the best out there, you've got to have some 2495.47s - 2499.87s | time to figure out what is your income going to look like from this. And so use that time to spin 2499.87s - 2504.35s | up and figure that out. And that's when you can start stepping aside from the nine to five with 2504.35s - 2510.91s | this. So when you've got motivation and some confidence, you can do better in the longer 2510.91s - 2519.79s | terms, but you need to back by some good findings in order to keep those, keep those bounty hunter 2520.19s - 2528.75s | running. So I'm moving on to some key discoveries that I've found during my bug bounty hunting. 2529.63s - 2537.47s | A couple of them, like first one is a SQL injection in a biggest e-commerce solution 2537.47s - 2548.75s |


chunk_text:
2486.91s | Please do not jump off next week and go, I'm that good. I've got my OSCP. I've got my OSCE. 2486.91s - 2491.15s | I'm going to become a full-time bounty hunter because that very well may turn out to be a 2491.15s - 2495.47s | very bad financial decision. Even if you're the best out there, you've got to have some 2495.47s - 2499.87s | time to figure out what is your income going to look like from this. And so use that time to spin 2499.87s - 2504.35s | up and figure that out. And that's when you can start stepping aside from the nine to five with 2504.35s - 2510.91s | this. So when you've got motivation and some confidence, you can do better in the longer 2510.91s - 2519.79s | terms, but you need to back by some good findings in order to keep those, keep those bounty hunter 2520.19s - 2528.75s | running. So I'm moving on to some key discoveries that I've found during my bug bounty hunting. 2529.63s - 2537.47s | A couple of them, like first one is a SQL injection in a biggest e-commerce solution 2537.47s - 2548.75s | in the world. So you can guess about it. So I was onboarded on a target at this e-commerce solution 2548.83s - 2563.14s | and while modifying the profile, I came across a country ID. And just a second. Okay. Sorry. I 2563.14s - 2575.97s | think this slide, I don't know how it comes. So yeah. So it was an online car marketplace. 2575.97s - 2587.73s | And I start, so I started running brute force on directories and files. And the application 2587.73s - 2595.65s | keep redirecting me to the login page on each directory and file brute force. Like that. 2596.61s - 2608.77s | Each hit getting redirected to 302 and it was kind of loop. And I tried to change the methods, 2608.77s - 2616.37s | but I got the same result out of it. So what I do, I notice the application is using a third 2616.37s - 2625.01s | party solutions. So what I do, I went to the third party solution and found it was a hosted 2625.49s - 2636.29s | invoice solution they are using. So what I do, I went ahead and see if there are any demo version 2636.29s


chunk_text:
in the world. So you can guess about it. So I was onboarded on a target at this e-commerce solution 2548.83s - 2563.14s | and while modifying the profile, I came across a country ID. And just a second. Okay. Sorry. I 2563.14s - 2575.97s | think this slide, I don't know how it comes. So yeah. So it was an online car marketplace. 2575.97s - 2587.73s | And I start, so I started running brute force on directories and files. And the application 2587.73s - 2595.65s | keep redirecting me to the login page on each directory and file brute force. Like that. 2596.61s - 2608.77s | Each hit getting redirected to 302 and it was kind of loop. And I tried to change the methods, 2608.77s - 2616.37s | but I got the same result out of it. So what I do, I notice the application is using a third 2616.37s - 2625.01s | party solutions. So what I do, I went to the third party solution and found it was a hosted 2625.49s - 2636.29s | invoice solution they are using. So what I do, I went ahead and see if there are any demo version 2636.29s - 2641.41s | available of the application. I couldn't find any demo version available anywhere. 2641.41s - 2654.13s | So what I did, I did a subdomain brute force of the third party provider. And I found a demo 2654.13s - 2664.69s | version running. And the demo version, these are all the demo version that are available for that 2664.69s - 2675.49s | application. And after exploring a bit, and watching the YouTube videos, I found that once, 2676.45s - 2695.10s | I mean, there was a, I found like, I was looking for a path from the application, which I couldn't 2695.10s - 2704.06s | get. But after getting the demo version of it, I found that the application do not have any 2704.06s - 2714.94s | authentication, but it was totally unauthenticated. They have added some rules in the path that was 2714.94s - 2723.02s | denying me to actually accessing the direct path in the application. So what I did, I just 2724.70s - 2733.18s | used that demo version to retract all the paths. And I just changed the domain name from the 2733.18s - 2741.42s | application. And I started fuzzing for SQLi vulnerability


chunk_text:
- 2641.41s | available of the application. I couldn't find any demo version available anywhere. 2641.41s - 2654.13s | So what I did, I did a subdomain brute force of the third party provider. And I found a demo 2654.13s - 2664.69s | version running. And the demo version, these are all the demo version that are available for that 2664.69s - 2675.49s | application. And after exploring a bit, and watching the YouTube videos, I found that once, 2676.45s - 2695.10s | I mean, there was a, I found like, I was looking for a path from the application, which I couldn't 2695.10s - 2704.06s | get. But after getting the demo version of it, I found that the application do not have any 2704.06s - 2714.94s | authentication, but it was totally unauthenticated. They have added some rules in the path that was 2714.94s - 2723.02s | denying me to actually accessing the direct path in the application. So what I did, I just 2724.70s - 2733.18s | used that demo version to retract all the paths. And I just changed the domain name from the 2733.18s - 2741.42s | application. And I started fuzzing for SQLi vulnerability on all the parameters that has been 2741.42s - 2752.22s | into, that has been used into the application. And I found that I was able to dump all of their 2753.02s - 2765.74s | databases because one parameter was vulnerable to SQLi. Then this is one of the banking asset that 2766.62s - 2776.86s | I got. So what they're doing that they are fetching one JavaScript file from a CDN file name 2776.86s - 2789.10s | parameter. And what I did, so CDN file name takes file input from file input such as user 2789.50s - 2799.90s | underscore tools.bundle. So in the comment, I have seen there was a comment that the file comment, 2799.90s - 2811.02s | which is having an API.github.com. And that user underscore tools.bundle was printed in that 2811.02s - 2819.50s | particular path. So I thought that let's do one thing. That's user dot dot slash to come on to 2819.50s - 2836.86s | the root path and then try to use API.github.com to query the internal data from the GitHub API. 2837.66s - 2849.02s | So I just used their events query and I was able to dump their internal events,


chunk_text:
on all the parameters that has been 2741.42s - 2752.22s | into, that has been used into the application. And I found that I was able to dump all of their 2753.02s - 2765.74s | databases because one parameter was vulnerable to SQLi. Then this is one of the banking asset that 2766.62s - 2776.86s | I got. So what they're doing that they are fetching one JavaScript file from a CDN file name 2776.86s - 2789.10s | parameter. And what I did, so CDN file name takes file input from file input such as user 2789.50s - 2799.90s | underscore tools.bundle. So in the comment, I have seen there was a comment that the file comment, 2799.90s - 2811.02s | which is having an API.github.com. And that user underscore tools.bundle was printed in that 2811.02s - 2819.50s | particular path. So I thought that let's do one thing. That's user dot dot slash to come on to 2819.50s - 2836.86s | the root path and then try to use API.github.com to query the internal data from the GitHub API. 2837.66s - 2849.02s | So I just used their events query and I was able to dump their internal events, all the events 2850.38s - 2861.18s | from the CDN file parameters only. Because the dot dot slash was taking all the file path to 2861.18s - 2867.02s | API.github.com only. Do you want to add something? 2867.98s - 2872.22s | Right now, this is your vault. So I'm going to let you go with that. You know, some of the things 2872.22s - 2876.62s | that I'm thinking about in the back of my head right now is just the persistence. And some of 2876.62s - 2881.74s | the things that we're kind of looking at is how do we succeed? You know, and so I'd say the 2881.74s - 2886.70s | persistence, keeping at it, learning, those are some of your key takeaways for how you start doing 2886.70s - 2892.86s | this and how you start making money. How do we start succeeding in bug bounty? And just understanding 2892.86s - 2898.06s | that there is a learning path. So that's kind of where I'm thinking right now. But keep running 2898.06s - 2905.34s | with the bolts, man. I always like bolts. So this was an account takeover vulnerability. 2905.34s - 2913.10s | So after doing


chunk_text:
all the events 2850.38s - 2861.18s | from the CDN file parameters only. Because the dot dot slash was taking all the file path to 2861.18s - 2867.02s | API.github.com only. Do you want to add something? 2867.98s - 2872.22s | Right now, this is your vault. So I'm going to let you go with that. You know, some of the things 2872.22s - 2876.62s | that I'm thinking about in the back of my head right now is just the persistence. And some of 2876.62s - 2881.74s | the things that we're kind of looking at is how do we succeed? You know, and so I'd say the 2881.74s - 2886.70s | persistence, keeping at it, learning, those are some of your key takeaways for how you start doing 2886.70s - 2892.86s | this and how you start making money. How do we start succeeding in bug bounty? And just understanding 2892.86s - 2898.06s | that there is a learning path. So that's kind of where I'm thinking right now. But keep running 2898.06s - 2905.34s | with the bolts, man. I always like bolts. So this was an account takeover vulnerability. 2905.34s - 2913.10s | So after doing subdomain discovery, I stumbled across a subdomain and it was giving a 403 2913.82s - 2921.50s | forbidden error. So the 404 written error looks interesting to me. So what I did, I just did 2922.14s - 2928.38s | quick Google search. And it was listing out a lot of applications. But one of the applications 2928.38s - 2935.90s | looks interesting. So but it was asking for some deviant ID, which I do not know because 2936.70s - 2945.66s | that is some unique thing. So I searched everywhere deviant ID was not available anywhere. 2946.06s - 2954.70s | So I just did a simple, simple Google search on deviant ID on images, images section, 2954.70s - 2963.98s | and I got I got some jumbo.com having a lot of contract IDs available under the 2964.94s - 2974.06s | under under the papers and they have them as a deviant ID as as a deviant ID field. 2974.78s - 2982.38s | So I collected those all all those deviant IDs from the Google images section on the and all 2982.38s - 2989.90s | those all those images are available on some jumbo.com site. I don't know how to how


chunk_text:
subdomain discovery, I stumbled across a subdomain and it was giving a 403 2913.82s - 2921.50s | forbidden error. So the 404 written error looks interesting to me. So what I did, I just did 2922.14s - 2928.38s | quick Google search. And it was listing out a lot of applications. But one of the applications 2928.38s - 2935.90s | looks interesting. So but it was asking for some deviant ID, which I do not know because 2936.70s - 2945.66s | that is some unique thing. So I searched everywhere deviant ID was not available anywhere. 2946.06s - 2954.70s | So I just did a simple, simple Google search on deviant ID on images, images section, 2954.70s - 2963.98s | and I got I got some jumbo.com having a lot of contract IDs available under the 2964.94s - 2974.06s | under under the papers and they have them as a deviant ID as as a deviant ID field. 2974.78s - 2982.38s | So I collected those all all those deviant IDs from the Google images section on the and all 2982.38s - 2989.90s | those all those images are available on some jumbo.com site. I don't know how to how to get it. 2990.38s - 2997.26s | So I so I in the in the subject section, they have a lot of these deviant IDs available. I 2997.26s - 3004.38s | use those deviant IDs. And I went to the application, I just use the forget password. 3004.38s - 3012.38s | And I have seen that the the past the application was actually fetching the password for that 3012.38s - 3018.86s | particular deviant ID and sending to me sending to the user in the plain text format in the in 3018.86s - 3025.10s | one request itself. So I just use that particular password and deviant ID to log into the application. 3028.32s - 3032.72s | So one thing I'm going to point out here is that you said something really interesting. 3032.72s - 3036.96s | I didn't know what it was. So I started looking for it. Google it. Google is your friend, right? 3037.60s - 3040.64s | I don't know how we would ever begin to hack before Google was what it is now. 3042.08s - 3045.84s | A lot of your time is going to be spent researching. Nobody in this room knows 3045.84s - 3049.84s


chunk_text:
to get it. 2990.38s - 2997.26s | So I so I in the in the subject section, they have a lot of these deviant IDs available. I 2997.26s - 3004.38s | use those deviant IDs. And I went to the application, I just use the forget password. 3004.38s - 3012.38s | And I have seen that the the past the application was actually fetching the password for that 3012.38s - 3018.86s | particular deviant ID and sending to me sending to the user in the plain text format in the in 3018.86s - 3025.10s | one request itself. So I just use that particular password and deviant ID to log into the application. 3028.32s - 3032.72s | So one thing I'm going to point out here is that you said something really interesting. 3032.72s - 3036.96s | I didn't know what it was. So I started looking for it. Google it. Google is your friend, right? 3037.60s - 3040.64s | I don't know how we would ever begin to hack before Google was what it is now. 3042.08s - 3045.84s | A lot of your time is going to be spent researching. Nobody in this room knows 3045.84s - 3049.84s | everything about everything in cyber. And if you think you do, I would love to talk to you. 3051.68s - 3054.96s | Look at these things. When you see something you don't understand, take a curiosity. 3054.96s - 3059.68s | I many times I've seen something that I've been like, OK, what is it? All of a sudden, 3059.68s - 3064.64s | I find out that is a key piece of information that is not supposed to be shared. This is a 3064.64s - 3068.64s | private something that is really sensitive. All of a sudden, I can start finding a way. 3068.64s - 3072.96s | These are used for that. Really? OK, now I'm interested that parameter. 3072.96s - 3077.84s | That was just something weird beforehand. So take the time to really understand the apps. 3078.64s - 3082.72s | This is why earlier we said stop. Look at that one target. Get to know it. 3083.36s - 3088.72s | Go and spend five, 10 hours on that target to really know it in depth. And part of that's 3088.72s - 3091.76s | just going to be your research time to understand what all these parameters are. 3092.32s


chunk_text:
| everything about everything in cyber. And if you think you do, I would love to talk to you. 3051.68s - 3054.96s | Look at these things. When you see something you don't understand, take a curiosity. 3054.96s - 3059.68s | I many times I've seen something that I've been like, OK, what is it? All of a sudden, 3059.68s - 3064.64s | I find out that is a key piece of information that is not supposed to be shared. This is a 3064.64s - 3068.64s | private something that is really sensitive. All of a sudden, I can start finding a way. 3068.64s - 3072.96s | These are used for that. Really? OK, now I'm interested that parameter. 3072.96s - 3077.84s | That was just something weird beforehand. So take the time to really understand the apps. 3078.64s - 3082.72s | This is why earlier we said stop. Look at that one target. Get to know it. 3083.36s - 3088.72s | Go and spend five, 10 hours on that target to really know it in depth. And part of that's 3088.72s - 3091.76s | just going to be your research time to understand what all these parameters are. 3092.32s - 3095.52s | DVM means something. They didn't just come up with that randomly. 3096.24s - 3100.08s | So what is it? What are they trying to communicate with that number? Understand that, 3100.08s - 3103.68s | and you're going to have a lot better chance of success and finding the right places to 3103.68s - 3108.72s | manipulate and poke. So when you said I went and I Googled it, I wasn't familiar with it, 3108.72s - 3113.04s | that's part of that time we said spend a lot of time on that target. Use that curiosity. 3113.68s - 3117.44s | Of course, a lot of them are going to be nothing interesting. But it's when you find that one 3117.44s - 3121.60s | interesting that you're like, oh, really, that whole parameter crawls the entire account for 3121.60s - 3128.16s | admins. Interesting. Now I want to play with that one. So it's going to help you focus whenever you 3128.16s - 3132.16s | start doing these researches on things you don't understand and see it's kind of weirdness. 3132.80s - 3140.96s | This was another one was an SSR of an ASM solution. The target launched and


chunk_text:
- 3095.52s | DVM means something. They didn't just come up with that randomly. 3096.24s - 3100.08s | So what is it? What are they trying to communicate with that number? Understand that, 3100.08s - 3103.68s | and you're going to have a lot better chance of success and finding the right places to 3103.68s - 3108.72s | manipulate and poke. So when you said I went and I Googled it, I wasn't familiar with it, 3108.72s - 3113.04s | that's part of that time we said spend a lot of time on that target. Use that curiosity. 3113.68s - 3117.44s | Of course, a lot of them are going to be nothing interesting. But it's when you find that one 3117.44s - 3121.60s | interesting that you're like, oh, really, that whole parameter crawls the entire account for 3121.60s - 3128.16s | admins. Interesting. Now I want to play with that one. So it's going to help you focus whenever you 3128.16s - 3132.16s | start doing these researches on things you don't understand and see it's kind of weirdness. 3132.80s - 3140.96s | This was another one was an SSR of an ASM solution. The target launched and there was no 3140.96s - 3148.08s | vulnerability submitted on it. No vulnerability accepted on it. So this makes me curious why. 3148.08s - 3155.28s | So I started digging into the application. So what application is doing? It starts doing 3155.84s - 3162.32s | recon for subdomain IP address and all the certs. And it also creates a screenshot of 3162.32s - 3168.00s | a parent domain too. So I got interested that if it is creating a screenshot of that parent too, 3168.88s - 3181.92s | maybe I can use maybe I can use some domains and redirect that domains to my custom payload. 3181.92s - 3191.36s | And that custom payload might comes up might extract some information from their internal 3192.24s - 3203.36s | system and capture it as a screenshot. So what I did, I so that is their application. And 3203.84s - 3214.16s | they're just creating a screenshot of whatever application is. So what I did, they were using 3215.84s - 3224.80s | Amazon. Amazon has infrastructure services. So what I did, I just put this and tried to extract 3225.20s - 3239.60s | the data from their screenshots. So that's how the


chunk_text:
there was no 3140.96s - 3148.08s | vulnerability submitted on it. No vulnerability accepted on it. So this makes me curious why. 3148.08s - 3155.28s | So I started digging into the application. So what application is doing? It starts doing 3155.84s - 3162.32s | recon for subdomain IP address and all the certs. And it also creates a screenshot of 3162.32s - 3168.00s | a parent domain too. So I got interested that if it is creating a screenshot of that parent too, 3168.88s - 3181.92s | maybe I can use maybe I can use some domains and redirect that domains to my custom payload. 3181.92s - 3191.36s | And that custom payload might comes up might extract some information from their internal 3192.24s - 3203.36s | system and capture it as a screenshot. So what I did, I so that is their application. And 3203.84s - 3214.16s | they're just creating a screenshot of whatever application is. So what I did, they were using 3215.84s - 3224.80s | Amazon. Amazon has infrastructure services. So what I did, I just put this and tried to extract 3225.20s - 3239.60s | the data from their screenshots. So that's how the screenshot is. It was all empty. There was 3239.60s - 3250.56s | nothing on it. So I was curious that why it's not coming as a screenshot. So I was researching 3250.56s - 3257.52s | more on this application and I found out that they are not using an EC2 but they are using the 3257.52s - 3267.76s | Lambda. So I went to the Twitter and I searched for what exactly the what how exactly I can do 3267.76s - 3276.08s | SSR with the Lambda. So I got a got a tweet that if you're if someone is using the Lambda function, 3276.08s - 3285.20s | you can particularly use this particular request to actually query the internal data. So next I 3285.20s - 3294.48s | created another redirect request and it actually it actually extracting the data from the Lambda 3294.48s - 3304.88s | function as a screenshot. So I again passed it into for the execution. And what I did, it 3304.88s - 3312.96s | actually captures their Lambda, Lambda, whatever Lambda event is running internally as a screenshot. 3313.68s - 3322.08s | So that's these are all key discoveries that I found in this solution.


chunk_text:
screenshot is. It was all empty. There was 3239.60s - 3250.56s | nothing on it. So I was curious that why it's not coming as a screenshot. So I was researching 3250.56s - 3257.52s | more on this application and I found out that they are not using an EC2 but they are using the 3257.52s - 3267.76s | Lambda. So I went to the Twitter and I searched for what exactly the what how exactly I can do 3267.76s - 3276.08s | SSR with the Lambda. So I got a got a tweet that if you're if someone is using the Lambda function, 3276.08s - 3285.20s | you can particularly use this particular request to actually query the internal data. So next I 3285.20s - 3294.48s | created another redirect request and it actually it actually extracting the data from the Lambda 3294.48s - 3304.88s | function as a screenshot. So I again passed it into for the execution. And what I did, it 3304.88s - 3312.96s | actually captures their Lambda, Lambda, whatever Lambda event is running internally as a screenshot. 3313.68s - 3322.08s | So that's these are all key discoveries that I found in this solution. 3322.64s - 3326.24s | So as we're getting to write up, there's been one question that I've asked you before, 3326.24s - 3330.24s | but I thought it was really kind of an interesting answer. And I think a lot of people here, 3331.12s - 3338.88s | you are globally known, you're on the Microsoft Hall of Fame, SYNAC Legends, you do well. We're up 3338.88s - 3344.24s | here today. Talk to me a little bit about imposter syndrome. Do you have it still? 3345.36s - 3351.84s | Yeah, I mean, I regularly I mean, if you go to go to Twitter, and you will find a lot of bug bounty 3352.64s - 3360.96s | tips. So you will get those imposter syndrome because, because looking at those, because, 3361.84s - 3367.60s | I mean, you will find someone like, like, you must you must be missing something, you must be 3367.60s - 3374.80s | missing something out from somewhere. I mean, someone is more skilled than you, and you are 3374.80s - 3381.04s | lacking some some of the skills because they are getting more bounties, more impactful bugs. So 3381.04s - 3386.00s | obviously that that's coming


chunk_text:
3322.64s - 3326.24s | So as we're getting to write up, there's been one question that I've asked you before, 3326.24s - 3330.24s | but I thought it was really kind of an interesting answer. And I think a lot of people here, 3331.12s - 3338.88s | you are globally known, you're on the Microsoft Hall of Fame, SYNAC Legends, you do well. We're up 3338.88s - 3344.24s | here today. Talk to me a little bit about imposter syndrome. Do you have it still? 3345.36s - 3351.84s | Yeah, I mean, I regularly I mean, if you go to go to Twitter, and you will find a lot of bug bounty 3352.64s - 3360.96s | tips. So you will get those imposter syndrome because, because looking at those, because, 3361.84s - 3367.60s | I mean, you will find someone like, like, you must you must be missing something, you must be 3367.60s - 3374.80s | missing something out from somewhere. I mean, someone is more skilled than you, and you are 3374.80s - 3381.04s | lacking some some of the skills because they are getting more bounties, more impactful bugs. So 3381.04s - 3386.00s | obviously that that's coming out and into your mind, but maybe that person has, 3387.60s - 3394.08s | has been doing like research from last three, four months, and then he found that impactful 3394.08s - 3399.60s | vulnerability. So it's, it's depends on total situation. And you do not have to panic from that. 3400.72s - 3404.32s | I think that's the key there is don't panic just because you missed something or because 3404.32s - 3410.80s | you didn't succeed. It doesn't mean you're wrong, right? It just means that, hey, let's keep going. 3410.80s - 3414.64s | You know, and I think one of the things you said on that one time that really stuck with me, 3414.64s - 3420.08s | and was that you woke up in the morning and kind of goes, am I really here? Am I? This is what I'm 3420.08s - 3427.04s | doing for my job. And you get scared. And he said, you sit down, start typing, start working, 3427.04s - 3431.20s | start to get in that mindset, life starts running well, okay, things are going good. Now find a flaw 3431.20s - 3434.72s | now find a second flaw. You know, things


chunk_text:
out and into your mind, but maybe that person has, 3387.60s - 3394.08s | has been doing like research from last three, four months, and then he found that impactful 3394.08s - 3399.60s | vulnerability. So it's, it's depends on total situation. And you do not have to panic from that. 3400.72s - 3404.32s | I think that's the key there is don't panic just because you missed something or because 3404.32s - 3410.80s | you didn't succeed. It doesn't mean you're wrong, right? It just means that, hey, let's keep going. 3410.80s - 3414.64s | You know, and I think one of the things you said on that one time that really stuck with me, 3414.64s - 3420.08s | and was that you woke up in the morning and kind of goes, am I really here? Am I? This is what I'm 3420.08s - 3427.04s | doing for my job. And you get scared. And he said, you sit down, start typing, start working, 3427.04s - 3431.20s | start to get in that mindset, life starts running well, okay, things are going good. Now find a flaw 3431.20s - 3434.72s | now find a second flaw. You know, things are getting rejected, things are getting accepted 3434.72s - 3438.72s | things. All that's going on any of the day you go, yeah, I got this. And the next morning, 3438.72s - 3444.40s | you wake up and feel like you're fake again. Yeah. So I can say this, that stuck with me, 3444.40s - 3448.40s | because I'm like, if he's doing it, then it's not a problem. If I'm doing it, too. These are 3448.40s - 3453.20s | normal things for us, especially when you add the full time aspect of bug bounty and the pressure. 3453.84s - 3461.28s | So just understand that the middle game is a lot in it. And the persistence and understanding that's 3461.28s - 3467.12s | where you're going to succeed in bug bounty is by being mental, persistent, smart, intelligent, 3467.12s - 3471.60s | go after it. Because yeah, you're competing against him, but he's also here to help you. 3472.56s - 3480.56s | So like, like, Charlie said that there are a lot of a lot of challenges while running the long, 3480.56s - 3486.56s | long time into bug bounties. So imposter syndrome is one of them, then if


chunk_text:
are getting rejected, things are getting accepted 3434.72s - 3438.72s | things. All that's going on any of the day you go, yeah, I got this. And the next morning, 3438.72s - 3444.40s | you wake up and feel like you're fake again. Yeah. So I can say this, that stuck with me, 3444.40s - 3448.40s | because I'm like, if he's doing it, then it's not a problem. If I'm doing it, too. These are 3448.40s - 3453.20s | normal things for us, especially when you add the full time aspect of bug bounty and the pressure. 3453.84s - 3461.28s | So just understand that the middle game is a lot in it. And the persistence and understanding that's 3461.28s - 3467.12s | where you're going to succeed in bug bounty is by being mental, persistent, smart, intelligent, 3467.12s - 3471.60s | go after it. Because yeah, you're competing against him, but he's also here to help you. 3472.56s - 3480.56s | So like, like, Charlie said that there are a lot of a lot of challenges while running the long, 3480.56s - 3486.56s | long time into bug bounties. So imposter syndrome is one of them, then if you are, 3486.56s - 3493.36s | if you're, if you're not earning one or two months, you will start doubting yourself that 3493.36s - 3500.56s | then the burnouts comes in. And the frustration of if reports are rejecting or getting duplicated, 3500.56s - 3507.52s | the frustration comes comes in as well. And all of these comes as a stress on you. So 3508.40s - 3514.16s | mental, your mental health gets impacted. So we're getting the signal to wrap it up, I think. 3515.20s - 3520.64s | Yeah, he's not back there. So we will have these slides posted. So you can go through see some of 3520.64s - 3525.60s | the details on this and cover it. But I think the basic thing is number one, treat this like a game. 3526.16s - 3530.64s | Understand that it's a puzzle on that puzzle and try and just keep it in that mindset. 3531.20s - 3537.36s | Treat it as fun training and enjoy the process. Keep at it. You're going to get success if you 3537.36s - 3541.60s | keep at it. It's one of those things, the more you work at it, the more likely you


chunk_text:
you are, 3486.56s - 3493.36s | if you're, if you're not earning one or two months, you will start doubting yourself that 3493.36s - 3500.56s | then the burnouts comes in. And the frustration of if reports are rejecting or getting duplicated, 3500.56s - 3507.52s | the frustration comes comes in as well. And all of these comes as a stress on you. So 3508.40s - 3514.16s | mental, your mental health gets impacted. So we're getting the signal to wrap it up, I think. 3515.20s - 3520.64s | Yeah, he's not back there. So we will have these slides posted. So you can go through see some of 3520.64s - 3525.60s | the details on this and cover it. But I think the basic thing is number one, treat this like a game. 3526.16s - 3530.64s | Understand that it's a puzzle on that puzzle and try and just keep it in that mindset. 3531.20s - 3537.36s | Treat it as fun training and enjoy the process. Keep at it. You're going to get success if you 3537.36s - 3541.60s | keep at it. It's one of those things, the more you work at it, the more likely you are to succeed. 3543.20s - 3548.40s | Anything else to add? All right. Well, thank you, guys. Appreciate it. Hope you had a good time.


chunk_text:
are to succeed. 3543.20s - 3548.40s | Anything else to add? All right. Well, thank you, guys. Appreciate it. Hope you had a good time.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=hnUG3hB0qVI", "title": "DEF CON 32 - Programming a CTS-V Gauge Cluster into an ATS-V, out of pure spite - Varjitt Jeeva", "description": "Some cars are over-engineered, some are too basic, and some check every box except one. I did that research over months when trying to buy a new car, and landed on a 6MT Cadillac ATS-V while only wanting and dealing with Japanese cars, specifically Lexus/Toyota. The one thing it was missing was a digital gauge cluster, and programmers were asking $350, so I set off to figure it out myself. I then dove deep into GM electronics and programming, found a smart dude who initially cracked it all for free to spite all the money-grabbing gatekeepers, then became a hyprocrite, backtracking asking thousands to reveal his learnings. This presentation will go over how I programmed that cluster, posted everything on Github, out of spite.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 916, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 6.32s | This text was transcribed using whisper model: large-v2 All righty, it's about 4.30 so I'll start. Hi everyone, my name is Varjit Jiva and I'm going 6.32s - 11.20s | to talk to you guys about how I got annoyed with a bunch of paywalls while I was trying to program 11.20s - 17.52s | my digital gauge cluster into my Cadillac ATS-V, figured it out, put it up on GitHub and helped a 17.52s - 23.04s | bunch of people. So I have 35 slides and 25 minutes so we're going to get going. So the 23.04s - 27.52s | overview for this talk, I'm going to introduce myself on the project, what project points made 27.52s - 32.72s | this possible, how the hell I figured it out, the high-level process results, and the future 32.72s - 38.72s | of GM programming and open source. So an introduction to myself, I'm just a software 38.72s - 44.08s | engineer but I'm into cars. I grew up in the Fast and Furious era so I was into Japanese cars for a 44.08s - 49.92s | long time and I somehow ended up buying a Cadillac ATS-V earlier this year. It was a six-speed manual 49.92s - 54.72s | with 400 wheel horsepower and I love that thing. I fall more in love with it every single day 54.72s - 60.56s | but I almost didn't buy


chunk_text:
I got annoyed with a bunch of paywalls while I was trying to program 11.20s - 17.52s | my digital gauge cluster into my Cadillac ATS-V, figured it out, put it up on GitHub and helped a 17.52s - 23.04s | bunch of people. So I have 35 slides and 25 minutes so we're going to get going. So the 23.04s - 27.52s | overview for this talk, I'm going to introduce myself on the project, what project points made 27.52s - 32.72s | this possible, how the hell I figured it out, the high-level process results, and the future 32.72s - 38.72s | of GM programming and open source. So an introduction to myself, I'm just a software 38.72s - 44.08s | engineer but I'm into cars. I grew up in the Fast and Furious era so I was into Japanese cars for a 44.08s - 49.92s | long time and I somehow ended up buying a Cadillac ATS-V earlier this year. It was a six-speed manual 49.92s - 54.72s | with 400 wheel horsepower and I love that thing. I fall more in love with it every single day 54.72s - 60.56s | but I almost didn't buy it. Why? Because it came with a gauge cluster on the left. It's needles. 60.56s - 67.12s | 2016 to 2019 this car was made and GM shipped it with needles. The rest of the fleet that they had 67.12s - 71.52s | had digital gauge clusters with the fancy stuff you see on the right but for my car they never 71.52s - 76.96s | made it. But I bit the bullet and bought the car because it turns out people were selling 76.96s - 82.88s | programming services to retrofit a digital gauge cluster into my car. So when I went into that 82.88s - 88.48s | there was one dude that was like, oh pay me 350 bucks then you can do it. And this was 88.48s - 92.72s | the only guy doing it for a long time. Then some other dude showed up from the shadows of Facebook 92.72s - 98.48s | marketplace. It was like $250. I was like, huh? How did this guy figure it out? And then I look 98.48s - 103.84s | a little bit further, there's another guy on the Corvette forum that put a 2021 digital gauge 103.84s -


chunk_text:
it. Why? Because it came with a gauge cluster on the left. It's needles. 60.56s - 67.12s | 2016 to 2019 this car was made and GM shipped it with needles. The rest of the fleet that they had 67.12s - 71.52s | had digital gauge clusters with the fancy stuff you see on the right but for my car they never 71.52s - 76.96s | made it. But I bit the bullet and bought the car because it turns out people were selling 76.96s - 82.88s | programming services to retrofit a digital gauge cluster into my car. So when I went into that 82.88s - 88.48s | there was one dude that was like, oh pay me 350 bucks then you can do it. And this was 88.48s - 92.72s | the only guy doing it for a long time. Then some other dude showed up from the shadows of Facebook 92.72s - 98.48s | marketplace. It was like $250. I was like, huh? How did this guy figure it out? And then I look 98.48s - 103.84s | a little bit further, there's another guy on the Corvette forum that put a 2021 digital gauge 103.84s - 109.68s | cluster into his 2019 C7 Corvette. And I was like, huh? If those two people can figure it out 109.68s - 114.00s | then I should be able to. And then there's a couple of people selling courses and weird tools 114.00s - 118.40s | and all these sketchy websites. I don't want to pay any of these people any money. I just want 118.40s - 123.84s | to figure it out. I didn't want to go bankrupt in the process too. So what project points actually 123.84s - 130.56s | made this possible? So first the 12.3 inch gauge cluster I'm talking about, the fully digital one 130.56s - 136.16s | was available in a whole bunch of Cadillac models of the same year, but with different views and 136.16s - 140.80s | stuff like that. They just didn't ship it with my car. On top of that, the plug that was on the 140.80s - 146.00s | back of this thing was the same thing as my car. So that was already a good indication. Then the 146.00s - 152.48s | view that I want to see on this 12.3 inch cluster was the same thing


chunk_text:
109.68s | cluster into his 2019 C7 Corvette. And I was like, huh? If those two people can figure it out 109.68s - 114.00s | then I should be able to. And then there's a couple of people selling courses and weird tools 114.00s - 118.40s | and all these sketchy websites. I don't want to pay any of these people any money. I just want 118.40s - 123.84s | to figure it out. I didn't want to go bankrupt in the process too. So what project points actually 123.84s - 130.56s | made this possible? So first the 12.3 inch gauge cluster I'm talking about, the fully digital one 130.56s - 136.16s | was available in a whole bunch of Cadillac models of the same year, but with different views and 136.16s - 140.80s | stuff like that. They just didn't ship it with my car. On top of that, the plug that was on the 140.80s - 146.00s | back of this thing was the same thing as my car. So that was already a good indication. Then the 146.00s - 152.48s | view that I want to see on this 12.3 inch cluster was the same thing that was available on a Cadillac 152.48s - 158.08s | CTS Vsport, which was the same engines, 3.6 liter twin turbo with the gauges and everything. It's 158.08s - 164.08s | got what I needed. And then turns out that between the needle gauge cluster and the 12.3 inch digital 164.08s - 169.92s | one, the total set of configuration flags was the exact same between the two. So basically what I'm 169.92s - 174.72s | saying is this gauge cluster could have fit my car the whole time, but GM just decided to not 174.72s - 179.84s | ship it. So that's why this programming became a thing. And here's how I figured it out. And here's 179.84s - 187.20s | the funny thing. I've added a counter into these slides where people sell courses and tools on how 187.20s - 192.16s | to do this stuff. And that total ran out to over a thousand dollars just to do this one thing. 192.16s - 196.08s | So I'll show you through these slides, how much you get to save by just listening to the 196.08s - 202.24s | presentation. So from the beginning, let's say you're me, you


chunk_text:
that was available on a Cadillac 152.48s - 158.08s | CTS Vsport, which was the same engines, 3.6 liter twin turbo with the gauges and everything. It's 158.08s - 164.08s | got what I needed. And then turns out that between the needle gauge cluster and the 12.3 inch digital 164.08s - 169.92s | one, the total set of configuration flags was the exact same between the two. So basically what I'm 169.92s - 174.72s | saying is this gauge cluster could have fit my car the whole time, but GM just decided to not 174.72s - 179.84s | ship it. So that's why this programming became a thing. And here's how I figured it out. And here's 179.84s - 187.20s | the funny thing. I've added a counter into these slides where people sell courses and tools on how 187.20s - 192.16s | to do this stuff. And that total ran out to over a thousand dollars just to do this one thing. 192.16s - 196.08s | So I'll show you through these slides, how much you get to save by just listening to the 196.08s - 202.24s | presentation. So from the beginning, let's say you're me, you have this car and you want to 202.24s - 207.12s | retrofit this cluster into that. So the programming advertisement, they'll tell you, get any of the 207.12s - 211.52s | 12.3 inch clusters from any of the car, any of the Cadillac cars from the same year. And then 211.52s - 216.64s | we'll program it to show the V cluster on there and what the correct red line and all this stuff. 216.64s - 223.36s | I was like, huh, interesting. So can I retrofit this from another car? Did they make all this 223.36s - 227.12s | custom? No, there's no way they made the graphics and stuff like that themselves. 227.12s - 234.48s | But was there a car that had the same basically engine and stuff that could show the right view? 234.48s - 239.52s | It was like, yeah, it was the Cadillac CTS Vsport. So I just had to get a 12.3 inch cluster, 239.52s - 245.20s | doesn't matter from what car, show that specific car's view and then put it into my car. 246.16s - 253.12s | So how do I make my cluster look like the one from the target


chunk_text:
have this car and you want to 202.24s - 207.12s | retrofit this cluster into that. So the programming advertisement, they'll tell you, get any of the 207.12s - 211.52s | 12.3 inch clusters from any of the car, any of the Cadillac cars from the same year. And then 211.52s - 216.64s | we'll program it to show the V cluster on there and what the correct red line and all this stuff. 216.64s - 223.36s | I was like, huh, interesting. So can I retrofit this from another car? Did they make all this 223.36s - 227.12s | custom? No, there's no way they made the graphics and stuff like that themselves. 227.12s - 234.48s | But was there a car that had the same basically engine and stuff that could show the right view? 234.48s - 239.52s | It was like, yeah, it was the Cadillac CTS Vsport. So I just had to get a 12.3 inch cluster, 239.52s - 245.20s | doesn't matter from what car, show that specific car's view and then put it into my car. 246.16s - 253.12s | So how do I make my cluster look like the one from the target vehicle? So I ended up buying a 253.12s - 260.64s | cluster from a 2017 Escalade and I had to make it show the view for the 2017 Cadillac CTS Vsport. 261.20s - 265.92s | So the first thing I did with this cluster was pop the back of it. If you see the middle chip 265.92s - 270.32s | right there, the middle to the little bit to the right, there's a silver one. That's a Texas 270.48s - 275.20s | Instruments ARM CPU. It was Linux-based basically. So I'm looking at PNG files, 275.20s - 279.36s | whatever, all those graphics. So it's pretty straightforward, I guess, at that point. 279.36s - 284.48s | But the next three questions I had at this point were, one, can this cluster connect to my car? 284.48s - 288.80s | Two, are the right files on there? Do I have to somehow patch them to get the right 289.44s - 293.60s | gauge cluster to show up? And three, how do I configure the cluster to work with my car, 293.60s - 300.72s | with my specific feature set and stuff? So those three questions actually relate to the 300.72s -


chunk_text:
vehicle? So I ended up buying a 253.12s - 260.64s | cluster from a 2017 Escalade and I had to make it show the view for the 2017 Cadillac CTS Vsport. 261.20s - 265.92s | So the first thing I did with this cluster was pop the back of it. If you see the middle chip 265.92s - 270.32s | right there, the middle to the little bit to the right, there's a silver one. That's a Texas 270.48s - 275.20s | Instruments ARM CPU. It was Linux-based basically. So I'm looking at PNG files, 275.20s - 279.36s | whatever, all those graphics. So it's pretty straightforward, I guess, at that point. 279.36s - 284.48s | But the next three questions I had at this point were, one, can this cluster connect to my car? 284.48s - 288.80s | Two, are the right files on there? Do I have to somehow patch them to get the right 289.44s - 293.60s | gauge cluster to show up? And three, how do I configure the cluster to work with my car, 293.60s - 300.72s | with my specific feature set and stuff? So those three questions actually relate to the 300.72s - 307.92s | three steps of CAN bus module programming in GM. First, you have to configure authentication, 307.92s - 313.04s | then programming for the general purpose firmware, software, whatever, and the setup 313.04s - 321.92s | and configuration to set the config flags according to what your car has. So the first thing, 321.92s - 326.32s | can I just plug and play this cluster? No. The first thing that you have to do is actually make 326.32s - 330.64s | sure that the cluster can authenticate with the rest of the CAN bus. And it does that with two 330.64s - 335.28s | specific pieces of information, which is the VIN number and the security pin, which is derived from 335.28s - 341.20s | the VIN number. So all I had to do was program those onto the cluster. But how do you do that? 341.20s - 345.76s | I looked in the back of the thing. And if anyone in here has ever touched a gauge cluster before, 345.76s - 350.64s | usually this kind of information is stored on an EEPROM chip. So I already had one of the best 350.64s - 356.64s | things, I


chunk_text:
307.92s | three steps of CAN bus module programming in GM. First, you have to configure authentication, 307.92s - 313.04s | then programming for the general purpose firmware, software, whatever, and the setup 313.04s - 321.92s | and configuration to set the config flags according to what your car has. So the first thing, 321.92s - 326.32s | can I just plug and play this cluster? No. The first thing that you have to do is actually make 326.32s - 330.64s | sure that the cluster can authenticate with the rest of the CAN bus. And it does that with two 330.64s - 335.28s | specific pieces of information, which is the VIN number and the security pin, which is derived from 335.28s - 341.20s | the VIN number. So all I had to do was program those onto the cluster. But how do you do that? 341.20s - 345.76s | I looked in the back of the thing. And if anyone in here has ever touched a gauge cluster before, 345.76s - 350.64s | usually this kind of information is stored on an EEPROM chip. So I already had one of the best 350.64s - 356.64s | things, I think, in this market is a CH341A EEPROM programmer, which is like $5 on AliExpress. 356.64s - 362.24s | And it turns out that the chip that was holding this was an I2C24C16. People were selling this 362.24s - 368.24s | a tool that can do this programming for $100. I figured it out for $5 and I read the chip. 368.24s - 372.16s | So what I did was I read it immediately. I didn't even have to repin it. Just read the chip, 372.16s - 378.72s | dumped it. And it turns out that in plain text, the first 17 digits was the VIN number. And there's 378.80s - 383.36s | a auspicious four digits right under, which is the security pin. All I did was set those to my 383.36s - 390.80s | values for my car and immediately it worked. The first thing this picture shows is that 390.80s - 394.48s | the cluster works with my car. It's pulling values and stuff, but it's just not showing 394.48s - 400.00s | the right thing. And I know this worked because you could see that the mileage for the vehicle 400.00s - 405.52s | actually showed


chunk_text:
think, in this market is a CH341A EEPROM programmer, which is like $5 on AliExpress. 356.64s - 362.24s | And it turns out that the chip that was holding this was an I2C24C16. People were selling this 362.24s - 368.24s | a tool that can do this programming for $100. I figured it out for $5 and I read the chip. 368.24s - 372.16s | So what I did was I read it immediately. I didn't even have to repin it. Just read the chip, 372.16s - 378.72s | dumped it. And it turns out that in plain text, the first 17 digits was the VIN number. And there's 378.80s - 383.36s | a auspicious four digits right under, which is the security pin. All I did was set those to my 383.36s - 390.80s | values for my car and immediately it worked. The first thing this picture shows is that 390.80s - 394.48s | the cluster works with my car. It's pulling values and stuff, but it's just not showing 394.48s - 400.00s | the right thing. And I know this worked because you could see that the mileage for the vehicle 400.00s - 405.52s | actually showed up there. In GM, the mileage for the car is actually not stored in the gauge cluster 405.52s - 410.72s | like other cars. It's actually stored in the body control module. And if your module face 410.72s - 415.28s | will authenticate with that module because of the mismatch of the VIN and pin, then that mileage 415.28s - 421.60s | will actually show up as dash, dash, dash. So I know I got this right because I got the odometer 421.60s - 426.40s | to show up actually. So cool. I got it to connect to the car. Now, how do I make sure the right 426.40s - 430.72s | files and the graphics are on there? So now I'll talk a little bit about how GM programming 430.72s - 436.00s | actually works with the dealer software called SPS2. I don't exactly remember what the acronym 436.00s - 440.48s | means, but that's basically the dealer software like any other car. You get that, you get a 440.48s - 446.56s | subscription with the VIN number for your car, $45 for two years, not expensive. Then you get 446.56s - 452.08s | the dealer cable, $186, not


chunk_text:
up there. In GM, the mileage for the car is actually not stored in the gauge cluster 405.52s - 410.72s | like other cars. It's actually stored in the body control module. And if your module face 410.72s - 415.28s | will authenticate with that module because of the mismatch of the VIN and pin, then that mileage 415.28s - 421.60s | will actually show up as dash, dash, dash. So I know I got this right because I got the odometer 421.60s - 426.40s | to show up actually. So cool. I got it to connect to the car. Now, how do I make sure the right 426.40s - 430.72s | files and the graphics are on there? So now I'll talk a little bit about how GM programming 430.72s - 436.00s | actually works with the dealer software called SPS2. I don't exactly remember what the acronym 436.00s - 440.48s | means, but that's basically the dealer software like any other car. You get that, you get a 440.48s - 446.56s | subscription with the VIN number for your car, $45 for two years, not expensive. Then you get 446.56s - 452.08s | the dealer cable, $186, not a big deal either. So the programming step, what this does is that 452.08s - 458.64s | it loads the firmware, all the software, whatever it needs just to run the general purpose of this 458.64s - 465.12s | module. So there's even a step before this, because in the world of GM programming, people 465.12s - 470.32s | can actually check what files are going to be loaded by the software into the modules before, 470.32s - 475.12s | ahead of time. And surprisingly, there was a light version of this running on the internet, 475.12s - 480.64s | open to the public, which is called, which is hosted by Opal. Turns out that GM has been selling 480.64s - 484.96s | their Canva system to a whole bunch of other manufacturers. One of them being Opal, Skoda, 484.96s - 490.08s | I think. And then I think a Chinese manufacturer, I don't remember. But it turns out I used this 490.08s - 495.92s | website just to check what programming files are going to be loaded into this module. And I did 495.92s - 501.76s | that by taking the VIN number from my donor Escalade cluster. I


chunk_text:
a big deal either. So the programming step, what this does is that 452.08s - 458.64s | it loads the firmware, all the software, whatever it needs just to run the general purpose of this 458.64s - 465.12s | module. So there's even a step before this, because in the world of GM programming, people 465.12s - 470.32s | can actually check what files are going to be loaded by the software into the modules before, 470.32s - 475.12s | ahead of time. And surprisingly, there was a light version of this running on the internet, 475.12s - 480.64s | open to the public, which is called, which is hosted by Opal. Turns out that GM has been selling 480.64s - 484.96s | their Canva system to a whole bunch of other manufacturers. One of them being Opal, Skoda, 484.96s - 490.08s | I think. And then I think a Chinese manufacturer, I don't remember. But it turns out I used this 490.08s - 495.92s | website just to check what programming files are going to be loaded into this module. And I did 495.92s - 501.76s | that by taking the VIN number from my donor Escalade cluster. I took the VIN number from a 501.76s - 509.28s | target car, which is the Cadillac CTS-V Sport. And I just ran the programming steps to just see 511.20s - 514.32s | what VIN number was going to come out. These numbers are actually called calibration numbers. 515.20s - 520.32s | It's a unique identifier in the GM world where they say this has this specific set of files in it. 520.32s - 525.44s | That turns out though, that the number is the exact same in both of these cars. That means that 525.44s - 531.28s | my Escalade cluster already had the views that I needed for a CTS-V, which is a sports car. It 531.28s - 536.56s | was already on all these cars. I just had to be able to reveal it. And how do I do that? 536.56s - 542.88s | That gets to step number three, the setup and configuration of GM programming. So now I have 542.88s - 547.92s | to actually get set the configuration values according to what I need. So a couple of slides 547.92s - 553.92s | here. This is actually some screen caps from when you actually go


chunk_text:
took the VIN number from a 501.76s - 509.28s | target car, which is the Cadillac CTS-V Sport. And I just ran the programming steps to just see 511.20s - 514.32s | what VIN number was going to come out. These numbers are actually called calibration numbers. 515.20s - 520.32s | It's a unique identifier in the GM world where they say this has this specific set of files in it. 520.32s - 525.44s | That turns out though, that the number is the exact same in both of these cars. That means that 525.44s - 531.28s | my Escalade cluster already had the views that I needed for a CTS-V, which is a sports car. It 531.28s - 536.56s | was already on all these cars. I just had to be able to reveal it. And how do I do that? 536.56s - 542.88s | That gets to step number three, the setup and configuration of GM programming. So now I have 542.88s - 547.92s | to actually get set the configuration values according to what I need. So a couple of slides 547.92s - 553.92s | here. This is actually some screen caps from when you actually go to get SPS-2 from ACDelco. You go 553.92s - 559.20s | to this website here, you sign up for your VIN number, you download the thing. It's a Java-based 559.92s - 565.20s | program. And you go into here, then you see right there, instrument cluster. You go to set up a 565.20s - 572.00s | configuration, just run that. And it does a two-step process where it pulls the files from the 572.00s - 579.20s | GM servers, stores it on your computer, and then programs it against your car. And turns out that 579.20s - 585.52s | they dump all these files to your local C drive. So a couple of bonus slides here where you can 585.52s - 594.00s | save some money. $450. This one was $450, which is ridiculous. This is how to grab any BIN file 594.00s - 600.00s | or config files from SPS-2 for any vehicle. All you have to do is buy the VIN number for the car 600.00s - 604.72s | that you don't have in front of you. And then you just have to connect to your car, even though it 604.72s - 609.68s | doesn't have the right


chunk_text:
to get SPS-2 from ACDelco. You go 553.92s - 559.20s | to this website here, you sign up for your VIN number, you download the thing. It's a Java-based 559.92s - 565.20s | program. And you go into here, then you see right there, instrument cluster. You go to set up a 565.20s - 572.00s | configuration, just run that. And it does a two-step process where it pulls the files from the 572.00s - 579.20s | GM servers, stores it on your computer, and then programs it against your car. And turns out that 579.20s - 585.52s | they dump all these files to your local C drive. So a couple of bonus slides here where you can 585.52s - 594.00s | save some money. $450. This one was $450, which is ridiculous. This is how to grab any BIN file 594.00s - 600.00s | or config files from SPS-2 for any vehicle. All you have to do is buy the VIN number for the car 600.00s - 604.72s | that you don't have in front of you. And then you just have to connect to your car, even though it 604.72s - 609.68s | doesn't have the right VIN number. And then just download and then run the programming for whatever 609.68s - 614.48s | you need for whatever module. It'll save the files to your computer. And then as soon as it's done 614.48s - 619.04s | downloading, yank the cable from your car. That's it. That's all I did to pull out these files from 619.04s - 624.96s | the car. And the thing is, people were advertising emulators online for this. This would have costed 624.96s - 630.48s | $450 just to do this when there was an override button right in front of you with a screen cap. 631.44s - 636.56s | And also those emulators get you banned from the GM servers. So instead of paying $450, 636.56s - 643.04s | you press an override button, which is ridiculous. Then another bonus slide, how to grab the security 643.04s - 650.08s | pin for a VIN number from a car for a VIN number from GM. So what you do here is that you actually 650.08s - 655.36s | run a dummy configuration that's just kind of safe because it only sets configuration flags in 655.36s - 661.44s | your module. All I


chunk_text:
VIN number. And then just download and then run the programming for whatever 609.68s - 614.48s | you need for whatever module. It'll save the files to your computer. And then as soon as it's done 614.48s - 619.04s | downloading, yank the cable from your car. That's it. That's all I did to pull out these files from 619.04s - 624.96s | the car. And the thing is, people were advertising emulators online for this. This would have costed 624.96s - 630.48s | $450 just to do this when there was an override button right in front of you with a screen cap. 631.44s - 636.56s | And also those emulators get you banned from the GM servers. So instead of paying $450, 636.56s - 643.04s | you press an override button, which is ridiculous. Then another bonus slide, how to grab the security 643.04s - 650.08s | pin for a VIN number from a car for a VIN number from GM. So what you do here is that you actually 650.08s - 655.36s | run a dummy configuration that's just kind of safe because it only sets configuration flags in 655.36s - 661.44s | your module. All I did was run that with a vehicle that I don't own. Well, I don't have access to it 661.44s - 666.00s | really. And then just running against my car, it'll just fail to authenticate with the module 666.00s - 670.00s | inside the car. So then it'll just bomb out, doesn't do anything. And then you go check 670.00s - 675.84s | inside the C drive over here. And there's a file right here called SPS tool bridge, tool bridge 675.92s - 680.24s | log, right? There's the VIN number that I was attempted and the security pin that was right 680.24s - 686.00s | there. So right then and there, you get it for free. Well, almost for free. There's also VIN 686.00s - 690.16s | to pin services that you could buy online for $50 from some random website, or you can get it from 690.16s - 697.68s | GM directly using this method. Now, before I can explain what I did for the configuration flags, 697.68s - 704.32s | I have to explain two things, what a build code and RPO code is. So in those local files I was 704.32s - 709.84s | talking about


chunk_text:
did was run that with a vehicle that I don't own. Well, I don't have access to it 661.44s - 666.00s | really. And then just running against my car, it'll just fail to authenticate with the module 666.00s - 670.00s | inside the car. So then it'll just bomb out, doesn't do anything. And then you go check 670.00s - 675.84s | inside the C drive over here. And there's a file right here called SPS tool bridge, tool bridge 675.92s - 680.24s | log, right? There's the VIN number that I was attempted and the security pin that was right 680.24s - 686.00s | there. So right then and there, you get it for free. Well, almost for free. There's also VIN 686.00s - 690.16s | to pin services that you could buy online for $50 from some random website, or you can get it from 690.16s - 697.68s | GM directly using this method. Now, before I can explain what I did for the configuration flags, 697.68s - 704.32s | I have to explain two things, what a build code and RPO code is. So in those local files I was 704.32s - 709.84s | talking about earlier, there's a build code, a build record at BLD, which has your VIN number, 709.84s - 714.64s | chassis code, and then a bunch of things called RPO codes. These are build codes or like option 714.64s - 719.04s | codes for stuffing your car. Like, oh, if you have a digital cluster or this fancy suspension, 719.04s - 724.32s | whatever, then there's an S3 file right there where ACDelco publishes every single RPO code 724.32s - 728.56s | that they've ever made for GM. And you can just look it up there. And the next file that was 728.56s - 735.04s | inside the C drive was an XML file that says something quite interesting. It turns out it is 735.04s - 743.04s | a logical mapping of P underscore whatever flag that says, set this flag to this value based on 743.04s - 749.28s | the existence of this RPO code and this chassis code in the car. So I look through this and I 749.28s - 756.80s | knew that I wanted to get the gauge cluster from a CTS Vsport, which has the chassis code of 6AL69 756.80s - 764.24s | right there and


chunk_text:
earlier, there's a build code, a build record at BLD, which has your VIN number, 709.84s - 714.64s | chassis code, and then a bunch of things called RPO codes. These are build codes or like option 714.64s - 719.04s | codes for stuffing your car. Like, oh, if you have a digital cluster or this fancy suspension, 719.04s - 724.32s | whatever, then there's an S3 file right there where ACDelco publishes every single RPO code 724.32s - 728.56s | that they've ever made for GM. And you can just look it up there. And the next file that was 728.56s - 735.04s | inside the C drive was an XML file that says something quite interesting. It turns out it is 735.04s - 743.04s | a logical mapping of P underscore whatever flag that says, set this flag to this value based on 743.04s - 749.28s | the existence of this RPO code and this chassis code in the car. So I look through this and I 749.28s - 756.80s | knew that I wanted to get the gauge cluster from a CTS Vsport, which has the chassis code of 6AL69 756.80s - 764.24s | right there and the engine code. And turns out that right here, PDDH variant gets set to the 764.24s - 773.36s | value of 6 to get the V fancy graphic out. So all I did was edit this file to include my car, 773.36s - 780.88s | which is a 6AE47 chassis code with an engine code of LF4. I left the UDV in there and then edited my 780.88s - 786.08s | build record to have a UDV, which is for the 12.3 inch cluster. UDD is for the needle one, 786.08s - 790.00s | whatever. I just changed it just so that everything that all the flights that get 790.00s - 795.52s | enabled by this XML file will be for my car. So it fully works. And then as soon as I did that, 795.52s - 801.04s | saw this, ran to my car. Oh yeah, by the way, this would have cost an extra $350. We're at $950 801.04s - 806.88s | right now already. Ran to my car. Press the configuration file or press the configuration 806.88s - 811.92s | function. Turns out that also the cache files on here are not checksum. You could just edit


chunk_text:
the engine code. And turns out that right here, PDDH variant gets set to the 764.24s - 773.36s | value of 6 to get the V fancy graphic out. So all I did was edit this file to include my car, 773.36s - 780.88s | which is a 6AE47 chassis code with an engine code of LF4. I left the UDV in there and then edited my 780.88s - 786.08s | build record to have a UDV, which is for the 12.3 inch cluster. UDD is for the needle one, 786.08s - 790.00s | whatever. I just changed it just so that everything that all the flights that get 790.00s - 795.52s | enabled by this XML file will be for my car. So it fully works. And then as soon as I did that, 795.52s - 801.04s | saw this, ran to my car. Oh yeah, by the way, this would have cost an extra $350. We're at $950 801.04s - 806.88s | right now already. Ran to my car. Press the configuration file or press the configuration 806.88s - 811.92s | function. Turns out that also the cache files on here are not checksum. You could just edit the 811.92s - 818.48s | files and GM will just detect the existence of the files, not even check anything else. You click, 818.48s - 822.40s | it'll just run with the files on your disk and then that's it. So I managed to click programs 822.40s - 827.12s | to this thing for free without paying anyone anything, which is fucking awesome. So tying 827.12s - 831.20s | this all together, high level process. There's a list of requirements right here. I'm not going 831.20s - 837.36s | to read this all out to you guys. High level programming steps. It's just setting up your 837.36s - 842.64s | windows laptop, then running a cluster configuration with your OEM cluster just to 842.64s - 849.36s | get the RPO codes and the XML files out. Then you edit the EEPROM on the cluster, which I explained 849.36s - 853.92s | earlier, then also edit the cache files locally and then just run the configuration again. And 853.92s - 861.92s | that's it. So the future of GM programming in open source. I posted this right away on GitHub 861.92s - 865.68s | and I posted it right away in


chunk_text:
the 811.92s - 818.48s | files and GM will just detect the existence of the files, not even check anything else. You click, 818.48s - 822.40s | it'll just run with the files on your disk and then that's it. So I managed to click programs 822.40s - 827.12s | to this thing for free without paying anyone anything, which is fucking awesome. So tying 827.12s - 831.20s | this all together, high level process. There's a list of requirements right here. I'm not going 831.20s - 837.36s | to read this all out to you guys. High level programming steps. It's just setting up your 837.36s - 842.64s | windows laptop, then running a cluster configuration with your OEM cluster just to 842.64s - 849.36s | get the RPO codes and the XML files out. Then you edit the EEPROM on the cluster, which I explained 849.36s - 853.92s | earlier, then also edit the cache files locally and then just run the configuration again. And 853.92s - 861.92s | that's it. So the future of GM programming in open source. I posted this right away on GitHub 861.92s - 865.68s | and I posted it right away in the Cadillac forum. So a few people actually got to use this and fix 865.68s - 871.12s | their own problems, which was really nice. But the crazy thing is I don't understand how I had 871.12s - 875.44s | to spend a thousand dollars just to figure this out. And thank God I did not pay any of that money 875.44s - 880.72s | because for how complicated this process was, it really wasn't that complicated. Most of this stuff 880.72s - 886.72s | was just open to the public, open on your laptop, open on the internet. It didn't really make sense. 886.72s - 893.44s | So I hope that with this, that more people get into modifying their GM cars to do cool stuff 893.44s - 898.80s | like this without having to pay $350 and stuff like that to do this stuff. So I really hope that 898.80s - 904.72s | this helps maybe a couple of people. A big shout out to the DEF CON conference and the Car Hacking 904.72s - 909.76s | Village for selecting my talk. This is actually my first DEF CON ever. So being up on the stage 909.76s -


chunk_text:
the Cadillac forum. So a few people actually got to use this and fix 865.68s - 871.12s | their own problems, which was really nice. But the crazy thing is I don't understand how I had 871.12s - 875.44s | to spend a thousand dollars just to figure this out. And thank God I did not pay any of that money 875.44s - 880.72s | because for how complicated this process was, it really wasn't that complicated. Most of this stuff 880.72s - 886.72s | was just open to the public, open on your laptop, open on the internet. It didn't really make sense. 886.72s - 893.44s | So I hope that with this, that more people get into modifying their GM cars to do cool stuff 893.44s - 898.80s | like this without having to pay $350 and stuff like that to do this stuff. So I really hope that 898.80s - 904.72s | this helps maybe a couple of people. A big shout out to the DEF CON conference and the Car Hacking 904.72s - 909.76s | Village for selecting my talk. This is actually my first DEF CON ever. So being up on the stage 909.76s - 913.36s | is crazy. So thank you guys so much. And yeah.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=b7WlUofPJpU", "title": "DEF CON 32 - Practical Exploitation of DoS in Bug Bounty - Roni Lupin Carta", "description": "The talk \"Practical Exploitation of DoS in Bug Bounty\" explains methods for identifying and exploiting Denial of Service (DoS) vulnerabilities in bug bounty programs. Starting with an overview of DoS attacks and their impact, we will highlight how these attacks disrupt services by overwhelming resources or exploiting flaws. The talk covers various DoS attack types, including N+1 errors, in-depth GraphQL crashing, and Cache Poisoning, with real-world examples demonstrating their effects.\n\nWe will then detail practical techniques for discovering DoS vulnerabilities. This includes automated scanning tools, manual testing methods, and understanding the target system's architecture.\n\nN+1 errors occur when an application makes redundant database queries, significantly impacting performance. Attackers can exploit this by triggering numerous unnecessary queries, causing severe slowdowns or crashes. GraphQL, a query language for APIs, can be vulnerable to complex queries that consume excessive resources, leading to server crashes. We will show how to craft such queries and the resulting impact. Cache Poisoning involves manipulating cached data to serve malicious or incorrect content, which can disrupt services or degrade performance. We will explore techniques to poison caches and demonstrate the potential consequences.\n\nAdditionally, the talk emphasizes the importance of responsibly reporting discovered vulnerabilities to bug bounty programs. Best practices are shared for effectively communicating findings and ensuring timely mitigation. Of course, there are some fails during this path, and those are going to be covered too.\n\nThe session wraps up by stressing the need for continuous learning and staying updated on the latest trends in DoS attack vectors and mitigation strategies", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1834, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 3.80s | This text was transcribed using whisper model: large-v2 So, I'm happy to introduce Ronnie Carta 3.80s - 5.56s | and talk about practical exploitation 5.56s - 8.76s | in denial of service and bug bounties. 8.76s - 14.13s | Ronnie, thanks. 14.13s - 14.97s | Hi everyone. 14.97s - 17.23s | I'm really happy to be there today. 17.23s - 20.51s | This is the first ever Bug Bounty Village 20.51s - 23.67s | and it's a true honor to do the first talk ever. 23.67s - 25.39s | Well, with some technical difficulties 25.39s - 27.93s | of not having an HDMI cable, but no worries. 27.93s - 28.83s | We are there now. 30.25s


chunk_text:
potential consequences.\n\nAdditionally, the talk emphasizes the importance of responsibly reporting discovered vulnerabilities to bug bounty programs. Best practices are shared for effectively communicating findings and ensuring timely mitigation. Of course, there are some fails during this path, and those are going to be covered too.\n\nThe session wraps up by stressing the need for continuous learning and staying updated on the latest trends in DoS attack vectors and mitigation strategies", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1834, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 3.80s | This text was transcribed using whisper model: large-v2 So, I'm happy to introduce Ronnie Carta 3.80s - 5.56s | and talk about practical exploitation 5.56s - 8.76s | in denial of service and bug bounties. 8.76s - 14.13s | Ronnie, thanks. 14.13s - 14.97s | Hi everyone. 14.97s - 17.23s | I'm really happy to be there today. 17.23s - 20.51s | This is the first ever Bug Bounty Village 20.51s - 23.67s | and it's a true honor to do the first talk ever. 23.67s - 25.39s | Well, with some technical difficulties 25.39s - 27.93s | of not having an HDMI cable, but no worries. 27.93s - 28.83s | We are there now. 30.25s - 32.11s | So, the talk is about practical exploitation 32.11s - 34.65s | of denial of service in bug bounty program. 34.65s - 36.39s | So, first of all, my name is Ronnie. 36.39s - 37.75s | I go by the nickname Lupin. 37.75s - 39.59s | I'm the co-founder of Lupin Homes. 39.59s - 42.51s | We are a security research and development company 42.51s - 46.03s | and I'm coming from the best city in the world, Grenoble. 46.03s - 48.91s | It's in the French Alps, lot of skiing, beautiful place. 50.47s - 52.55s | I love denial of service. 52.55s - 55.03s | I love denial of service because you can actually 55.03s - 57.87s | try to slow down or considerably take down 57.87s - 59.91s | an entire product environment. 59.95s - 62.95s | And so, the goal of denial of service in bug bounties 62.95s - 67.03s | is to basically try to find the most business impact. 67.03s - 69.51s | Imagine like a website not having traffic anymore. 69.51s - 72.11s | That will be a huge bummer for the company. 73.31s - 77.83s | And so, denial of service


chunk_text:
- 32.11s | So, the talk is about practical exploitation 32.11s - 34.65s | of denial of service in bug bounty program. 34.65s - 36.39s | So, first of all, my name is Ronnie. 36.39s - 37.75s | I go by the nickname Lupin. 37.75s - 39.59s | I'm the co-founder of Lupin Homes. 39.59s - 42.51s | We are a security research and development company 42.51s - 46.03s | and I'm coming from the best city in the world, Grenoble. 46.03s - 48.91s | It's in the French Alps, lot of skiing, beautiful place. 50.47s - 52.55s | I love denial of service. 52.55s - 55.03s | I love denial of service because you can actually 55.03s - 57.87s | try to slow down or considerably take down 57.87s - 59.91s | an entire product environment. 59.95s - 62.95s | And so, the goal of denial of service in bug bounties 62.95s - 67.03s | is to basically try to find the most business impact. 67.03s - 69.51s | Imagine like a website not having traffic anymore. 69.51s - 72.11s | That will be a huge bummer for the company. 73.31s - 77.83s | And so, denial of service and like the difference 77.83s - 79.35s | between denial of service and DDoS 79.35s - 82.79s | is basically denial of service is from one single machine. 82.79s - 86.87s | But DDoS, the additional D is for distributed, of course. 86.87s - 89.25s | So, it means that we require a series of different machine 89.25s - 91.49s | to be able to take down our target. 91.49s - 94.01s | This is basically all about the resource 94.01s - 96.73s | that you have on your machine against the resources 96.73s - 99.01s | that you have on your target. 99.01s - 102.57s | So, if the attacker has more resources on its machine, 102.57s - 106.37s | then it can basically take down the target. 106.37s - 109.57s | But in a DDoS, you might have amplification 109.57s - 112.09s | or multiplicating factor in order to be able 112.09s - 113.97s | to completely take down the machine. 113.97s - 116.37s | So, that's what we're going to talk about today. 117.37s - 119.81s | A little bit of definition debates here. 121.17s - 122.65s | Basically, there is a whole debate 122.65s - 124.89s


chunk_text:
and like the difference 77.83s - 79.35s | between denial of service and DDoS 79.35s - 82.79s | is basically denial of service is from one single machine. 82.79s - 86.87s | But DDoS, the additional D is for distributed, of course. 86.87s - 89.25s | So, it means that we require a series of different machine 89.25s - 91.49s | to be able to take down our target. 91.49s - 94.01s | This is basically all about the resource 94.01s - 96.73s | that you have on your machine against the resources 96.73s - 99.01s | that you have on your target. 99.01s - 102.57s | So, if the attacker has more resources on its machine, 102.57s - 106.37s | then it can basically take down the target. 106.37s - 109.57s | But in a DDoS, you might have amplification 109.57s - 112.09s | or multiplicating factor in order to be able 112.09s - 113.97s | to completely take down the machine. 113.97s - 116.37s | So, that's what we're going to talk about today. 117.37s - 119.81s | A little bit of definition debates here. 121.17s - 122.65s | Basically, there is a whole debate 122.65s - 124.89s | about denial of service being an availability 124.89s - 126.89s | or integrity impact. 126.89s - 130.37s | So, basically, the impact of like the DDoS 130.37s - 132.25s | is not a vulnerability class, 132.25s - 134.47s | but more like an impact, I will say. 134.47s - 137.33s | And we can say that deleting a resource 137.33s - 139.01s | is in a sense denied. 139.01s - 141.17s | But the CVSS documentation says 141.17s - 143.69s | that the deletion of a resource is integrity 143.69s - 145.37s | and not availability at all. 145.37s - 147.73s | So, that whole blob of documentation, 147.73s - 150.53s | if you want to read it, is what the CVSS says. 150.53s - 153.33s | So, basically, it says that availability 153.33s - 156.37s | is the performance and operation of the service itself 156.37s - 159.77s | and not the availability of the data. 159.77s - 161.85s | For those who have been doing bug bounty hunting, 161.85s - 165.53s | you know that you are debating a lot about CVSS 165.53s - 167.17s | and you need to read all the documentation. 167.17s - 169.61s


chunk_text:
| about denial of service being an availability 124.89s - 126.89s | or integrity impact. 126.89s - 130.37s | So, basically, the impact of like the DDoS 130.37s - 132.25s | is not a vulnerability class, 132.25s - 134.47s | but more like an impact, I will say. 134.47s - 137.33s | And we can say that deleting a resource 137.33s - 139.01s | is in a sense denied. 139.01s - 141.17s | But the CVSS documentation says 141.17s - 143.69s | that the deletion of a resource is integrity 143.69s - 145.37s | and not availability at all. 145.37s - 147.73s | So, that whole blob of documentation, 147.73s - 150.53s | if you want to read it, is what the CVSS says. 150.53s - 153.33s | So, basically, it says that availability 153.33s - 156.37s | is the performance and operation of the service itself 156.37s - 159.77s | and not the availability of the data. 159.77s - 161.85s | For those who have been doing bug bounty hunting, 161.85s - 165.53s | you know that you are debating a lot about CVSS 165.53s - 167.17s | and you need to read all the documentation. 167.17s - 169.61s | So, be mindful of that if you want 169.61s - 171.79s | to argue with CVSS programs. 172.79s - 176.07s | So, when DDoS is relevant, 176.07s - 179.11s | basically, it is relevant for every feature 179.11s - 181.83s | where there is a strong dependency. 181.83s - 183.47s | This means that it's a feature 183.47s - 185.59s | that a lot of users are going to use 185.59s - 188.83s | or maybe there is a dependency on the machines 188.83s - 191.19s | that you are targeting. 191.19s - 192.15s | For instance, if you can take 192.15s - 194.79s | that entire EKS cluster in production, 194.79s - 196.67s | well, that might be super impactful. 198.03s - 200.15s | But yeah, I know what you are going to say. 200.15s - 202.31s | The denial-of-service is totally out of scope. 202.31s - 205.31s | Actually, on HackerOne default templates for program, 205.31s - 208.49s | it's marked as out of scope by default. 208.49s - 209.95s | And there's a reason for that 209.95s - 213.55s | because companies, in usual, do not like denial-of-service. 213.55s - 215.99s | Not because of the


chunk_text:
| So, be mindful of that if you want 169.61s - 171.79s | to argue with CVSS programs. 172.79s - 176.07s | So, when DDoS is relevant, 176.07s - 179.11s | basically, it is relevant for every feature 179.11s - 181.83s | where there is a strong dependency. 181.83s - 183.47s | This means that it's a feature 183.47s - 185.59s | that a lot of users are going to use 185.59s - 188.83s | or maybe there is a dependency on the machines 188.83s - 191.19s | that you are targeting. 191.19s - 192.15s | For instance, if you can take 192.15s - 194.79s | that entire EKS cluster in production, 194.79s - 196.67s | well, that might be super impactful. 198.03s - 200.15s | But yeah, I know what you are going to say. 200.15s - 202.31s | The denial-of-service is totally out of scope. 202.31s - 205.31s | Actually, on HackerOne default templates for program, 205.31s - 208.49s | it's marked as out of scope by default. 208.49s - 209.95s | And there's a reason for that 209.95s - 213.55s | because companies, in usual, do not like denial-of-service. 213.55s - 215.99s | Not because of the low impact 215.99s - 217.83s | or because it's not security availability, 217.83s - 221.47s | but because, actually, if you let all your bug hunters 221.47s - 223.27s | completely take down your website, 223.27s - 226.27s | it might be a huge problem for them. 226.27s - 230.47s | So, basically, it's not because denial-of-service 230.47s - 231.31s | has low impact, 231.31s - 233.91s | but because sometimes that's too much impact. 233.91s - 236.67s | But we can test denial-of-service responsibly 236.67s - 239.73s | and actually make a few bucks with it. 241.41s - 243.63s | In order to test denial-of-service responsibly, 243.63s - 246.51s | you need to find the gadget of the problem 246.51s - 247.79s | to fully exploit it. 247.79s - 249.63s | So, this means that, for instance, 249.63s - 252.79s | if you have a request that takes more than 10 seconds, 252.79s - 254.19s | this might be a cool gadget 254.19s - 257.23s | in order to take down the entire product environment, 257.23s - 259.35s | but you do not need to actually take it down 259.35s - 262.31s | to just see that one request


chunk_text:
low impact 215.99s - 217.83s | or because it's not security availability, 217.83s - 221.47s | but because, actually, if you let all your bug hunters 221.47s - 223.27s | completely take down your website, 223.27s - 226.27s | it might be a huge problem for them. 226.27s - 230.47s | So, basically, it's not because denial-of-service 230.47s - 231.31s | has low impact, 231.31s - 233.91s | but because sometimes that's too much impact. 233.91s - 236.67s | But we can test denial-of-service responsibly 236.67s - 239.73s | and actually make a few bucks with it. 241.41s - 243.63s | In order to test denial-of-service responsibly, 243.63s - 246.51s | you need to find the gadget of the problem 246.51s - 247.79s | to fully exploit it. 247.79s - 249.63s | So, this means that, for instance, 249.63s - 252.79s | if you have a request that takes more than 10 seconds, 252.79s - 254.19s | this might be a cool gadget 254.19s - 257.23s | in order to take down the entire product environment, 257.23s - 259.35s | but you do not need to actually take it down 259.35s - 262.31s | to just see that one request takes more than 10 seconds. 262.31s - 264.55s | And also, if you are allowed, 264.55s - 266.55s | you can still try to take down 266.55s - 267.91s | the non-production environment, 267.91s - 270.99s | so staging, integration, sandbox, et cetera. 270.99s - 274.79s | But if there is something to know about this entire talk, 274.79s - 277.21s | please, always ask the programs 277.21s - 279.79s | before even searching for denial-of-services 279.79s - 281.47s | because programs need to be aware 281.47s - 284.27s | of what kind of tests you are going to do 284.27s - 285.71s | in order for them to monitor. 285.71s - 288.35s | And if everything is going to fire, 288.35s - 290.71s | they need to identify that you are the one doing the test 290.71s - 291.75s | and just call you and say, 291.75s - 294.09s | hey, I think there is a problem here. 296.03s - 299.23s | And denial-of-service is all about program's maturity. 300.35s - 304.75s | Some companies do not care about denial-of-service's risk 304.75s - 306.15s | because they, I don't know, 306.15s - 310.11s | they don't have user traffic


chunk_text:
takes more than 10 seconds. 262.31s - 264.55s | And also, if you are allowed, 264.55s - 266.55s | you can still try to take down 266.55s - 267.91s | the non-production environment, 267.91s - 270.99s | so staging, integration, sandbox, et cetera. 270.99s - 274.79s | But if there is something to know about this entire talk, 274.79s - 277.21s | please, always ask the programs 277.21s - 279.79s | before even searching for denial-of-services 279.79s - 281.47s | because programs need to be aware 281.47s - 284.27s | of what kind of tests you are going to do 284.27s - 285.71s | in order for them to monitor. 285.71s - 288.35s | And if everything is going to fire, 288.35s - 290.71s | they need to identify that you are the one doing the test 290.71s - 291.75s | and just call you and say, 291.75s - 294.09s | hey, I think there is a problem here. 296.03s - 299.23s | And denial-of-service is all about program's maturity. 300.35s - 304.75s | Some companies do not care about denial-of-service's risk 304.75s - 306.15s | because they, I don't know, 306.15s - 310.11s | they don't have user traffic or stuff like that. 310.11s - 312.43s | But actually, some programs will allow you 312.43s - 315.57s | to completely take down their prod environment. 315.57s - 318.43s | And I'm serious, they are completely allowing 318.43s - 320.35s | to take down their dub-dub-dub environment, 320.35s - 321.73s | so this is amazing. 322.63s - 324.81s | Before starting going on all the different techniques, 324.81s - 328.23s | I need to thanks Rezo, Zach, Ixo, Snorlax, 328.23s - 330.67s | Bifed, BonsoirD, and DoomerHunter. 330.67s - 331.75s | Those are amazing hunter. 331.75s - 334.31s | We did all these research together 334.31s - 335.97s | on the span of two years, 335.97s - 338.55s | so I needed to quickly show that to them. 338.87s - 340.39s | Amazing people to follow, too. 341.83s - 344.99s | Okay, let's start with a quick vulnerability. 344.99s - 346.83s | This one is really fun. 346.83s - 349.51s | So one evening we were hacking with Snorlax 349.51s - 353.47s | and there was this application that was sending service, 353.47s - 355.99s | like it was service to send chat messages. 355.99s - 358.31s | And so


chunk_text:
or stuff like that. 310.11s - 312.43s | But actually, some programs will allow you 312.43s - 315.57s | to completely take down their prod environment. 315.57s - 318.43s | And I'm serious, they are completely allowing 318.43s - 320.35s | to take down their dub-dub-dub environment, 320.35s - 321.73s | so this is amazing. 322.63s - 324.81s | Before starting going on all the different techniques, 324.81s - 328.23s | I need to thanks Rezo, Zach, Ixo, Snorlax, 328.23s - 330.67s | Bifed, BonsoirD, and DoomerHunter. 330.67s - 331.75s | Those are amazing hunter. 331.75s - 334.31s | We did all these research together 334.31s - 335.97s | on the span of two years, 335.97s - 338.55s | so I needed to quickly show that to them. 338.87s - 340.39s | Amazing people to follow, too. 341.83s - 344.99s | Okay, let's start with a quick vulnerability. 344.99s - 346.83s | This one is really fun. 346.83s - 349.51s | So one evening we were hacking with Snorlax 349.51s - 353.47s | and there was this application that was sending service, 353.47s - 355.99s | like it was service to send chat messages. 355.99s - 358.31s | And so with Snorlax, when we are hunting together, 358.31s - 362.33s | we have this game where the goal is to basically 362.33s - 364.47s | try to XSS the other one. 364.47s - 367.19s | So we were contacting one another, sending messages, 367.19s - 370.63s | and we were like, the first that got XSS wins it. 370.63s - 372.35s | But at some point, we were doing a test 372.35s - 374.91s | and my page completely goes blank. 374.91s - 377.15s | And I was like, ah, maybe I lost internet. 377.15s - 379.19s | But I was still hearing Snorlax on Discord 379.19s - 381.39s | and I was like, there's something weird, right? 381.39s - 386.11s | Until he tells me, hey Lupin, is your page blank, too? 387.47s - 391.31s | So those are the payloads that we sent at this moment. 391.31s - 394.49s | So try to think about which one did manage 394.49s - 396.43s | to make the page entirely blank. 397.31s - 400.53s | Do you have it? 400.53s - 402.05s | Yeah, this is the one. 402.05s - 405.61s | And so to understand why this payload 405.61s


chunk_text:
with Snorlax, when we are hunting together, 358.31s - 362.33s | we have this game where the goal is to basically 362.33s - 364.47s | try to XSS the other one. 364.47s - 367.19s | So we were contacting one another, sending messages, 367.19s - 370.63s | and we were like, the first that got XSS wins it. 370.63s - 372.35s | But at some point, we were doing a test 372.35s - 374.91s | and my page completely goes blank. 374.91s - 377.15s | And I was like, ah, maybe I lost internet. 377.15s - 379.19s | But I was still hearing Snorlax on Discord 379.19s - 381.39s | and I was like, there's something weird, right? 381.39s - 386.11s | Until he tells me, hey Lupin, is your page blank, too? 387.47s - 391.31s | So those are the payloads that we sent at this moment. 391.31s - 394.49s | So try to think about which one did manage 394.49s - 396.43s | to make the page entirely blank. 397.31s - 400.53s | Do you have it? 400.53s - 402.05s | Yeah, this is the one. 402.05s - 405.61s | And so to understand why this payload 405.61s - 407.57s | made the page completely blank, 407.57s - 410.05s | basically you need to understand that the service 410.05s - 413.01s | was using a library called sanitize-html. 413.01s - 416.49s | So basically it's some kind of dump purify 416.49s - 419.61s | that will try to sanitize every XSS 419.61s - 421.57s | that you are going to send. 421.57s - 424.69s | And this library actually tried to sanitize 424.69s - 427.53s | every href attribute in your frontend. 427.53s - 430.57s | So for instance, if you have a JavaScript schema, 430.57s - 433.25s | it will try to remove it from the href. 434.21s - 436.81s | However, in this payload, where is the href? 436.81s - 438.45s | There is a problem here. 438.45s - 441.09s | And so the library actually called the function 441.09s - 444.73s | noti-href and take an argument href 444.73s - 446.49s | and do a dot replace on it. 446.49s - 448.49s | However, when it's undefined, 448.49s - 451.01s | completely crashed the entire frontend. 451.01s - 453.69s | Okay, that was a pretty cool one. 453.69s - 456.61s | And so for every


chunk_text:
- 407.57s | made the page completely blank, 407.57s - 410.05s | basically you need to understand that the service 410.05s - 413.01s | was using a library called sanitize-html. 413.01s - 416.49s | So basically it's some kind of dump purify 416.49s - 419.61s | that will try to sanitize every XSS 419.61s - 421.57s | that you are going to send. 421.57s - 424.69s | And this library actually tried to sanitize 424.69s - 427.53s | every href attribute in your frontend. 427.53s - 430.57s | So for instance, if you have a JavaScript schema, 430.57s - 433.25s | it will try to remove it from the href. 434.21s - 436.81s | However, in this payload, where is the href? 436.81s - 438.45s | There is a problem here. 438.45s - 441.09s | And so the library actually called the function 441.09s - 444.73s | noti-href and take an argument href 444.73s - 446.49s | and do a dot replace on it. 446.49s - 448.49s | However, when it's undefined, 448.49s - 451.01s | completely crashed the entire frontend. 451.01s - 453.69s | Okay, that was a pretty cool one. 453.69s - 456.61s | And so for every kind of client side 456.77s - 457.89s | of service malformed data, 457.89s - 460.21s | I would say that the impact is not that huge. 460.21s - 464.37s | It's all depending on the target. 464.37s - 466.53s | Overall, with this specific technique 466.53s - 471.25s | of malformed data html, we did $350 bounty, 471.25s - 472.57s | but that's just the start. 473.81s - 476.29s | If you want to actually search for more 477.49s - 480.17s | malformed data in the frontend, 480.17s - 482.37s | you can, there was a cool vulnerability 482.37s - 484.77s | where we had like a POST request 484.77s - 487.33s | and we could send any invalid JSON 487.33s - 489.01s | that was validated by the backend, 489.01s - 491.81s | but it was a completely malformed JSON. 491.81s - 494.25s | And so when the frontend was using it, 494.25s - 496.89s | it will also completely crash. 496.89s - 500.17s | And so the malformed JSON was like really simple. 500.17s - 505.13s | It was using two back quotes at the same time, 505.13s - 506.21s | two escape back quotes. 506.21s - 509.09s


chunk_text:
kind of client side 456.77s - 457.89s | of service malformed data, 457.89s - 460.21s | I would say that the impact is not that huge. 460.21s - 464.37s | It's all depending on the target. 464.37s - 466.53s | Overall, with this specific technique 466.53s - 471.25s | of malformed data html, we did $350 bounty, 471.25s - 472.57s | but that's just the start. 473.81s - 476.29s | If you want to actually search for more 477.49s - 480.17s | malformed data in the frontend, 480.17s - 482.37s | you can, there was a cool vulnerability 482.37s - 484.77s | where we had like a POST request 484.77s - 487.33s | and we could send any invalid JSON 487.33s - 489.01s | that was validated by the backend, 489.01s - 491.81s | but it was a completely malformed JSON. 491.81s - 494.25s | And so when the frontend was using it, 494.25s - 496.89s | it will also completely crash. 496.89s - 500.17s | And so the malformed JSON was like really simple. 500.17s - 505.13s | It was using two back quotes at the same time, 505.13s - 506.21s | two escape back quotes. 506.21s - 509.09s | And so it was somehow accepted by the backend, 509.09s - 512.29s | but when you were doing a JSON.parse on the frontend, 512.29s - 514.69s | it will completely crash. 515.53s - 518.45s | And so this technique actually worked on TikTok 518.45s - 520.41s | and we got paid with XO for that. 520.41s - 522.53s | So that was a cool one, 522.53s - 525.49s | but there were some cooler techniques now. 525.49s - 529.81s | Okay, so that guy here is one of the biggest problem 529.81s - 534.37s | for all developers, the N plus one problem. 534.37s - 539.21s | Basically this technique, I actually knew about it 539.21s - 542.01s | because my brother, who is a backend developer 542.01s - 544.69s | told me about, like we were talking about 544.69s - 547.29s | in our services and how I was trying to exploit them. 547.29s - 549.61s | And he was like, do you know what's an N plus one problem? 549.61s - 550.45s | And I was like, no. 550.45s - 553.09s | And he told me that basically an N plus one problem 553.09s - 555.53s |


chunk_text:
| And so it was somehow accepted by the backend, 509.09s - 512.29s | but when you were doing a JSON.parse on the frontend, 512.29s - 514.69s | it will completely crash. 515.53s - 518.45s | And so this technique actually worked on TikTok 518.45s - 520.41s | and we got paid with XO for that. 520.41s - 522.53s | So that was a cool one, 522.53s - 525.49s | but there were some cooler techniques now. 525.49s - 529.81s | Okay, so that guy here is one of the biggest problem 529.81s - 534.37s | for all developers, the N plus one problem. 534.37s - 539.21s | Basically this technique, I actually knew about it 539.21s - 542.01s | because my brother, who is a backend developer 542.01s - 544.69s | told me about, like we were talking about 544.69s - 547.29s | in our services and how I was trying to exploit them. 547.29s - 549.61s | And he was like, do you know what's an N plus one problem? 549.61s - 550.45s | And I was like, no. 550.45s - 553.09s | And he told me that basically an N plus one problem 553.09s - 555.53s | is was a database anti-pattern 555.53s - 559.97s | when one query leads to N additional queries 559.97s - 562.97s | causing inefficient data retrieval. 562.97s - 567.41s | So basically an attacker can exploit N plus one queries 567.41s - 569.85s | to trigger numerous call to the database 569.97s - 572.69s | and potentially overwhelm the system. 572.69s - 575.13s | And the impact of an N plus one query 575.13s - 577.25s | often scales with the data size. 577.25s - 578.81s | So the more data that you add, 578.81s - 582.21s | the more DOS capability you can have on your target. 583.47s - 585.81s | So how to detect an N plus one query? 585.81s - 589.51s | Basically you find an endpoint that creates data in the API. 589.51s - 592.43s | You find a request that gets all the data at the same time. 592.43s - 594.05s | So usually a get request. 594.05s - 596.69s | And if there is pagination, try to increase the limit. 596.69s - 598.21s | For instance, you have some get request 598.21s - 599.81s | which is page equal 10. 599.81s - 602.85s | Try


chunk_text:
is was a database anti-pattern 555.53s - 559.97s | when one query leads to N additional queries 559.97s - 562.97s | causing inefficient data retrieval. 562.97s - 567.41s | So basically an attacker can exploit N plus one queries 567.41s - 569.85s | to trigger numerous call to the database 569.97s - 572.69s | and potentially overwhelm the system. 572.69s - 575.13s | And the impact of an N plus one query 575.13s - 577.25s | often scales with the data size. 577.25s - 578.81s | So the more data that you add, 578.81s - 582.21s | the more DOS capability you can have on your target. 583.47s - 585.81s | So how to detect an N plus one query? 585.81s - 589.51s | Basically you find an endpoint that creates data in the API. 589.51s - 592.43s | You find a request that gets all the data at the same time. 592.43s - 594.05s | So usually a get request. 594.05s - 596.69s | And if there is pagination, try to increase the limit. 596.69s - 598.21s | For instance, you have some get request 598.21s - 599.81s | which is page equal 10. 599.81s - 602.85s | Try to put 10,000 and see what's going to happen. 603.77s - 606.97s | And if the more data you add in the backend, 606.97s - 609.59s | the more time delay there is in the response, 609.59s - 611.29s | then you have an N plus one error. 612.69s - 614.77s | I also created a BURP extension 614.77s - 618.05s | that I'm going to release right after this talk. 618.05s - 619.53s | That's called Tridos. 619.53s - 623.53s | And basically it's going to search in your proxy passively 623.53s - 626.57s | all the requests that takes more than X seconds 626.57s - 629.93s | where X is a threshold that you set yourself. 629.93s - 632.23s | I personally put it to three seconds. 632.23s - 636.35s | And this is a good way to actually identify queries 636.35s - 639.07s | that might take a lot of time on the backend 639.07s - 642.89s | and that you can actually use for your exploitation. 642.89s - 647.89s | So let's take an example of an N plus one problem. 648.55s - 650.61s | There was an app that could accept 650.61s - 653.65s |


chunk_text:
to put 10,000 and see what's going to happen. 603.77s - 606.97s | And if the more data you add in the backend, 606.97s - 609.59s | the more time delay there is in the response, 609.59s - 611.29s | then you have an N plus one error. 612.69s - 614.77s | I also created a BURP extension 614.77s - 618.05s | that I'm going to release right after this talk. 618.05s - 619.53s | That's called Tridos. 619.53s - 623.53s | And basically it's going to search in your proxy passively 623.53s - 626.57s | all the requests that takes more than X seconds 626.57s - 629.93s | where X is a threshold that you set yourself. 629.93s - 632.23s | I personally put it to three seconds. 632.23s - 636.35s | And this is a good way to actually identify queries 636.35s - 639.07s | that might take a lot of time on the backend 639.07s - 642.89s | and that you can actually use for your exploitation. 642.89s - 647.89s | So let's take an example of an N plus one problem. 648.55s - 650.61s | There was an app that could accept 650.61s - 653.65s | to create as many objects as we wanted. 653.65s - 655.25s | The JSON blob was something like that 655.25s - 657.17s | where you had a list of users. 657.17s - 662.05s | And then on each user, on each array of the list, 662.05s - 664.61s | you can create a new user. 664.61s - 667.01s | And then there was another sub object 667.01s - 669.41s | with another array with new objects. 669.41s - 671.71s | So that's basically an N plus one problem 671.71s - 673.45s | when one request can create 673.45s - 676.09s | as many sub objects as you want. 677.21s - 679.09s | And so how did we exploit that? 679.09s - 682.65s | Well, we sent the request to create all those objects 682.69s - 686.97s | and we created approximately 10,000 objects in the backend. 686.97s - 691.39s | And then our get request to retrieve all the objects 691.39s - 694.01s | took 10 seconds per request. 694.01s - 696.85s | So that's a really, really good sign 696.85s - 698.83s | that you have an N plus one problem. 698.83s - 700.17s | We took those requests,


chunk_text:
to create as many objects as we wanted. 653.65s - 655.25s | The JSON blob was something like that 655.25s - 657.17s | where you had a list of users. 657.17s - 662.05s | And then on each user, on each array of the list, 662.05s - 664.61s | you can create a new user. 664.61s - 667.01s | And then there was another sub object 667.01s - 669.41s | with another array with new objects. 669.41s - 671.71s | So that's basically an N plus one problem 671.71s - 673.45s | when one request can create 673.45s - 676.09s | as many sub objects as you want. 677.21s - 679.09s | And so how did we exploit that? 679.09s - 682.65s | Well, we sent the request to create all those objects 682.69s - 686.97s | and we created approximately 10,000 objects in the backend. 686.97s - 691.39s | And then our get request to retrieve all the objects 691.39s - 694.01s | took 10 seconds per request. 694.01s - 696.85s | So that's a really, really good sign 696.85s - 698.83s | that you have an N plus one problem. 698.83s - 700.17s | We took those requests, 700.17s - 703.29s | we put it into an intruder on burp 703.29s - 706.77s | and we set it with no payloads, 10 concurrent requests. 706.77s - 710.31s | And we basically set it to run indefinitely. 710.31s - 716.36s | And the result, complete crash. 716.36s - 718.84s | Overall, this technique, not on a single vulnerability, 718.84s - 723.26s | but overall, we did $46,000 in bounty. 723.26s - 724.60s | There was an LHE this week, 724.60s - 727.84s | so we can add 10,000 more to this slide. 727.84s - 732.40s | I think that 30K of this was Nolak's alone 733.38s - 736.12s | because he's so good as just taking one technique 736.12s - 737.24s | and spread it. 737.24s - 740.16s | I think he did 15K per vulnerability, 740.16s - 742.48s | so in two vulnerability, 30K. 742.48s - 743.64s | That guy is insane. 745.32s - 749.64s | Okay, let's talk about network-based denial of services. 749.64s - 752.16s | Have you ever been in that situation 752.16s - 753.80s | where you have a blind SSRF 753.80s - 756.20s | and you don't know what to do with it?


chunk_text:
700.17s - 703.29s | we put it into an intruder on burp 703.29s - 706.77s | and we set it with no payloads, 10 concurrent requests. 706.77s - 710.31s | And we basically set it to run indefinitely. 710.31s - 716.36s | And the result, complete crash. 716.36s - 718.84s | Overall, this technique, not on a single vulnerability, 718.84s - 723.26s | but overall, we did $46,000 in bounty. 723.26s - 724.60s | There was an LHE this week, 724.60s - 727.84s | so we can add 10,000 more to this slide. 727.84s - 732.40s | I think that 30K of this was Nolak's alone 733.38s - 736.12s | because he's so good as just taking one technique 736.12s - 737.24s | and spread it. 737.24s - 740.16s | I think he did 15K per vulnerability, 740.16s - 742.48s | so in two vulnerability, 30K. 742.48s - 743.64s | That guy is insane. 745.32s - 749.64s | Okay, let's talk about network-based denial of services. 749.64s - 752.16s | Have you ever been in that situation 752.16s - 753.80s | where you have a blind SSRF 753.80s - 756.20s | and you don't know what to do with it? 756.20s - 758.66s | And that you are desperate for a technique 758.66s - 762.16s | that will help you transform this sometimes informative 762.16s - 764.44s | vulnerability into a higher crit? 764.44s - 766.62s | Well, we have a technique for you. 767.62s - 770.90s | Basically, do you guys know something called 770.90s - 772.62s | like slow low-risk attack? 772.62s - 774.58s | Well, basically, we are going to try 774.58s - 776.62s | to do something really similar 776.62s - 780.06s | where we are going to try to make the bucket hang 780.06s - 782.66s | on the network level as much as possible. 782.66s - 784.90s | We can do it with several ways. 784.90s - 788.06s | You can make your server hang 788.06s - 790.54s | and just time out after 10 seconds, 790.54s - 793.60s | or you can create a request loop. 793.60s - 796.02s | So, what do I mean by request loop? 796.42s - 798.46s | Well, you have your server that has a path 798.46s - 801.46s | that will reject 301 on path two, 801.46s - 804.22s | and then the path two will reject


chunk_text:
756.20s - 758.66s | And that you are desperate for a technique 758.66s - 762.16s | that will help you transform this sometimes informative 762.16s - 764.44s | vulnerability into a higher crit? 764.44s - 766.62s | Well, we have a technique for you. 767.62s - 770.90s | Basically, do you guys know something called 770.90s - 772.62s | like slow low-risk attack? 772.62s - 774.58s | Well, basically, we are going to try 774.58s - 776.62s | to do something really similar 776.62s - 780.06s | where we are going to try to make the bucket hang 780.06s - 782.66s | on the network level as much as possible. 782.66s - 784.90s | We can do it with several ways. 784.90s - 788.06s | You can make your server hang 788.06s - 790.54s | and just time out after 10 seconds, 790.54s - 793.60s | or you can create a request loop. 793.60s - 796.02s | So, what do I mean by request loop? 796.42s - 798.46s | Well, you have your server that has a path 798.46s - 801.46s | that will reject 301 on path two, 801.46s - 804.22s | and then the path two will reject again on path one. 804.22s - 807.70s | So, we create like an infinite loop of redirects. 807.70s - 811.46s | And the goal is to make the server time out 811.46s - 812.88s | as much as possible. 812.88s - 815.96s | So, we have that kind of schema happening. 817.94s - 819.86s | And the goal of that technique is actually 819.86s - 822.94s | to fill all the available sockets of the server 822.94s - 827.02s | so it couldn't actually treat the next request 829.06s - 831.74s | until we have this bottleneck happening 831.74s - 834.16s | and there is no available sockets anymore. 837.36s - 839.32s | For this technique, I think it was 839.32s - 841.24s | on two separate vulnerabilities. 841.24s - 843.32s | We made 15K. 843.32s - 845.00s | So, it's actually a great technique 845.00s - 848.20s | to transform blind SSRF into a critical. 848.20s - 850.92s | Again, every time that we take down product environments, 850.92s - 853.16s | we always ask for the programs. 853.16s - 854.96s | Really be mindful of that. 855.52s - 858.42s | That's a pretty cool one if you're ever


chunk_text:
again on path one. 804.22s - 807.70s | So, we create like an infinite loop of redirects. 807.70s - 811.46s | And the goal is to make the server time out 811.46s - 812.88s | as much as possible. 812.88s - 815.96s | So, we have that kind of schema happening. 817.94s - 819.86s | And the goal of that technique is actually 819.86s - 822.94s | to fill all the available sockets of the server 822.94s - 827.02s | so it couldn't actually treat the next request 829.06s - 831.74s | until we have this bottleneck happening 831.74s - 834.16s | and there is no available sockets anymore. 837.36s - 839.32s | For this technique, I think it was 839.32s - 841.24s | on two separate vulnerabilities. 841.24s - 843.32s | We made 15K. 843.32s - 845.00s | So, it's actually a great technique 845.00s - 848.20s | to transform blind SSRF into a critical. 848.20s - 850.92s | Again, every time that we take down product environments, 850.92s - 853.16s | we always ask for the programs. 853.16s - 854.96s | Really be mindful of that. 855.52s - 858.42s | That's a pretty cool one if you're ever stuck. 860.08s - 863.48s | Okay, let's go to sign-in denial of services. 864.96s - 867.82s | This one was really cool because we had a target 867.82s - 870.36s | with an employee webpage. 870.36s - 872.56s | And basically, when we see an employee webpage, 872.56s - 875.50s | we try password stuffing or brute forcing 875.50s - 878.88s | with simple combination, injection, et cetera, et cetera. 878.88s - 882.36s | But why this target was particularly interesting for us 882.36s - 886.64s | is because it was a target with more than 1,000 employees. 886.64s - 890.36s | There was no rate limiting on the login, no 2FA at all, 890.36s - 893.40s | and they were using first name dot last name for the user. 893.40s - 895.80s | So, we could pull everything on LinkedIn 895.80s - 899.12s | and we had a great world list to work with. 899.12s - 900.90s | So, what do we do? 900.90s - 903.20s | We managed to automate the attack, 903.20s - 906.88s | no rate limiting at all, and then no login found. 906.88s - 908.60s | Wait, no login found? 909.48s - 911.64s |


chunk_text:
stuck. 860.08s - 863.48s | Okay, let's go to sign-in denial of services. 864.96s - 867.82s | This one was really cool because we had a target 867.82s - 870.36s | with an employee webpage. 870.36s - 872.56s | And basically, when we see an employee webpage, 872.56s - 875.50s | we try password stuffing or brute forcing 875.50s - 878.88s | with simple combination, injection, et cetera, et cetera. 878.88s - 882.36s | But why this target was particularly interesting for us 882.36s - 886.64s | is because it was a target with more than 1,000 employees. 886.64s - 890.36s | There was no rate limiting on the login, no 2FA at all, 890.36s - 893.40s | and they were using first name dot last name for the user. 893.40s - 895.80s | So, we could pull everything on LinkedIn 895.80s - 899.12s | and we had a great world list to work with. 899.12s - 900.90s | So, what do we do? 900.90s - 903.20s | We managed to automate the attack, 903.20s - 906.88s | no rate limiting at all, and then no login found. 906.88s - 908.60s | Wait, no login found? 909.48s - 911.64s | But we still got a crit. 911.64s - 915.84s | Okay, guess what protection they implemented 915.84s - 917.46s | for brute forcing attack. 917.46s - 919.72s | Is it A, delay the next attempt? 919.72s - 921.44s | B, capture? 921.44s - 923.40s | C, ban the IP address? 923.40s - 930.69s | Or D, ban the employee account? 930.69s - 933.01s | There is actual documentation on the internet 933.01s - 936.03s | that says that this is the right thing to do. 936.03s - 937.59s | So, yeah. 937.59s - 938.43s | What happened? 938.43s - 939.89s | 600 account locked. 940.77s - 943.85s | They had LTAP integration with the AD. 943.85s - 946.83s | So, Active Directory completely down, 946.83s - 949.29s | no access to the VPN anymore, 949.29s - 952.69s | completely take down of the internet environment. 952.69s - 953.71s | So funny. 954.97s - 957.21s | I would say that the impact of this technique 957.21s - 961.25s | is actually like a three out of five, 961.25s - 964.97s | but it's because the presence in the wild is also reduced. 964.97s - 966.41s | I don't think that a


chunk_text:
But we still got a crit. 911.64s - 915.84s | Okay, guess what protection they implemented 915.84s - 917.46s | for brute forcing attack. 917.46s - 919.72s | Is it A, delay the next attempt? 919.72s - 921.44s | B, capture? 921.44s - 923.40s | C, ban the IP address? 923.40s - 930.69s | Or D, ban the employee account? 930.69s - 933.01s | There is actual documentation on the internet 933.01s - 936.03s | that says that this is the right thing to do. 936.03s - 937.59s | So, yeah. 937.59s - 938.43s | What happened? 938.43s - 939.89s | 600 account locked. 940.77s - 943.85s | They had LTAP integration with the AD. 943.85s - 946.83s | So, Active Directory completely down, 946.83s - 949.29s | no access to the VPN anymore, 949.29s - 952.69s | completely take down of the internet environment. 952.69s - 953.71s | So funny. 954.97s - 957.21s | I would say that the impact of this technique 957.21s - 961.25s | is actually like a three out of five, 961.25s - 964.97s | but it's because the presence in the wild is also reduced. 964.97s - 966.41s | I don't think that a lot of companies 966.41s - 969.87s | are doing that anymore, but pretty cool bug. 970.87s - 974.75s | Okay, let's go to another type of DOS, 974.75s - 976.41s | disk consumption DOS. 976.41s - 977.75s | So, this story is quite cool. 977.75s - 980.79s | It started because I read this AssetNode research. 980.79s - 982.71s | If you guys don't know AssetNode, 982.71s - 985.63s | you should read every blog post of them. 985.63s - 986.69s | It's amazing. 986.69s - 989.11s | And there was this blog post from 2019 989.11s - 992.79s | called Discovering a Zero Day and Getting Code Execution 992.79s - 994.63s | on Modular AWS Network. 994.63s - 997.05s | So, how did AssetNode achieve that? 997.05s - 1000.21s | Basically, there was an instance called WebHTest 1000.21s - 1002.45s | and it was completely open source. 1002.45s - 1005.05s | So, they read the code and there was this piece of code 1005.05s - 1007.45s | where you could extract a zip file 1007.45s - 1008.89s | that was given by the user 1008.89s - 1012.09s | and then with some kind of quick race condition, 1012.09s -


chunk_text:
lot of companies 966.41s - 969.87s | are doing that anymore, but pretty cool bug. 970.87s - 974.75s | Okay, let's go to another type of DOS, 974.75s - 976.41s | disk consumption DOS. 976.41s - 977.75s | So, this story is quite cool. 977.75s - 980.79s | It started because I read this AssetNode research. 980.79s - 982.71s | If you guys don't know AssetNode, 982.71s - 985.63s | you should read every blog post of them. 985.63s - 986.69s | It's amazing. 986.69s - 989.11s | And there was this blog post from 2019 989.11s - 992.79s | called Discovering a Zero Day and Getting Code Execution 992.79s - 994.63s | on Modular AWS Network. 994.63s - 997.05s | So, how did AssetNode achieve that? 997.05s - 1000.21s | Basically, there was an instance called WebHTest 1000.21s - 1002.45s | and it was completely open source. 1002.45s - 1005.05s | So, they read the code and there was this piece of code 1005.05s - 1007.45s | where you could extract a zip file 1007.45s - 1008.89s | that was given by the user 1008.89s - 1012.09s | and then with some kind of quick race condition, 1012.09s - 1015.09s | you could actually call a PHP file. 1015.09s - 1017.57s | And so, for this race condition to work, 1017.57s - 1019.89s | you needed to set up an intruder 1019.89s - 1022.93s | and just run as many requests as possible. 1024.17s - 1025.97s | What happened when I tried it? 1027.17s - 1029.57s | The backend didn't have enough eNodes 1029.57s - 1030.93s | to take the charge of requests. 1030.93s - 1033.41s | So, every time it was creating a zip file 1033.41s - 1037.17s | and trying to extract it, it was allocating eNodes 1037.17s - 1041.67s | and so, the disk was full in like maybe two, three seconds. 1041.67s - 1044.31s | So, yeah, I took down the instance 1044.31s - 1047.33s | and I thought that this instance wasn't used by anyone 1047.33s - 1050.61s | until someone told me, hey, all the pipelines are down. 1050.61s - 1052.69s | And so, every time they were running a pipeline, 1052.69s - 1054.51s | they were going to that instance. 1055.53s - 1056.37s | That's cool. 1057.37s - 1059.25s | So, total crash of the server. 1059.25s - 1060.33s | No access


chunk_text:
1015.09s | you could actually call a PHP file. 1015.09s - 1017.57s | And so, for this race condition to work, 1017.57s - 1019.89s | you needed to set up an intruder 1019.89s - 1022.93s | and just run as many requests as possible. 1024.17s - 1025.97s | What happened when I tried it? 1027.17s - 1029.57s | The backend didn't have enough eNodes 1029.57s - 1030.93s | to take the charge of requests. 1030.93s - 1033.41s | So, every time it was creating a zip file 1033.41s - 1037.17s | and trying to extract it, it was allocating eNodes 1037.17s - 1041.67s | and so, the disk was full in like maybe two, three seconds. 1041.67s - 1044.31s | So, yeah, I took down the instance 1044.31s - 1047.33s | and I thought that this instance wasn't used by anyone 1047.33s - 1050.61s | until someone told me, hey, all the pipelines are down. 1050.61s - 1052.69s | And so, every time they were running a pipeline, 1052.69s - 1054.51s | they were going to that instance. 1055.53s - 1056.37s | That's cool. 1057.37s - 1059.25s | So, total crash of the server. 1059.25s - 1060.33s | No access to the disk. 1060.33s - 1062.65s | They needed to clean everything, wipe out, 1062.65s - 1064.21s | restart the server. 1064.21s - 1065.61s | That was a cool one. 1065.61s - 1068.77s | I would say that, again, the impact is reduced 1068.77s - 1070.33s | because of the presence in the world. 1070.33s - 1072.09s | So, it's a three out of five. 1073.93s - 1075.33s | Cache poisoning. 1075.33s - 1076.33s | That's a good one. 1077.19s - 1080.45s | So, one day, for this anecdote, 1080.45s - 1083.21s | at Lupienzo Homes, we were developing a new feature 1083.21s - 1085.57s | for our tool, Depi, in research mode. 1085.57s - 1088.77s | Research mode, for us, is when we want to test an idea 1088.77s - 1092.01s | and spread it to see if it should be incorporated 1092.01s - 1095.01s | into our tool for our customers. 1095.01s - 1098.61s | And so, the idea was, what if registries, 1098.61s - 1101.49s | when you install a dependency and have two factories, 1101.49s - 1103.13s | used by the clients were vulnerable 1103.13s - 1105.45s | to cache poisoning in our service? 1105.45s -


chunk_text:
to the disk. 1060.33s - 1062.65s | They needed to clean everything, wipe out, 1062.65s - 1064.21s | restart the server. 1064.21s - 1065.61s | That was a cool one. 1065.61s - 1068.77s | I would say that, again, the impact is reduced 1068.77s - 1070.33s | because of the presence in the world. 1070.33s - 1072.09s | So, it's a three out of five. 1073.93s - 1075.33s | Cache poisoning. 1075.33s - 1076.33s | That's a good one. 1077.19s - 1080.45s | So, one day, for this anecdote, 1080.45s - 1083.21s | at Lupienzo Homes, we were developing a new feature 1083.21s - 1085.57s | for our tool, Depi, in research mode. 1085.57s - 1088.77s | Research mode, for us, is when we want to test an idea 1088.77s - 1092.01s | and spread it to see if it should be incorporated 1092.01s - 1095.01s | into our tool for our customers. 1095.01s - 1098.61s | And so, the idea was, what if registries, 1098.61s - 1101.49s | when you install a dependency and have two factories, 1101.49s - 1103.13s | used by the clients were vulnerable 1103.13s - 1105.45s | to cache poisoning in our service? 1105.45s - 1107.41s | It's a good thing to try. 1107.41s - 1109.33s | So, we developed a proof concept 1109.33s - 1112.45s | and on the first run, we managed to get a hit 1112.45s - 1114.45s | on registry.npmjs.org. 1114.53s - 1118.29s | And I was like, no, that didn't happen. 1118.29s - 1119.33s | Like, no way. 1120.93s - 1122.65s | So, we thought it was a false positive 1122.65s - 1125.61s | and lo and behold, it worked. 1126.91s - 1129.61s | So, what is CPDOS? 1129.61s - 1134.61s | CPDOS, it was a web attack technique described by Portugal. 1135.01s - 1137.69s | Portugal actually made it really, really famous. 1137.69s - 1139.85s | Again, if you didn't read in your life 1139.85s - 1142.81s | a James Kettle research, you should do it. 1142.81s - 1144.05s | This guy is amazing. 1144.57s - 1145.93s | Always breaking the internet. 1145.93s - 1148.69s | And basically, it involved exploiting vulnerabilities 1148.69s - 1149.97s | in the web caching system 1149.97s - 1154.21s | in order to deliver malicious content to the users. 1154.21s - 1157.97s | So, the methodology is to first understand 1157.97s - 1161.49s |


chunk_text:
1107.41s | It's a good thing to try. 1107.41s - 1109.33s | So, we developed a proof concept 1109.33s - 1112.45s | and on the first run, we managed to get a hit 1112.45s - 1114.45s | on registry.npmjs.org. 1114.53s - 1118.29s | And I was like, no, that didn't happen. 1118.29s - 1119.33s | Like, no way. 1120.93s - 1122.65s | So, we thought it was a false positive 1122.65s - 1125.61s | and lo and behold, it worked. 1126.91s - 1129.61s | So, what is CPDOS? 1129.61s - 1134.61s | CPDOS, it was a web attack technique described by Portugal. 1135.01s - 1137.69s | Portugal actually made it really, really famous. 1137.69s - 1139.85s | Again, if you didn't read in your life 1139.85s - 1142.81s | a James Kettle research, you should do it. 1142.81s - 1144.05s | This guy is amazing. 1144.57s - 1145.93s | Always breaking the internet. 1145.93s - 1148.69s | And basically, it involved exploiting vulnerabilities 1148.69s - 1149.97s | in the web caching system 1149.97s - 1154.21s | in order to deliver malicious content to the users. 1154.21s - 1157.97s | So, the methodology is to first understand 1157.97s - 1161.49s | how the cache keys of our target is working 1161.49s - 1165.57s | and then understand how the output of the request 1165.57s - 1168.09s | is linked to your HTTP input. 1168.09s - 1171.29s | So, for instance, is the cache key inside the path, 1171.29s - 1175.17s | the headers, or maybe some data in the POST requests? 1175.17s - 1176.81s | Once you identify the cache key, 1176.81s - 1179.33s | try to understand how you can manipulate it 1179.33s - 1181.65s | in order to cache unwanted content. 1181.65s - 1184.93s | So, it could be a malicious content like an XSS payload 1184.93s - 1189.01s | or it could just take down the page for all the users. 1190.09s - 1194.49s | So, the case of registry.npmjs.org was pretty cool. 1194.49s - 1196.93s | Basically, my assumption is that the cache key 1196.93s - 1199.57s | was actually the full path. 1199.65s - 1203.97s | And when we added our malicious header, 1203.97s - 1207.09s | it will create a 404 error. 1207.09s - 1210.29s | But however, the cache key is still remaining the same, 1210.29s - 1213.81s | and so it will just


chunk_text:
how the cache keys of our target is working 1161.49s - 1165.57s | and then understand how the output of the request 1165.57s - 1168.09s | is linked to your HTTP input. 1168.09s - 1171.29s | So, for instance, is the cache key inside the path, 1171.29s - 1175.17s | the headers, or maybe some data in the POST requests? 1175.17s - 1176.81s | Once you identify the cache key, 1176.81s - 1179.33s | try to understand how you can manipulate it 1179.33s - 1181.65s | in order to cache unwanted content. 1181.65s - 1184.93s | So, it could be a malicious content like an XSS payload 1184.93s - 1189.01s | or it could just take down the page for all the users. 1190.09s - 1194.49s | So, the case of registry.npmjs.org was pretty cool. 1194.49s - 1196.93s | Basically, my assumption is that the cache key 1196.93s - 1199.57s | was actually the full path. 1199.65s - 1203.97s | And when we added our malicious header, 1203.97s - 1207.09s | it will create a 404 error. 1207.09s - 1210.29s | But however, the cache key is still remaining the same, 1210.29s - 1213.81s | and so it will just override the cache key with a 404. 1215.13s - 1219.01s | So, at this point, we called deny packages. 1219.01s - 1223.45s | That's a screenshot of my script running in the back 1223.45s - 1225.65s | and I'm trying to do an npm install, 1225.65s - 1226.65s | and then that's it. 1226.65s - 1229.49s | We got a 404 in production environment. 1230.17s - 1231.33s | That was kind of cool. 1231.33s - 1234.13s | Don't worry, I did it on a package that I created myself. 1234.13s - 1236.61s | I didn't take down anything, hopefully. 1237.77s - 1241.13s | And so, the impact was a complete denial 1241.13s - 1243.93s | of any npm package in the world. 1243.93s - 1247.25s | Imagine Express has 30 million plus downloads per week. 1248.45s - 1251.21s | Actually, there was a lot of mitigation in place 1251.21s - 1254.17s | on GitHub and npm side, 1254.17s - 1258.09s | but it was quite cool vulnerability. 1258.09s - 1263.09s | And so, first, they awarded a $500 informative, 1264.05s - 1267.29s | but then they actually did an awesome work 1267.29s - 1269.17s | to reconsider the severity, 1269.17s


chunk_text:
override the cache key with a 404. 1215.13s - 1219.01s | So, at this point, we called deny packages. 1219.01s - 1223.45s | That's a screenshot of my script running in the back 1223.45s - 1225.65s | and I'm trying to do an npm install, 1225.65s - 1226.65s | and then that's it. 1226.65s - 1229.49s | We got a 404 in production environment. 1230.17s - 1231.33s | That was kind of cool. 1231.33s - 1234.13s | Don't worry, I did it on a package that I created myself. 1234.13s - 1236.61s | I didn't take down anything, hopefully. 1237.77s - 1241.13s | And so, the impact was a complete denial 1241.13s - 1243.93s | of any npm package in the world. 1243.93s - 1247.25s | Imagine Express has 30 million plus downloads per week. 1248.45s - 1251.21s | Actually, there was a lot of mitigation in place 1251.21s - 1254.17s | on GitHub and npm side, 1254.17s - 1258.09s | but it was quite cool vulnerability. 1258.09s - 1263.09s | And so, first, they awarded a $500 informative, 1264.05s - 1267.29s | but then they actually did an awesome work 1267.29s - 1269.17s | to reconsider the severity, 1269.17s - 1274.17s | and they added a $10,000 bounty for this npm crash. 1274.89s - 1278.57s | So, I was so happy, especially for something 1278.57s - 1280.65s | that we didn't do on purpose again. 1282.41s - 1285.41s | Okay, let's go to another cool attack vector 1285.41s - 1286.89s | for denial of services. 1286.89s - 1289.29s | Everything related to GraphQL. 1289.29s - 1291.81s | So, why are we talking about GraphQL today? 1291.81s - 1295.85s | Because it has a huge adoption in the last few years, 1295.85s - 1298.13s | and there is so many denial of services 1298.13s - 1300.37s | in the default configuration. 1300.37s - 1305.34s | But when I say so many, I say so many. 1305.34s - 1309.26s | First case of denial of services on GraphQL 1309.26s - 1311.26s | is a circular definition. 1311.26s - 1313.46s | Basically, circular definition occurs 1313.46s - 1318.46s | when an object references itself directly or indirectly. 1319.70s - 1322.46s | For instance, here we have a type user 1322.46s - 1324.14s | that has a best friend user. 1324.14s - 1328.64s | But imagine if your best friend is also best


chunk_text:
- 1274.17s | and they added a $10,000 bounty for this npm crash. 1274.89s - 1278.57s | So, I was so happy, especially for something 1278.57s - 1280.65s | that we didn't do on purpose again. 1282.41s - 1285.41s | Okay, let's go to another cool attack vector 1285.41s - 1286.89s | for denial of services. 1286.89s - 1289.29s | Everything related to GraphQL. 1289.29s - 1291.81s | So, why are we talking about GraphQL today? 1291.81s - 1295.85s | Because it has a huge adoption in the last few years, 1295.85s - 1298.13s | and there is so many denial of services 1298.13s - 1300.37s | in the default configuration. 1300.37s - 1305.34s | But when I say so many, I say so many. 1305.34s - 1309.26s | First case of denial of services on GraphQL 1309.26s - 1311.26s | is a circular definition. 1311.26s - 1313.46s | Basically, circular definition occurs 1313.46s - 1318.46s | when an object references itself directly or indirectly. 1319.70s - 1322.46s | For instance, here we have a type user 1322.46s - 1324.14s | that has a best friend user. 1324.14s - 1328.64s | But imagine if your best friend is also best friend with you. 1328.64s - 1330.62s | You are basically referencing yourself. 1330.62s - 1332.62s | So, we have a circular definition here. 1333.60s - 1336.30s | But no need to check for the introspection 1336.30s - 1339.06s | and actually understand the structure of your target. 1339.06s - 1340.94s | GraphQL is vulnerable by default 1340.94s - 1342.92s | in the introspection schema. 1343.36s - 1344.68s | So, you can just do an introspection 1344.68s - 1346.24s | and actually DOS your target 1346.24s - 1348.80s | without understanding their data structure. 1348.80s - 1352.31s | That's insane. 1352.31s - 1354.91s | And so, there's another kind of technique 1354.91s - 1357.31s | called GraphQL batching that is pretty cool. 1357.31s - 1361.35s | Basically, the goal is to compile a lot of different requests 1361.35s - 1363.55s | in the same HTTP requests. 1363.55s - 1368.47s | And again, this could be used to actually DOS your target. 1368.47s - 1371.67s | We're going to talk about this a little bit later. 1371.67s - 1373.67s | Something really similar to GraphQL batching, 1373.67s - 1375.27s | there is aliases where, basically, 1375.27s - 1380.07s | you can use


chunk_text:
friend with you. 1328.64s - 1330.62s | You are basically referencing yourself. 1330.62s - 1332.62s | So, we have a circular definition here. 1333.60s - 1336.30s | But no need to check for the introspection 1336.30s - 1339.06s | and actually understand the structure of your target. 1339.06s - 1340.94s | GraphQL is vulnerable by default 1340.94s - 1342.92s | in the introspection schema. 1343.36s - 1344.68s | So, you can just do an introspection 1344.68s - 1346.24s | and actually DOS your target 1346.24s - 1348.80s | without understanding their data structure. 1348.80s - 1352.31s | That's insane. 1352.31s - 1354.91s | And so, there's another kind of technique 1354.91s - 1357.31s | called GraphQL batching that is pretty cool. 1357.31s - 1361.35s | Basically, the goal is to compile a lot of different requests 1361.35s - 1363.55s | in the same HTTP requests. 1363.55s - 1368.47s | And again, this could be used to actually DOS your target. 1368.47s - 1371.67s | We're going to talk about this a little bit later. 1371.67s - 1373.67s | Something really similar to GraphQL batching, 1373.67s - 1375.27s | there is aliases where, basically, 1375.27s - 1380.07s | you can use different aliases for the same requests 1380.07s - 1382.19s | but also use different arguments. 1382.19s - 1385.63s | So, that also could be a huge attack vector 1385.63s - 1387.47s | for the network service. 1387.47s - 1390.83s | So, quick tip for batching and aliases 1390.83s - 1393.55s | is to actually try to find gadget. 1393.55s - 1396.91s | What I call gadget, if it's the right definition, 1396.91s - 1399.57s | but what I call gadget for this specific vulnerability 1399.57s - 1403.81s | is to find a query in the structure of your target 1403.81s - 1406.05s | that takes already 200 milliseconds 1406.05s - 1408.13s | up to 500 milliseconds. 1408.13s - 1412.17s | Sometimes more when you don't optimize anything, I guess. 1413.49s - 1417.73s | And use this specific query in every batching request 1417.73s - 1420.17s | that you do or in every aliases. 1420.17s - 1423.05s | And this will allow you to send a lot of requests 1423.05s - 1426.65s | to maybe the disk operation that it does, the memory, 1427.05s - 1429.85s | it really depends on how the backend implemented it. 1430.81s - 1433.59s | But


chunk_text:
different aliases for the same requests 1380.07s - 1382.19s | but also use different arguments. 1382.19s - 1385.63s | So, that also could be a huge attack vector 1385.63s - 1387.47s | for the network service. 1387.47s - 1390.83s | So, quick tip for batching and aliases 1390.83s - 1393.55s | is to actually try to find gadget. 1393.55s - 1396.91s | What I call gadget, if it's the right definition, 1396.91s - 1399.57s | but what I call gadget for this specific vulnerability 1399.57s - 1403.81s | is to find a query in the structure of your target 1403.81s - 1406.05s | that takes already 200 milliseconds 1406.05s - 1408.13s | up to 500 milliseconds. 1408.13s - 1412.17s | Sometimes more when you don't optimize anything, I guess. 1413.49s - 1417.73s | And use this specific query in every batching request 1417.73s - 1420.17s | that you do or in every aliases. 1420.17s - 1423.05s | And this will allow you to send a lot of requests 1423.05s - 1426.65s | to maybe the disk operation that it does, the memory, 1427.05s - 1429.85s | it really depends on how the backend implemented it. 1430.81s - 1433.59s | But this could take you a batching 1433.59s - 1435.49s | that takes five seconds per request 1435.49s - 1437.79s | up to five minutes per request. 1437.79s - 1442.73s | So, this is a good way to multiply and amplify your DOS. 1444.53s - 1448.17s | And there is this one, the GraphQL directives. 1448.17s - 1450.13s | So, what's a directive? 1450.13s - 1454.35s | It's a way for GraphQL to decorate a part of the schema 1454.35s - 1457.63s | and actually to do an operation on top of it 1457.63s - 1459.41s | or additional configuration. 1460.39s - 1461.75s | And there is a technique called 1461.75s - 1464.59s | GraphQL directive overloading, 1464.59s - 1467.27s | where basically you can just make that payload, 1467.27s - 1470.95s | repeat the at a as many times as you like, 1470.95s - 1475.71s | and it will totally crush the server somehow. 1475.71s - 1479.63s | But we had a cool story on the Google console 1480.83s - 1482.39s | with evolving that. 1482.39s - 1486.63s | So, let's imagine that a directive could be used 1486.63s - 1488.67s | for, again, our type user, 1488.67s - 1490.87s


chunk_text:
this could take you a batching 1433.59s - 1435.49s | that takes five seconds per request 1435.49s - 1437.79s | up to five minutes per request. 1437.79s - 1442.73s | So, this is a good way to multiply and amplify your DOS. 1444.53s - 1448.17s | And there is this one, the GraphQL directives. 1448.17s - 1450.13s | So, what's a directive? 1450.13s - 1454.35s | It's a way for GraphQL to decorate a part of the schema 1454.35s - 1457.63s | and actually to do an operation on top of it 1457.63s - 1459.41s | or additional configuration. 1460.39s - 1461.75s | And there is a technique called 1461.75s - 1464.59s | GraphQL directive overloading, 1464.59s - 1467.27s | where basically you can just make that payload, 1467.27s - 1470.95s | repeat the at a as many times as you like, 1470.95s - 1475.71s | and it will totally crush the server somehow. 1475.71s - 1479.63s | But we had a cool story on the Google console 1480.83s - 1482.39s | with evolving that. 1482.39s - 1486.63s | So, let's imagine that a directive could be used 1486.63s - 1488.67s | for, again, our type user, 1488.67s - 1490.87s | and you can query every user 1490.87s - 1494.43s | with a auth role admin or auth role user. 1494.43s - 1498.95s | So, that's the way that normally we could use a directive. 1499.83s - 1502.27s | But then Google was using the directive 1502.27s - 1505.31s | in a very, very strange way. 1505.31s - 1509.39s | Basically, you add the query list operation, for instance, 1509.39s - 1512.47s | and then you see that we have directive 1512.47s - 1515.55s | at signature with bytes inside. 1515.55s - 1517.83s | And what they were doing, 1517.83s - 1521.63s | they were actually signing the body of the request 1521.63s - 1524.59s | from within the GraphQL requests. 1525.51s - 1528.71s | And every time that we wanted to modify any variables 1528.71s - 1532.31s | or anything in the schema, we will get an error. 1532.31s - 1535.39s | So, when we are trying to attack a backend, 1535.39s - 1538.51s | we really want to modify the request in our proxy. 1538.95s - 1540.35s | That was a huge bummer 1540.35s - 1543.67s | because it means that everything was totally signed. 1543.67s - 1547.83s


chunk_text:
| and you can query every user 1490.87s - 1494.43s | with a auth role admin or auth role user. 1494.43s - 1498.95s | So, that's the way that normally we could use a directive. 1499.83s - 1502.27s | But then Google was using the directive 1502.27s - 1505.31s | in a very, very strange way. 1505.31s - 1509.39s | Basically, you add the query list operation, for instance, 1509.39s - 1512.47s | and then you see that we have directive 1512.47s - 1515.55s | at signature with bytes inside. 1515.55s - 1517.83s | And what they were doing, 1517.83s - 1521.63s | they were actually signing the body of the request 1521.63s - 1524.59s | from within the GraphQL requests. 1525.51s - 1528.71s | And every time that we wanted to modify any variables 1528.71s - 1532.31s | or anything in the schema, we will get an error. 1532.31s - 1535.39s | So, when we are trying to attack a backend, 1535.39s - 1538.51s | we really want to modify the request in our proxy. 1538.95s - 1540.35s | That was a huge bummer 1540.35s - 1543.67s | because it means that everything was totally signed. 1543.67s - 1547.83s | So, we tried to see if we could sign out our requests, 1547.83s - 1551.03s | but the problem is that they were outcoding everything 1551.03s - 1552.03s | in the JavaScript. 1552.03s - 1554.15s | So, generating everything on the build 1554.15s - 1556.07s | and putting this in the JavaScript. 1556.07s - 1557.87s | And so, they actually told us 1557.87s - 1562.31s | that they were using a secret that was a passphrase, 1562.31s - 1565.27s | and it was also outcoded inside the code base, 1565.27s - 1568.23s | so they awarded $1,000 for that. 1568.95s - 1572.11s | That was a fun one, but nothing related to DOS. 1572.11s - 1573.83s | But there is something interesting. 1573.83s - 1576.95s | How they can sign the body 1576.95s - 1579.79s | and put the signature inside the body. 1579.79s - 1583.07s | This means that there is something in the GraphQL 1583.07s - 1585.83s | that is not being checked correctly, right? 1585.83s - 1588.15s | That is not inside the signature. 1588.15s - 1591.39s | And normally, it's just the signature itself. 1591.39s - 1593.15s | So, this means that we can add


chunk_text:
| So, we tried to see if we could sign out our requests, 1547.83s - 1551.03s | but the problem is that they were outcoding everything 1551.03s - 1552.03s | in the JavaScript. 1552.03s - 1554.15s | So, generating everything on the build 1554.15s - 1556.07s | and putting this in the JavaScript. 1556.07s - 1557.87s | And so, they actually told us 1557.87s - 1562.31s | that they were using a secret that was a passphrase, 1562.31s - 1565.27s | and it was also outcoded inside the code base, 1565.27s - 1568.23s | so they awarded $1,000 for that. 1568.95s - 1572.11s | That was a fun one, but nothing related to DOS. 1572.11s - 1573.83s | But there is something interesting. 1573.83s - 1576.95s | How they can sign the body 1576.95s - 1579.79s | and put the signature inside the body. 1579.79s - 1583.07s | This means that there is something in the GraphQL 1583.07s - 1585.83s | that is not being checked correctly, right? 1585.83s - 1588.15s | That is not inside the signature. 1588.15s - 1591.39s | And normally, it's just the signature itself. 1591.39s - 1593.15s | So, this means that we can add 1593.15s - 1595.87s | as many signatures as possible. 1595.87s - 1597.39s | And every time that we had a signature, 1597.39s - 1599.23s | they were running the check 1599.23s - 1601.67s | of the entire body all over again. 1602.59s - 1607.23s | So, we wrote a script where we will add 10 directive, 1607.23s - 1609.59s | 500, 1,000, up to a million, 1609.59s - 1613.27s | and check the requests every time. 1613.27s - 1614.35s | What happened? 1614.35s - 1618.95s | The first 10 directive, 0.9 seconds to answer. 1618.95s - 1621.51s | 500 directive, one second. 1621.51s - 1624.31s | We had 5,000 directive, 2.7. 1624.31s - 1626.75s | 10,000, 2.6, don't know what happened here. 1627.83s - 1632.83s | 50,000, 6.5, and then up to 1,109,000 seconds. 1633.19s - 1638.19s | So, we had one minute 40 per request, which is huge. 1639.67s - 1641.91s | This vulnerability was found with Rezo, 1641.91s - 1645.43s | and Google actually gave us a 6K bounty for that. 1645.43s - 1650.43s | And I think that compared to the presence in the wild, 1651.27s - 1654.55s | the impact is really high for that kind


chunk_text:
1593.15s - 1595.87s | as many signatures as possible. 1595.87s - 1597.39s | And every time that we had a signature, 1597.39s - 1599.23s | they were running the check 1599.23s - 1601.67s | of the entire body all over again. 1602.59s - 1607.23s | So, we wrote a script where we will add 10 directive, 1607.23s - 1609.59s | 500, 1,000, up to a million, 1609.59s - 1613.27s | and check the requests every time. 1613.27s - 1614.35s | What happened? 1614.35s - 1618.95s | The first 10 directive, 0.9 seconds to answer. 1618.95s - 1621.51s | 500 directive, one second. 1621.51s - 1624.31s | We had 5,000 directive, 2.7. 1624.31s - 1626.75s | 10,000, 2.6, don't know what happened here. 1627.83s - 1632.83s | 50,000, 6.5, and then up to 1,109,000 seconds. 1633.19s - 1638.19s | So, we had one minute 40 per request, which is huge. 1639.67s - 1641.91s | This vulnerability was found with Rezo, 1641.91s - 1645.43s | and Google actually gave us a 6K bounty for that. 1645.43s - 1650.43s | And I think that compared to the presence in the wild, 1651.27s - 1654.55s | the impact is really high for that kind of stuff. 1654.55s - 1659.39s | And overall, for all the GraphQL DOS that we did in the, 1659.39s - 1660.35s | oh, I'm sorry. 1660.35s - 1661.91s | Also, pro-tips, pro-tip. 1661.91s - 1663.31s | Yeah, this one is important. 1664.39s - 1667.03s | GraphQL exposes WebSockets, 1667.03s - 1669.83s | depending on the configuration and on the backend. 1669.83s - 1674.83s | But this WebSocket server usually do not have any WAF 1675.11s - 1678.19s | or any check, and people often forget that it exists. 1678.19s - 1679.95s | So, if you have rate limiting in place 1679.95s - 1683.23s | and that you want to exploit any GraphQL DOS, 1683.23s - 1684.95s | you can just go to the WebSocket, 1684.95s - 1686.79s | and there is no security anymore. 1686.79s - 1691.43s | And if you like, actually, GraphQL hunting, 1691.43s - 1694.39s | if you go to the WebSocket, 1694.39s - 1696.07s | you can also have introspection 1696.07s - 1698.43s | and other GraphQL configurations. 1698.43s - 1701.75s | So, it might actually give you a lot more attack surface. 1701.75s - 1703.91s | So, that's another GraphQL pro-tip. 1703.91s - 1706.87s |


chunk_text:
of stuff. 1654.55s - 1659.39s | And overall, for all the GraphQL DOS that we did in the, 1659.39s - 1660.35s | oh, I'm sorry. 1660.35s - 1661.91s | Also, pro-tips, pro-tip. 1661.91s - 1663.31s | Yeah, this one is important. 1664.39s - 1667.03s | GraphQL exposes WebSockets, 1667.03s - 1669.83s | depending on the configuration and on the backend. 1669.83s - 1674.83s | But this WebSocket server usually do not have any WAF 1675.11s - 1678.19s | or any check, and people often forget that it exists. 1678.19s - 1679.95s | So, if you have rate limiting in place 1679.95s - 1683.23s | and that you want to exploit any GraphQL DOS, 1683.23s - 1684.95s | you can just go to the WebSocket, 1684.95s - 1686.79s | and there is no security anymore. 1686.79s - 1691.43s | And if you like, actually, GraphQL hunting, 1691.43s - 1694.39s | if you go to the WebSocket, 1694.39s - 1696.07s | you can also have introspection 1696.07s - 1698.43s | and other GraphQL configurations. 1698.43s - 1701.75s | So, it might actually give you a lot more attack surface. 1701.75s - 1703.91s | So, that's another GraphQL pro-tip. 1703.91s - 1706.87s | And overall, with all the GraphQL denial of services, 1706.87s - 1710.39s | we made a 70K bounty. 1710.39s - 1712.43s | So, every time you see GraphQL, 1712.47s - 1717.46s | just say to yourself, we can take it down. 1717.46s - 1719.90s | Okay, I had to rush a little bit this presentation 1719.90s - 1722.90s | because we were having this HTML problem. 1722.90s - 1725.06s | So, let's go straight to the conclusion. 1725.06s - 1726.46s | Let's talk about the timeline 1726.46s - 1730.14s | of this entire denial of service research. 1730.14s - 1733.58s | The first denial of service that we found with Snorlax 1733.58s - 1738.58s | was in 2022, and the last one that we found was last week. 1738.94s - 1743.22s | But the main focus of the entire research 1743.66s - 1745.90s | was during eight months last year. 1745.90s - 1747.90s | So, most of the bounties were made 1747.90s - 1749.34s | in a span of eight months. 1750.90s - 1753.18s | And so, how much bounty overall 1753.18s - 1757.30s | we made with this entire research? 1757.30s - 1762.30s | We made almost $150,000 in


chunk_text:
And overall, with all the GraphQL denial of services, 1706.87s - 1710.39s | we made a 70K bounty. 1710.39s - 1712.43s | So, every time you see GraphQL, 1712.47s - 1717.46s | just say to yourself, we can take it down. 1717.46s - 1719.90s | Okay, I had to rush a little bit this presentation 1719.90s - 1722.90s | because we were having this HTML problem. 1722.90s - 1725.06s | So, let's go straight to the conclusion. 1725.06s - 1726.46s | Let's talk about the timeline 1726.46s - 1730.14s | of this entire denial of service research. 1730.14s - 1733.58s | The first denial of service that we found with Snorlax 1733.58s - 1738.58s | was in 2022, and the last one that we found was last week. 1738.94s - 1743.22s | But the main focus of the entire research 1743.66s - 1745.90s | was during eight months last year. 1745.90s - 1747.90s | So, most of the bounties were made 1747.90s - 1749.34s | in a span of eight months. 1750.90s - 1753.18s | And so, how much bounty overall 1753.18s - 1757.30s | we made with this entire research? 1757.30s - 1762.30s | We made almost $150,000 in bounty, 1762.98s - 1765.10s | which is a lot, I would say, 1765.10s - 1767.54s | for a technique that is out of scope. 1769.10s - 1771.18s | Something that is actually quite interesting 1771.22s - 1775.02s | is that I think that this could be a main vulnerability 1775.02s - 1776.22s | for a lot of bug hunters, 1776.22s - 1778.14s | but I would say it's better to use it 1778.14s - 1781.10s | like as a side golden goose. 1781.10s - 1784.70s | So, for instance, if you like to find a lot of vulnerabilities 1784.70s - 1787.38s | and then at one point you have no ideas anymore, 1787.38s - 1789.58s | just look for a DOS, you'll find one, 1789.58s - 1791.98s | send it, make a quick bug out of it. 1791.98s - 1794.14s | I think it's a good way to do it. 1795.18s - 1798.14s | Before finishing this presentation, 1798.14s - 1801.30s | I needed to do a huge shout out to Idnama. 1801.30s - 1803.58s | She's our graphical designer. 1803.58s - 1804.82s | When I asked her, 1804.82s - 1807.62s | hey, can you do this entire presentation for


chunk_text:
bounty, 1762.98s - 1765.10s | which is a lot, I would say, 1765.10s - 1767.54s | for a technique that is out of scope. 1769.10s - 1771.18s | Something that is actually quite interesting 1771.22s - 1775.02s | is that I think that this could be a main vulnerability 1775.02s - 1776.22s | for a lot of bug hunters, 1776.22s - 1778.14s | but I would say it's better to use it 1778.14s - 1781.10s | like as a side golden goose. 1781.10s - 1784.70s | So, for instance, if you like to find a lot of vulnerabilities 1784.70s - 1787.38s | and then at one point you have no ideas anymore, 1787.38s - 1789.58s | just look for a DOS, you'll find one, 1789.58s - 1791.98s | send it, make a quick bug out of it. 1791.98s - 1794.14s | I think it's a good way to do it. 1795.18s - 1798.14s | Before finishing this presentation, 1798.14s - 1801.30s | I needed to do a huge shout out to Idnama. 1801.30s - 1803.58s | She's our graphical designer. 1803.58s - 1804.82s | When I asked her, 1804.82s - 1807.62s | hey, can you do this entire presentation for DEF CON? 1807.62s - 1810.54s | She was like, what do you want me to do again? 1810.54s - 1813.46s | 2,000 memes, a lot of reference, a lot of things. 1813.46s - 1815.22s | I think she did an amazing job. 1815.22s - 1817.42s | So, huge shout out to her. 1818.50s - 1821.38s | Thanks a lot, everyone, for attending this presentation. 1821.38s - 1822.86s | I hope you liked it. 1822.86s - 1825.70s | And if you have any question later, 1825.70s - 1827.66s | I will be happy to answer them.


chunk_text:
DEF CON? 1807.62s - 1810.54s | She was like, what do you want me to do again? 1810.54s - 1813.46s | 2,000 memes, a lot of reference, a lot of things. 1813.46s - 1815.22s | I think she did an amazing job. 1815.22s - 1817.42s | So, huge shout out to her. 1818.50s - 1821.38s | Thanks a lot, everyone, for attending this presentation. 1821.38s - 1822.86s | I hope you liked it. 1822.86s - 1825.70s | And if you have any question later, 1825.70s - 1827.66s | I will be happy to answer them.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=RyuDq0cjap0", "title": "DEF CON 32 - Porn & Privacy - ET", "description": "As our social lives are highly intertwined with our online lives, people share a lot of information and create pictures and content that needs to be secured. In this talk I cover obscenity laws, revenge porn (nonconsensual distribution of intimate images), stalking, catfishing and sextortion and how people can prevent information being leaked as well as how to recover from it.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1269, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 4.46s | This text was transcribed using whisper model: large-v2 Good morning, everyone. Welcome, DEF CON. 4.46s - 9.16s | Thank you all for being here so early in the morning with me. 9.16s - 10.86s | This talk is Porn and Privacy. 10.86s - 14.06s | Hopefully, you're in the right room. 14.06s - 18.26s | I do have to start because my time has already started, 18.26s - 21.26s | and I have to be done by a certain time. 21.26s - 24.50s | So I know some of you are still joining in, 24.50s - 30.60s | and I have to get started. 30.60s - 33.40s | Who am I? My name is Edna Johnson. 33.40s - 34.74s | I also go by ET. 34.74s - 37.00s | I use they, them pronouns. 37.00s - 39.00s | I'm a cybersecurity professional 39.00s - 42.20s | as well as a master's degree student. 42.20s - 46.06s | I compete in OSINT CTF competitions, 46.06s - 50.04s | and I advise my friends on digital safety. 50.04s - 53.40s | I do want to give a content warning for this talk. 53.44s - 56.70s | I'm going to be talking about subjects that may be triggering, 56.70s - 61.00s | and if you do have any triggers regarding these issues, 61.00s - 63.04s | I will happily share this information 63.04s - 64.80s | with you at a later time. 64.80s - 66.86s | But I'm going to be talking about nonconsensual 66.86s - 70.16s | intimate image abuse or revenge porn, 70.16s - 75.45s | deep fakes, and sextortion. 75.45s - 77.05s | And I want to give a disclaimer 77.05s - 79.13s | that as a cybersecurity professional, 79.13s - 82.15s | I am here sharing my technical knowledge 82.15s - 83.93s | to make your digital life safer,


chunk_text:
I? My name is Edna Johnson. 33.40s - 34.74s | I also go by ET. 34.74s - 37.00s | I use they, them pronouns. 37.00s - 39.00s | I'm a cybersecurity professional 39.00s - 42.20s | as well as a master's degree student. 42.20s - 46.06s | I compete in OSINT CTF competitions, 46.06s - 50.04s | and I advise my friends on digital safety. 50.04s - 53.40s | I do want to give a content warning for this talk. 53.44s - 56.70s | I'm going to be talking about subjects that may be triggering, 56.70s - 61.00s | and if you do have any triggers regarding these issues, 61.00s - 63.04s | I will happily share this information 63.04s - 64.80s | with you at a later time. 64.80s - 66.86s | But I'm going to be talking about nonconsensual 66.86s - 70.16s | intimate image abuse or revenge porn, 70.16s - 75.45s | deep fakes, and sextortion. 75.45s - 77.05s | And I want to give a disclaimer 77.05s - 79.13s | that as a cybersecurity professional, 79.13s - 82.15s | I am here sharing my technical knowledge 82.15s - 83.93s | to make your digital life safer, 83.93s - 85.19s | and it is important to note 85.19s - 87.53s | that I'm not a mental health professional. 87.53s - 89.59s | While I'm here to provide guidance 89.59s - 92.47s | on matters that affect your personal lives, 92.47s - 95.27s | I am not equipped to offer mental health assistance. 95.27s - 98.73s | So if needed, I do encourage you to seek help 98.73s - 103.47s | from an appropriately trained mental health profession. 103.47s - 105.73s | Our roadmap today is I'm going to be going over 105.73s - 109.69s | some obscenity laws that are being passed in states. 109.69s - 113.15s | I'm going to cover NCIIA, 113.15s - 117.03s | nonconsensual intimate image abuse or revenge porn. 117.03s - 120.49s | We're going to go over some deep fake, 120.49s - 123.09s | and then we're going to go over how to minimize the risk 123.09s - 125.39s | of images being abused online. 125.39s - 127.73s | And if they have been abused, 127.73s - 135.70s | how to recover from those images when they've been leaked. 135.70s - 138.90s | So the first thing is the obscenity laws.


chunk_text:
83.93s - 85.19s | and it is important to note 85.19s - 87.53s | that I'm not a mental health professional. 87.53s - 89.59s | While I'm here to provide guidance 89.59s - 92.47s | on matters that affect your personal lives, 92.47s - 95.27s | I am not equipped to offer mental health assistance. 95.27s - 98.73s | So if needed, I do encourage you to seek help 98.73s - 103.47s | from an appropriately trained mental health profession. 103.47s - 105.73s | Our roadmap today is I'm going to be going over 105.73s - 109.69s | some obscenity laws that are being passed in states. 109.69s - 113.15s | I'm going to cover NCIIA, 113.15s - 117.03s | nonconsensual intimate image abuse or revenge porn. 117.03s - 120.49s | We're going to go over some deep fake, 120.49s - 123.09s | and then we're going to go over how to minimize the risk 123.09s - 125.39s | of images being abused online. 125.39s - 127.73s | And if they have been abused, 127.73s - 135.70s | how to recover from those images when they've been leaked. 135.70s - 138.90s | So the first thing is the obscenity laws. 138.94s - 144.14s | States all have been passing laws 144.14s - 150.34s | where they're requiring you to upload your government ID 150.34s - 152.40s | to be able to access adult content 152.40s - 154.84s | or pornographic material. 154.84s - 161.26s | And so Pornhub, for example, has been blocking states 161.26s - 165.14s | from being able to access their website 165.14s - 168.54s | because of these laws, because of the privacy implications 168.54s - 170.08s | that it contains. 170.08s - 174.98s | So if you're coming from any of these eight states currently, 174.98s - 180.04s | that is Utah, North Carolina, Texas, and others, 180.04s - 181.90s | you'll get a message from Pornhub showing you 181.90s - 186.90s | that says basically, dear user, 186.90s - 189.74s | if you're visiting from these states, 189.74s - 193.58s | your government officials have this requirement 193.58s - 195.38s | to show your ID. 195.38s - 202.24s | And that is tying your porn habits to your actual identity. 202.24s - 207.64s | And thank you. 207.64s - 210.52s | So that is a privacy concern. 210.52s - 214.92s | Okay. Yeah, that


chunk_text:
138.94s - 144.14s | States all have been passing laws 144.14s - 150.34s | where they're requiring you to upload your government ID 150.34s - 152.40s | to be able to access adult content 152.40s - 154.84s | or pornographic material. 154.84s - 161.26s | And so Pornhub, for example, has been blocking states 161.26s - 165.14s | from being able to access their website 165.14s - 168.54s | because of these laws, because of the privacy implications 168.54s - 170.08s | that it contains. 170.08s - 174.98s | So if you're coming from any of these eight states currently, 174.98s - 180.04s | that is Utah, North Carolina, Texas, and others, 180.04s - 181.90s | you'll get a message from Pornhub showing you 181.90s - 186.90s | that says basically, dear user, 186.90s - 189.74s | if you're visiting from these states, 189.74s - 193.58s | your government officials have this requirement 193.58s - 195.38s | to show your ID. 195.38s - 202.24s | And that is tying your porn habits to your actual identity. 202.24s - 207.64s | And thank you. 207.64s - 210.52s | So that is a privacy concern. 210.52s - 214.92s | Okay. Yeah, that works. 214.92s - 216.12s | Okay, thank you. 216.12s - 218.78s | Sorry about that. 218.78s - 223.78s | All right, so these eight states have already passed these laws, 223.82s - 225.68s | and they're in effect currently. 225.68s - 229.98s | And so when people are accessing porn from these sites, 229.98s - 232.18s | they're either needing to use a VPN 232.18s - 240.19s | to access porn providers that are blocking the site 240.19s - 245.79s | or they have providers that aren't as, 245.79s - 247.39s | you know, compliant with laws. 247.39s - 251.55s | And so those might be a little more sketchy websites. 251.55s - 253.43s | More states are currently passing these laws, 253.43s - 258.63s | such as Florida just had this law go in effect on July 1st. 258.63s - 260.67s | And these laws are typically packaged 260.67s - 264.79s | with some kind of a child protection, 264.79s - 267.79s | internet protection bill. 267.79s - 272.37s | So, for example, in Florida, they have now provided a law 272.37s - 277.29s | that gives a minimum age for kids to use social media. 277.29s - 289.86s


chunk_text:
works. 214.92s - 216.12s | Okay, thank you. 216.12s - 218.78s | Sorry about that. 218.78s - 223.78s | All right, so these eight states have already passed these laws, 223.82s - 225.68s | and they're in effect currently. 225.68s - 229.98s | And so when people are accessing porn from these sites, 229.98s - 232.18s | they're either needing to use a VPN 232.18s - 240.19s | to access porn providers that are blocking the site 240.19s - 245.79s | or they have providers that aren't as, 245.79s - 247.39s | you know, compliant with laws. 247.39s - 251.55s | And so those might be a little more sketchy websites. 251.55s - 253.43s | More states are currently passing these laws, 253.43s - 258.63s | such as Florida just had this law go in effect on July 1st. 258.63s - 260.67s | And these laws are typically packaged 260.67s - 264.79s | with some kind of a child protection, 264.79s - 267.79s | internet protection bill. 267.79s - 272.37s | So, for example, in Florida, they have now provided a law 272.37s - 277.29s | that gives a minimum age for kids to use social media. 277.29s - 289.86s | And so they tied that in with this adult material block. 289.86s - 292.32s | Thank you. 292.32s - 294.20s | So I'm going to go over some basics 294.20s - 296.32s | regarding interdigital privacy. 296.32s - 299.10s | And a lot of you, most of you probably already know this, 299.10s - 300.26s | but I want to make sure we all have 300.26s - 302.72s | the same fundamental knowledge. 302.72s - 305.60s | So digital privacy refers to the protection 305.60s - 309.36s | of private citizens' online information. 309.36s - 312.96s | So that can be companies collecting information on users, 312.96s - 314.46s | visiting websites, 314.46s - 319.60s | or it can be you're sharing information on social media. 319.60s - 321.00s | All of our activities online 321.00s - 322.76s | are going to leave a digital footprint, 322.76s - 327.40s | and that information can be used to help identify us. 327.40s - 331.16s | Personal Identifiable Information, PII, 331.16s - 335.12s | is information connected to a specific individual 335.12s - 338.16s | that can be used to uncover their individual identity, 338.16s - 340.30s | such as social


chunk_text:
| And so they tied that in with this adult material block. 289.86s - 292.32s | Thank you. 292.32s - 294.20s | So I'm going to go over some basics 294.20s - 296.32s | regarding interdigital privacy. 296.32s - 299.10s | And a lot of you, most of you probably already know this, 299.10s - 300.26s | but I want to make sure we all have 300.26s - 302.72s | the same fundamental knowledge. 302.72s - 305.60s | So digital privacy refers to the protection 305.60s - 309.36s | of private citizens' online information. 309.36s - 312.96s | So that can be companies collecting information on users, 312.96s - 314.46s | visiting websites, 314.46s - 319.60s | or it can be you're sharing information on social media. 319.60s - 321.00s | All of our activities online 321.00s - 322.76s | are going to leave a digital footprint, 322.76s - 327.40s | and that information can be used to help identify us. 327.40s - 331.16s | Personal Identifiable Information, PII, 331.16s - 335.12s | is information connected to a specific individual 335.12s - 338.16s | that can be used to uncover their individual identity, 338.16s - 340.30s | such as social security number, 340.30s - 345.40s | full name, email address, and phone number. 345.40s - 348.50s | Make sure you're using strong account security basics. 348.50s - 351.76s | So the basics are necessary. 351.76s - 355.30s | And first, make sure you have strong passwords 355.30s - 360.00s | so you can accomplish that by using passphrases, 360.00s - 365.62s | using at least 10 or more characters in your password. 365.66s - 368.86s | Use multiple character types, such as numbers, 368.86s - 372.22s | special characters, upper and lowercase letters. 372.22s - 374.42s | And then use a password manager 374.42s - 376.52s | to manage all of those passwords, 376.52s - 379.06s | and examples include bit warning, 379.06s - 382.66s | key pass, and one password. 382.66s - 386.16s | Additionally, I recommend using a two-factor authentication 386.16s - 389.02s | or a multi-factor application, 389.02s - 392.66s | and those could be SMS or text messages, 392.66s - 395.46s | applications such as Google Authenticator, 395.46s - 398.66s | Microsoft Authenticator, Duo, and more. 398.66s - 404.02s | Or you can use a hardware token such as YubiKey 404.02s - 405.42s | for your


chunk_text:
security number, 340.30s - 345.40s | full name, email address, and phone number. 345.40s - 348.50s | Make sure you're using strong account security basics. 348.50s - 351.76s | So the basics are necessary. 351.76s - 355.30s | And first, make sure you have strong passwords 355.30s - 360.00s | so you can accomplish that by using passphrases, 360.00s - 365.62s | using at least 10 or more characters in your password. 365.66s - 368.86s | Use multiple character types, such as numbers, 368.86s - 372.22s | special characters, upper and lowercase letters. 372.22s - 374.42s | And then use a password manager 374.42s - 376.52s | to manage all of those passwords, 376.52s - 379.06s | and examples include bit warning, 379.06s - 382.66s | key pass, and one password. 382.66s - 386.16s | Additionally, I recommend using a two-factor authentication 386.16s - 389.02s | or a multi-factor application, 389.02s - 392.66s | and those could be SMS or text messages, 392.66s - 395.46s | applications such as Google Authenticator, 395.46s - 398.66s | Microsoft Authenticator, Duo, and more. 398.66s - 404.02s | Or you can use a hardware token such as YubiKey 404.02s - 405.42s | for your security hygiene. 405.42s - 410.94s | So if you're creating accounts on adult websites, 410.94s - 412.98s | try to limit the personal information 412.98s - 417.48s | and keep personal information off of those spicy websites. 417.48s - 419.34s | Limit the information that you share 419.34s - 421.82s | that could be used to identify you, 421.82s - 425.44s | and I recommend using separate email addresses for activities 425.50s - 429.20s | so you could have an email account 429.20s - 430.94s | for your personal accounts. 430.94s - 434.64s | So if you're emailing your dad and things like that, 434.64s - 437.00s | a different email address for your banking, 437.00s - 441.34s | and then an email account for your spicy websites, 441.34s - 443.70s | your adult content websites. 443.70s - 446.70s | That way, if any of those are compromised, 446.70s - 455.74s | you're limiting the scope of damage that can happen. 455.78s - 458.60s | OSINT or open-source intelligence, 458.60s - 462.34s | that is the searching for and analyzing information 462.34s - 463.64s | that is publicly available 463.64s - 467.30s | and meant to produce actionable intelligence, 467.30s


chunk_text:
security hygiene. 405.42s - 410.94s | So if you're creating accounts on adult websites, 410.94s - 412.98s | try to limit the personal information 412.98s - 417.48s | and keep personal information off of those spicy websites. 417.48s - 419.34s | Limit the information that you share 419.34s - 421.82s | that could be used to identify you, 421.82s - 425.44s | and I recommend using separate email addresses for activities 425.50s - 429.20s | so you could have an email account 429.20s - 430.94s | for your personal accounts. 430.94s - 434.64s | So if you're emailing your dad and things like that, 434.64s - 437.00s | a different email address for your banking, 437.00s - 441.34s | and then an email account for your spicy websites, 441.34s - 443.70s | your adult content websites. 443.70s - 446.70s | That way, if any of those are compromised, 446.70s - 455.74s | you're limiting the scope of damage that can happen. 455.78s - 458.60s | OSINT or open-source intelligence, 458.60s - 462.34s | that is the searching for and analyzing information 462.34s - 463.64s | that is publicly available 463.64s - 467.30s | and meant to produce actionable intelligence, 467.30s - 470.10s | and that can be found using public records, 470.10s - 475.14s | images or videos online by finding it on websites 475.14s - 479.14s | or social media platforms or more. 479.14s - 484.98s | All right, nonconsensual intimate image abuse, NCIIA. 484.98s - 487.72s | Also known as revenge porn. 487.72s - 490.02s | So nonconsensual intimate image abuse 490.02s - 494.92s | is the distribution of sexually graphic images 494.92s - 498.08s | of individuals without their consent. 498.08s - 503.42s | This includes images originally obtained without consent 503.42s - 506.68s | as well as images originally obtained with consent, 506.68s - 510.38s | and this is usually in the context of a private 510.38s - 512.48s | or a confidential relationship. 515.44s - 517.44s | When you've been compromised 517.44s - 520.44s | or your images have been leaked online, 520.44s - 523.18s | you might feel like something is off. 523.18s - 527.42s | You could have an influx of friend requests on Facebook 527.42s - 530.28s | or lots of new followers on Twitter 530.28s - 535.22s | or your inboxes are overflowing all of a sudden. 535.22s - 539.08s |


chunk_text:
- 470.10s | and that can be found using public records, 470.10s - 475.14s | images or videos online by finding it on websites 475.14s - 479.14s | or social media platforms or more. 479.14s - 484.98s | All right, nonconsensual intimate image abuse, NCIIA. 484.98s - 487.72s | Also known as revenge porn. 487.72s - 490.02s | So nonconsensual intimate image abuse 490.02s - 494.92s | is the distribution of sexually graphic images 494.92s - 498.08s | of individuals without their consent. 498.08s - 503.42s | This includes images originally obtained without consent 503.42s - 506.68s | as well as images originally obtained with consent, 506.68s - 510.38s | and this is usually in the context of a private 510.38s - 512.48s | or a confidential relationship. 515.44s - 517.44s | When you've been compromised 517.44s - 520.44s | or your images have been leaked online, 520.44s - 523.18s | you might feel like something is off. 523.18s - 527.42s | You could have an influx of friend requests on Facebook 527.42s - 530.28s | or lots of new followers on Twitter 530.28s - 535.22s | or your inboxes are overflowing all of a sudden. 535.22s - 539.08s | So when you are finding yourself in that situation, 539.08s - 542.92s | the first step is to do OSINT on yourself. 542.92s - 546.26s | You may want to find a friend to help you with this 546.26s - 551.36s | because it could be an emotional experience to go through. 551.36s - 553.32s | When you do find information, 553.32s - 556.56s | you want to make sure to do online hygiene 556.56s - 560.62s | and do checkups to make sure that you don't have information 560.62s - 564.46s | that could make things worse. 564.46s - 568.96s | So you want to limit the information shared online, 568.96s - 570.86s | and you got to know what's out there 570.86s - 577.27s | before you can start to clean it up. 577.27s - 580.91s | Some of you may know of Caitlin Bowden. 580.91s - 586.85s | Caitlin had her images leaked online, 586.85s - 591.67s | and those images were from... 591.67s - 594.05s | She had been in a relationship, 594.05s - 597.41s | and the images were on her ex's phone, 597.41s - 599.97s | and it wasn't her ex that shared them


chunk_text:
So when you are finding yourself in that situation, 539.08s - 542.92s | the first step is to do OSINT on yourself. 542.92s - 546.26s | You may want to find a friend to help you with this 546.26s - 551.36s | because it could be an emotional experience to go through. 551.36s - 553.32s | When you do find information, 553.32s - 556.56s | you want to make sure to do online hygiene 556.56s - 560.62s | and do checkups to make sure that you don't have information 560.62s - 564.46s | that could make things worse. 564.46s - 568.96s | So you want to limit the information shared online, 568.96s - 570.86s | and you got to know what's out there 570.86s - 577.27s | before you can start to clean it up. 577.27s - 580.91s | Some of you may know of Caitlin Bowden. 580.91s - 586.85s | Caitlin had her images leaked online, 586.85s - 591.67s | and those images were from... 591.67s - 594.05s | She had been in a relationship, 594.05s - 597.41s | and the images were on her ex's phone, 597.41s - 599.97s | and it wasn't her ex that shared them out. 600.03s - 602.27s | It was... 602.27s - 604.27s | The phone got stolen, 604.27s - 609.61s | and the phone did not have any passcode on it. 609.61s - 612.51s | So some stranger shared out her images, 612.51s - 615.97s | and she wanted me to let you know that offline access 615.97s - 619.47s | is only as secure as the device it is on 619.47s - 622.17s | and that these are very special pictures, 622.17s - 625.13s | and so conversations matter. 625.13s - 627.41s | So make sure you have conversations with the people 627.41s - 632.08s | that you're sharing ahead of time. 632.14s - 634.48s | So when you're sharing your intimate images, 634.48s - 637.94s | have those conversations with your partner 637.94s - 642.02s | or your spicy friend about the expectations of those images, 642.02s - 644.44s | where they can store those images, 644.44s - 650.64s | such as on the phone or computer, any other place, 650.64s - 652.52s | even on the cloud. 652.52s - 657.44s | Are they able to show those pictures to other people? 657.44s - 661.32s | Is it something that


chunk_text:
out. 600.03s - 602.27s | It was... 602.27s - 604.27s | The phone got stolen, 604.27s - 609.61s | and the phone did not have any passcode on it. 609.61s - 612.51s | So some stranger shared out her images, 612.51s - 615.97s | and she wanted me to let you know that offline access 615.97s - 619.47s | is only as secure as the device it is on 619.47s - 622.17s | and that these are very special pictures, 622.17s - 625.13s | and so conversations matter. 625.13s - 627.41s | So make sure you have conversations with the people 627.41s - 632.08s | that you're sharing ahead of time. 632.14s - 634.48s | So when you're sharing your intimate images, 634.48s - 637.94s | have those conversations with your partner 637.94s - 642.02s | or your spicy friend about the expectations of those images, 642.02s - 644.44s | where they can store those images, 644.44s - 650.64s | such as on the phone or computer, any other place, 650.64s - 652.52s | even on the cloud. 652.52s - 657.44s | Are they able to show those pictures to other people? 657.44s - 661.32s | Is it something that they can send to anyone else, 661.32s - 665.06s | and do you expect them to be deleted at any certain point, 665.06s - 666.98s | such as when you break up, 666.98s - 673.22s | so that they are no longer in your possession? 673.22s - 674.52s | When you're sharing images, 674.52s - 677.66s | you want to make sure that you're watermarking them, 677.66s - 683.12s | and that is to put a word across the image, 683.12s - 686.66s | and you can do that both by putting the location 686.66s - 688.32s | where those images were shared, 688.32s - 691.32s | such as OnlyFans or Discord. 691.36s - 695.26s | You can also put their name or handle, 695.26s - 697.96s | such as TooHotToHandle or Dave, 697.96s - 701.92s | and you can hide those watermarks within the image 701.92s - 705.92s | in dark spots, like in shadows, and make them small 705.92s - 707.92s | so that they're not really visible, 707.92s - 710.22s | but then if they are leaked later on, 710.22s - 713.46s | you're able to find out who was the source of the leak 713.46s -


chunk_text:
they can send to anyone else, 661.32s - 665.06s | and do you expect them to be deleted at any certain point, 665.06s - 666.98s | such as when you break up, 666.98s - 673.22s | so that they are no longer in your possession? 673.22s - 674.52s | When you're sharing images, 674.52s - 677.66s | you want to make sure that you're watermarking them, 677.66s - 683.12s | and that is to put a word across the image, 683.12s - 686.66s | and you can do that both by putting the location 686.66s - 688.32s | where those images were shared, 688.32s - 691.32s | such as OnlyFans or Discord. 691.36s - 695.26s | You can also put their name or handle, 695.26s - 697.96s | such as TooHotToHandle or Dave, 697.96s - 701.92s | and you can hide those watermarks within the image 701.92s - 705.92s | in dark spots, like in shadows, and make them small 705.92s - 707.92s | so that they're not really visible, 707.92s - 710.22s | but then if they are leaked later on, 710.22s - 713.46s | you're able to find out who was the source of the leak 713.46s - 717.02s | or what was the source of that leak. 717.02s - 719.92s | A lot of platforms already remove EXIF data, 719.92s - 723.72s | but it is a good idea to remove EXIF data from your images 723.72s - 728.02s | so that they don't contain, for example, your geolocation, 728.02s - 732.16s | and you can create an inventory of a list of images 732.16s - 738.32s | that you do share out so that you can easily reference 738.32s - 740.78s | where those images were shared from 740.78s - 742.38s | and who they were shared to. 742.38s - 751.88s | So when you do have an incident with images being shared out, 751.88s - 757.68s | there is a website called StopNCII.org, 757.68s - 761.88s | and with the images that have been leaked, 761.88s - 765.08s | you can upload and create a case on that website, 765.08s - 768.74s | and they will go through all the major platforms, 768.74s - 773.94s | such as Facebook, Instagram, Pornhub, OnlyFans, 773.94s - 782.65s | and they will help you to remove the images from those platforms. 782.65s - 786.15s | You're also able


chunk_text:
717.02s | or what was the source of that leak. 717.02s - 719.92s | A lot of platforms already remove EXIF data, 719.92s - 723.72s | but it is a good idea to remove EXIF data from your images 723.72s - 728.02s | so that they don't contain, for example, your geolocation, 728.02s - 732.16s | and you can create an inventory of a list of images 732.16s - 738.32s | that you do share out so that you can easily reference 738.32s - 740.78s | where those images were shared from 740.78s - 742.38s | and who they were shared to. 742.38s - 751.88s | So when you do have an incident with images being shared out, 751.88s - 757.68s | there is a website called StopNCII.org, 757.68s - 761.88s | and with the images that have been leaked, 761.88s - 765.08s | you can upload and create a case on that website, 765.08s - 768.74s | and they will go through all the major platforms, 768.74s - 773.94s | such as Facebook, Instagram, Pornhub, OnlyFans, 773.94s - 782.65s | and they will help you to remove the images from those platforms. 782.65s - 786.15s | You're also able to remove those images from Google searches. 786.15s - 790.65s | So a lot of times when images have been released, 790.65s - 793.25s | they will contain your personal information. 793.25s - 799.45s | It gets added to the images, 799.55s - 803.55s | and they'll include whatever personal information they have about you, 803.55s - 808.35s | and so you can request Google to remove from the Google search results. 808.35s - 810.35s | So if you're searching your name, 810.35s - 815.95s | your images that are your personal, explicit, intimate images 815.95s - 821.80s | are removed from the Google search results. 821.80s - 825.80s | Another process that you can do is a DMCA request. 825.80s - 831.20s | This is using copyright law to have images that belong to you 831.20s - 833.50s | removed from websites. 833.50s - 837.40s | The DMCA.com website does have a section 837.40s - 840.90s | that helps you go through the steps 840.90s - 845.10s | of removing revenge porn from the web, 845.10s - 850.06s | and you can find that on their website. 850.06s - 851.76s | All right, so AI. 851.76s - 857.86s |


chunk_text:
to remove those images from Google searches. 786.15s - 790.65s | So a lot of times when images have been released, 790.65s - 793.25s | they will contain your personal information. 793.25s - 799.45s | It gets added to the images, 799.55s - 803.55s | and they'll include whatever personal information they have about you, 803.55s - 808.35s | and so you can request Google to remove from the Google search results. 808.35s - 810.35s | So if you're searching your name, 810.35s - 815.95s | your images that are your personal, explicit, intimate images 815.95s - 821.80s | are removed from the Google search results. 821.80s - 825.80s | Another process that you can do is a DMCA request. 825.80s - 831.20s | This is using copyright law to have images that belong to you 831.20s - 833.50s | removed from websites. 833.50s - 837.40s | The DMCA.com website does have a section 837.40s - 840.90s | that helps you go through the steps 840.90s - 845.10s | of removing revenge porn from the web, 845.10s - 850.06s | and you can find that on their website. 850.06s - 851.76s | All right, so AI. 851.76s - 857.86s | So recently, AI has been exploding in popularity, 857.86s - 865.96s | and they're being created tools to abuse images, 865.96s - 871.06s | and so AI is going to be used to change the world 871.06s - 874.16s | as a tool to make the world better, right? 874.16s - 877.86s | As a tool to make the world better, right? 877.86s - 883.06s | So there's been a lot of new apps 883.06s - 887.56s | that are mostly targeting young men, 887.56s - 895.06s | where you can change images to either put somebody into a bikini 895.06s - 897.26s | or remove all of their clothing 897.26s - 902.06s | or put somebody's face onto other images, 902.06s - 905.56s | and these are being advertised on Instagram. 905.56s - 910.76s | They're not in some dark corner, dark web marketplace. 910.76s - 914.26s | They're out there, 914.26s - 917.96s | and so new laws are needed to be passed. 917.96s - 920.36s | There's states that have passed laws against this, 920.36s - 927.60s | but more comprehensive laws are needed. 927.60s - 929.60s | Five minutes? Okay. 929.60s - 933.10s | All right,


chunk_text:
So recently, AI has been exploding in popularity, 857.86s - 865.96s | and they're being created tools to abuse images, 865.96s - 871.06s | and so AI is going to be used to change the world 871.06s - 874.16s | as a tool to make the world better, right? 874.16s - 877.86s | As a tool to make the world better, right? 877.86s - 883.06s | So there's been a lot of new apps 883.06s - 887.56s | that are mostly targeting young men, 887.56s - 895.06s | where you can change images to either put somebody into a bikini 895.06s - 897.26s | or remove all of their clothing 897.26s - 902.06s | or put somebody's face onto other images, 902.06s - 905.56s | and these are being advertised on Instagram. 905.56s - 910.76s | They're not in some dark corner, dark web marketplace. 910.76s - 914.26s | They're out there, 914.26s - 917.96s | and so new laws are needed to be passed. 917.96s - 920.36s | There's states that have passed laws against this, 920.36s - 927.60s | but more comprehensive laws are needed. 927.60s - 929.60s | Five minutes? Okay. 929.60s - 933.10s | All right, so tips for using OnlyFans. 933.10s - 936.80s | When you create an account, set up a monthly charge. 936.80s - 938.20s | Use a fake name. 938.20s - 941.00s | Do not use your real name. 941.00s - 944.40s | Create new social media accounts for advertising it. 944.40s - 946.80s | Don't tie it to your existing accounts, 946.80s - 952.00s | and fake publicly available location. 952.00s - 956.20s | To lower the risk of foreign, regionally block your state. 956.20s - 958.90s | So if you're from Florida, block Florida. 958.90s - 960.80s | That way you don't have people from high school 960.80s - 963.40s | finding your OnlyFans account. 963.40s - 966.30s | Make sure to watermark your photos. 966.30s - 968.90s | OnlyFans does have an easy block feature 968.90s - 971.10s | that allows you to delete their content 971.10s - 974.90s | after they've been downloaded, 974.90s - 978.10s | and if there is a leak, OnlyFans actually owns the content 978.10s - 980.10s | that you publish on their website, 980.10s - 985.90s | so they will send their lawyers to do the DMCA notices for you. 985.90s - 988.90s


chunk_text:
so tips for using OnlyFans. 933.10s - 936.80s | When you create an account, set up a monthly charge. 936.80s - 938.20s | Use a fake name. 938.20s - 941.00s | Do not use your real name. 941.00s - 944.40s | Create new social media accounts for advertising it. 944.40s - 946.80s | Don't tie it to your existing accounts, 946.80s - 952.00s | and fake publicly available location. 952.00s - 956.20s | To lower the risk of foreign, regionally block your state. 956.20s - 958.90s | So if you're from Florida, block Florida. 958.90s - 960.80s | That way you don't have people from high school 960.80s - 963.40s | finding your OnlyFans account. 963.40s - 966.30s | Make sure to watermark your photos. 966.30s - 968.90s | OnlyFans does have an easy block feature 968.90s - 971.10s | that allows you to delete their content 971.10s - 974.90s | after they've been downloaded, 974.90s - 978.10s | and if there is a leak, OnlyFans actually owns the content 978.10s - 980.10s | that you publish on their website, 980.10s - 985.90s | so they will send their lawyers to do the DMCA notices for you. 985.90s - 988.90s | Make sure that you enable two-factor authentication. 988.90s - 991.40s | There's a huge problem with accounts 991.40s - 994.90s | that have been taken over on OnlyFans 994.90s - 998.10s | where they set up two-factor for you, 998.10s - 1002.30s | but they do have a support for getting control of it. 1002.30s - 1006.40s | You have to contact OnlyFans to be able to get your account back 1006.40s - 1011.60s | after it's been taken over by somebody else. 1011.60s - 1013.90s | Catfishing tips. 1013.90s - 1016.20s | So if you think you've been catfished, 1016.20s - 1021.00s | use reverse image search to look up the pictures. 1021.00s - 1023.70s | You may find that there's loads of other accounts 1023.70s - 1026.20s | with many different names. 1026.20s - 1029.00s | You can use Canary tokens or Grabify 1029.00s - 1032.00s | to find out what their IP address is. 1032.00s - 1035.30s | Try to verify the identity early on. 1035.30s - 1039.00s | You can do that by doing a video call 1039.00s - 1041.00s | or getting them to take a photo 1041.00s - 1045.40s | with a specific


chunk_text:
| Make sure that you enable two-factor authentication. 988.90s - 991.40s | There's a huge problem with accounts 991.40s - 994.90s | that have been taken over on OnlyFans 994.90s - 998.10s | where they set up two-factor for you, 998.10s - 1002.30s | but they do have a support for getting control of it. 1002.30s - 1006.40s | You have to contact OnlyFans to be able to get your account back 1006.40s - 1011.60s | after it's been taken over by somebody else. 1011.60s - 1013.90s | Catfishing tips. 1013.90s - 1016.20s | So if you think you've been catfished, 1016.20s - 1021.00s | use reverse image search to look up the pictures. 1021.00s - 1023.70s | You may find that there's loads of other accounts 1023.70s - 1026.20s | with many different names. 1026.20s - 1029.00s | You can use Canary tokens or Grabify 1029.00s - 1032.00s | to find out what their IP address is. 1032.00s - 1035.30s | Try to verify the identity early on. 1035.30s - 1039.00s | You can do that by doing a video call 1039.00s - 1041.00s | or getting them to take a photo 1041.00s - 1045.40s | with a specific sign or symbol that you request, 1045.40s - 1048.30s | and make sure to take things slow in an online relationship 1048.30s - 1052.40s | and don't send money to somebody you've never met. 1052.40s - 1054.90s | Sextortion is a form of blackmail 1054.90s - 1058.50s | where someone threatens to share a nude or sexual image 1058.50s - 1061.70s | or video of you unless you give in to their demands. 1061.70s - 1065.40s | It is illegal in most states, and if you pay a scammer once, 1065.40s - 1071.10s | they will never leave you alone. 1071.10s - 1075.40s | If you are being sextorted, do not give in to their demands 1075.40s - 1078.50s | and all contact with the extorter immediately. 1078.50s - 1081.90s | Turn off your social media accounts and LinkedIn accounts 1081.90s - 1085.60s | and serve the blackmailer with a cease and desist notice, 1085.60s - 1091.50s | and make sure to file a police report against the extorter. 1091.60s - 1095.10s | Currently, states that have NCIA laws 1095.10s - 1099.60s | are almost all of the states except for two. 1099.60s - 1103.60s | States that have laws


chunk_text:
sign or symbol that you request, 1045.40s - 1048.30s | and make sure to take things slow in an online relationship 1048.30s - 1052.40s | and don't send money to somebody you've never met. 1052.40s - 1054.90s | Sextortion is a form of blackmail 1054.90s - 1058.50s | where someone threatens to share a nude or sexual image 1058.50s - 1061.70s | or video of you unless you give in to their demands. 1061.70s - 1065.40s | It is illegal in most states, and if you pay a scammer once, 1065.40s - 1071.10s | they will never leave you alone. 1071.10s - 1075.40s | If you are being sextorted, do not give in to their demands 1075.40s - 1078.50s | and all contact with the extorter immediately. 1078.50s - 1081.90s | Turn off your social media accounts and LinkedIn accounts 1081.90s - 1085.60s | and serve the blackmailer with a cease and desist notice, 1085.60s - 1091.50s | and make sure to file a police report against the extorter. 1091.60s - 1095.10s | Currently, states that have NCIA laws 1095.10s - 1099.60s | are almost all of the states except for two. 1099.60s - 1103.60s | States that have laws against extortion 1103.60s - 1107.50s | is about half of the states in the United States currently, 1107.50s - 1112.40s | and deepfake laws are in some of the states, 1112.40s - 1115.50s | but it definitely needs to be improved on. 1115.50s - 1120.70s | There is a new law going through Congress right now 1120.70s - 1125.80s | regarding deepfakes, and we'll see how that goes through. 1125.80s - 1129.30s | It's, yeah. 1129.30s - 1132.30s | Okay, so resources. 1132.30s - 1136.00s | There is an organization called Operation Safescape. 1136.00s - 1138.10s | They are a great organization 1138.10s - 1142.10s | with support from cybersecurity professionals. 1142.10s - 1144.30s | If you have an interest in helping out 1144.30s - 1146.60s | with people in these situations 1146.60s - 1149.90s | and also with stalking and domestic violence, 1149.90s - 1153.10s | this is a great organization 1153.10s - 1157.90s | that does need help from cybersecurity professionals, 1157.90s - 1162.50s | so they are accepting volunteers. 1162.50s - 1165.70s | If you or somebody you know is needing assistance 1165.70s - 1168.90s | with any of the kinds of issues that I mentioned, 1168.90s


chunk_text:
against extortion 1103.60s - 1107.50s | is about half of the states in the United States currently, 1107.50s - 1112.40s | and deepfake laws are in some of the states, 1112.40s - 1115.50s | but it definitely needs to be improved on. 1115.50s - 1120.70s | There is a new law going through Congress right now 1120.70s - 1125.80s | regarding deepfakes, and we'll see how that goes through. 1125.80s - 1129.30s | It's, yeah. 1129.30s - 1132.30s | Okay, so resources. 1132.30s - 1136.00s | There is an organization called Operation Safescape. 1136.00s - 1138.10s | They are a great organization 1138.10s - 1142.10s | with support from cybersecurity professionals. 1142.10s - 1144.30s | If you have an interest in helping out 1144.30s - 1146.60s | with people in these situations 1146.60s - 1149.90s | and also with stalking and domestic violence, 1149.90s - 1153.10s | this is a great organization 1153.10s - 1157.90s | that does need help from cybersecurity professionals, 1157.90s - 1162.50s | so they are accepting volunteers. 1162.50s - 1165.70s | If you or somebody you know is needing assistance 1165.70s - 1168.90s | with any of the kinds of issues that I mentioned, 1168.90s - 1171.60s | lockdown your life, 1171.60s - 1177.60s | she has quick, easy learning bits that you can sign up for 1177.60s - 1180.10s | and also has consultations, 1180.10s - 1183.50s | and then there's a platform called Operation Privacy, 1183.50s - 1188.00s | and it's a free platform, 1188.00s - 1191.50s | and it has basically like checklists that you go through 1191.50s - 1198.80s | to improve your online privacy. 1198.80s - 1203.30s | I do want to remind you that this is tough to go through, 1203.30s - 1208.00s | so if you are experiencing any kinds of these situations, 1208.00s - 1210.20s | there's a phone number 988 1210.20s - 1213.50s | as well as the website 988lifeline.org 1213.50s - 1216.60s | that does provide assistance 1216.60s - 1219.10s | if you're needing to talk to somebody, 1219.10s - 1221.30s | and I definitely recommend 1221.30s - 1226.00s | if you are experiencing any of the situations 1226.00s - 1228.00s | that I've talked about to talk with someone, 1228.00s - 1231.40s | whether that's a friend, family member, or a therapist. 1231.50s - 1234.70s | You don't have to keep it to yourself.


chunk_text:
- 1171.60s | lockdown your life, 1171.60s - 1177.60s | she has quick, easy learning bits that you can sign up for 1177.60s - 1180.10s | and also has consultations, 1180.10s - 1183.50s | and then there's a platform called Operation Privacy, 1183.50s - 1188.00s | and it's a free platform, 1188.00s - 1191.50s | and it has basically like checklists that you go through 1191.50s - 1198.80s | to improve your online privacy. 1198.80s - 1203.30s | I do want to remind you that this is tough to go through, 1203.30s - 1208.00s | so if you are experiencing any kinds of these situations, 1208.00s - 1210.20s | there's a phone number 988 1210.20s - 1213.50s | as well as the website 988lifeline.org 1213.50s - 1216.60s | that does provide assistance 1216.60s - 1219.10s | if you're needing to talk to somebody, 1219.10s - 1221.30s | and I definitely recommend 1221.30s - 1226.00s | if you are experiencing any of the situations 1226.00s - 1228.00s | that I've talked about to talk with someone, 1228.00s - 1231.40s | whether that's a friend, family member, or a therapist. 1231.50s - 1234.70s | You don't have to keep it to yourself. 1234.70s - 1237.30s | I want to give a huge shout-out to Caitlin Bowden. 1237.30s - 1242.40s | She has done so much great work for this, 1242.40s - 1246.40s | for Orange Porn, and I really look up to her, 1246.40s - 1251.60s | and I appreciate her help in preparing this presentation. 1251.60s - 1253.50s | My name is Edna Johnson. 1253.50s - 1257.30s | You can email me at edna at edna.tech. 1257.30s - 1261.00s | You can find me on Twitter and BlueSky at Edna's. 1261.00s - 1262.90s | Thank you all so much for being here today. 1262.90s - 1264.60s | I appreciate you.


chunk_text:
1234.70s - 1237.30s | I want to give a huge shout-out to Caitlin Bowden. 1237.30s - 1242.40s | She has done so much great work for this, 1242.40s - 1246.40s | for Orange Porn, and I really look up to her, 1246.40s - 1251.60s | and I appreciate her help in preparing this presentation. 1251.60s - 1253.50s | My name is Edna Johnson. 1253.50s - 1257.30s | You can email me at edna at edna.tech. 1257.30s - 1261.00s | You can find me on Twitter and BlueSky at Edna's. 1261.00s - 1262.90s | Thank you all so much for being here today. 1262.90s - 1264.60s | I appreciate you.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=TqLRpUmpBWY", "title": "DEF CON 32 - Open Source Hacker V. Government Lawyer - Rebecca Lively, Eddie Zaneski", "description": "Join a recovering government attorney and an open-source hacker for a fiery debate that dives into the world of DoD cybersecurity inefficiencies. Rebecca, a former DoD lawyer, pairs her intricate understanding of perplexing government policies with Eddie\u2019s fresh, critical (and dare we say naive?) insights from the private sector. This session will explore the frustrating \u201chow\u201d behind the government\u2019s \u201cwhy,\u201d from slow booting government laptops to the realities of \u201cmilitary-grade technology.\u201d Together, they will challenge the status quo, proposing innovative, open-source inspired solutions to streamline and secure DoD operations. Expect a dynamic exchange filled with real-world frustrations, enlightening explanations, and a hacker\u2019s touch on how to fix what\u2019s broken.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2087, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 5.12s | This text was transcribed using whisper model: large-v2 Thank you for joining us for Open Source Hacker vs. Government Lawyer, Clashing Views on Fixing 5.12s - 6.88s | Tech and the DoD. 6.88s - 9.84s | My name is Eddie, and I am an open source hacker. 9.84s - 18.42s | And I'm Rebecca Lively, I'm a government attorney. 18.42s - 25.38s | We met at the Bravo 11 collaborative software development event. 25.38s - 30.10s | I'm told that that's actually Bravo 3, which is some sort of weird hacker code. 30.10s - 31.10s | It's binary. 31.10s - 32.10s | Oh. 32.10s - 33.10s | Binary. 33.10s - 34.10s | Okay. 34.10s - 42.26s | So, anyway, we met at this science fair, where a bunch of software developers got together, 42.26s - 48.14s | and the dude running it, he had some sort of compromising material, I think, on the 48.14s - 54.90s | general counsel, because he was able to convince all of these completely unclear, random civilians. 54.90s - 57.98s | He was able to convince his general counsel that it was fine to bring them onto a military 57.98s - 63.20s | base and give them access to some of the most sensitive government data. 63.20s - 66.50s | And so, that's where I met this random civilian. 66.50s - 68.82s | It was a hackathon, Rebecca. 68.82s - 71.42s | And I think Stuart's here somewhere. 71.42s - 72.90s | Hey! 72.90s - 76.26s | So, that's awkward. 76.26s


chunk_text:
a government attorney. 18.42s - 25.38s | We met at the Bravo 11 collaborative software development event. 25.38s - 30.10s | I'm told that that's actually Bravo 3, which is some sort of weird hacker code. 30.10s - 31.10s | It's binary. 31.10s - 32.10s | Oh. 32.10s - 33.10s | Binary. 33.10s - 34.10s | Okay. 34.10s - 42.26s | So, anyway, we met at this science fair, where a bunch of software developers got together, 42.26s - 48.14s | and the dude running it, he had some sort of compromising material, I think, on the 48.14s - 54.90s | general counsel, because he was able to convince all of these completely unclear, random civilians. 54.90s - 57.98s | He was able to convince his general counsel that it was fine to bring them onto a military 57.98s - 63.20s | base and give them access to some of the most sensitive government data. 63.20s - 66.50s | And so, that's where I met this random civilian. 66.50s - 68.82s | It was a hackathon, Rebecca. 68.82s - 71.42s | And I think Stuart's here somewhere. 71.42s - 72.90s | Hey! 72.90s - 76.26s | So, that's awkward. 76.26s - 81.10s | But anyway, so we were at this collaborative software development event, and we basically, 81.10s - 86.84s | because there were these random, uncleared, unvetted people, we had to have a special 86.84s - 89.88s | environment set up so that they couldn't screw anything up. 89.88s - 92.08s | But good news, we had, like, literally everything y'all needed. 92.08s - 93.08s | So, you showed up. 93.08s - 94.08s | Yeah. 94.08s - 95.08s | About that. 95.08s - 98.80s | It was my first time on a military base, and I had no idea what to expect. 98.80s - 102.52s | I showed up with my laptop, and they told me I couldn't bring it in. 102.52s - 103.72s | Of course you could not bring that in. 103.72s - 105.84s | Like, why did you think that you could bring that in? 105.84s - 111.36s | Well, I said, okay, let me just get my little USB YubiKey out so I can log into GitHub. 111.36s - 113.56s | We do not do USBs in the Department of Defense. 113.56s - 114.56s | That is not a thing. 114.56s - 116.72s | And


chunk_text:
- 81.10s | But anyway, so we were at this collaborative software development event, and we basically, 81.10s - 86.84s | because there were these random, uncleared, unvetted people, we had to have a special 86.84s - 89.88s | environment set up so that they couldn't screw anything up. 89.88s - 92.08s | But good news, we had, like, literally everything y'all needed. 92.08s - 93.08s | So, you showed up. 93.08s - 94.08s | Yeah. 94.08s - 95.08s | About that. 95.08s - 98.80s | It was my first time on a military base, and I had no idea what to expect. 98.80s - 102.52s | I showed up with my laptop, and they told me I couldn't bring it in. 102.52s - 103.72s | Of course you could not bring that in. 103.72s - 105.84s | Like, why did you think that you could bring that in? 105.84s - 111.36s | Well, I said, okay, let me just get my little USB YubiKey out so I can log into GitHub. 111.36s - 113.56s | We do not do USBs in the Department of Defense. 113.56s - 114.56s | That is not a thing. 114.56s - 116.72s | And also, GitHub, is that where the open source software is stored? 116.72s - 117.72s | Yep. 117.72s - 118.72s | Okay. 118.72s - 119.72s | Yeah. 119.72s - 120.72s | That's also not going to be a thing. 120.72s - 121.72s | Well, there was no internet, so it actually didn't matter. 121.72s - 122.72s | Correct. 122.72s - 125.40s | There was no internet, because you were there to exfiltrate, I mean, you could have been 125.40s - 128.40s | there to exfiltrate data, and there would have been no way of knowing that. 128.40s - 129.40s | Yep. 129.40s - 130.40s | Well, you built this environment. 130.40s - 132.32s | It was a great environment. 132.32s - 135.88s | It had literally all of the tools that developers need to do their jobs. 135.88s - 141.00s | They had VS Code installed without any of the language plugins. 141.00s - 143.64s | And to be clear, I'm not sure why you would need language plugins. 143.64s - 146.08s | This is America, and we speak English. 147.08s - 151.68s | What wound up happening was we kind of went out to the car and tethered from our


chunk_text:
also, GitHub, is that where the open source software is stored? 116.72s - 117.72s | Yep. 117.72s - 118.72s | Okay. 118.72s - 119.72s | Yeah. 119.72s - 120.72s | That's also not going to be a thing. 120.72s - 121.72s | Well, there was no internet, so it actually didn't matter. 121.72s - 122.72s | Correct. 122.72s - 125.40s | There was no internet, because you were there to exfiltrate, I mean, you could have been 125.40s - 128.40s | there to exfiltrate data, and there would have been no way of knowing that. 128.40s - 129.40s | Yep. 129.40s - 130.40s | Well, you built this environment. 130.40s - 132.32s | It was a great environment. 132.32s - 135.88s | It had literally all of the tools that developers need to do their jobs. 135.88s - 141.00s | They had VS Code installed without any of the language plugins. 141.00s - 143.64s | And to be clear, I'm not sure why you would need language plugins. 143.64s - 146.08s | This is America, and we speak English. 147.08s - 151.68s | What wound up happening was we kind of went out to the car and tethered from our phones 151.68s - 154.40s | to get anything done at all. 154.40s - 158.16s | I don't know if you know, that is both probably illegal, definitely unethical, and a very 158.16s - 159.16s | bad security practice. 159.16s - 162.20s | Well, you shouldn't have brought us there if you didn't want us to get things done. 162.20s - 164.64s | I didn't actually care if you got anything done. 164.64s - 167.28s | Well, it was a good time. 167.28s - 168.48s | Anyway, time out. 168.48s - 171.40s | We don't actually hate each other, if you couldn't tell. 171.40s - 173.56s | I mean, we do now. 173.56s - 179.88s | Well, Rebecca is dressed stereotypically like chat GPT thinks all women lawyers look like. 179.88s - 180.88s | I was, anyway. 180.88s - 182.60s | I was seconds ago. 182.60s - 186.96s | But Stuart and his team did a great job when they put on the Bravo 3 Hackathon, so shout 186.96s - 187.96s | out to them. 187.96s - 190.16s | If you ever get a chance to check out the Bravo Hackathons, they're rad. 190.16s - 194.48s | They invite civilians and


chunk_text:
phones 151.68s - 154.40s | to get anything done at all. 154.40s - 158.16s | I don't know if you know, that is both probably illegal, definitely unethical, and a very 158.16s - 159.16s | bad security practice. 159.16s - 162.20s | Well, you shouldn't have brought us there if you didn't want us to get things done. 162.20s - 164.64s | I didn't actually care if you got anything done. 164.64s - 167.28s | Well, it was a good time. 167.28s - 168.48s | Anyway, time out. 168.48s - 171.40s | We don't actually hate each other, if you couldn't tell. 171.40s - 173.56s | I mean, we do now. 173.56s - 179.88s | Well, Rebecca is dressed stereotypically like chat GPT thinks all women lawyers look like. 179.88s - 180.88s | I was, anyway. 180.88s - 182.60s | I was seconds ago. 182.60s - 186.96s | But Stuart and his team did a great job when they put on the Bravo 3 Hackathon, so shout 186.96s - 187.96s | out to them. 187.96s - 190.16s | If you ever get a chance to check out the Bravo Hackathons, they're rad. 190.16s - 194.48s | They invite civilians and U.S. citizens to come work with controlled and classified data. 194.48s - 195.48s | Really cool time. 195.48s - 196.48s | So they're open to the U.S. public. 196.48s - 197.48s | So... 197.48s - 198.48s | Go ahead. 198.48s - 202.64s | One more thing about the Bravo Hackathon, it is literally the basis for this entire 202.72s - 205.16s | talk, because that is actually where we met. 205.16s - 208.96s | And he was actually having no prior government experience, and he kept asking me questions 208.96s - 212.08s | like why the fuck are we doing this, Rebecca? 212.08s - 216.16s | And I would provide the most reasonable explanation that I could imagine based on 13 years of 216.16s - 217.16s | Stockholm Syndrome. 217.16s - 218.16s | Yeah. 218.16s - 220.40s | So, rewinding real quick. 220.40s - 221.40s | I'm Eddie Zaneski. 221.40s - 225.96s | I'm an open source staff engineer at a company called Defense Unicorns. 225.96s - 229.36s | I'm a maintainer for the Kubernetes project, which is what I spend most of my time working 229.36s - 230.36s | on. 230.36s - 231.36s | And I don't go here.


chunk_text:
U.S. citizens to come work with controlled and classified data. 194.48s - 195.48s | Really cool time. 195.48s - 196.48s | So they're open to the U.S. public. 196.48s - 197.48s | So... 197.48s - 198.48s | Go ahead. 198.48s - 202.64s | One more thing about the Bravo Hackathon, it is literally the basis for this entire 202.72s - 205.16s | talk, because that is actually where we met. 205.16s - 208.96s | And he was actually having no prior government experience, and he kept asking me questions 208.96s - 212.08s | like why the fuck are we doing this, Rebecca? 212.08s - 216.16s | And I would provide the most reasonable explanation that I could imagine based on 13 years of 216.16s - 217.16s | Stockholm Syndrome. 217.16s - 218.16s | Yeah. 218.16s - 220.40s | So, rewinding real quick. 220.40s - 221.40s | I'm Eddie Zaneski. 221.40s - 225.96s | I'm an open source staff engineer at a company called Defense Unicorns. 225.96s - 229.36s | I'm a maintainer for the Kubernetes project, which is what I spend most of my time working 229.36s - 230.36s | on. 230.36s - 231.36s | And I don't go here. 231.36s - 232.92s | I'm not a security person at all. 232.92s - 234.40s | I'm just an open source maintainer. 234.40s - 237.40s | And I definitely am very new to the government and the policy world. 237.40s - 241.56s | So I'm about eight months into that world. 241.56s - 242.56s | And I'm Rebecca. 242.56s - 244.56s | I was actually a government attorney. 244.56s - 245.56s | I am still... 245.56s - 248.56s | Every time I tell people I'm not an attorney anymore, they think I got disbarred, and that 248.56s - 250.20s | did not happen. 250.20s - 253.72s | But I did stop practicing law about four years ago. 253.72s - 258.16s | And I went to, for three years, the coolest squadron in the entire Air Force. 258.16s - 261.56s | The 90th Cyber Ops Squadron. 261.60s - 264.04s | And built malware. 264.04s - 266.04s | Which was really freaking cool. 266.04s - 267.40s | And then I escaped there, too. 267.40s - 269.66s | Because apparently all good things must end. 269.66s - 272.32s | And I also joined the same company that Eddie's at, which is Defense Unicorns. 272.32s


chunk_text:
231.36s - 232.92s | I'm not a security person at all. 232.92s - 234.40s | I'm just an open source maintainer. 234.40s - 237.40s | And I definitely am very new to the government and the policy world. 237.40s - 241.56s | So I'm about eight months into that world. 241.56s - 242.56s | And I'm Rebecca. 242.56s - 244.56s | I was actually a government attorney. 244.56s - 245.56s | I am still... 245.56s - 248.56s | Every time I tell people I'm not an attorney anymore, they think I got disbarred, and that 248.56s - 250.20s | did not happen. 250.20s - 253.72s | But I did stop practicing law about four years ago. 253.72s - 258.16s | And I went to, for three years, the coolest squadron in the entire Air Force. 258.16s - 261.56s | The 90th Cyber Ops Squadron. 261.60s - 264.04s | And built malware. 264.04s - 266.04s | Which was really freaking cool. 266.04s - 267.40s | And then I escaped there, too. 267.40s - 269.66s | Because apparently all good things must end. 269.66s - 272.32s | And I also joined the same company that Eddie's at, which is Defense Unicorns. 272.32s - 273.32s | Yeah. 273.32s - 274.32s | So we mentioned Defense Unicorns. 274.32s - 275.50s | We don't want to shill or plug too much. 275.50s - 277.72s | But we build open source software for the US military. 277.72s - 278.72s | It's kind of rad. 278.72s - 283.16s | And their goal is to kind of get people like me out of industry and private sector to come 283.16s - 284.52s | work on stuff for the public. 284.52s - 286.08s | So check out what they're doing. 286.08s - 287.96s | They're pretty cool. 287.96s - 290.68s | We want to quickly define that when we talk about the term hacker here, we're talking 290.68s - 292.00s | about the traditional sense of the word. 292.00s - 294.44s | Again, I'm not a security person. 294.44s - 297.20s | Building cool shit, subverting the rules, doing that type of stuff. 297.20s - 299.72s | So that's our definition here. 299.72s - 304.08s | And so basically we organized this talk around, like, six questions that Eddie asked me over 304.08s - 305.80s | the last three months. 305.80s - 309.08s | All of which, at the


chunk_text:
- 273.32s | Yeah. 273.32s - 274.32s | So we mentioned Defense Unicorns. 274.32s - 275.50s | We don't want to shill or plug too much. 275.50s - 277.72s | But we build open source software for the US military. 277.72s - 278.72s | It's kind of rad. 278.72s - 283.16s | And their goal is to kind of get people like me out of industry and private sector to come 283.16s - 284.52s | work on stuff for the public. 284.52s - 286.08s | So check out what they're doing. 286.08s - 287.96s | They're pretty cool. 287.96s - 290.68s | We want to quickly define that when we talk about the term hacker here, we're talking 290.68s - 292.00s | about the traditional sense of the word. 292.00s - 294.44s | Again, I'm not a security person. 294.44s - 297.20s | Building cool shit, subverting the rules, doing that type of stuff. 297.20s - 299.72s | So that's our definition here. 299.72s - 304.08s | And so basically we organized this talk around, like, six questions that Eddie asked me over 304.08s - 305.80s | the last three months. 305.80s - 309.08s | All of which, at the moment, I was like, what do you mean you don't understand why that 309.08s - 310.52s | would happen? 310.52s - 313.32s | And actually spurred, like, really great conversations. 313.32s - 318.24s | But what we kind of realized is that the root of all of it is just competing priorities 318.24s - 320.52s | within, like, the hacker community and the government community. 320.52s - 323.72s | So we're going to start with what those competing priorities are. 323.72s - 327.88s | In the government, and I put at the bottom, both because I'm a recovering attorney and 327.88s - 330.56s | because I thought it was funny, terms and conditions apply. 330.56s - 335.28s | The government, it turns out, is not a monolith that acts completely deliberately and with 335.28s - 338.00s | one singular direction and intention. 338.00s - 343.48s | And so how exactly these various things are rated in terms of importance to any given 343.48s - 345.48s | piece of the federal government depends. 345.48s - 347.76s | But we've got compliance. 347.76s - 352.94s | So that is, like, the checking the box and validating that you meet all of the


chunk_text:
moment, I was like, what do you mean you don't understand why that 309.08s - 310.52s | would happen? 310.52s - 313.32s | And actually spurred, like, really great conversations. 313.32s - 318.24s | But what we kind of realized is that the root of all of it is just competing priorities 318.24s - 320.52s | within, like, the hacker community and the government community. 320.52s - 323.72s | So we're going to start with what those competing priorities are. 323.72s - 327.88s | In the government, and I put at the bottom, both because I'm a recovering attorney and 327.88s - 330.56s | because I thought it was funny, terms and conditions apply. 330.56s - 335.28s | The government, it turns out, is not a monolith that acts completely deliberately and with 335.28s - 338.00s | one singular direction and intention. 338.00s - 343.48s | And so how exactly these various things are rated in terms of importance to any given 343.48s - 345.48s | piece of the federal government depends. 345.48s - 347.76s | But we've got compliance. 347.76s - 352.94s | So that is, like, the checking the box and validating that you meet all of the various 352.94s - 356.72s | requirements from all of the various different parts of government and law. 356.72s - 357.72s | There's scale. 357.72s - 361.48s | So literally every time I had a great idea when I worked in the government, no matter 361.48s - 364.40s | how, like, hey, I just want to try this and see if it works, like, can we just string 364.40s - 366.96s | a couple of raspberry pies together and try this thing? 366.96s - 370.44s | The first question I would almost always get from my leadership was, okay, but do you think 370.44s - 375.28s | that would scale across the entire Department of the Air Force? 375.28s - 380.24s | And I'm, like, really, like, I just I want $32 to know whether or not this would work. 380.24s - 381.92s | Like, can I do that? 381.92s - 386.44s | And often, like, entire projects would be killed because I couldn't articulate a couldn't 386.44s - 390.14s | quickly articulate an easy idea of how this would scale or whether it would make sense 390.14s - 391.14s | for it to scale. 391.14s - 392.14s | And that


chunk_text:
various 352.94s - 356.72s | requirements from all of the various different parts of government and law. 356.72s - 357.72s | There's scale. 357.72s - 361.48s | So literally every time I had a great idea when I worked in the government, no matter 361.48s - 364.40s | how, like, hey, I just want to try this and see if it works, like, can we just string 364.40s - 366.96s | a couple of raspberry pies together and try this thing? 366.96s - 370.44s | The first question I would almost always get from my leadership was, okay, but do you think 370.44s - 375.28s | that would scale across the entire Department of the Air Force? 375.28s - 380.24s | And I'm, like, really, like, I just I want $32 to know whether or not this would work. 380.24s - 381.92s | Like, can I do that? 381.92s - 386.44s | And often, like, entire projects would be killed because I couldn't articulate a couldn't 386.44s - 390.14s | quickly articulate an easy idea of how this would scale or whether it would make sense 390.14s - 391.14s | for it to scale. 391.14s - 392.14s | And that wasn't just tech. 392.14s - 393.14s | That was also policy. 393.14s - 396.20s | So I was, like, hey, it would be cool if for these 16 people we could try this special 396.20s - 397.84s | authority that actually already exists. 397.84s - 401.44s | They'd be, like, ah, it would be really unfair to the other people. 401.44s - 403.20s | So scale is a big thing. 403.20s - 407.56s | Documentation, the ability to prove to each echelon of authority that you have done all 407.56s - 410.80s | of the things that you're supposed to do is often, to be completely honest, more important 410.80s - 416.48s | than anything else to the bureaucratic assholes in the government, of which they are not all. 416.48s - 421.08s | Fairness, that's within the acquisition process, but then in general, like, making sure and 421.08s - 424.88s | a lot of that comes from, look, I don't want to be a country where, like, if I as a contractor 424.88s - 427.44s | install a pool in your backyard, I'm going to get the next contract. 427.44s - 430.80s | Like, that is not how I want


chunk_text:
wasn't just tech. 392.14s - 393.14s | That was also policy. 393.14s - 396.20s | So I was, like, hey, it would be cool if for these 16 people we could try this special 396.20s - 397.84s | authority that actually already exists. 397.84s - 401.44s | They'd be, like, ah, it would be really unfair to the other people. 401.44s - 403.20s | So scale is a big thing. 403.20s - 407.56s | Documentation, the ability to prove to each echelon of authority that you have done all 407.56s - 410.80s | of the things that you're supposed to do is often, to be completely honest, more important 410.80s - 416.48s | than anything else to the bureaucratic assholes in the government, of which they are not all. 416.48s - 421.08s | Fairness, that's within the acquisition process, but then in general, like, making sure and 421.08s - 424.88s | a lot of that comes from, look, I don't want to be a country where, like, if I as a contractor 424.88s - 427.44s | install a pool in your backyard, I'm going to get the next contract. 427.44s - 430.80s | Like, that is not how I want our country to operate as a taxpayer. 430.80s - 436.36s | So there's a lot that's baked into avoiding, like, graft and, like, bad things and crime 436.36s - 437.36s | and stuff. 437.36s - 438.36s | And the last one is mission. 438.36s - 441.36s | And I put it last because honestly a lot of times when I was in the government, it felt 441.36s - 442.76s | like it was last. 442.76s - 446.36s | It felt like it was the last thing in the level of importance. 446.36s - 451.52s | But it is the most important thing to me and I think to a lot of the people in the government, 451.52s - 455.72s | which is the other piece I'd love to touch on really quick, which is this idea of, like, 455.72s - 457.36s | the stereotypical government employee. 457.36s - 460.44s | So if you are not a government employee and you're in this room, you may have some idea 460.48s - 465.32s | of, like, a suit wearing, like, kind of stodgy person who doesn't understand that 11 is actually 465.32s - 466.68s | three and binary. 466.68s - 472.96s |


chunk_text:
our country to operate as a taxpayer. 430.80s - 436.36s | So there's a lot that's baked into avoiding, like, graft and, like, bad things and crime 436.36s - 437.36s | and stuff. 437.36s - 438.36s | And the last one is mission. 438.36s - 441.36s | And I put it last because honestly a lot of times when I was in the government, it felt 441.36s - 442.76s | like it was last. 442.76s - 446.36s | It felt like it was the last thing in the level of importance. 446.36s - 451.52s | But it is the most important thing to me and I think to a lot of the people in the government, 451.52s - 455.72s | which is the other piece I'd love to touch on really quick, which is this idea of, like, 455.72s - 457.36s | the stereotypical government employee. 457.36s - 460.44s | So if you are not a government employee and you're in this room, you may have some idea 460.48s - 465.32s | of, like, a suit wearing, like, kind of stodgy person who doesn't understand that 11 is actually 465.32s - 466.68s | three and binary. 466.68s - 472.96s | And, like, that is, in my experience, a really unhelpful stereotype for actually getting 472.96s - 473.96s | things done. 473.96s - 474.96s | The other part is the mission. 474.96s - 476.52s | Like, national security. 476.52s - 478.04s | That sounds boring. 478.04s - 479.04s | Exactly. 479.04s - 480.60s | Except for it's not. 480.60s - 483.04s | Because I run my mouth, like, nonstop all the time. 483.04s - 485.52s | I talk so much shit and I complain about the government. 485.52s - 487.16s | And I haven't gotten shot yet. 487.16s - 488.68s | And that is because of national security. 488.68s - 489.68s | Because we have freedom of speech. 489.68s - 493.84s | Because we have rights that, like, actually, it turns out, like, matter and we are willing 493.84s - 494.84s | to defend. 494.84s - 496.84s | So that's the government. 496.84s - 500.56s | So the hacker side of this, obviously, as an engineer coming in to solve a problem, 500.56s - 504.16s | a technical problem, the first thing I would care about is, is there technology out there 504.16s - 505.16s | and does it work? 505.16s


chunk_text:
And, like, that is, in my experience, a really unhelpful stereotype for actually getting 472.96s - 473.96s | things done. 473.96s - 474.96s | The other part is the mission. 474.96s - 476.52s | Like, national security. 476.52s - 478.04s | That sounds boring. 478.04s - 479.04s | Exactly. 479.04s - 480.60s | Except for it's not. 480.60s - 483.04s | Because I run my mouth, like, nonstop all the time. 483.04s - 485.52s | I talk so much shit and I complain about the government. 485.52s - 487.16s | And I haven't gotten shot yet. 487.16s - 488.68s | And that is because of national security. 488.68s - 489.68s | Because we have freedom of speech. 489.68s - 493.84s | Because we have rights that, like, actually, it turns out, like, matter and we are willing 493.84s - 494.84s | to defend. 494.84s - 496.84s | So that's the government. 496.84s - 500.56s | So the hacker side of this, obviously, as an engineer coming in to solve a problem, 500.56s - 504.16s | a technical problem, the first thing I would care about is, is there technology out there 504.16s - 505.16s | and does it work? 505.16s - 506.16s | Right? 506.16s - 509.04s | Is there something that someone built ahead of me that I can use, repurpose? 509.04s - 512.72s | As an open source maintainer, obviously, I wish there to be an open source solution. 512.72s - 516.20s | We all know the value of open source so I can audit the code myself, make changes, that 516.20s - 517.20s | sort of stuff. 517.68s - 519.52s | But I'm not a zealot when it comes to open source. 519.52s - 524.72s | So if there is a good proprietary solution out there, I'm willing to pay for it to make 524.72s - 525.72s | the job better. 525.72s - 529.16s | Does it need to scale is a great question. 529.16s - 532.34s | It's a lot of engineers when they're first going to build an architect systems, they're 532.34s - 537.08s | worried about reaching Google scale of hundreds of thousands of requests per second, right? 537.08s - 541.24s | I have a great friend who works for the U.S. forest department and he builds an app that 541.24s - 548.20s | the firefighting pilots use to fight forest fires and dispatch


chunk_text:
- 506.16s | Right? 506.16s - 509.04s | Is there something that someone built ahead of me that I can use, repurpose? 509.04s - 512.72s | As an open source maintainer, obviously, I wish there to be an open source solution. 512.72s - 516.20s | We all know the value of open source so I can audit the code myself, make changes, that 516.20s - 517.20s | sort of stuff. 517.68s - 519.52s | But I'm not a zealot when it comes to open source. 519.52s - 524.72s | So if there is a good proprietary solution out there, I'm willing to pay for it to make 524.72s - 525.72s | the job better. 525.72s - 529.16s | Does it need to scale is a great question. 529.16s - 532.34s | It's a lot of engineers when they're first going to build an architect systems, they're 532.34s - 537.08s | worried about reaching Google scale of hundreds of thousands of requests per second, right? 537.08s - 541.24s | I have a great friend who works for the U.S. forest department and he builds an app that 541.24s - 548.20s | the firefighting pilots use to fight forest fires and dispatch planes and he's got three 548.20s - 553.08s | users for his app and it is massively important to national health, right? 553.08s - 556.40s | But it does not need to scale to a massive audience. 556.40s - 560.04s | And then obviously I want to iterate quickly and over and over again, right? 560.04s - 563.92s | I don't want to stick to a traditional waterfall model where I'm talking about requirements 563.92s - 565.80s | and shipping stuff very slowly. 565.80s - 568.88s | I want to throw shit at the wall and see if it's the right thing to solve the problem 568.88s - 572.04s | and get feedback real quickly. 572.04s - 577.04s | So basically as I listened to Eddie's naive questions and then answered them and realized 577.04s - 580.40s | they were actually profound, we figured there were three main categories of questions that 580.40s - 583.92s | he asked and so these are kind of how we organized our talk. 583.92s - 586.08s | The first one is technical challenges in the government. 586.08s - 591.88s | If you heard General Nakasone speak this morning, I was so delighted that he


chunk_text:
planes and he's got three 548.20s - 553.08s | users for his app and it is massively important to national health, right? 553.08s - 556.40s | But it does not need to scale to a massive audience. 556.40s - 560.04s | And then obviously I want to iterate quickly and over and over again, right? 560.04s - 563.92s | I don't want to stick to a traditional waterfall model where I'm talking about requirements 563.92s - 565.80s | and shipping stuff very slowly. 565.80s - 568.88s | I want to throw shit at the wall and see if it's the right thing to solve the problem 568.88s - 572.04s | and get feedback real quickly. 572.04s - 577.04s | So basically as I listened to Eddie's naive questions and then answered them and realized 577.04s - 580.40s | they were actually profound, we figured there were three main categories of questions that 580.40s - 583.92s | he asked and so these are kind of how we organized our talk. 583.92s - 586.08s | The first one is technical challenges in the government. 586.08s - 591.88s | If you heard General Nakasone speak this morning, I was so delighted that he talked about buckshot 591.88s - 594.48s | Yankee because I was like I have a slide for that. 594.48s - 596.80s | So technical challenges in the government. 596.80s - 600.64s | We're specifically talking about the actual technical challenges, like things that make 600.64s - 603.72s | ‑‑ you said this better than me. 603.72s - 604.72s | What are we talking about? 604.72s - 605.72s | Yeah. 605.72s - 608.28s | This is how the actual technology that we solve problems for. 608.28s - 613.28s | So what goes into using and choosing that technology? 613.28s - 617.02s | So one of the first things I noticed at this Bravo hackathon we went to was my partner 617.02s - 620.32s | for the hackathon worked in a secure facility normally. 620.32s - 623.76s | This was kind of his normal environment and he kept getting up and leaving and coming 623.76s - 626.12s | back and he had this notebook with him. 626.12s - 629.20s | Turns out what he was doing was he was going out to the parking lot, looking shit up on 629.20s - 634.20s | Stack Overflow, copying code out of Stack Overflow into


chunk_text:
talked about buckshot 591.88s - 594.48s | Yankee because I was like I have a slide for that. 594.48s - 596.80s | So technical challenges in the government. 596.80s - 600.64s | We're specifically talking about the actual technical challenges, like things that make 600.64s - 603.72s | ‑‑ you said this better than me. 603.72s - 604.72s | What are we talking about? 604.72s - 605.72s | Yeah. 605.72s - 608.28s | This is how the actual technology that we solve problems for. 608.28s - 613.28s | So what goes into using and choosing that technology? 613.28s - 617.02s | So one of the first things I noticed at this Bravo hackathon we went to was my partner 617.02s - 620.32s | for the hackathon worked in a secure facility normally. 620.32s - 623.76s | This was kind of his normal environment and he kept getting up and leaving and coming 623.76s - 626.12s | back and he had this notebook with him. 626.12s - 629.20s | Turns out what he was doing was he was going out to the parking lot, looking shit up on 629.20s - 634.20s | Stack Overflow, copying code out of Stack Overflow into his notebook to bring back into 634.20s - 639.04s | the secure room to type it into the editor to see if it worked or not and that was mind 639.04s - 643.08s | blowing to me that this was ‑‑ sure, like we were making do with what we had, but 643.08s - 645.96s | this was a normal thing for him to do. 645.96s - 648.92s | Granted a lot of those facilities do have internet pipes and separate computers that 648.92s - 653.52s | you can use, but from what he was telling me, this is his normal everyday thing and 653.52s - 654.52s | that's mind blowing. 655.32s - 657.04s | It's also super inefficient. 657.04s - 660.60s | One of the questions I asked was actually, so I've worked in a lot of secure facilities 660.60s - 664.04s | where they take all of the fun things that you have and make you do actual work because 664.04s - 666.56s | you can't play Candy Crush on your phone anymore. 666.56s - 670.32s | Good news, I don't work in that kind of facility anymore, but they'd never taken my 670.32s - 674.80s | key


chunk_text:
his notebook to bring back into 634.20s - 639.04s | the secure room to type it into the editor to see if it worked or not and that was mind 639.04s - 643.08s | blowing to me that this was ‑‑ sure, like we were making do with what we had, but 643.08s - 645.96s | this was a normal thing for him to do. 645.96s - 648.92s | Granted a lot of those facilities do have internet pipes and separate computers that 648.92s - 653.52s | you can use, but from what he was telling me, this is his normal everyday thing and 653.52s - 654.52s | that's mind blowing. 655.32s - 657.04s | It's also super inefficient. 657.04s - 660.60s | One of the questions I asked was actually, so I've worked in a lot of secure facilities 660.60s - 664.04s | where they take all of the fun things that you have and make you do actual work because 664.04s - 666.56s | you can't play Candy Crush on your phone anymore. 666.56s - 670.32s | Good news, I don't work in that kind of facility anymore, but they'd never taken my 670.32s - 674.80s | key fob before and so I was ‑‑ I kind of went down stereotype land and I was like 674.80s - 678.44s | these people don't understand what it is they're actually screening for because my key 678.44s - 683.68s | fob from the rental car company is not dangerous, it does not emit Bluetooth and I 683.72s - 687.12s | almost told them that they were wrong and then I decided to shut my mouth because 687.12s - 691.00s | usually when I feel that strongly it's actually me who's wrong and then I started 691.00s - 694.84s | thinking like what could they be worried about and I realized a key fob comes from a 694.84s - 696.60s | rental car company. 696.60s - 701.44s | It is assigned to me based on random things like that you could probably Google too or 701.44s - 704.72s | search me on LinkedIn and know what kind of things I'm there for or what kind of things 704.72s - 708.80s | I might be there for and then at the end of my time I give it back and so if you let 708.80s - 713.36s | that into a secure


chunk_text:
fob before and so I was ‑‑ I kind of went down stereotype land and I was like 674.80s - 678.44s | these people don't understand what it is they're actually screening for because my key 678.44s - 683.68s | fob from the rental car company is not dangerous, it does not emit Bluetooth and I 683.72s - 687.12s | almost told them that they were wrong and then I decided to shut my mouth because 687.12s - 691.00s | usually when I feel that strongly it's actually me who's wrong and then I started 691.00s - 694.84s | thinking like what could they be worried about and I realized a key fob comes from a 694.84s - 696.60s | rental car company. 696.60s - 701.44s | It is assigned to me based on random things like that you could probably Google too or 701.44s - 704.72s | search me on LinkedIn and know what kind of things I'm there for or what kind of things 704.72s - 708.80s | I might be there for and then at the end of my time I give it back and so if you let 708.80s - 713.36s | that into a secure facility, you're potentially letting some sort of battery operated 713.36s - 716.72s | device that's then going to be returned to somebody else into a facility, so like again 716.72s - 720.32s | this is one of those examples of things that seem completely asinine that might actually 720.32s - 723.60s | have legitimate reasons. 723.60s - 727.20s | When I think of like the root cause of tech challenges in the government, the first one 727.20s - 734.36s | is people, like we often lack true technical talent on the keyboard in the government. 734.36s - 738.00s | When we're successful at recruiting them, we are not successful at retaining them, largely 738.00s - 742.32s | because what happens is we promote them out of their technical competence areas. 742.32s - 743.32s | People don't like that. 743.32s - 746.40s | If you're really good at tech, it definitely doesn't mean that you want to lead a thousand 746.40s - 749.08s | people and that like you'll also be good at that. 749.08s - 751.12s | The next is law policy and inertia. 751.12s - 753.76s | So law specifically, like there's all sorts of laws out there. 753.76s


chunk_text:
facility, you're potentially letting some sort of battery operated 713.36s - 716.72s | device that's then going to be returned to somebody else into a facility, so like again 716.72s - 720.32s | this is one of those examples of things that seem completely asinine that might actually 720.32s - 723.60s | have legitimate reasons. 723.60s - 727.20s | When I think of like the root cause of tech challenges in the government, the first one 727.20s - 734.36s | is people, like we often lack true technical talent on the keyboard in the government. 734.36s - 738.00s | When we're successful at recruiting them, we are not successful at retaining them, largely 738.00s - 742.32s | because what happens is we promote them out of their technical competence areas. 742.32s - 743.32s | People don't like that. 743.32s - 746.40s | If you're really good at tech, it definitely doesn't mean that you want to lead a thousand 746.40s - 749.08s | people and that like you'll also be good at that. 749.08s - 751.12s | The next is law policy and inertia. 751.12s - 753.76s | So law specifically, like there's all sorts of laws out there. 753.76s - 755.46s | They're implemented by policy. 755.46s - 760.08s | If you are at an organization at the bottom of the organizational chart, then you have 760.08s - 765.88s | potentially like ten layers of policy between you and the law and it turns out usually most 765.88s - 768.56s | of them get more restrictive, not less. 768.56s - 769.88s | And then inertia is the last one. 769.88s - 775.32s | So when I was in the legal office, I wanted to buy a fridge with government money for 775.32s - 776.60s | $1,000. 776.60s - 778.24s | I thought it was a reasonable purchase. 778.24s - 781.32s | I looked up the rules and I determined that, yes, we could buy a fridge. 781.32s - 784.12s | And so I went to the comptroller and I said, we would like to buy a fridge. 784.12s - 785.12s | Can I have $1,000? 785.12s - 789.00s | And he said, you cannot use government funds to buy kitchen appliances. 789.00s - 791.36s | And I was like, can you help me understand like where you got that from? 791.36s - 795.88s | And he pulled out a


chunk_text:
- 755.46s | They're implemented by policy. 755.46s - 760.08s | If you are at an organization at the bottom of the organizational chart, then you have 760.08s - 765.88s | potentially like ten layers of policy between you and the law and it turns out usually most 765.88s - 768.56s | of them get more restrictive, not less. 768.56s - 769.88s | And then inertia is the last one. 769.88s - 775.32s | So when I was in the legal office, I wanted to buy a fridge with government money for 775.32s - 776.60s | $1,000. 776.60s - 778.24s | I thought it was a reasonable purchase. 778.24s - 781.32s | I looked up the rules and I determined that, yes, we could buy a fridge. 781.32s - 784.12s | And so I went to the comptroller and I said, we would like to buy a fridge. 784.12s - 785.12s | Can I have $1,000? 785.12s - 789.00s | And he said, you cannot use government funds to buy kitchen appliances. 789.00s - 791.36s | And I was like, can you help me understand like where you got that from? 791.36s - 795.88s | And he pulled out a binder where he'd printed all of the regulations ten years previously 795.88s - 799.12s | when he started his job and he had a thing highlighted in that binder. 799.12s - 802.24s | And sure enough, ten years ago, you couldn't buy a fridge, but now you can. 802.24s - 806.08s | So that is the inertia that an organization like the government can have. 806.08s - 808.08s | And the last one is incentives. 808.08s - 812.08s | There are a lot of leaders who say the right things and it feels really good to hear them. 812.08s - 815.76s | They don't then also go and align the incentives to prioritize those things. 815.76s - 820.08s | And so if all of the incentives are risk averse and you're saying, take risk, fail fast, but 820.08s - 825.96s | also you might get fired if you fail, people aren't going to take risks and fail fast. 826.00s - 831.12s | And so some of the things that I noticed coming into this world, anyone familiar with ATOs, 831.12s - 835.08s | this concept of authority to operate, anytime you want to sell, build, or use software to 835.08s


chunk_text:
binder where he'd printed all of the regulations ten years previously 795.88s - 799.12s | when he started his job and he had a thing highlighted in that binder. 799.12s - 802.24s | And sure enough, ten years ago, you couldn't buy a fridge, but now you can. 802.24s - 806.08s | So that is the inertia that an organization like the government can have. 806.08s - 808.08s | And the last one is incentives. 808.08s - 812.08s | There are a lot of leaders who say the right things and it feels really good to hear them. 812.08s - 815.76s | They don't then also go and align the incentives to prioritize those things. 815.76s - 820.08s | And so if all of the incentives are risk averse and you're saying, take risk, fail fast, but 820.08s - 825.96s | also you might get fired if you fail, people aren't going to take risks and fail fast. 826.00s - 831.12s | And so some of the things that I noticed coming into this world, anyone familiar with ATOs, 831.12s - 835.08s | this concept of authority to operate, anytime you want to sell, build, or use software to 835.08s - 839.48s | the U.S. government or inside the government, you have to do this ATO process. 839.48s - 844.00s | It's basically a sense like hundreds of pages of NIST controls and how you implement them. 844.00s - 848.44s | And there's an authorizing official who's responsible, and I mean responsible, for signing 848.44s - 849.44s | off on that. 849.44s - 853.64s | So what that means is that you have sometimes non-technical people that have to make a decision 853.64s - 857.28s | about if the right technology is being proposed for a job. 857.28s - 862.12s | And it kind of leads to this really painful process that some people don't want to take 862.12s - 866.94s | on the risk because they don't understand the technology that's being proposed. 866.94s - 870.60s | Another thing is there's lots of checkboxes all throughout the government that I've noticed. 870.60s - 873.52s | A big one is software bill of materials or SBOMs. 873.52s - 878.24s | FedRAMP requires that you provide an SBOM to the government if you're selling them software. 878.24s - 883.12s | The reality is that you can provide them a blank SBOM.json


chunk_text:
- 839.48s | the U.S. government or inside the government, you have to do this ATO process. 839.48s - 844.00s | It's basically a sense like hundreds of pages of NIST controls and how you implement them. 844.00s - 848.44s | And there's an authorizing official who's responsible, and I mean responsible, for signing 848.44s - 849.44s | off on that. 849.44s - 853.64s | So what that means is that you have sometimes non-technical people that have to make a decision 853.64s - 857.28s | about if the right technology is being proposed for a job. 857.28s - 862.12s | And it kind of leads to this really painful process that some people don't want to take 862.12s - 866.94s | on the risk because they don't understand the technology that's being proposed. 866.94s - 870.60s | Another thing is there's lots of checkboxes all throughout the government that I've noticed. 870.60s - 873.52s | A big one is software bill of materials or SBOMs. 873.52s - 878.24s | FedRAMP requires that you provide an SBOM to the government if you're selling them software. 878.24s - 883.12s | The reality is that you can provide them a blank SBOM.json file or a handwritten Microsoft 883.12s - 885.32s | Word file, and it will check the box. 885.32s - 888.76s | And it's not a problem, it's not like the fault of the serviceman who's responsible 888.76s - 889.76s | for checking that box. 889.76s - 891.48s | They're doing what they were trained to do. 891.48s - 895.48s | It's just that that is a requirement, and that's kind of where the technical requirement 895.48s - 896.48s | stops. 896.48s - 902.16s | Legacy and proprietary software, you don't even know where to begin to unwind and upgrade 902.16s - 903.72s | some of these systems. 903.72s - 905.72s | That's how complicated it is. 905.72s - 908.90s | And then I mentioned these NIST controls. 908.90s - 915.78s | Hundreds and hundreds of pages of NIST controls that you don't want to have to write and think 915.78s - 919.86s | through these controls by hand and explain how your application implements NIST 300, 919.86s - 922.06s | 1, 2, 3, 4, whatever. 922.06s - 926.10s | And it gets real frustrating when you are brought on to write code and not documentation 926.10s - 928.46s | like


chunk_text:
file or a handwritten Microsoft 883.12s - 885.32s | Word file, and it will check the box. 885.32s - 888.76s | And it's not a problem, it's not like the fault of the serviceman who's responsible 888.76s - 889.76s | for checking that box. 889.76s - 891.48s | They're doing what they were trained to do. 891.48s - 895.48s | It's just that that is a requirement, and that's kind of where the technical requirement 895.48s - 896.48s | stops. 896.48s - 902.16s | Legacy and proprietary software, you don't even know where to begin to unwind and upgrade 902.16s - 903.72s | some of these systems. 903.72s - 905.72s | That's how complicated it is. 905.72s - 908.90s | And then I mentioned these NIST controls. 908.90s - 915.78s | Hundreds and hundreds of pages of NIST controls that you don't want to have to write and think 915.78s - 919.86s | through these controls by hand and explain how your application implements NIST 300, 919.86s - 922.06s | 1, 2, 3, 4, whatever. 922.06s - 926.10s | And it gets real frustrating when you are brought on to write code and not documentation 926.10s - 928.46s | like this. 928.46s - 930.14s | So how do we fix it? 930.14s - 934.10s | First one is prioritizing technical depth. 934.10s - 938.98s | There is a world where you can have no technical skills whatsoever and promote and promote 938.98s - 943.62s | and promote and be the technically best in the world at something and literally not get 943.62s - 946.86s | promoted within the government because you don't meet whatever leadership criteria or 946.86s - 949.06s | whatever other things that they think that you need. 949.06s - 950.06s | Yeah. 950.06s - 952.74s | And the other part of this I've learned is that there is no actual career track to being 952.74s - 959.30s | a software engineer in the military, and that frustrates lots of people from what I've heard. 959.30s - 961.30s | Next is improving hiring and firing speed. 961.30s - 966.78s | It turns out it's hard to fire people in the federal government. 966.78s - 970.46s | And that makes people really uncomfortable about hiring people because you want to make 970.46s - 974.74s | sure that you don't get the wrong person and they get stuck with them


chunk_text:
this. 928.46s - 930.14s | So how do we fix it? 930.14s - 934.10s | First one is prioritizing technical depth. 934.10s - 938.98s | There is a world where you can have no technical skills whatsoever and promote and promote 938.98s - 943.62s | and promote and be the technically best in the world at something and literally not get 943.62s - 946.86s | promoted within the government because you don't meet whatever leadership criteria or 946.86s - 949.06s | whatever other things that they think that you need. 949.06s - 950.06s | Yeah. 950.06s - 952.74s | And the other part of this I've learned is that there is no actual career track to being 952.74s - 959.30s | a software engineer in the military, and that frustrates lots of people from what I've heard. 959.30s - 961.30s | Next is improving hiring and firing speed. 961.30s - 966.78s | It turns out it's hard to fire people in the federal government. 966.78s - 970.46s | And that makes people really uncomfortable about hiring people because you want to make 970.46s - 974.74s | sure that you don't get the wrong person and they get stuck with them for the rest of time. 974.74s - 979.26s | There are things that can be done both within existing law and policy, but also by potentially 979.26s - 983.54s | modifying some existing law and policy to make both of those processes faster, and I 983.54s - 988.58s | think it is essential to compete for tech because I have not met a single outstanding 988.66s - 992.90s | software developer type who is really comfortable with the idea of waiting six to eight months for 992.90s - 993.78s | their final job offer. 995.38s - 996.98s | Oh, and I'm supposed to do the next one, too. 996.98s - 1000.26s | Aligning and setting priorities, that just comes back to, look, if you say that failing 1000.26s - 1004.10s | fast and iterating and all of those things is important, then you need to also make that 1004.90s - 1008.66s | what gets you promoted, not something that is a risk that you take that actually affects 1008.66s - 1009.46s | your career. 1009.46s - 1009.78s | Yeah. 1009.78s - 1013.38s | And in automating a lot of that compliance documentation, we need to find ways to produce 1013.38s


chunk_text:
for the rest of time. 974.74s - 979.26s | There are things that can be done both within existing law and policy, but also by potentially 979.26s - 983.54s | modifying some existing law and policy to make both of those processes faster, and I 983.54s - 988.58s | think it is essential to compete for tech because I have not met a single outstanding 988.66s - 992.90s | software developer type who is really comfortable with the idea of waiting six to eight months for 992.90s - 993.78s | their final job offer. 995.38s - 996.98s | Oh, and I'm supposed to do the next one, too. 996.98s - 1000.26s | Aligning and setting priorities, that just comes back to, look, if you say that failing 1000.26s - 1004.10s | fast and iterating and all of those things is important, then you need to also make that 1004.90s - 1008.66s | what gets you promoted, not something that is a risk that you take that actually affects 1008.66s - 1009.46s | your career. 1009.46s - 1009.78s | Yeah. 1009.78s - 1013.38s | And in automating a lot of that compliance documentation, we need to find ways to produce 1013.38s - 1018.98s | that with policy code, with actual software policy, where people aren't sitting there 1018.98s - 1023.38s | reading NIST manuals forever and then having to write up their implementation by hand every 1023.38s - 1023.94s | time. 1023.94s - 1024.66s | Super frustrating. 1024.66s - 1026.18s | So we need to find ways to automate that. 1027.46s - 1032.18s | Budget and organizational inefficiencies, we kind of think about this as the money and 1032.18s - 1036.58s | the people side of it, and this is a lovely org chart of DoD stuff. 1037.54s - 1042.34s | This is an org chart of DoD cyber, and it illustrates why I think it's so effective. 1042.98s - 1047.78s | So one of the things I learned is I went to an Air Force conference, and the Air Force 1047.78s - 1052.42s | PKI office had a table there in the vendor hall, and I quickly learned that every single 1052.42s - 1058.50s | branch of the DoD has their own PKI audit, I mean, login, authentication, DNS. 1058.50s - 1061.38s | They're providing all of these things, and they're not building them themselves. 1061.38s - 1062.66s | A


chunk_text:
- 1018.98s | that with policy code, with actual software policy, where people aren't sitting there 1018.98s - 1023.38s | reading NIST manuals forever and then having to write up their implementation by hand every 1023.38s - 1023.94s | time. 1023.94s - 1024.66s | Super frustrating. 1024.66s - 1026.18s | So we need to find ways to automate that. 1027.46s - 1032.18s | Budget and organizational inefficiencies, we kind of think about this as the money and 1032.18s - 1036.58s | the people side of it, and this is a lovely org chart of DoD stuff. 1037.54s - 1042.34s | This is an org chart of DoD cyber, and it illustrates why I think it's so effective. 1042.98s - 1047.78s | So one of the things I learned is I went to an Air Force conference, and the Air Force 1047.78s - 1052.42s | PKI office had a table there in the vendor hall, and I quickly learned that every single 1052.42s - 1058.50s | branch of the DoD has their own PKI audit, I mean, login, authentication, DNS. 1058.50s - 1061.38s | They're providing all of these things, and they're not building them themselves. 1061.38s - 1062.66s | A contractor is building that. 1062.66s - 1066.90s | So some contractor is getting paid to build the same thing six times, the same way to 1066.90s - 1071.46s | solve the same requirements from scratch, and as a taxpayer, that's frustrating. 1072.34s - 1076.10s | I always thought that this was all provided at the DoD service level, and everyone used 1076.10s - 1079.14s | this like any other sort of business organization out there. 1081.06s - 1086.26s | The next one is, so everyone I know who's left the government has a handful of stories 1086.26s - 1089.70s | that they will tell when someone asks them, like, what was your moment when you decided 1089.70s - 1091.14s | that it was time for you to leave the government? 1092.18s - 1096.18s | I have a few, and this is one of mine, and essentially, I like how you're looking at 1096.18s - 1097.62s | me right now, because you know this story. 1098.58s - 1102.98s | Essentially, we tried to do an experiment where we took money that would normally go 1102.98s - 1107.38s | to an acquisition organization, instead we gave it to an operational organization, and


chunk_text:
contractor is building that. 1062.66s - 1066.90s | So some contractor is getting paid to build the same thing six times, the same way to 1066.90s - 1071.46s | solve the same requirements from scratch, and as a taxpayer, that's frustrating. 1072.34s - 1076.10s | I always thought that this was all provided at the DoD service level, and everyone used 1076.10s - 1079.14s | this like any other sort of business organization out there. 1081.06s - 1086.26s | The next one is, so everyone I know who's left the government has a handful of stories 1086.26s - 1089.70s | that they will tell when someone asks them, like, what was your moment when you decided 1089.70s - 1091.14s | that it was time for you to leave the government? 1092.18s - 1096.18s | I have a few, and this is one of mine, and essentially, I like how you're looking at 1096.18s - 1097.62s | me right now, because you know this story. 1098.58s - 1102.98s | Essentially, we tried to do an experiment where we took money that would normally go 1102.98s - 1107.38s | to an acquisition organization, instead we gave it to an operational organization, and 1107.38s - 1113.30s | we got $2 million, we met the customer requirement in six months instead of a year, and we spent 1113.30s - 1117.06s | only $500,000 instead of $2 million, and I was super stoked about this. 1117.06s - 1123.62s | I thought we had made, I thought it was like an unmitigated success, and so we're talking 1123.70s - 1127.86s | about, like, we're trying to use this as an example, and the acquisition people got 1127.86s - 1133.38s | to talk first, and they said, yeah, that experiment was a total failure, and I was, my face did 1133.38s - 1136.74s | this thing in the meeting where it made everyone kind of look at me, because apparently it 1136.74s - 1140.82s | was a facial expression that you're not supposed to make, and I was like, I don't understand, 1140.82s - 1145.06s | like, help me out here, and it was a complete failure, because we had not spent all of the 1145.06s - 1150.10s | money within the timeline expected, and I was pissed, so in case you were wondering, 1150.10s - 1150.82s | I was pissed. 1150.82s - 1153.70s | So what


chunk_text:
1107.38s - 1113.30s | we got $2 million, we met the customer requirement in six months instead of a year, and we spent 1113.30s - 1117.06s | only $500,000 instead of $2 million, and I was super stoked about this. 1117.06s - 1123.62s | I thought we had made, I thought it was like an unmitigated success, and so we're talking 1123.70s - 1127.86s | about, like, we're trying to use this as an example, and the acquisition people got 1127.86s - 1133.38s | to talk first, and they said, yeah, that experiment was a total failure, and I was, my face did 1133.38s - 1136.74s | this thing in the meeting where it made everyone kind of look at me, because apparently it 1136.74s - 1140.82s | was a facial expression that you're not supposed to make, and I was like, I don't understand, 1140.82s - 1145.06s | like, help me out here, and it was a complete failure, because we had not spent all of the 1145.06s - 1150.10s | money within the timeline expected, and I was pissed, so in case you were wondering, 1150.10s - 1150.82s | I was pissed. 1150.82s - 1153.70s | So what causes it? 1153.70s - 1155.78s | One of the things I heard, are there any lawyers in the room? 1158.06s - 1161.58s | Okay, and you don't have to, oh, perfect, yeah, the lawyers in the room are afraid, 1161.58s - 1165.10s | and I understand that, like, don't actually raise your hand, but just listen carefully 1165.10s - 1166.22s | and let this resonate with you. 1166.94s - 1169.74s | One of the things that my clients would say to me that made me want to punch them in the 1169.74s - 1173.98s | face was I do not look good in orange, basically, Rebecca, don't let me go to jail, and when 1173.98s - 1177.18s | they meant it earnestly, I did not want to punch them in the face, but often, like, they 1177.18s - 1181.74s | thought it was funny, and they didn't realize I'd heard it 6,000 times that same day, but 1181.74s - 1185.58s | it is an interesting concept, because there aren't a lot of jobs in the private sector 1185.58s - 1189.50s | where you can literally go to jail if you do your job wrong, but also in good faith. 1190.30s


chunk_text:
causes it? 1153.70s - 1155.78s | One of the things I heard, are there any lawyers in the room? 1158.06s - 1161.58s | Okay, and you don't have to, oh, perfect, yeah, the lawyers in the room are afraid, 1161.58s - 1165.10s | and I understand that, like, don't actually raise your hand, but just listen carefully 1165.10s - 1166.22s | and let this resonate with you. 1166.94s - 1169.74s | One of the things that my clients would say to me that made me want to punch them in the 1169.74s - 1173.98s | face was I do not look good in orange, basically, Rebecca, don't let me go to jail, and when 1173.98s - 1177.18s | they meant it earnestly, I did not want to punch them in the face, but often, like, they 1177.18s - 1181.74s | thought it was funny, and they didn't realize I'd heard it 6,000 times that same day, but 1181.74s - 1185.58s | it is an interesting concept, because there aren't a lot of jobs in the private sector 1185.58s - 1189.50s | where you can literally go to jail if you do your job wrong, but also in good faith. 1190.30s - 1192.70s | That being said, a lot of people don't go to jail for this sort of stuff, but there 1192.70s - 1195.90s | are rules, so the Anti-Deficiency Act is a great example, it is a federal law, it is 1195.90s - 1200.62s | a criminal statute, and it basically says if you accidentally spend money wrong, you 1200.62s - 1204.70s | go to jail, or you could, at least, or be fined, or, like, all sorts of other things, 1204.70s - 1209.50s | so the federal government is full of really scary things that can happen to you if you 1209.50s - 1212.94s | screw up your job, and also it usually doesn't pay enough to take on that level of risk. 1213.82s - 1218.06s | Not invented here, I think this is a pervasive problem, not just in the government, but also 1218.06s - 1221.58s | it's definitely a problem in the government, so it's this idea that, like, look, I don't, 1221.58s - 1225.58s | maybe this other organization is doing it so much better, I don't really care, I don't 1225.58s - 1229.18s | really want to go down that path, we built this,


chunk_text:
- 1192.70s | That being said, a lot of people don't go to jail for this sort of stuff, but there 1192.70s - 1195.90s | are rules, so the Anti-Deficiency Act is a great example, it is a federal law, it is 1195.90s - 1200.62s | a criminal statute, and it basically says if you accidentally spend money wrong, you 1200.62s - 1204.70s | go to jail, or you could, at least, or be fined, or, like, all sorts of other things, 1204.70s - 1209.50s | so the federal government is full of really scary things that can happen to you if you 1209.50s - 1212.94s | screw up your job, and also it usually doesn't pay enough to take on that level of risk. 1213.82s - 1218.06s | Not invented here, I think this is a pervasive problem, not just in the government, but also 1218.06s - 1221.58s | it's definitely a problem in the government, so it's this idea that, like, look, I don't, 1221.58s - 1225.58s | maybe this other organization is doing it so much better, I don't really care, I don't 1225.58s - 1229.18s | really want to go down that path, we built this, we know what it is, we know how it works, 1229.18s - 1231.50s | we've been using it for ten years, we're going to keep doing it. 1232.14s - 1233.98s | The next one is no one ever asks for less. 1233.98s - 1236.46s | This is another thing when I was listening to General Nakastony this morning, he was 1236.46s - 1241.18s | talking about how, like, we need more people, we need more funds, and I felt like he set 1241.18s - 1241.90s | me up for this. 1241.90s - 1246.62s | We actually don't necessarily need more, but also no one's ever going to ask for less, 1246.62s - 1249.10s | so, like, when the Congress rolls through, like, what can we do to help? 1249.10s - 1252.06s | Well, we're going to need more people and more funds, and so we add, and we add, and 1252.06s - 1256.14s | we add, and the government gets bigger and more complex, and then the last one is the 1256.14s - 1259.58s | appropriations bills each year are getting passed later and later and later, which means 1259.58s - 1264.86s | you end up in this situation where


chunk_text:
we know what it is, we know how it works, 1229.18s - 1231.50s | we've been using it for ten years, we're going to keep doing it. 1232.14s - 1233.98s | The next one is no one ever asks for less. 1233.98s - 1236.46s | This is another thing when I was listening to General Nakastony this morning, he was 1236.46s - 1241.18s | talking about how, like, we need more people, we need more funds, and I felt like he set 1241.18s - 1241.90s | me up for this. 1241.90s - 1246.62s | We actually don't necessarily need more, but also no one's ever going to ask for less, 1246.62s - 1249.10s | so, like, when the Congress rolls through, like, what can we do to help? 1249.10s - 1252.06s | Well, we're going to need more people and more funds, and so we add, and we add, and 1252.06s - 1256.14s | we add, and the government gets bigger and more complex, and then the last one is the 1256.14s - 1259.58s | appropriations bills each year are getting passed later and later and later, which means 1259.58s - 1264.86s | you end up in this situation where the money actually shows up, this is just a weird government 1264.86s - 1267.42s | thing because money is weird in the government. 1267.42s - 1271.10s | Like, so the money shows up, and you have three months to spend it because you need 1271.10s - 1274.22s | to spend it three months in advance of the end of the fiscal year, and it's a nightmare 1275.42s - 1277.58s | for so many reasons that you can probably figure out on your own. 1279.34s - 1282.14s | Time is valuable, I think we've got to start speed running this. 1282.86s - 1285.74s | Time is valuable, yes, we're going to move on. 1286.70s - 1292.38s | It took three months to get a three-month contract signed and started, that's the story 1292.38s - 1293.26s | I have there, it was awful. 1294.14s - 1297.66s | Tech talent is expensive, it's real hard to get people to go from making a ton of money 1297.66s - 1301.58s | at a Google or an Amazon and ask them to take a pay cut to come do civil service and work 1301.58s - 1305.26s | for the DOD, they just can't compete. 1305.26s


