# MediaChunks

chunk_text:
examples of transpositions 437.90s - 441.86s | and this goes back, I think it's to the ancient Egyptians. 441.86s - 444.82s | They used to have a stick of a certain size 444.82s - 447.06s | and wrap a leather strap around it, 447.06s - 450.42s | write their message and then unwind it 450.42s - 452.82s | and so it was just a bunch of random letters 452.86s - 455.02s | written out on this big long strip. 455.02s - 456.70s | They would send it to the recipient. 456.70s - 459.10s | He would have to have the same size stick 459.10s - 462.74s | to wrap it back together again and put it back in order. 462.74s - 465.18s | Also something that was used that I learned about 465.18s - 466.70s | in my early days was something 466.70s - 468.66s | that's sort of like a crossword puzzle, 468.66s - 470.82s | but you have a sort of a stencil, 470.82s - 473.14s | a square with certain holes cut out of it. 473.14s - 476.38s | You'd write your message in one letter at a time, 476.38s - 478.58s | rotate it, keep going with your message, 478.58s - 480.14s | rotate it and so on and so forth. 480.14s - 483.10s | When you pull it up, you've got a square 483.10s - 485.22s | filled with letters in a random order 485.22s - 486.82s | that hopefully nobody could figure out 486.82s - 488.22s | how to put it back together. 490.74s - 494.50s | Another example of something that I learned back in my days 494.50s - 497.26s | is something called a substitution cipher play fair 497.26s - 499.90s | where you would put the letters of the alphabet 499.90s - 501.82s | in a five by five square. 502.70s - 504.70s | Of course, we had 26 letters in the alphabet 504.70s - 506.46s | so we had to double up very commonly. 506.46s - 509.02s | It was JK, but it could have been anything else. 510.14s - 512.14s | The first ones were just simply A to Z, 512.14s - 515.06s | but to add a level of complexity, 515.06s - 518.50s | very often you would start using a keyword. 518.50s - 522.18s | Did I do that? 522.18s - 528.46s | Hey, who is this


chunk_text:
with your message, 478.58s - 480.14s | rotate it and so on and so forth. 480.14s - 483.10s | When you pull it up, you've got a square 483.10s - 485.22s | filled with letters in a random order 485.22s - 486.82s | that hopefully nobody could figure out 486.82s - 488.22s | how to put it back together. 490.74s - 494.50s | Another example of something that I learned back in my days 494.50s - 497.26s | is something called a substitution cipher play fair 497.26s - 499.90s | where you would put the letters of the alphabet 499.90s - 501.82s | in a five by five square. 502.70s - 504.70s | Of course, we had 26 letters in the alphabet 504.70s - 506.46s | so we had to double up very commonly. 506.46s - 509.02s | It was JK, but it could have been anything else. 510.14s - 512.14s | The first ones were just simply A to Z, 512.14s - 515.06s | but to add a level of complexity, 515.06s - 518.50s | very often you would start using a keyword. 518.50s - 522.18s | Did I do that? 522.18s - 528.46s | Hey, who is this guy? 530.46s - 532.62s | To add complexity, you'd start with a keyword 532.62s - 535.02s | and write the letters of that word out in the square 535.02s - 537.26s | and then you've used a letter once, 537.26s - 539.98s | you'd fill in the rest of the square with the alphabet. 539.98s - 542.42s | And then the way that you would do the encryption 542.42s - 546.50s | and the decryption was basically create a square 547.34s - 548.62s | with the letter that you wanted to write 548.62s - 553.30s | and then make a square and find out what the cipher is, 553.30s - 555.50s | if that makes sense to you by looking at it. 557.78s - 560.46s | World War II, Navajo, 562.66s - 565.94s | natives were enlisted to be radio operators 565.94s - 567.78s | and code talkers. 567.78s - 570.66s | The Japanese, the enemy never broke the code. 570.66s - 573.34s | They were not only just speaking in their native tongue, 573.34s - 574.62s | which apparently the Japanese 575.02s - 576.90s | had a hard time understanding, 576.90s - 581.90s | but they were using words


chunk_text:
guy? 530.46s - 532.62s | To add complexity, you'd start with a keyword 532.62s - 535.02s | and write the letters of that word out in the square 535.02s - 537.26s | and then you've used a letter once, 537.26s - 539.98s | you'd fill in the rest of the square with the alphabet. 539.98s - 542.42s | And then the way that you would do the encryption 542.42s - 546.50s | and the decryption was basically create a square 547.34s - 548.62s | with the letter that you wanted to write 548.62s - 553.30s | and then make a square and find out what the cipher is, 553.30s - 555.50s | if that makes sense to you by looking at it. 557.78s - 560.46s | World War II, Navajo, 562.66s - 565.94s | natives were enlisted to be radio operators 565.94s - 567.78s | and code talkers. 567.78s - 570.66s | The Japanese, the enemy never broke the code. 570.66s - 573.34s | They were not only just speaking in their native tongue, 573.34s - 574.62s | which apparently the Japanese 575.02s - 576.90s | had a hard time understanding, 576.90s - 581.90s | but they were using words to mean other things. 582.06s - 584.50s | So you can see some examples there, 584.50s - 587.70s | like a battleship was a whale, things like that. 587.70s - 590.22s | Seems intuitive now that that would have made sense, 590.22s - 591.42s | but it worked. 593.22s - 597.10s | Machine encryption started becoming popular in the 30s 597.10s - 600.02s | and most famously in World War II, 600.02s - 601.94s | there was the German Enigma machine. 602.70s - 607.50s | I went to work for the NSA in 1986, 607.50s - 608.94s | was learning about things like this 608.94s - 611.34s | and sort of basic courses that we took 611.34s - 613.90s | to get introduced to the field, 615.02s - 619.06s | mostly to try to bide our time while our clearances, 619.06s - 622.02s | our background investigations were being completed. 622.02s - 625.38s | I learned at that time in 1986 625.38s - 629.02s | that we weren't telling people 629.02s - 630.74s | that the Enigma machine had been broken 630.74s - 631.74s | back in World War II. 632.54s - 633.38s | That was still a secret. 633.38s


chunk_text:
to mean other things. 582.06s - 584.50s | So you can see some examples there, 584.50s - 587.70s | like a battleship was a whale, things like that. 587.70s - 590.22s | Seems intuitive now that that would have made sense, 590.22s - 591.42s | but it worked. 593.22s - 597.10s | Machine encryption started becoming popular in the 30s 597.10s - 600.02s | and most famously in World War II, 600.02s - 601.94s | there was the German Enigma machine. 602.70s - 607.50s | I went to work for the NSA in 1986, 607.50s - 608.94s | was learning about things like this 608.94s - 611.34s | and sort of basic courses that we took 611.34s - 613.90s | to get introduced to the field, 615.02s - 619.06s | mostly to try to bide our time while our clearances, 619.06s - 622.02s | our background investigations were being completed. 622.02s - 625.38s | I learned at that time in 1986 625.38s - 629.02s | that we weren't telling people 629.02s - 630.74s | that the Enigma machine had been broken 630.74s - 631.74s | back in World War II. 632.54s - 633.38s | That was still a secret. 633.38s - 636.38s | It wasn't revealed to the public 636.38s - 640.02s | that the Enigma machine had been broken in World War II, 641.18s - 645.78s | prior to World War II until I think 1987 or 88. 645.78s - 649.90s | The reason being there was still somebody out there 649.90s - 651.06s | that was using it. 652.58s - 657.58s | It was first broken in 1938 by Polish cryptographers 657.70s - 661.38s | and used for 50 years after that. 662.06s - 664.14s | And we kept a secret that we knew how to break it. 664.14s - 666.30s | I don't think there's anything else that we've ever done 666.30s - 669.66s | in terms of secrecy that's held up that long. 671.06s - 674.14s | We being the US, we being NSA types. 675.46s - 679.26s | Some of the radios and equipment that were being used 679.26s - 681.82s | when I was there at NSA back in the 80s and 90s, 681.82s - 683.94s | a lot of these were Vietnam era, 683.94s - 688.22s | but again, it was about communication security. 688.22s - 689.46s | When I first went to


chunk_text:
- 636.38s | It wasn't revealed to the public 636.38s - 640.02s | that the Enigma machine had been broken in World War II, 641.18s - 645.78s | prior to World War II until I think 1987 or 88. 645.78s - 649.90s | The reason being there was still somebody out there 649.90s - 651.06s | that was using it. 652.58s - 657.58s | It was first broken in 1938 by Polish cryptographers 657.70s - 661.38s | and used for 50 years after that. 662.06s - 664.14s | And we kept a secret that we knew how to break it. 664.14s - 666.30s | I don't think there's anything else that we've ever done 666.30s - 669.66s | in terms of secrecy that's held up that long. 671.06s - 674.14s | We being the US, we being NSA types. 675.46s - 679.26s | Some of the radios and equipment that were being used 679.26s - 681.82s | when I was there at NSA back in the 80s and 90s, 681.82s - 683.94s | a lot of these were Vietnam era, 683.94s - 688.22s | but again, it was about communication security. 688.22s - 689.46s | When I first went to work 689.46s - 691.58s | for the defensive side of operations, 691.58s - 694.42s | it was called ComSec, communication security. 694.42s - 698.14s | Shortly after that, it was renamed to information security. 698.14s - 699.82s | So we called it InfoSec. 702.97s - 704.25s | But some of these radios, 704.25s - 706.81s | initially they would take an analog signal 706.81s - 709.97s | and they would apply an encryption algorithm, 709.97s - 712.25s | usually built into a little black box 712.25s - 714.41s | because that's what NSA built in those days 714.41s - 716.61s | with key being applied to it. 716.61s - 718.61s | So there was encryption involved 718.61s - 720.53s | and then a receiver on the other end 721.25s - 723.37s | that could reverse the process. 723.37s - 726.45s | Later on, there was radios and devices 726.45s - 729.53s | that would convert the analog signal to digital 729.53s - 731.93s | and then do the encryption of the digits, 731.93s - 735.37s | send it and then do the whole process in reverse. 737.33s - 739.17s | These are just different examples. 740.65s - 744.41s | One


chunk_text:
work 689.46s - 691.58s | for the defensive side of operations, 691.58s - 694.42s | it was called ComSec, communication security. 694.42s - 698.14s | Shortly after that, it was renamed to information security. 698.14s - 699.82s | So we called it InfoSec. 702.97s - 704.25s | But some of these radios, 704.25s - 706.81s | initially they would take an analog signal 706.81s - 709.97s | and they would apply an encryption algorithm, 709.97s - 712.25s | usually built into a little black box 712.25s - 714.41s | because that's what NSA built in those days 714.41s - 716.61s | with key being applied to it. 716.61s - 718.61s | So there was encryption involved 718.61s - 720.53s | and then a receiver on the other end 721.25s - 723.37s | that could reverse the process. 723.37s - 726.45s | Later on, there was radios and devices 726.45s - 729.53s | that would convert the analog signal to digital 729.53s - 731.93s | and then do the encryption of the digits, 731.93s - 735.37s | send it and then do the whole process in reverse. 737.33s - 739.17s | These are just different examples. 740.65s - 744.41s | One other way to try to defeat the enemy from, 744.41s - 747.53s | or adversary from intercepting the signal 747.53s - 749.05s | was not only encrypting it, 749.05s - 751.53s | but trying to hide it across frequencies. 751.53s - 752.93s | So send a little bit here, 752.93s - 755.73s | then using some sort of random algorithm 755.73s - 757.77s | that was predictable on both sides, 757.77s - 759.61s | send more and more of the signal 759.61s - 761.81s | just on different frequencies. 761.81s - 763.05s | Interestingly enough, 763.05s - 768.05s | that concept was invented 768.05s - 772.09s | by Hedy Lamarr, a movie actress from the 1920s. 773.97s - 775.61s | That's just a shout out to women. 775.61s - 777.45s | We need more women in industry 777.49s - 782.06s | because they're smarter than us men very often. 782.06s - 784.62s | As the systems advanced, 784.62s - 787.62s | keys needed to be more complex and longer 787.62s - 790.58s | and keys needed to be changed frequently. 790.58s - 793.02s | And when you were putting it into a little black box, 793.02s - 795.54s | you


chunk_text:
other way to try to defeat the enemy from, 744.41s - 747.53s | or adversary from intercepting the signal 747.53s - 749.05s | was not only encrypting it, 749.05s - 751.53s | but trying to hide it across frequencies. 751.53s - 752.93s | So send a little bit here, 752.93s - 755.73s | then using some sort of random algorithm 755.73s - 757.77s | that was predictable on both sides, 757.77s - 759.61s | send more and more of the signal 759.61s - 761.81s | just on different frequencies. 761.81s - 763.05s | Interestingly enough, 763.05s - 768.05s | that concept was invented 768.05s - 772.09s | by Hedy Lamarr, a movie actress from the 1920s. 773.97s - 775.61s | That's just a shout out to women. 775.61s - 777.45s | We need more women in industry 777.49s - 782.06s | because they're smarter than us men very often. 782.06s - 784.62s | As the systems advanced, 784.62s - 787.62s | keys needed to be more complex and longer 787.62s - 790.58s | and keys needed to be changed frequently. 790.58s - 793.02s | And when you were putting it into a little black box, 793.02s - 795.54s | you needed to have key machines 795.54s - 797.54s | that inject the keys. 797.54s - 801.06s | So these are some examples of key injectors. 802.86s - 805.86s | This was something that was trying to be popular. 806.86s - 809.78s | Again, when I was at NSA in the late 80s, 809.78s - 811.86s | sort of trying to get modern. 811.86s - 814.38s | So they had a little thing called a KL-43 814.38s - 816.90s | that had a keyboard and had a little LCD screen 816.90s - 819.62s | that I think held, you could see 32 digits. 819.62s - 822.06s | And the idea was you type in a message 822.06s - 824.98s | and it would immediately be encrypted on the screen. 824.98s - 827.14s | Usually it would be output to, 828.26s - 830.94s | gosh, we didn't have thumb drives back then. 830.94s - 833.02s | It would either be transmitted automatically 833.10s - 836.02s | or be printed out on paper for distribution. 836.02s - 839.26s | But the idea was this was high tech, 839.26s - 842.22s | self-contained encryption system 842.22s - 843.90s | rather than a little black


chunk_text:
needed to have key machines 795.54s - 797.54s | that inject the keys. 797.54s - 801.06s | So these are some examples of key injectors. 802.86s - 805.86s | This was something that was trying to be popular. 806.86s - 809.78s | Again, when I was at NSA in the late 80s, 809.78s - 811.86s | sort of trying to get modern. 811.86s - 814.38s | So they had a little thing called a KL-43 814.38s - 816.90s | that had a keyboard and had a little LCD screen 816.90s - 819.62s | that I think held, you could see 32 digits. 819.62s - 822.06s | And the idea was you type in a message 822.06s - 824.98s | and it would immediately be encrypted on the screen. 824.98s - 827.14s | Usually it would be output to, 828.26s - 830.94s | gosh, we didn't have thumb drives back then. 830.94s - 833.02s | It would either be transmitted automatically 833.10s - 836.02s | or be printed out on paper for distribution. 836.02s - 839.26s | But the idea was this was high tech, 839.26s - 842.22s | self-contained encryption system 842.22s - 843.90s | rather than a little black box 843.90s - 847.02s | or a little black inside of a radio or a phone 847.02s - 849.30s | or a little black box that the radio or phone 849.30s - 850.42s | was attached to. 853.22s - 856.38s | Stu-3 telephone was what we were using at the time. 856.38s - 860.22s | So it was one of the first times that NSA put out 860.22s - 862.42s | for bid to a contractor 863.26s - 866.94s | an idea of, you know, NSA came up with the specs, 866.94s - 870.94s | but different contractors bid on the idea 870.94s - 872.98s | of how to make a secure phone. 873.94s - 875.50s | These secure phones were starting 875.50s - 877.38s | to use public key cryptography 877.38s - 880.62s | and the keys were seeded with these things 880.62s - 883.18s | that looked like keys, but you had to stick it in, 883.18s - 886.30s | turn it, have it, read it and set it up. 886.30s - 889.54s | And the first ones were half duplex, 889.54s - 891.42s | which means kind of like a walkie talkie. 891.42s - 894.78s | It's


chunk_text:
box 843.90s - 847.02s | or a little black inside of a radio or a phone 847.02s - 849.30s | or a little black box that the radio or phone 849.30s - 850.42s | was attached to. 853.22s - 856.38s | Stu-3 telephone was what we were using at the time. 856.38s - 860.22s | So it was one of the first times that NSA put out 860.22s - 862.42s | for bid to a contractor 863.26s - 866.94s | an idea of, you know, NSA came up with the specs, 866.94s - 870.94s | but different contractors bid on the idea 870.94s - 872.98s | of how to make a secure phone. 873.94s - 875.50s | These secure phones were starting 875.50s - 877.38s | to use public key cryptography 877.38s - 880.62s | and the keys were seeded with these things 880.62s - 883.18s | that looked like keys, but you had to stick it in, 883.18s - 886.30s | turn it, have it, read it and set it up. 886.30s - 889.54s | And the first ones were half duplex, 889.54s - 891.42s | which means kind of like a walkie talkie. 891.42s - 894.78s | It's pushed to talk, one way communication, 894.78s - 897.66s | then you let go and then the other person would talk back. 897.66s - 901.82s | On a telephone, that was often very difficult. 901.82s - 903.70s | And because of the encryption, 904.86s - 906.50s | when you used it, you kind of sounded, 906.50s - 908.10s | the people on the other end kind of sounded 908.10s - 913.10s | like Donald Duck, but it was modern technology at the time. 913.82s - 915.34s | And eventually they were able to put it 915.34s - 919.54s | into smartphones, cell phones, so it became more portable. 921.70s - 924.02s | Very briefly, you know, now we're in the age 924.02s - 926.62s | of digital cryptography, things have evolved. 928.86s - 931.34s | We all use cryptography every day 931.34s - 933.42s | in our lives on the internet. 933.42s - 936.46s | And there's probably a lot of you guys know this, 936.46s - 939.22s | but there's basically two forms of encryption. 939.22s - 942.30s | There's symmetric encryption where it's the same key used 942.30s - 945.22s | on either end of the communication. 945.22s


chunk_text:
pushed to talk, one way communication, 894.78s - 897.66s | then you let go and then the other person would talk back. 897.66s - 901.82s | On a telephone, that was often very difficult. 901.82s - 903.70s | And because of the encryption, 904.86s - 906.50s | when you used it, you kind of sounded, 906.50s - 908.10s | the people on the other end kind of sounded 908.10s - 913.10s | like Donald Duck, but it was modern technology at the time. 913.82s - 915.34s | And eventually they were able to put it 915.34s - 919.54s | into smartphones, cell phones, so it became more portable. 921.70s - 924.02s | Very briefly, you know, now we're in the age 924.02s - 926.62s | of digital cryptography, things have evolved. 928.86s - 931.34s | We all use cryptography every day 931.34s - 933.42s | in our lives on the internet. 933.42s - 936.46s | And there's probably a lot of you guys know this, 936.46s - 939.22s | but there's basically two forms of encryption. 939.22s - 942.30s | There's symmetric encryption where it's the same key used 942.30s - 945.22s | on either end of the communication. 945.22s - 947.78s | And the communication these days are websites 947.78s - 948.98s | and so on and so forth. 949.46s - 953.58s | And then the other type public key cryptography 953.58s - 956.66s | is the idea of key pairs where it's a one way, 956.66s - 959.02s | there's a public and a private key. 959.02s - 962.22s | I hold my private key and give you my public key. 962.22s - 964.54s | And I give all of you my public key 964.54s - 966.02s | because you can encrypt a message 966.02s - 969.50s | that I can only decrypt with my private key. 969.50s - 971.98s | But for me to talk back to you, 971.98s - 975.66s | I've got to get your public key and I can write a message 975.66s - 977.78s | and send it to you and you're the only one 977.78s - 978.82s | that can decrypt it. 979.66s - 981.74s | Very simplified view. 981.74s - 984.18s | There is a third form up in Canada 984.18s - 986.70s | and it's called symmetric A encryption. 987.78s - 988.62s | That was a joke. 990.26s - 994.06s


chunk_text:
- 947.78s | And the communication these days are websites 947.78s - 948.98s | and so on and so forth. 949.46s - 953.58s | And then the other type public key cryptography 953.58s - 956.66s | is the idea of key pairs where it's a one way, 956.66s - 959.02s | there's a public and a private key. 959.02s - 962.22s | I hold my private key and give you my public key. 962.22s - 964.54s | And I give all of you my public key 964.54s - 966.02s | because you can encrypt a message 966.02s - 969.50s | that I can only decrypt with my private key. 969.50s - 971.98s | But for me to talk back to you, 971.98s - 975.66s | I've got to get your public key and I can write a message 975.66s - 977.78s | and send it to you and you're the only one 977.78s - 978.82s | that can decrypt it. 979.66s - 981.74s | Very simplified view. 981.74s - 984.18s | There is a third form up in Canada 984.18s - 986.70s | and it's called symmetric A encryption. 987.78s - 988.62s | That was a joke. 990.26s - 994.06s | Whitfield Diffie, he was affiliated with NSA 994.06s - 996.14s | often on Diffie-Hellman algorithm. 996.14s - 999.10s | I actually took a course with him early on at NSA. 999.10s - 1002.22s | That's why I kind of threw his picture up there. 1002.22s - 1003.50s | And then you got the modern age 1003.50s - 1005.74s | and all the fun stuff coming like with quantum. 1005.74s - 1008.58s | I don't wanna say that much about quantum cryptography. 1009.54s - 1011.10s | The other big thing that's popular, 1011.10s - 1012.42s | I just saw it earlier in the week. 1012.42s - 1014.54s | I was down at that other conference 1014.54s - 1016.30s | that we don't mention around here, 1016.30s - 1018.58s | but the idea of homomorphic encryption, 1018.58s - 1020.18s | which really rubs me the wrong way 1020.18s - 1022.06s | because I spent my entire career 1022.06s - 1023.58s | and learned about all the different ways 1023.58s - 1026.82s | that we protect data, protect data, encrypt data, 1026.82s - 1029.74s | with the idea that we're keeping things a secret. 1029.74s - 1032.18s | But people are coming


chunk_text:
| Whitfield Diffie, he was affiliated with NSA 994.06s - 996.14s | often on Diffie-Hellman algorithm. 996.14s - 999.10s | I actually took a course with him early on at NSA. 999.10s - 1002.22s | That's why I kind of threw his picture up there. 1002.22s - 1003.50s | And then you got the modern age 1003.50s - 1005.74s | and all the fun stuff coming like with quantum. 1005.74s - 1008.58s | I don't wanna say that much about quantum cryptography. 1009.54s - 1011.10s | The other big thing that's popular, 1011.10s - 1012.42s | I just saw it earlier in the week. 1012.42s - 1014.54s | I was down at that other conference 1014.54s - 1016.30s | that we don't mention around here, 1016.30s - 1018.58s | but the idea of homomorphic encryption, 1018.58s - 1020.18s | which really rubs me the wrong way 1020.18s - 1022.06s | because I spent my entire career 1022.06s - 1023.58s | and learned about all the different ways 1023.58s - 1026.82s | that we protect data, protect data, encrypt data, 1026.82s - 1029.74s | with the idea that we're keeping things a secret. 1029.74s - 1032.18s | But people are coming up with ways 1032.18s - 1034.50s | of being able to encrypt data, 1034.50s - 1037.46s | but still get meaningful information out of it. 1037.46s - 1039.94s | I don't get my head wrapped around that very well. 1039.94s - 1043.38s | I kind of think that, okay, it's neat technology. 1043.38s - 1044.78s | It's a neat idea. 1044.78s - 1046.66s | Just don't call it encryption, 1046.66s - 1050.14s | but I'm losing that battle as many other battles. 1051.42s - 1054.50s | Just in terms of why I kind of put this talk together, 1056.30s - 1057.26s | several months ago, 1057.26s - 1059.74s | I do a podcast called Paul's Security Weekly. 1059.74s - 1061.82s | And gosh, it was probably a year ago. 1061.82s - 1063.50s | We were talking to somebody 1063.50s - 1066.06s | and somebody in the chat, 1066.06s - 1067.98s | when we used to broadcast live, 1067.98s - 1070.50s | was saying something about encryption and encoding. 1070.50s - 1072.46s | And I'm like, you know, those are two different things. 1072.46s - 1074.10s | And he's like, well, no, they're interchangeable. 1074.10s - 1077.90s | So I like


chunk_text:
up with ways 1032.18s - 1034.50s | of being able to encrypt data, 1034.50s - 1037.46s | but still get meaningful information out of it. 1037.46s - 1039.94s | I don't get my head wrapped around that very well. 1039.94s - 1043.38s | I kind of think that, okay, it's neat technology. 1043.38s - 1044.78s | It's a neat idea. 1044.78s - 1046.66s | Just don't call it encryption, 1046.66s - 1050.14s | but I'm losing that battle as many other battles. 1051.42s - 1054.50s | Just in terms of why I kind of put this talk together, 1056.30s - 1057.26s | several months ago, 1057.26s - 1059.74s | I do a podcast called Paul's Security Weekly. 1059.74s - 1061.82s | And gosh, it was probably a year ago. 1061.82s - 1063.50s | We were talking to somebody 1063.50s - 1066.06s | and somebody in the chat, 1066.06s - 1067.98s | when we used to broadcast live, 1067.98s - 1070.50s | was saying something about encryption and encoding. 1070.50s - 1072.46s | And I'm like, you know, those are two different things. 1072.46s - 1074.10s | And he's like, well, no, they're interchangeable. 1074.10s - 1077.90s | So I like went out to Google the meaning of the words. 1077.90s - 1080.66s | And I went, I found on Wikipedia, 1080.66s - 1084.82s | the definition here and I'm reading through it. 1084.82s - 1088.22s | And I'm gonna have to stick to my laptop here for a minute. 1089.54s - 1091.26s | It says, well, you can read it, 1091.26s - 1092.86s | but it uses encryption saying 1092.86s - 1095.10s | it's the process of encoding. 1095.10s - 1100.10s | And later on, it talks about cipher text, plain text. 1101.54s - 1104.58s | But this has always been kind of a beef with me 1104.58s - 1107.06s | because there's codes and there's ciphers. 1107.06s - 1109.74s | And encoding is something you do with code. 1109.74s - 1112.18s | And then ciphering is something you do with ciphers. 1112.18s - 1114.10s | They're two different things, 1114.10s - 1116.46s | but they're very often used interchangeably, 1117.30s - 1119.86s | which bothers me because I'm a purist. 1119.86s - 1122.66s | Another thing I found was another definition 1122.66s - 1125.18s | and they talked to, oops, sorry. 1125.18s - 1128.50s | They talked about secret


chunk_text:
went out to Google the meaning of the words. 1077.90s - 1080.66s | And I went, I found on Wikipedia, 1080.66s - 1084.82s | the definition here and I'm reading through it. 1084.82s - 1088.22s | And I'm gonna have to stick to my laptop here for a minute. 1089.54s - 1091.26s | It says, well, you can read it, 1091.26s - 1092.86s | but it uses encryption saying 1092.86s - 1095.10s | it's the process of encoding. 1095.10s - 1100.10s | And later on, it talks about cipher text, plain text. 1101.54s - 1104.58s | But this has always been kind of a beef with me 1104.58s - 1107.06s | because there's codes and there's ciphers. 1107.06s - 1109.74s | And encoding is something you do with code. 1109.74s - 1112.18s | And then ciphering is something you do with ciphers. 1112.18s - 1114.10s | They're two different things, 1114.10s - 1116.46s | but they're very often used interchangeably, 1117.30s - 1119.86s | which bothers me because I'm a purist. 1119.86s - 1122.66s | Another thing I found was another definition 1122.66s - 1125.18s | and they talked to, oops, sorry. 1125.18s - 1128.50s | They talked about secret codes 1128.50s - 1130.78s | and there's talking about coding and decoding 1130.78s - 1132.86s | and that's how you get ciphers. 1132.86s - 1134.54s | That's not technically accurate. 1136.42s - 1138.38s | If you remember, I shared this earlier. 1140.50s - 1143.90s | This is sort of the summary of what codes and ciphers are. 1143.90s - 1145.58s | And I kind of wanted to set out 1145.58s - 1147.74s | and try to give some information 1147.74s - 1150.62s | about why I say these words are wrong. 1150.62s - 1153.14s | And the CFP that I submitted, 1153.14s - 1156.18s | they gave me feedback that this was sounding subjective 1156.18s - 1158.58s | and opinion-based, but it's actually not. 1159.62s - 1162.50s | I have sort of the Bibles of cryptography. 1162.50s - 1164.62s | They're just declassified at some point. 1164.62s - 1166.22s | I was allowed to keep my copies 1166.22s - 1170.58s | of military cryptanalytics volumes one and two 1170.58s - 1173.70s | or part one and two written by gentlemen 1173.70s - 1176.14s | that were very highly respected cryptographers 1176.14s - 1178.90s | before World War II sort of


chunk_text:
codes 1128.50s - 1130.78s | and there's talking about coding and decoding 1130.78s - 1132.86s | and that's how you get ciphers. 1132.86s - 1134.54s | That's not technically accurate. 1136.42s - 1138.38s | If you remember, I shared this earlier. 1140.50s - 1143.90s | This is sort of the summary of what codes and ciphers are. 1143.90s - 1145.58s | And I kind of wanted to set out 1145.58s - 1147.74s | and try to give some information 1147.74s - 1150.62s | about why I say these words are wrong. 1150.62s - 1153.14s | And the CFP that I submitted, 1153.14s - 1156.18s | they gave me feedback that this was sounding subjective 1156.18s - 1158.58s | and opinion-based, but it's actually not. 1159.62s - 1162.50s | I have sort of the Bibles of cryptography. 1162.50s - 1164.62s | They're just declassified at some point. 1164.62s - 1166.22s | I was allowed to keep my copies 1166.22s - 1170.58s | of military cryptanalytics volumes one and two 1170.58s - 1173.70s | or part one and two written by gentlemen 1173.70s - 1176.14s | that were very highly respected cryptographers 1176.14s - 1178.90s | before World War II sort of became the pioneers 1178.90s - 1183.90s | in the formation of NSA, Lambros Kalimahos. 1183.98s - 1186.74s | And if you guys have gone to the village 1186.74s - 1188.86s | and you've heard about the Goldbug Award, 1188.86s - 1190.82s | there's also a society at NSA 1190.82s - 1194.18s | of cryptographers called the Dundee Society. 1194.18s - 1196.90s | You can see the explanation of it there. 1196.90s - 1200.18s | But then also the other author was William Friedman. 1200.18s - 1201.10s | Thank you. 1201.10s - 1204.86s | Between he and his wife, Elizabeth Friedman, 1204.86s - 1206.54s | they were sort of responsible. 1206.54s - 1208.46s | They're sort of considered the godfather, 1208.46s - 1210.90s | the godmother of cryptography. 1210.90s - 1212.06s | So these are the authors. 1212.06s - 1213.82s | These guys were the ones breaking the codes 1213.82s - 1215.74s | and ciphers back in World War II. 1216.74s - 1220.48s | So very quickly, the definitions that they wrote 1220.48s - 1224.02s | that are written down are such, 1224.02s - 1226.34s | and hopefully you can see it on the screen there. 1226.34s - 1229.18s | I


chunk_text:
became the pioneers 1178.90s - 1183.90s | in the formation of NSA, Lambros Kalimahos. 1183.98s - 1186.74s | And if you guys have gone to the village 1186.74s - 1188.86s | and you've heard about the Goldbug Award, 1188.86s - 1190.82s | there's also a society at NSA 1190.82s - 1194.18s | of cryptographers called the Dundee Society. 1194.18s - 1196.90s | You can see the explanation of it there. 1196.90s - 1200.18s | But then also the other author was William Friedman. 1200.18s - 1201.10s | Thank you. 1201.10s - 1204.86s | Between he and his wife, Elizabeth Friedman, 1204.86s - 1206.54s | they were sort of responsible. 1206.54s - 1208.46s | They're sort of considered the godfather, 1208.46s - 1210.90s | the godmother of cryptography. 1210.90s - 1212.06s | So these are the authors. 1212.06s - 1213.82s | These guys were the ones breaking the codes 1213.82s - 1215.74s | and ciphers back in World War II. 1216.74s - 1220.48s | So very quickly, the definitions that they wrote 1220.48s - 1224.02s | that are written down are such, 1224.02s - 1226.34s | and hopefully you can see it on the screen there. 1226.34s - 1229.18s | I just wanna highlight a couple of things here 1229.18s - 1231.74s | where, again, it's in writing. 1231.74s - 1235.42s | Ciphers have to do with individual letters. 1235.42s - 1236.98s | I say characters. 1236.98s - 1242.42s | And then the codes have to do with words and phrases. 1242.42s - 1244.66s | Oh, this is something I picked up. 1244.66s - 1247.24s | I was reading, preparing for this this morning, 1247.24s - 1249.30s | and I thought this was kind of interesting. 1249.30s - 1251.14s | I hadn't noticed it before. 1251.14s - 1253.92s | But there's a statement there that simply says 1253.92s - 1255.90s | you do these things, you encrypt things 1255.90s - 1259.42s | and create cryptograms for one of two reasons, 1259.42s - 1262.70s | secrecy and economy or brevity. 1262.70s - 1263.90s | And I thought that was interesting 1263.90s - 1266.54s | because the way I was learning code and cipher, 1266.54s - 1269.30s | especially when we're starting to get into computers 1269.30s - 1272.14s | and internet technology, 1272.14s - 1275.90s | encoding was always considered a way to shrink down, 1275.90s - 1278.50s | compress the data


chunk_text:
just wanna highlight a couple of things here 1229.18s - 1231.74s | where, again, it's in writing. 1231.74s - 1235.42s | Ciphers have to do with individual letters. 1235.42s - 1236.98s | I say characters. 1236.98s - 1242.42s | And then the codes have to do with words and phrases. 1242.42s - 1244.66s | Oh, this is something I picked up. 1244.66s - 1247.24s | I was reading, preparing for this this morning, 1247.24s - 1249.30s | and I thought this was kind of interesting. 1249.30s - 1251.14s | I hadn't noticed it before. 1251.14s - 1253.92s | But there's a statement there that simply says 1253.92s - 1255.90s | you do these things, you encrypt things 1255.90s - 1259.42s | and create cryptograms for one of two reasons, 1259.42s - 1262.70s | secrecy and economy or brevity. 1262.70s - 1263.90s | And I thought that was interesting 1263.90s - 1266.54s | because the way I was learning code and cipher, 1266.54s - 1269.30s | especially when we're starting to get into computers 1269.30s - 1272.14s | and internet technology, 1272.14s - 1275.90s | encoding was always considered a way to shrink down, 1275.90s - 1278.50s | compress the data so it could be sent quicker 1278.50s - 1279.98s | and more easily. 1279.98s - 1283.22s | And we never presumed that it was secure. 1283.22s - 1285.86s | That's what the encryption was for. 1285.86s - 1289.78s | So brevity or speed, coding, 1290.78s - 1294.62s | secrecy, protection of what you're trying to transmit, 1294.62s - 1295.46s | cipher. 1297.66s - 1301.14s | And then finally, just a brief mention here again, 1301.14s - 1303.98s | where they talk about the introduction of key. 1303.98s - 1307.54s | And we know key now most commonly as certificates, 1307.54s - 1310.94s | but key was really any method that was used 1310.94s - 1313.10s | and agreed upon by both sides 1314.46s - 1318.54s | as how you were gonna do the encryption, the protection. 1318.58s - 1322.02s | Nowadays, it's mostly just throwing huge random streams 1322.02s - 1324.06s | that hopefully nobody can figure out 1324.06s - 1326.18s | and giving the random streams to both ends 1326.18s - 1329.38s | to go through a very complex mathematical algorithm. 1329.38s - 1331.18s | That's where we are today. 1331.18s - 1333.82s | But just to summarize in


chunk_text:
so it could be sent quicker 1278.50s - 1279.98s | and more easily. 1279.98s - 1283.22s | And we never presumed that it was secure. 1283.22s - 1285.86s | That's what the encryption was for. 1285.86s - 1289.78s | So brevity or speed, coding, 1290.78s - 1294.62s | secrecy, protection of what you're trying to transmit, 1294.62s - 1295.46s | cipher. 1297.66s - 1301.14s | And then finally, just a brief mention here again, 1301.14s - 1303.98s | where they talk about the introduction of key. 1303.98s - 1307.54s | And we know key now most commonly as certificates, 1307.54s - 1310.94s | but key was really any method that was used 1310.94s - 1313.10s | and agreed upon by both sides 1314.46s - 1318.54s | as how you were gonna do the encryption, the protection. 1318.58s - 1322.02s | Nowadays, it's mostly just throwing huge random streams 1322.02s - 1324.06s | that hopefully nobody can figure out 1324.06s - 1326.18s | and giving the random streams to both ends 1326.18s - 1329.38s | to go through a very complex mathematical algorithm. 1329.38s - 1331.18s | That's where we are today. 1331.18s - 1333.82s | But just to summarize in terms of 1333.82s - 1335.54s | why I think words have meanings 1335.54s - 1337.22s | and why I think we need to understand 1337.22s - 1338.34s | the meanings of the words, 1338.34s - 1341.38s | even in our modern digital context 1341.38s - 1343.10s | is going back to the fundamentals 1343.10s - 1345.94s | of where they came from, codes and ciphers. 1345.94s - 1348.18s | And I would suggest to you that again, 1348.82s - 1350.70s | if you think about codes or encoding 1350.70s - 1354.62s | as just a way to compress and increase speed, 1354.62s - 1356.94s | not necessarily security, 1356.94s - 1358.86s | that's where the cipher and the encryption 1358.86s - 1361.06s | and the big long key streams come in. 1364.47s - 1368.43s | Real briefly, it's all about protection of data, 1368.43s - 1370.11s | information, keeping secrets. 1370.11s - 1371.55s | You probably know about the idea 1371.55s - 1374.39s | of confidential integrity and availability 1374.39s - 1379.31s | and then digital age introduced things like non repudiation. 1379.35s - 1382.35s | We spent most of our time in the digital age 1382.35s - 1384.67s |


chunk_text:
terms of 1333.82s - 1335.54s | why I think words have meanings 1335.54s - 1337.22s | and why I think we need to understand 1337.22s - 1338.34s | the meanings of the words, 1338.34s - 1341.38s | even in our modern digital context 1341.38s - 1343.10s | is going back to the fundamentals 1343.10s - 1345.94s | of where they came from, codes and ciphers. 1345.94s - 1348.18s | And I would suggest to you that again, 1348.82s - 1350.70s | if you think about codes or encoding 1350.70s - 1354.62s | as just a way to compress and increase speed, 1354.62s - 1356.94s | not necessarily security, 1356.94s - 1358.86s | that's where the cipher and the encryption 1358.86s - 1361.06s | and the big long key streams come in. 1364.47s - 1368.43s | Real briefly, it's all about protection of data, 1368.43s - 1370.11s | information, keeping secrets. 1370.11s - 1371.55s | You probably know about the idea 1371.55s - 1374.39s | of confidential integrity and availability 1374.39s - 1379.31s | and then digital age introduced things like non repudiation. 1379.35s - 1382.35s | We spent most of our time in the digital age 1382.35s - 1384.67s | focusing on the confidentiality. 1384.67s - 1386.11s | Nowadays, we're trying to figure out 1386.11s - 1387.83s | how to do the availability 1387.83s - 1391.35s | because of all the ransomware attacks that are out there. 1391.35s - 1393.83s | One last thing that cipher wheel I mentioned, 1394.71s - 1398.03s | it was put on display at the National Cryptologic Museum 1398.03s - 1400.87s | near Fort Meade, Maryland back in April. 1400.87s - 1404.19s | And it's on display through September. 1404.19s - 1407.47s | If you make it to Maryland, it's in a display case. 1407.47s - 1411.19s | There I am looking at it and there's the display. 1411.19s - 1413.47s | If you could probably not read it there, 1413.47s - 1416.31s | but it says Jeff Mann reinvents the wheel. 1417.35s - 1418.55s | So thank you very much.


chunk_text:
focusing on the confidentiality. 1384.67s - 1386.11s | Nowadays, we're trying to figure out 1386.11s - 1387.83s | how to do the availability 1387.83s - 1391.35s | because of all the ransomware attacks that are out there. 1391.35s - 1393.83s | One last thing that cipher wheel I mentioned, 1394.71s - 1398.03s | it was put on display at the National Cryptologic Museum 1398.03s - 1400.87s | near Fort Meade, Maryland back in April. 1400.87s - 1404.19s | And it's on display through September. 1404.19s - 1407.47s | If you make it to Maryland, it's in a display case. 1407.47s - 1411.19s | There I am looking at it and there's the display. 1411.19s - 1413.47s | If you could probably not read it there, 1413.47s - 1416.31s | but it says Jeff Mann reinvents the wheel. 1417.35s - 1418.55s | So thank you very much.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=ocXSZRKmI0I", "title": "DEF CON 32 - Fitness of Physical Red Teamers - Lucas Rooyakkers & Billy Graydon", "description": "Cybersecurity red teams have myriad ways of practicing their skills - from CTFs to certifications - but how do you train for physical red teaming? This talk will focus on leveling up your body - add new abilities to climb, sneak, jump, and become an unstoppable ninja while performing physical penetration tests. We\u2019ll talk about which abilities you need, and how we train ourselves (and our staff) for performing at our peak for physical engagements. This will be complemented by plenty of war stories and lessons learned in the field for what abilities are most worth leveling up in, and comparisons between red teaming before and after our weight loss. We\u2019ll then discuss different exercises and habits that the audience can start doing as soon as in your hotel room to improve your lives and your ability to break into buildings!", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1493, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.02s - 5.82s | This text was transcribed using whisper model: large-v2 So welcome everyone. I'm impressed at the size of the audience who came out, took 5.82s - 9.86s | time out of your hacker talk, hacker con to listen to two of us talk about gym for 9.86s - 16.06s | half an hour. So we're going to end with that and how you can train yourself up 16.06s - 21.66s | but I'll start by talking about why and what specifically we're looking to 21.66s - 26.22s | train towards for physical red teaming. So we're going to talk about hacking 26.22s - 30.50s | physical spaces with the human body, using the human body for things that it 30.50s - 34.22s | might not necessarily be designed to do or meant to do and that the physical 34.22s - 39.14s | spaces we occupy were not or did not contemplate within their security model 39.14s - 42.58s | and then we'll talk about red team fitness and how to train yourself up for 42.58s - 47.70s | it. So brute force and we'll show you a couple fun examples of that and how 47.70s - 51.98s | without even any tools you can get through some locked spaces. Fences, 51.98s - 57.06s | climbing, spelunking, speed, rope work, all of that in order to


chunk_text:
- 9.86s | time out of your hacker talk, hacker con to listen to two of us talk about gym for 9.86s - 16.06s | half an hour. So we're going to end with that and how you can train yourself up 16.06s - 21.66s | but I'll start by talking about why and what specifically we're looking to 21.66s - 26.22s | train towards for physical red teaming. So we're going to talk about hacking 26.22s - 30.50s | physical spaces with the human body, using the human body for things that it 30.50s - 34.22s | might not necessarily be designed to do or meant to do and that the physical 34.22s - 39.14s | spaces we occupy were not or did not contemplate within their security model 39.14s - 42.58s | and then we'll talk about red team fitness and how to train yourself up for 42.58s - 47.70s | it. So brute force and we'll show you a couple fun examples of that and how 47.70s - 51.98s | without even any tools you can get through some locked spaces. Fences, 51.98s - 57.06s | climbing, spelunking, speed, rope work, all of that in order to get from the 57.06s - 62.97s | outside to whatever the crown jewels are. So deformation and latching mechanisms 62.97s - 66.29s | and frames and this is something that we talk about in the physical security 66.29s - 72.09s | village every year in bypass 101. We've got a cool video of it that we're going 72.09s - 77.97s | to be releasing this con as well. Particularly double doors with a pole in 77.97s - 80.53s | between the two of them and we'll see how that works. 80.53s - 85.25s | Lifting heavy garage doors is something you can do as well. So if a building is 85.25s - 91.73s | locked but there's a garage door, oftentimes there's access control on the 91.73s - 96.53s | motor that lifts that up but there's nothing actually to pin it shut and so 96.53s - 101.89s | you just reach down and with sufficient force you can lift the bottom segments 101.89s - 108.49s | of that high enough to roll under and let yourself in. Pulling a door to the 108.49s - 112.93s | side in its frame which will then disengage the latch from the frame


chunk_text:
get from the 57.06s - 62.97s | outside to whatever the crown jewels are. So deformation and latching mechanisms 62.97s - 66.29s | and frames and this is something that we talk about in the physical security 66.29s - 72.09s | village every year in bypass 101. We've got a cool video of it that we're going 72.09s - 77.97s | to be releasing this con as well. Particularly double doors with a pole in 77.97s - 80.53s | between the two of them and we'll see how that works. 80.53s - 85.25s | Lifting heavy garage doors is something you can do as well. So if a building is 85.25s - 91.73s | locked but there's a garage door, oftentimes there's access control on the 91.73s - 96.53s | motor that lifts that up but there's nothing actually to pin it shut and so 96.53s - 101.89s | you just reach down and with sufficient force you can lift the bottom segments 101.89s - 108.49s | of that high enough to roll under and let yourself in. Pulling a door to the 108.49s - 112.93s | side in its frame which will then disengage the latch from the frame 112.93s - 117.37s | itself and lifting and pulling to unpin double latch doors. So we'll go 117.37s - 122.89s | through all of that. So here here's the the image of what happens when you just 122.89s - 127.49s | take a door like this and pull it hard enough and so you'll see that that post 127.49s - 132.61s | that's between the two double doors actually deforms to the side and the 132.61s - 136.97s | latch then pops in because the door is now deformed and it's able to do that 136.97s - 143.45s | and so just by grabbing the handle and pulling hard enough towards you and 143.45s - 148.61s | using your body weight to support that leverage you can actually force open a 148.61s - 157.29s | lot of commercial doors of this design with no tools whatsoever. When a door has 157.29s - 162.73s | no center mullion and it's pinned at the top and bottom very similar things 162.73s - 167.69s | happen except the door bows out when you pull it and that's actually enough to 167.69s - 172.69s | pop out of the frame and pull the door


chunk_text:
112.93s - 117.37s | itself and lifting and pulling to unpin double latch doors. So we'll go 117.37s - 122.89s | through all of that. So here here's the the image of what happens when you just 122.89s - 127.49s | take a door like this and pull it hard enough and so you'll see that that post 127.49s - 132.61s | that's between the two double doors actually deforms to the side and the 132.61s - 136.97s | latch then pops in because the door is now deformed and it's able to do that 136.97s - 143.45s | and so just by grabbing the handle and pulling hard enough towards you and 143.45s - 148.61s | using your body weight to support that leverage you can actually force open a 148.61s - 157.29s | lot of commercial doors of this design with no tools whatsoever. When a door has 157.29s - 162.73s | no center mullion and it's pinned at the top and bottom very similar things 162.73s - 167.69s | happen except the door bows out when you pull it and that's actually enough to 167.69s - 172.69s | pop out of the frame and pull the door open just by brute force. So this is 172.69s - 176.01s | something that on pest pen testing engagements it's one of the first things 176.01s - 181.01s | we check for is can someone just pull the door hard enough and oftentimes you 181.01s - 187.17s | can and that's that's a big problem because threat model wise anyone can do 187.17s - 190.93s | it and and people do and and we've worked a bunch of cases where that was 190.93s - 196.73s | actually the case and there was a break-in and and that's how they got in. 196.89s - 203.29s | Climbing is another thing so often we'll we'll complain about windows not having 203.29s - 206.11s | adequate locks and they'll say oh well they do on the first floor well the 206.11s - 208.69s | first floor isn't the only thing you have to consider and so when you have 208.69s - 215.05s | this rustication on the on the masonry here that provides a perfect set of 215.05s - 221.01s | hand grips to lift yourself up and get to the second story window. Scaffolding as 221.01s - 225.61s | well so always


chunk_text:
open just by brute force. So this is 172.69s - 176.01s | something that on pest pen testing engagements it's one of the first things 176.01s - 181.01s | we check for is can someone just pull the door hard enough and oftentimes you 181.01s - 187.17s | can and that's that's a big problem because threat model wise anyone can do 187.17s - 190.93s | it and and people do and and we've worked a bunch of cases where that was 190.93s - 196.73s | actually the case and there was a break-in and and that's how they got in. 196.89s - 203.29s | Climbing is another thing so often we'll we'll complain about windows not having 203.29s - 206.11s | adequate locks and they'll say oh well they do on the first floor well the 206.11s - 208.69s | first floor isn't the only thing you have to consider and so when you have 208.69s - 215.05s | this rustication on the on the masonry here that provides a perfect set of 215.05s - 221.01s | hand grips to lift yourself up and get to the second story window. Scaffolding as 221.01s - 225.61s | well so always be considering construction and what's happening in the 225.61s - 230.25s | transitionary stages of a building and you can climb up scaffolding even up to 230.25s - 236.09s | a second window or all the way up to the roof and oftentimes once you're onto the 236.09s - 240.01s | roof you can get back into the building because that door is now in the exit 240.01s - 245.05s | direction as far as the security was considered. False floors of course so 245.05s - 248.57s | secure or so server rooms tend to use false floors to run the cabling under 248.57s - 253.93s | them pop that open slide underneath and and access the server room false 253.93s - 259.41s | ceilings we'll show you a video of that in a moment and and generally getting 259.41s - 262.89s | around the exterior of buildings as a way to get to the interior in 262.89s - 269.93s | unintended ways. So scaffolding as well this was we're we're from up in Canada 269.93s - 274.09s | this was the the 2019 Raptors celebration in Toronto and all 274.09s - 279.21s | scaffolding all around the city was


chunk_text:
be considering construction and what's happening in the 225.61s - 230.25s | transitionary stages of a building and you can climb up scaffolding even up to 230.25s - 236.09s | a second window or all the way up to the roof and oftentimes once you're onto the 236.09s - 240.01s | roof you can get back into the building because that door is now in the exit 240.01s - 245.05s | direction as far as the security was considered. False floors of course so 245.05s - 248.57s | secure or so server rooms tend to use false floors to run the cabling under 248.57s - 253.93s | them pop that open slide underneath and and access the server room false 253.93s - 259.41s | ceilings we'll show you a video of that in a moment and and generally getting 259.41s - 262.89s | around the exterior of buildings as a way to get to the interior in 262.89s - 269.93s | unintended ways. So scaffolding as well this was we're we're from up in Canada 269.93s - 274.09s | this was the the 2019 Raptors celebration in Toronto and all 274.09s - 279.21s | scaffolding all around the city was completely inundated with people and so 279.21s - 283.37s | that's something that's that does happen and of course you've got a whole lot of 283.37s - 287.13s | distractions for the police if someone wanted to break in during an event like 287.13s - 295.01s | this. So false ceilings this is something that you're aware of from a bypass 295.01s - 299.73s | perspective that you need to harden that ceiling that someone can pop the false 299.73s - 303.89s | ceiling out and climb over from a red teamers perspective though if you want 303.89s - 308.17s | to take advantage of that you need to be fit enough to do it and so that involves 308.17s - 313.81s | getting up there moving it out of the way not damaging these relatively 313.81s - 318.37s | delicate thin aluminum ceiling brackets getting yourself up through and over 318.37s - 322.25s | actually being able to fit through whatever holes there and drop down on 322.25s - 327.33s | the other side. So it takes quite a bit of a physical ability that not a lot of 327.33s - 335.49s | people have to do that. And


chunk_text:
completely inundated with people and so 279.21s - 283.37s | that's something that's that does happen and of course you've got a whole lot of 283.37s - 287.13s | distractions for the police if someone wanted to break in during an event like 287.13s - 295.01s | this. So false ceilings this is something that you're aware of from a bypass 295.01s - 299.73s | perspective that you need to harden that ceiling that someone can pop the false 299.73s - 303.89s | ceiling out and climb over from a red teamers perspective though if you want 303.89s - 308.17s | to take advantage of that you need to be fit enough to do it and so that involves 308.17s - 313.81s | getting up there moving it out of the way not damaging these relatively 313.81s - 318.37s | delicate thin aluminum ceiling brackets getting yourself up through and over 318.37s - 322.25s | actually being able to fit through whatever holes there and drop down on 322.25s - 327.33s | the other side. So it takes quite a bit of a physical ability that not a lot of 327.33s - 335.49s | people have to do that. And then just climbing in general so big beefy gate to 336.01s - 340.61s | block out this door but you can climb over it if you're able to do that. 340.61s - 346.01s | Pipe shafts is another thing so we do a lot of assessments of offices that are 346.01s - 350.89s | renting out a space in a high-rise building with other offices and if 350.89s - 356.45s | someone can get to your much less secure downstairs neighbor access a pipe shaft 356.45s - 360.65s | utility shaft elevator shaft whatever it might be from that less secure office 360.65s - 365.13s | they can then climb up to yours pop themselves out in a mechanical room which 365.13s - 370.73s | is deep within the core of your office and have at it from there. But again from 370.73s - 375.09s | a red team perspective in order to take advantage of this you need to be fit 375.09s - 385.55s | enough to squeeze in and scale up. Of course fences as well. Fences I mean we 385.55s - 391.67s | the way over is obvious so we always harp on it that fences keep


chunk_text:
then just climbing in general so big beefy gate to 336.01s - 340.61s | block out this door but you can climb over it if you're able to do that. 340.61s - 346.01s | Pipe shafts is another thing so we do a lot of assessments of offices that are 346.01s - 350.89s | renting out a space in a high-rise building with other offices and if 350.89s - 356.45s | someone can get to your much less secure downstairs neighbor access a pipe shaft 356.45s - 360.65s | utility shaft elevator shaft whatever it might be from that less secure office 360.65s - 365.13s | they can then climb up to yours pop themselves out in a mechanical room which 365.13s - 370.73s | is deep within the core of your office and have at it from there. But again from 370.73s - 375.09s | a red team perspective in order to take advantage of this you need to be fit 375.09s - 385.55s | enough to squeeze in and scale up. Of course fences as well. Fences I mean we 385.55s - 391.67s | the way over is obvious so we always harp on it that fences keep honest 391.67s - 396.59s | people honest there's always a way over. In this case they got the barbed wire 396.59s - 400.71s | right here but what the hell is this pole doing there it completely defeats 400.71s - 404.19s | the purpose of that barbed wire and we'll show you in a minute what what 404.19s - 410.07s | consequence that has. You can often untie the top squeeze the two parts apart and 410.07s - 413.75s | squeeze through or even pull up the bottom wire of the fence which takes 413.75s - 417.55s | some strength to do and you need to be able to fit under it but if you're able 417.55s - 424.47s | to do that that's the way past those. So here's a quick video of that right 424.47s - 429.23s | barbed wire fence but because of that fence post it completely defeats the 429.23s - 432.83s | purpose of that barbed wire. Brace yourself against the fence post don't 432.83s - 436.87s | know why that video didn't finish. Brace yourself against the fence post and 436.87s - 442.91s | climb over bypassing the barbed wire entirely jump down the


chunk_text:
honest 391.67s - 396.59s | people honest there's always a way over. In this case they got the barbed wire 396.59s - 400.71s | right here but what the hell is this pole doing there it completely defeats 400.71s - 404.19s | the purpose of that barbed wire and we'll show you in a minute what what 404.19s - 410.07s | consequence that has. You can often untie the top squeeze the two parts apart and 410.07s - 413.75s | squeeze through or even pull up the bottom wire of the fence which takes 413.75s - 417.55s | some strength to do and you need to be able to fit under it but if you're able 417.55s - 424.47s | to do that that's the way past those. So here's a quick video of that right 424.47s - 429.23s | barbed wire fence but because of that fence post it completely defeats the 429.23s - 432.83s | purpose of that barbed wire. Brace yourself against the fence post don't 432.83s - 436.87s | know why that video didn't finish. Brace yourself against the fence post and 436.87s - 442.91s | climb over bypassing the barbed wire entirely jump down the other side. So 442.91s - 446.95s | that was a two or that was a five second bypass there of this barbed wire fence. 446.95s - 452.87s | And of course if a fence is properly designed it does not have a post you can 452.91s - 458.83s | grab you can throw a thick wool blanket over that and and use the barbed wire to 458.83s - 463.23s | to support yourself that way. So so there's ways around it but you got to be 463.23s - 468.63s | fit enough to do it. Cases like this these are common in garages and retail 468.63s - 473.67s | protection they provide a nice little ladder themselves it's small you got to 473.67s - 478.43s | be able to grab and and get your toes in there but you climb up swing yourself 478.43s - 482.67s | around the top and that's a way in as well but of course you got to be able to 482.67s - 488.47s | climb and you got to be able to fit. And so this is something that I I used to be 488.47s - 492.35s | a hundred pounds fatter and so


chunk_text:
other side. So 442.91s - 446.95s | that was a two or that was a five second bypass there of this barbed wire fence. 446.95s - 452.87s | And of course if a fence is properly designed it does not have a post you can 452.91s - 458.83s | grab you can throw a thick wool blanket over that and and use the barbed wire to 458.83s - 463.23s | to support yourself that way. So so there's ways around it but you got to be 463.23s - 468.63s | fit enough to do it. Cases like this these are common in garages and retail 468.63s - 473.67s | protection they provide a nice little ladder themselves it's small you got to 473.67s - 478.43s | be able to grab and and get your toes in there but you climb up swing yourself 478.43s - 482.67s | around the top and that's a way in as well but of course you got to be able to 482.67s - 488.47s | climb and you got to be able to fit. And so this is something that I I used to be 488.47s - 492.35s | a hundred pounds fatter and so when I was doing red team engagements in that 492.35s - 497.61s | shape we'd find situations with fences that you could pull up there was a gap 497.61s - 501.67s | in the bottom cases where it abutted the wall of a building we could pull it 501.67s - 506.71s | apart and squeeze through or thin gaps like this and and on our team we started 506.71s - 509.91s | calling them fatty filters because everyone else was able to squeeze 509.91s - 515.59s | through and then damn Billy has to find some other way around. So I'm able to get 515.59s - 518.99s | through more of the fatty filters now but that's something as well that often 518.99s - 524.79s | it's just a thin space that you have to squeeze through. An interesting example 524.79s - 527.95s | of this and for those who are not familiar with it I encourage you to look 527.95s - 533.49s | up the 2015 Clinton State Correctional Facility escape. So this was a high 533.49s - 539.27s | profile escape where they used a number of impressive techniques to get out they 539.27s - 543.71s | popped


chunk_text:
when I was doing red team engagements in that 492.35s - 497.61s | shape we'd find situations with fences that you could pull up there was a gap 497.61s - 501.67s | in the bottom cases where it abutted the wall of a building we could pull it 501.67s - 506.71s | apart and squeeze through or thin gaps like this and and on our team we started 506.71s - 509.91s | calling them fatty filters because everyone else was able to squeeze 509.91s - 515.59s | through and then damn Billy has to find some other way around. So I'm able to get 515.59s - 518.99s | through more of the fatty filters now but that's something as well that often 518.99s - 524.79s | it's just a thin space that you have to squeeze through. An interesting example 524.79s - 527.95s | of this and for those who are not familiar with it I encourage you to look 527.95s - 533.49s | up the 2015 Clinton State Correctional Facility escape. So this was a high 533.49s - 539.27s | profile escape where they used a number of impressive techniques to get out they 539.27s - 543.71s | popped through the back of their cell into the pipe chase behind it which 543.71s - 547.43s | supports the plumbing for their toilets and from there climbed down into the 547.43s - 552.31s | steam tunnels below and so those tunnels were at times very tight difficult to 552.31s - 555.31s | squeeze through you've got to be able to lift yourself squeeze yourself and 555.31s - 559.75s | position yourself to get through it. The most impressive part was the escape 559.75s - 563.75s | through the prison wall itself where they waited until July when the steam 563.75s - 568.83s | was turned off and actually cut into the steam pipe and squeezed through the 568.83s - 572.67s | inside of the steam pipe to get through that eight foot thick concrete wall and 572.67s - 578.99s | then from within the steam pipe cut their way out on the other side and and 578.99s - 583.99s | there were two two prisoners that made that escape one of which did most of the 583.99s - 589.15s | manual labor there while the other did some of the social aspects of it but but 589.15s - 592.79s |


chunk_text:
through the back of their cell into the pipe chase behind it which 543.71s - 547.43s | supports the plumbing for their toilets and from there climbed down into the 547.43s - 552.31s | steam tunnels below and so those tunnels were at times very tight difficult to 552.31s - 555.31s | squeeze through you've got to be able to lift yourself squeeze yourself and 555.31s - 559.75s | position yourself to get through it. The most impressive part was the escape 559.75s - 563.75s | through the prison wall itself where they waited until July when the steam 563.75s - 568.83s | was turned off and actually cut into the steam pipe and squeezed through the 568.83s - 572.67s | inside of the steam pipe to get through that eight foot thick concrete wall and 572.67s - 578.99s | then from within the steam pipe cut their way out on the other side and and 578.99s - 583.99s | there were two two prisoners that made that escape one of which did most of the 583.99s - 589.15s | manual labor there while the other did some of the social aspects of it but but 589.15s - 592.79s | the second one was a bit more heavy set and he almost didn't make it just 592.79s - 598.03s | because of the diameter of this pipe. So another thing thing to think about from 598.03s - 601.51s | a threat modeling perspective when you've got high security correctional 601.51s - 606.19s | facilities for people getting out and similar ideas for people getting in. The 606.19s - 611.03s | the US military has standards for the maximum diameter of any utility pipe 611.03s - 614.95s | bypassing a secure perimeter for exactly this reason and so you have to either 614.95s - 618.99s | put reinforced grates across it or split it up into multiple pipes to prevent 618.99s - 624.34s | someone from getting in that way. And then false ceilings as well this one you 624.34s - 630.10s | get a bit of a leg up because we have a roof hatch ladder right on the one side 630.10s - 637.90s | so we're popping up there and instead of going to the hatch climbing out into the 637.90s - 644.40s | attic on the other side and you see there's a lot of utilities a lot


chunk_text:
the second one was a bit more heavy set and he almost didn't make it just 592.79s - 598.03s | because of the diameter of this pipe. So another thing thing to think about from 598.03s - 601.51s | a threat modeling perspective when you've got high security correctional 601.51s - 606.19s | facilities for people getting out and similar ideas for people getting in. The 606.19s - 611.03s | the US military has standards for the maximum diameter of any utility pipe 611.03s - 614.95s | bypassing a secure perimeter for exactly this reason and so you have to either 614.95s - 618.99s | put reinforced grates across it or split it up into multiple pipes to prevent 618.99s - 624.34s | someone from getting in that way. And then false ceilings as well this one you 624.34s - 630.10s | get a bit of a leg up because we have a roof hatch ladder right on the one side 630.10s - 637.90s | so we're popping up there and instead of going to the hatch climbing out into the 637.90s - 644.40s | attic on the other side and you see there's a lot of utilities a lot of 644.40s - 650.28s | sharp things a lot of delicate delicate supports to avoid there pop the ceiling 650.28s - 665.62s | tile out on the secure side of that door and then drop our way down. So there's a 665.62s - 668.46s | whole lot of control you have to have over your body and a whole lot of upper 668.46s - 675.50s | body strength to be able to do that successfully. And so ladders in general 675.50s - 681.22s | you see cages trying to prevent you from climbing them without without unlocking 681.22s - 685.98s | it here sometimes they're badly designed and you can just climb the back and it's 685.98s - 689.50s | still just a ladder but when that's not the case you got to be able to climb 689.50s - 693.06s | that cage which is not particularly difficult to do if you train up for it. 693.06s - 698.51s | And then sometimes it's too far you don't have enough handholds and you can 698.51s - 703.03s | do rope work to get up and down so being able to repel being able to do a 703.03s - 708.43s |


chunk_text:
of 644.40s - 650.28s | sharp things a lot of delicate delicate supports to avoid there pop the ceiling 650.28s - 665.62s | tile out on the secure side of that door and then drop our way down. So there's a 665.62s - 668.46s | whole lot of control you have to have over your body and a whole lot of upper 668.46s - 675.50s | body strength to be able to do that successfully. And so ladders in general 675.50s - 681.22s | you see cages trying to prevent you from climbing them without without unlocking 681.22s - 685.98s | it here sometimes they're badly designed and you can just climb the back and it's 685.98s - 689.50s | still just a ladder but when that's not the case you got to be able to climb 689.50s - 693.06s | that cage which is not particularly difficult to do if you train up for it. 693.06s - 698.51s | And then sometimes it's too far you don't have enough handholds and you can 698.51s - 703.03s | do rope work to get up and down so being able to repel being able to do a 703.03s - 708.43s | rope ascender is something as well that that we can use in various circumstances. 708.43s - 714.47s | And then the last relevant aspect is speed. So it does not matter if you set 714.47s - 719.75s | off every alarm if you're gone by the time security arrives. So a couple 719.75s - 726.03s | examples of that happening these are all all Apple stores that that got robbed in 726.19s - 736.74s | this case 12 seconds. Come in start grabbing things and then run back out 736.74s - 773.06s | and now the employees are catching on. Very similar case 12 seconds $27,000 773.06s - 781.74s | take and so being able to pull that door open get through even if you set off an 781.74s - 786.66s | alarm get to the crown jewels pull them out and make your exfiltration 786.70s - 792.34s | successfully. No guards gonna be able to show up within 12 seconds unless they're 792.34s - 799.98s | already on site and you do see that in most burglaries is there criminals know 799.98s - 804.98s | to be in and out within five minutes if they can do that they're


chunk_text:
rope ascender is something as well that that we can use in various circumstances. 708.43s - 714.47s | And then the last relevant aspect is speed. So it does not matter if you set 714.47s - 719.75s | off every alarm if you're gone by the time security arrives. So a couple 719.75s - 726.03s | examples of that happening these are all all Apple stores that that got robbed in 726.19s - 736.74s | this case 12 seconds. Come in start grabbing things and then run back out 736.74s - 773.06s | and now the employees are catching on. Very similar case 12 seconds $27,000 773.06s - 781.74s | take and so being able to pull that door open get through even if you set off an 781.74s - 786.66s | alarm get to the crown jewels pull them out and make your exfiltration 786.70s - 792.34s | successfully. No guards gonna be able to show up within 12 seconds unless they're 792.34s - 799.98s | already on site and you do see that in most burglaries is there criminals know 799.98s - 804.98s | to be in and out within five minutes if they can do that they're gonna evade any 804.98s - 809.86s | security that might respond to them being there and so being able to do 809.86s - 813.38s | these bypasses do these forcible entries do these climbing whatever you have to 813.38s - 821.18s | do to get in and back out again in a quick period of time is is important. So 821.18s - 824.30s | now I'll hand it over to Lucas who's gonna talk about how you can train 824.30s - 830.22s | yourself up to be capable of all these things. Hi so I'm Lucas and briefly for 830.22s - 833.26s | the second half of this presentation we're going to be going over the health 833.26s - 837.46s | effects of fitness the fundamental movements and movement patterns of the 837.46s - 840.94s | human body and how to do workout planning in order to increase your 840.94s - 845.18s | capacity for red team engagements. So one thing I first want to show you is 845.18s - 848.90s | the math of exercise and why it's an important routine to have or adds to your 848.90s - 856.22s | daily life. Studies often you say that it


chunk_text:
gonna evade any 804.98s - 809.86s | security that might respond to them being there and so being able to do 809.86s - 813.38s | these bypasses do these forcible entries do these climbing whatever you have to 813.38s - 821.18s | do to get in and back out again in a quick period of time is is important. So 821.18s - 824.30s | now I'll hand it over to Lucas who's gonna talk about how you can train 824.30s - 830.22s | yourself up to be capable of all these things. Hi so I'm Lucas and briefly for 830.22s - 833.26s | the second half of this presentation we're going to be going over the health 833.26s - 837.46s | effects of fitness the fundamental movements and movement patterns of the 837.46s - 840.94s | human body and how to do workout planning in order to increase your 840.94s - 845.18s | capacity for red team engagements. So one thing I first want to show you is 845.18s - 848.90s | the math of exercise and why it's an important routine to have or adds to your 848.90s - 856.22s | daily life. Studies often you say that it is recommended to get 75 to 100 or 150 856.22s - 861.70s | minutes this is an hour sorry 150 minutes per week of moderate to intense 861.70s - 866.86s | to severe exercise and if you can do that one minute of exercising at this 866.86s - 870.78s | rate in studies gives you two and a half minutes of additional life so if you 870.78s - 874.70s | subtract out the one minute that you spend exercising let's every second you 874.70s - 878.14s | spend exercising you get or every minute you spend exercising that's an 878.14s - 883.06s | additional 90 minutes of bonus life and you'll be a fit old person as well and 883.06s - 886.46s | it's there I'm not sure about studies that like look at the upper limits of 886.46s - 890.44s | this but it's pretty hard to overdo it unless you're like basically training is 890.44s - 894.42s | like a full-time athlete. So here's the study where I got that math from if 894.42s - 900.78s | anyone wants to note down the DOI. So what is physical fitness? It is an 900.78s - 904.54s | aggregate of


chunk_text:
is recommended to get 75 to 100 or 150 856.22s - 861.70s | minutes this is an hour sorry 150 minutes per week of moderate to intense 861.70s - 866.86s | to severe exercise and if you can do that one minute of exercising at this 866.86s - 870.78s | rate in studies gives you two and a half minutes of additional life so if you 870.78s - 874.70s | subtract out the one minute that you spend exercising let's every second you 874.70s - 878.14s | spend exercising you get or every minute you spend exercising that's an 878.14s - 883.06s | additional 90 minutes of bonus life and you'll be a fit old person as well and 883.06s - 886.46s | it's there I'm not sure about studies that like look at the upper limits of 886.46s - 890.44s | this but it's pretty hard to overdo it unless you're like basically training is 890.44s - 894.42s | like a full-time athlete. So here's the study where I got that math from if 894.42s - 900.78s | anyone wants to note down the DOI. So what is physical fitness? It is an 900.78s - 904.54s | aggregate of several several different diverse metrics including your cardio 904.54s - 910.34s | and aerobic capacity so how long you can run for and do cardio. Pure strength so 910.34s - 915.30s | just how much you can lift even going slow at a slow rate. Power and explosive 915.30s - 919.50s | capacity so how much you can like how high you can jump and how much weight 919.50s - 924.22s | you can push very fast in a short period of time. As well as endurance so how long 924.22s - 929.86s | you can keep doing a certain hard workload for and flexibility. I've got 929.86s - 935.78s | different examples of all those here on the GIFs. So resistance training is a 935.78s - 941.62s | very important part of physical exercise. In the past different Olympians and 941.62s - 944.78s | other sports people would just train specifically for their sport because it 944.78s - 948.06s | was thought okay if I just do running I'll just practice running forever. 948.06s - 952.42s | However it's under the fear that if you spent too much time doing weight 952.46s - 955.66s | training you'd become muscle


chunk_text:
several several different diverse metrics including your cardio 904.54s - 910.34s | and aerobic capacity so how long you can run for and do cardio. Pure strength so 910.34s - 915.30s | just how much you can lift even going slow at a slow rate. Power and explosive 915.30s - 919.50s | capacity so how much you can like how high you can jump and how much weight 919.50s - 924.22s | you can push very fast in a short period of time. As well as endurance so how long 924.22s - 929.86s | you can keep doing a certain hard workload for and flexibility. I've got 929.86s - 935.78s | different examples of all those here on the GIFs. So resistance training is a 935.78s - 941.62s | very important part of physical exercise. In the past different Olympians and 941.62s - 944.78s | other sports people would just train specifically for their sport because it 944.78s - 948.06s | was thought okay if I just do running I'll just practice running forever. 948.06s - 952.42s | However it's under the fear that if you spent too much time doing weight 952.46s - 955.66s | training you'd become muscle bound and too much of an inflexible muscle head 955.66s - 959.58s | who couldn't do anything except for like lift heavy rocks. But most athletes 959.58s - 962.58s | nowadays generally follow a split where they're doing a large amount of 962.58s - 967.14s | resistance training just generic strength training in the gym as well as 967.14s - 970.86s | a small amount of a smaller amount of time dedicated to their sports specific 970.86s - 974.42s | training when they're at higher levels. So because of that a lot of the 974.42s - 978.78s | preparing for the red team physical fitness is just the same as being an 978.78s - 984.02s | athlete which is doing weighted resistance training. So yeah there is no 984.02s - 987.26s | muscle bound syndrome and the more weight you can lift and the more 987.26s - 991.70s | strength training you do that generally increases your flexibility and joint 991.70s - 995.18s | health and many many other things. And versus in the past it was worried that 995.18s - 998.46s | if you became too much like Arnold Schwarzenegger you wouldn't be able to do 998.46s - 1003.06s


chunk_text:
bound and too much of an inflexible muscle head 955.66s - 959.58s | who couldn't do anything except for like lift heavy rocks. But most athletes 959.58s - 962.58s | nowadays generally follow a split where they're doing a large amount of 962.58s - 967.14s | resistance training just generic strength training in the gym as well as 967.14s - 970.86s | a small amount of a smaller amount of time dedicated to their sports specific 970.86s - 974.42s | training when they're at higher levels. So because of that a lot of the 974.42s - 978.78s | preparing for the red team physical fitness is just the same as being an 978.78s - 984.02s | athlete which is doing weighted resistance training. So yeah there is no 984.02s - 987.26s | muscle bound syndrome and the more weight you can lift and the more 987.26s - 991.70s | strength training you do that generally increases your flexibility and joint 991.70s - 995.18s | health and many many other things. And versus in the past it was worried that 995.18s - 998.46s | if you became too much like Arnold Schwarzenegger you wouldn't be able to do 998.46s - 1003.06s | much else. And here's an example of a famous Greek powerlifter named Kyriakos 1003.06s - 1007.30s | Grizzly. This is a 400 pound man who can do the splits. So just demonstrating that 1007.30s - 1013.90s | strength and flexibility and cardio are not orthogonal at all. Now there are 1013.90s - 1018.38s | seven fundamental movements of the human body according to kinesiologists. There's 1018.38s - 1022.70s | push motions so like doing push-ups or the bench press or the overhead press. 1022.70s - 1028.50s | There are pull motions like pull-ups. There's the squat which involves just 1028.50s - 1032.74s | knee bending. And then there's the hip hinge where your knees don't bend at all 1032.74s - 1037.90s | but you just lean over this way so like the deadlift. There's the twist 1037.90s - 1042.70s | clockwise as a fundamental movement and then the tists anti-clockwise. These 1042.70s - 1047.58s | both count as two separate ones. And then the last movement is the farmer's carry 1047.58s - 1051.10s | which to me doesn't seem like a movement. It's just when you're carrying heavy 1051.10s - 1056.66s | weights and walking like this but according


chunk_text:
| much else. And here's an example of a famous Greek powerlifter named Kyriakos 1003.06s - 1007.30s | Grizzly. This is a 400 pound man who can do the splits. So just demonstrating that 1007.30s - 1013.90s | strength and flexibility and cardio are not orthogonal at all. Now there are 1013.90s - 1018.38s | seven fundamental movements of the human body according to kinesiologists. There's 1018.38s - 1022.70s | push motions so like doing push-ups or the bench press or the overhead press. 1022.70s - 1028.50s | There are pull motions like pull-ups. There's the squat which involves just 1028.50s - 1032.74s | knee bending. And then there's the hip hinge where your knees don't bend at all 1032.74s - 1037.90s | but you just lean over this way so like the deadlift. There's the twist 1037.90s - 1042.70s | clockwise as a fundamental movement and then the tists anti-clockwise. These 1042.70s - 1047.58s | both count as two separate ones. And then the last movement is the farmer's carry 1047.58s - 1051.10s | which to me doesn't seem like a movement. It's just when you're carrying heavy 1051.10s - 1056.66s | weights and walking like this but according to kinesiologists it is. So 1056.66s - 1060.42s | traditional strength and resistance training is meant to work these seven 1060.42s - 1065.74s | fundamental movements. So one of the most important ones is the deadlift which is 1065.74s - 1070.38s | just lifting a heavy thing off the ground. It involves a ton of back muscles 1070.38s - 1077.58s | and your entire anterior chain and is mostly a hip hinge motion. Other gym 1077.58s - 1083.66s | movements include, oops, the bench press which is our horizontal pressing motion. 1083.66s - 1092.09s | Oh geez. The barbell row which is a pulling motion. So instead of pushing the 1092.09s - 1098.78s | weight away we're pulling it away or pulling it towards us. The overhead press 1098.78s - 1104.98s | so we have a vertical push motion and this works the shoulders mainly. Oops. And 1104.98s - 1109.50s | then pull-ups which is a vertical pull. So here we've got horizontal push, 1109.50s - 1114.02s | horizontal pull, vertical push, vertical pull, hip hinge, and squat. And if you just 1114.02s - 1119.14s | train just these five exercises this vastly improves your whole body 1119.14s - 1123.10s


chunk_text:
to kinesiologists it is. So 1056.66s - 1060.42s | traditional strength and resistance training is meant to work these seven 1060.42s - 1065.74s | fundamental movements. So one of the most important ones is the deadlift which is 1065.74s - 1070.38s | just lifting a heavy thing off the ground. It involves a ton of back muscles 1070.38s - 1077.58s | and your entire anterior chain and is mostly a hip hinge motion. Other gym 1077.58s - 1083.66s | movements include, oops, the bench press which is our horizontal pressing motion. 1083.66s - 1092.09s | Oh geez. The barbell row which is a pulling motion. So instead of pushing the 1092.09s - 1098.78s | weight away we're pulling it away or pulling it towards us. The overhead press 1098.78s - 1104.98s | so we have a vertical push motion and this works the shoulders mainly. Oops. And 1104.98s - 1109.50s | then pull-ups which is a vertical pull. So here we've got horizontal push, 1109.50s - 1114.02s | horizontal pull, vertical push, vertical pull, hip hinge, and squat. And if you just 1114.02s - 1119.14s | train just these five exercises this vastly improves your whole body 1119.14s - 1123.10s | strength and coordination because all of these movements are compounds that are 1123.10s - 1127.26s | using many many muscle groups. So like you don't just need to go and just do 1127.26s - 1131.22s | bicep curls. In this case doing these heavy compound movements that use many 1131.22s - 1135.10s | many muscles and require a lot of coordination improves your overall joint 1135.10s - 1141.81s | health and strength massively. And one that I'd like to emphasize importantly 1141.81s - 1146.73s | is the deadlift. So the deadlift is basically every time I check and try and 1146.73s - 1149.69s | remove this from my workout routine according to science there's just too 1149.69s - 1153.57s | many positive things it does in such a short period of time. There's basically 1153.57s - 1157.01s | no other exercise that works as many muscles as the deadlift in a shorter 1157.01s - 1162.17s | period of time. And even in the studies where they try out various different 1162.17s - 1167.29s | antidepressants and and and like exercises like running and SSRIs and all 1167.29s - 1170.89s | of these different things that in I've seen various


chunk_text:
| strength and coordination because all of these movements are compounds that are 1123.10s - 1127.26s | using many many muscle groups. So like you don't just need to go and just do 1127.26s - 1131.22s | bicep curls. In this case doing these heavy compound movements that use many 1131.22s - 1135.10s | many muscles and require a lot of coordination improves your overall joint 1135.10s - 1141.81s | health and strength massively. And one that I'd like to emphasize importantly 1141.81s - 1146.73s | is the deadlift. So the deadlift is basically every time I check and try and 1146.73s - 1149.69s | remove this from my workout routine according to science there's just too 1149.69s - 1153.57s | many positive things it does in such a short period of time. There's basically 1153.57s - 1157.01s | no other exercise that works as many muscles as the deadlift in a shorter 1157.01s - 1162.17s | period of time. And even in the studies where they try out various different 1162.17s - 1167.29s | antidepressants and and and like exercises like running and SSRIs and all 1167.29s - 1170.89s | of these different things that in I've seen various studies where the deadlift 1170.89s - 1177.37s | just drastically outperforms every other treatment that was applied. It also fixes 1177.37s - 1181.85s | your grip strength and massively boosts that and your forearm strength. It 1181.85s - 1186.41s | completely fixes your posture because on the back there you have all these spinal 1186.41s - 1189.85s | erectors. So if you're like us and you spend a lot of time at your computer 1189.85s - 1193.61s | with a with like chronically bad posture like this the deadlift forces you to 1193.61s - 1199.37s | snap that up and have a straight back. It's also good for fixing back pain 1199.37s - 1203.73s | despite the fact that it looks like it would snap your lower back if you don't 1203.73s - 1206.45s | learn the movements and how to tighten up and stuff. So it does take a little 1206.45s - 1210.49s | bit to learn the form but there's basically no other single compound 1210.49s - 1214.85s | movement you can do that is effective at fixing everything in your body at once. 1214.85s - 1220.25s | And another one is squatting. I like this article called


chunk_text:
studies where the deadlift 1170.89s - 1177.37s | just drastically outperforms every other treatment that was applied. It also fixes 1177.37s - 1181.85s | your grip strength and massively boosts that and your forearm strength. It 1181.85s - 1186.41s | completely fixes your posture because on the back there you have all these spinal 1186.41s - 1189.85s | erectors. So if you're like us and you spend a lot of time at your computer 1189.85s - 1193.61s | with a with like chronically bad posture like this the deadlift forces you to 1193.61s - 1199.37s | snap that up and have a straight back. It's also good for fixing back pain 1199.37s - 1203.73s | despite the fact that it looks like it would snap your lower back if you don't 1203.73s - 1206.45s | learn the movements and how to tighten up and stuff. So it does take a little 1206.45s - 1210.49s | bit to learn the form but there's basically no other single compound 1210.49s - 1214.85s | movement you can do that is effective at fixing everything in your body at once. 1214.85s - 1220.25s | And another one is squatting. I like this article called squatting is as 1220.25s - 1225.69s | essential as brushing your teeth. So I wanted to read a bit of this. The deep 1225.69s - 1230.89s | squat from a joint hygiene perspective is akin to brushing our teeth. We do not 1230.89s - 1235.37s | simply brush the top one day, the bottom another day, and the side or back 1235.37s - 1238.89s | whenever we feel like it. We brush every angle of our teeth every day. From my 1238.89s - 1242.09s | perspective the deep squat movement is a toothbrush for our joints ensuring 1242.09s - 1245.53s | they're all moving without sticking over restricted areas. And I took this 1245.53s - 1249.21s | stuff a little bit too seriously because whenever I brush my teeth I try to do it 1249.21s - 1255.21s | in a deep squat in order just to multitask. And actually so four 1255.21s - 1259.05s | years ago I actually couldn't get into a deep squat like this. It literally took 1259.05s - 1262.25s | me like several months of practicing. I go down as far as I can without 1262.25s - 1266.13s | compromising my form and it took me


chunk_text:
squatting is as 1220.25s - 1225.69s | essential as brushing your teeth. So I wanted to read a bit of this. The deep 1225.69s - 1230.89s | squat from a joint hygiene perspective is akin to brushing our teeth. We do not 1230.89s - 1235.37s | simply brush the top one day, the bottom another day, and the side or back 1235.37s - 1238.89s | whenever we feel like it. We brush every angle of our teeth every day. From my 1238.89s - 1242.09s | perspective the deep squat movement is a toothbrush for our joints ensuring 1242.09s - 1245.53s | they're all moving without sticking over restricted areas. And I took this 1245.53s - 1249.21s | stuff a little bit too seriously because whenever I brush my teeth I try to do it 1249.21s - 1255.21s | in a deep squat in order just to multitask. And actually so four 1255.21s - 1259.05s | years ago I actually couldn't get into a deep squat like this. It literally took 1259.05s - 1262.25s | me like several months of practicing. I go down as far as I can without 1262.25s - 1266.13s | compromising my form and it took me like two months to even just be able to get 1266.13s - 1269.89s | down here. So don't worry. All you have to do is keep working at it and every day 1269.89s - 1276.33s | trying harder to get into that deep squat. Another aspect is cardio. As 1276.33s - 1281.25s | you saw from the store or the videos of people hitting the Apple stores, it's 1281.25s - 1285.73s | very important to be able to run fast. This can take many forms including 1285.73s - 1290.65s | jogging, bicycling, swimming, dancing, or whatever makes you personally feel the 1290.65s - 1296.09s | most comfortable doing it. This also increases your VO2 max which is how much 1296.09s - 1302.77s | oxygen you can take into your lungs and how efficiently you can use it. One 1302.77s - 1306.57s | aspect of cardio that is beneficial for your health, instead of just doing normal 1306.57s - 1311.09s | steady state cardio and going jogging for a marathon for hours, it's probably 1311.09s - 1315.85s | best for your health scientifically to try and do very intense sprints whenever 1315.85s - 1320.29s | you can. So very high intensity


chunk_text:
like two months to even just be able to get 1266.13s - 1269.89s | down here. So don't worry. All you have to do is keep working at it and every day 1269.89s - 1276.33s | trying harder to get into that deep squat. Another aspect is cardio. As 1276.33s - 1281.25s | you saw from the store or the videos of people hitting the Apple stores, it's 1281.25s - 1285.73s | very important to be able to run fast. This can take many forms including 1285.73s - 1290.65s | jogging, bicycling, swimming, dancing, or whatever makes you personally feel the 1290.65s - 1296.09s | most comfortable doing it. This also increases your VO2 max which is how much 1296.09s - 1302.77s | oxygen you can take into your lungs and how efficiently you can use it. One 1302.77s - 1306.57s | aspect of cardio that is beneficial for your health, instead of just doing normal 1306.57s - 1311.09s | steady state cardio and going jogging for a marathon for hours, it's probably 1311.09s - 1315.85s | best for your health scientifically to try and do very intense sprints whenever 1315.85s - 1320.29s | you can. So very high intensity intervals for 30 seconds and then you rest for a 1320.29s - 1324.33s | minute or two and then do another 30 second all-out sprint. There's a 1324.33s - 1328.73s | bunch of reasons that this levels up your mitochondria which is the 1328.73s - 1337.26s | powerhouse of the cell. So yeah. So that's our general resistance training. The 20% 1337.26s - 1341.78s | specific training that we want to do as Red Teamers basically focuses around 1341.78s - 1346.78s | climbing. So this uses a lot of upper back and being able to do a pull-up is 1346.78s - 1350.46s | is very, very useful for Red Team engagements because most of the exploits 1350.46s - 1356.38s | we're doing involve just climbing over and around things. Climbing works a lot 1356.38s - 1360.02s | of different areas of your body and has a lot of carryover effects to other 1360.02s - 1364.98s | other things. And there are lots of ways you can do this from rock climbing to 1364.98s - 1374.32s | bouldering, pull-ups, and parkour. However one particular item that I'm a fan of is 1374.32s - 1378.84s | kettlebells which if I can only


chunk_text:
intervals for 30 seconds and then you rest for a 1320.29s - 1324.33s | minute or two and then do another 30 second all-out sprint. There's a 1324.33s - 1328.73s | bunch of reasons that this levels up your mitochondria which is the 1328.73s - 1337.26s | powerhouse of the cell. So yeah. So that's our general resistance training. The 20% 1337.26s - 1341.78s | specific training that we want to do as Red Teamers basically focuses around 1341.78s - 1346.78s | climbing. So this uses a lot of upper back and being able to do a pull-up is 1346.78s - 1350.46s | is very, very useful for Red Team engagements because most of the exploits 1350.46s - 1356.38s | we're doing involve just climbing over and around things. Climbing works a lot 1356.38s - 1360.02s | of different areas of your body and has a lot of carryover effects to other 1360.02s - 1364.98s | other things. And there are lots of ways you can do this from rock climbing to 1364.98s - 1374.32s | bouldering, pull-ups, and parkour. However one particular item that I'm a fan of is 1374.32s - 1378.84s | kettlebells which if I can only have one item for the gym it would be the 1379.24s - 1383.08s | kettlebell. This I got really into these during COVID when all the gyms were 1383.08s - 1387.60s | closed because it's just a tiny full comprehensive thing that fits in your 1387.60s - 1392.08s | closet. So like just taking a kettlebell and swinging it up here and catching it 1392.08s - 1396.36s | at the top is a full body movement that uses basically every single muscle in 1396.36s - 1400.24s | your body. So just doing repetition kettlebell snatches for 10 minutes a day 1400.24s - 1403.48s | is a full body workout. You don't need to worry about all these other complicated 1403.48s - 1407.28s | movements. However if you're an ultra minimalist and you're stuck in your 1407.32s - 1411.48s | hotel room for example you can't really go wrong with just burpees and body 1411.48s - 1415.48s | weight squats. These are also just full body exercises that don't use any 1415.48s - 1418.48s | equipment whatsoever that you can do anywhere just if you're in a prison 1418.48s - 1424.32s | cell a hotel room or etc. Going slightly more


chunk_text:
have one item for the gym it would be the 1379.24s - 1383.08s | kettlebell. This I got really into these during COVID when all the gyms were 1383.08s - 1387.60s | closed because it's just a tiny full comprehensive thing that fits in your 1387.60s - 1392.08s | closet. So like just taking a kettlebell and swinging it up here and catching it 1392.08s - 1396.36s | at the top is a full body movement that uses basically every single muscle in 1396.36s - 1400.24s | your body. So just doing repetition kettlebell snatches for 10 minutes a day 1400.24s - 1403.48s | is a full body workout. You don't need to worry about all these other complicated 1403.48s - 1407.28s | movements. However if you're an ultra minimalist and you're stuck in your 1407.32s - 1411.48s | hotel room for example you can't really go wrong with just burpees and body 1411.48s - 1415.48s | weight squats. These are also just full body exercises that don't use any 1415.48s - 1418.48s | equipment whatsoever that you can do anywhere just if you're in a prison 1418.48s - 1424.32s | cell a hotel room or etc. Going slightly more advanced in the calisthenics area 1424.32s - 1428.64s | if you can do dip bars and pull-ups just doing those are also pretty 1428.64s - 1433.00s | comprehensive movements. And if you're feeling very advanced the one-arm push-up 1433.00s - 1437.16s | the one leg squat and handstand push-ups are just like the limit of what you can 1437.16s - 1441.96s | do with just purely your own body weight no equipment required. So a note 1441.96s - 1445.20s | on habit formation if exercise is not already a part of your life and we've 1445.20s - 1449.12s | convinced you that it should be remember that consistency is key so you just need 1449.12s - 1453.04s | to pick something that you want to do whether that's sports resistance 1453.04s - 1457.36s | training just going on daily walks after dinner or dancing or anything else. Only 1457.36s - 1461.52s | an ounce of discipline is required to change your life. In this case most 1461.52s - 1464.64s | people who go to the gym compulsively don't feel impressed that they do it 1464.64s - 1467.32s | they have a habit and it would feel weird for them not


chunk_text:
advanced in the calisthenics area 1424.32s - 1428.64s | if you can do dip bars and pull-ups just doing those are also pretty 1428.64s - 1433.00s | comprehensive movements. And if you're feeling very advanced the one-arm push-up 1433.00s - 1437.16s | the one leg squat and handstand push-ups are just like the limit of what you can 1437.16s - 1441.96s | do with just purely your own body weight no equipment required. So a note 1441.96s - 1445.20s | on habit formation if exercise is not already a part of your life and we've 1445.20s - 1449.12s | convinced you that it should be remember that consistency is key so you just need 1449.12s - 1453.04s | to pick something that you want to do whether that's sports resistance 1453.04s - 1457.36s | training just going on daily walks after dinner or dancing or anything else. Only 1457.36s - 1461.52s | an ounce of discipline is required to change your life. In this case most 1461.52s - 1464.64s | people who go to the gym compulsively don't feel impressed that they do it 1464.64s - 1467.32s | they have a habit and it would feel weird for them not to do it. There was 1467.32s - 1472.88s | only about one brief period of habit formation where they it's sorry where 1472.88s - 1477.68s | they actually need to apply discipline and do something you don't want. So yeah 1477.68s - 1481.96s | the conclusion is try and get your 150 minutes a week of exercise for maximum 1481.96s - 1486.52s | life extension but do whatever is easiest for you to do and maintain 1486.52s - 1491.72s | consistently and discipline is freedom. Thank you.


chunk_text:
to do it. There was 1467.32s - 1472.88s | only about one brief period of habit formation where they it's sorry where 1472.88s - 1477.68s | they actually need to apply discipline and do something you don't want. So yeah 1477.68s - 1481.96s | the conclusion is try and get your 150 minutes a week of exercise for maximum 1481.96s - 1486.52s | life extension but do whatever is easiest for you to do and maintain 1486.52s - 1491.72s | consistently and discipline is freedom. Thank you.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=j7twZA6SBz8", "title": "DEF CON 32 - I am still the Captain now! - Paul Brownridge", "description": "Fresh from his DEFCON 31 marsec village talk, 'I am the Captain now', Paul has another year's experience at sea from which to share stories of taking control of vessels.\n\nAs it's timely, he will look at why the MV Dali incident wasn't a hack, dispelling ill-informed opinions from the wave of armchair experts that suddenly emerged, but more interestingly, ways that it so easily could have been a cyber event.\n\nFinally, maritime cyber regulation is starting to catch up, but so many operators and technology providers are likely to be caught out by IACS UR E26 & 27", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1199, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 4.62s | This text was transcribed using whisper model: large-v2 So good afternoon, everybody. And welcome. This is my amazing 4.62s - 7.42s | in my second talk at DEF CON. It's such a privilege and honor 7.42s - 11.42s | to talk once at DEF CON, but twice. It's just unbelievable. 11.74s - 14.58s | So before I continue, I'd like to thank my colleagues, Kerry 14.58s - 20.42s | Coburn, John Waksmanski, Mike Leonard, Ken, and yeah, the rest 20.42s - 24.38s | of the P2P team that are here helping out. I couldn't have 24.38s - 27.74s | done this presentation without them. So I got to do the 27.74s - 31.36s | obligatory. Who am I? So my name is Paul Brownridge. 31.40s - 35.44s | Obviously, I started my working life as an engineer in Cape Town 35.44s - 40.32s | in South Africa. I have an OT background, then just by a 40.32s - 44.40s | series of accidents, found myself into working in 44.40s - 48.74s | cybersecurity. So I do a lot of OT testing, maritime, IoT, APIs, a 48.74s - 52.00s | lot of interesting stuff. I mean, we do a lot of interesting 52.00s - 55.92s | stuff. So quite topical, probably something that's been 55.92s - 60.34s | talked about maybe five or six times at this conference is the 60.34s - 65.90s | MV Dolly. Is it hacked? Well, there's a lot of lot of opinion 65.90s - 68.26s | on on the internet, right? Everybody's an armchair warrior 68.26s - 71.90s | at the end of the day. They


chunk_text:
John Waksmanski, Mike Leonard, Ken, and yeah, the rest 20.42s - 24.38s | of the P2P team that are here helping out. I couldn't have 24.38s - 27.74s | done this presentation without them. So I got to do the 27.74s - 31.36s | obligatory. Who am I? So my name is Paul Brownridge. 31.40s - 35.44s | Obviously, I started my working life as an engineer in Cape Town 35.44s - 40.32s | in South Africa. I have an OT background, then just by a 40.32s - 44.40s | series of accidents, found myself into working in 44.40s - 48.74s | cybersecurity. So I do a lot of OT testing, maritime, IoT, APIs, a 48.74s - 52.00s | lot of interesting stuff. I mean, we do a lot of interesting 52.00s - 55.92s | stuff. So quite topical, probably something that's been 55.92s - 60.34s | talked about maybe five or six times at this conference is the 60.34s - 65.90s | MV Dolly. Is it hacked? Well, there's a lot of lot of opinion 65.90s - 68.26s | on on the internet, right? Everybody's an armchair warrior 68.26s - 71.90s | at the end of the day. They reckon yes, it was hacked. 71.90s - 75.06s | Definitely. It's deep state, etc. Other people say no, not 75.06s - 78.74s | possible. I think that once you understand how ships are 78.74s - 82.50s | architected, you understand actually that maybe the answer 82.50s - 85.10s | is somewhere in the middle. And what I'm going to be doing is 85.10s - 88.64s | going to be going through the individual systems, examining 88.64s - 92.80s | some of the the attack surface and maybe some of the threat 92.80s - 98.12s | vectors and that. So really sort of like a high level view of the 98.12s - 102.74s | systems on the ship. So to be quite honest, you know, before I 102.74s - 105.08s | came across this picture, I didn't know how much damage the 105.08s - 107.66s | ship actually done, which is quite scary, isn't it? I mean, 107.66s - 111.08s | that is a mess or somebody's not getting getting the bonuses 111.08s - 116.88s | here. And okay, so let's start with the main engines. So the 116.88s - 121.72s | picture that you see over there, that is a


chunk_text:
reckon yes, it was hacked. 71.90s - 75.06s | Definitely. It's deep state, etc. Other people say no, not 75.06s - 78.74s | possible. I think that once you understand how ships are 78.74s - 82.50s | architected, you understand actually that maybe the answer 82.50s - 85.10s | is somewhere in the middle. And what I'm going to be doing is 85.10s - 88.64s | going to be going through the individual systems, examining 88.64s - 92.80s | some of the the attack surface and maybe some of the threat 92.80s - 98.12s | vectors and that. So really sort of like a high level view of the 98.12s - 102.74s | systems on the ship. So to be quite honest, you know, before I 102.74s - 105.08s | came across this picture, I didn't know how much damage the 105.08s - 107.66s | ship actually done, which is quite scary, isn't it? I mean, 107.66s - 111.08s | that is a mess or somebody's not getting getting the bonuses 111.08s - 116.88s | here. And okay, so let's start with the main engines. So the 116.88s - 121.72s | picture that you see over there, that is a typical engine on a 121.72s - 126.48s | container ship. It's one engine. It differs from other engines 126.48s - 129.56s | that you're used to in that it's supported by ancillary system. 129.56s - 134.36s | So there's pumps, for instance, they handle the cooling, the 134.36s - 139.04s | fuel injection, etc. And these are handled by generators in 139.04s - 144.16s | redundant arrays. The generators will power the 144.16s - 147.04s | steering without any power. Obviously, there's no steering. 147.44s - 150.96s | And this is all organized by the power management system. So the 150.96s - 157.48s | PMS that is in turn, managed by a network control system called 157.48s - 160.52s | the integrated alarm and monitoring system. And then you 160.52s - 164.12s | have these multiple systems all over the ship that tie into it 164.16s - 168.84s | by a series of either serial connections, either IP over 168.84s - 174.72s | serial, etc. And we will take a look at those in turn. And of 174.72s - 177.68s | course, we've got the steering controls, right? We have the 177.68s - 182.48s | controls at the helm, tied


chunk_text:
typical engine on a 121.72s - 126.48s | container ship. It's one engine. It differs from other engines 126.48s - 129.56s | that you're used to in that it's supported by ancillary system. 129.56s - 134.36s | So there's pumps, for instance, they handle the cooling, the 134.36s - 139.04s | fuel injection, etc. And these are handled by generators in 139.04s - 144.16s | redundant arrays. The generators will power the 144.16s - 147.04s | steering without any power. Obviously, there's no steering. 147.44s - 150.96s | And this is all organized by the power management system. So the 150.96s - 157.48s | PMS that is in turn, managed by a network control system called 157.48s - 160.52s | the integrated alarm and monitoring system. And then you 160.52s - 164.12s | have these multiple systems all over the ship that tie into it 164.16s - 168.84s | by a series of either serial connections, either IP over 168.84s - 174.72s | serial, etc. And we will take a look at those in turn. And of 174.72s - 177.68s | course, we've got the steering controls, right? We have the 177.68s - 182.48s | controls at the helm, tied into autopilot. And it's important to 182.48s - 185.28s | note that at this time, there is a physical switch that if 185.28s - 189.04s | anything goes wrong, you can turn that off. It's as we go 189.04s - 190.96s | through these slides, it's something to note all the time 190.96s - 194.76s | that is always going to be somebody in charge, which is 194.76s - 198.96s | really important. So there we go the helm, the steering gear, the 198.96s - 202.92s | steering flat, which is basically a deck that you can 202.92s - 206.32s | steer the ship from any emergency situation, you can 206.32s - 210.52s | manually control the ship in case anything goes wrong. All 210.52s - 213.56s | right. Then of course, the systems tie into the rudder. And 213.56s - 215.88s | the steering gear, as I mentioned the previous slide, 216.16s - 221.24s | it's all tied in with the generator. So this is you can 221.24s - 223.12s | see the picture on the left hand side. This is what you see in 223.12s - 225.52s | the movies, right with the telegraph, you know, full steam


chunk_text:
into autopilot. And it's important to 182.48s - 185.28s | note that at this time, there is a physical switch that if 185.28s - 189.04s | anything goes wrong, you can turn that off. It's as we go 189.04s - 190.96s | through these slides, it's something to note all the time 190.96s - 194.76s | that is always going to be somebody in charge, which is 194.76s - 198.96s | really important. So there we go the helm, the steering gear, the 198.96s - 202.92s | steering flat, which is basically a deck that you can 202.92s - 206.32s | steer the ship from any emergency situation, you can 206.32s - 210.52s | manually control the ship in case anything goes wrong. All 210.52s - 213.56s | right. Then of course, the systems tie into the rudder. And 213.56s - 215.88s | the steering gear, as I mentioned the previous slide, 216.16s - 221.24s | it's all tied in with the generator. So this is you can 221.24s - 223.12s | see the picture on the left hand side. This is what you see in 223.12s - 225.52s | the movies, right with the telegraph, you know, full steam 225.52s - 230.20s | ahead. But on the right hand side, this is the more modern 230.20s - 233.64s | derivation of that. It's important to note that a lot of 233.64s - 238.80s | these systems are tied down to certain revs so that it doesn't 238.80s - 242.32s | cause any potentially dangerous vibrations on the ship. Or 243.08s - 246.04s | sometimes it's also economics as well, because a ship will have 246.04s - 251.16s | a most economical, I can say, revolution band, and there'll be 251.16s - 253.60s | tying into that. What's important to note that at any 253.60s - 257.04s | time of this, yet again, the captain can override any of 257.04s - 262.84s | these controls. So if there's a blackout on the ship, like what 262.84s - 265.44s | happened to Emi Dali, right? What are the procedures to 265.44s - 267.92s | restart this? Well, normally, it's as simple as pressing a 267.92s - 270.68s | single button on the screen. But how do we do this when the rest 270.68s - 274.28s | of the ship does not have any power, right? So it could 274.28s - 276.92s


chunk_text:
225.52s - 230.20s | ahead. But on the right hand side, this is the more modern 230.20s - 233.64s | derivation of that. It's important to note that a lot of 233.64s - 238.80s | these systems are tied down to certain revs so that it doesn't 238.80s - 242.32s | cause any potentially dangerous vibrations on the ship. Or 243.08s - 246.04s | sometimes it's also economics as well, because a ship will have 246.04s - 251.16s | a most economical, I can say, revolution band, and there'll be 251.16s - 253.60s | tying into that. What's important to note that at any 253.60s - 257.04s | time of this, yet again, the captain can override any of 257.04s - 262.84s | these controls. So if there's a blackout on the ship, like what 262.84s - 265.44s | happened to Emi Dali, right? What are the procedures to 265.44s - 267.92s | restart this? Well, normally, it's as simple as pressing a 267.92s - 270.68s | single button on the screen. But how do we do this when the rest 270.68s - 274.28s | of the ship does not have any power, right? So it could 274.28s - 276.92s | involve using controls local to the generator start. So you could 276.92s - 280.24s | send your engineers down there, waiting for it to come up to 280.24s - 283.72s | speed, and then closing breakers, for instance. And this 283.72s - 287.80s | is important to note, because it's a process like any OT 287.80s - 291.92s | system, any refinery, any chemical processes, everything 291.92s - 294.92s | works in a sequence. There's no just like one button, bam, it 294.92s - 299.80s | comes on. It's a series of processes. Sometimes you have 299.80s - 302.72s | manual management of the system will need to be performed. As a 302.72s - 305.88s | load is drawn by the ship, this would take 30 seconds normally, 305.88s - 309.92s | but you never know, and it might take several. But according to 309.92s - 314.40s | regulations, your emergency generator should come on 45 314.40s - 318.04s | seconds. But as we all know, in the real world, right, that 318.04s - 321.72s | hardly ever happens. I mean, that's the ideal state. So what 321.72s - 324.92s | could take or is supposed to take 45


chunk_text:
| involve using controls local to the generator start. So you could 276.92s - 280.24s | send your engineers down there, waiting for it to come up to 280.24s - 283.72s | speed, and then closing breakers, for instance. And this 283.72s - 287.80s | is important to note, because it's a process like any OT 287.80s - 291.92s | system, any refinery, any chemical processes, everything 291.92s - 294.92s | works in a sequence. There's no just like one button, bam, it 294.92s - 299.80s | comes on. It's a series of processes. Sometimes you have 299.80s - 302.72s | manual management of the system will need to be performed. As a 302.72s - 305.88s | load is drawn by the ship, this would take 30 seconds normally, 305.88s - 309.92s | but you never know, and it might take several. But according to 309.92s - 314.40s | regulations, your emergency generator should come on 45 314.40s - 318.04s | seconds. But as we all know, in the real world, right, that 318.04s - 321.72s | hardly ever happens. I mean, that's the ideal state. So what 321.72s - 324.92s | could take or is supposed to take 45 seconds could take 324.92s - 330.12s | minutes. And if you are in the open sea, with a blackout, and 330.12s - 333.28s | your ship is coasting, that is not a problem, right? But if 333.28s - 337.36s | you're approaching a bridge or a built up system, just 45 337.40s - 340.28s | seconds or even sometimes if these systems don't start, a 340.28s - 344.40s | minute or two minutes can end in emergency, like we saw in the 344.40s - 349.76s | previous slide. So what triggers a blackout? Well, bad fuel. 349.76s - 352.56s | Yeah, some of the cheapy fuel that you pick up at these ports, 352.56s - 357.20s | right? Ship rolling, some of the heavy seas can cause loss of 357.20s - 361.12s | pressure and cause the ship to blackout. Electrical problems, 361.12s - 365.40s | bad maintenance, etc, etc. It's long. The older the ship, the 365.40s - 370.68s | worse these problems get. And cruise ships do blackout. 2013 370.68s - 375.76s | Carnival Triumph was out of commission for a few days, due 375.76s - 380.08s | to the battery power fail several times. In 2019, the


chunk_text:
seconds could take 324.92s - 330.12s | minutes. And if you are in the open sea, with a blackout, and 330.12s - 333.28s | your ship is coasting, that is not a problem, right? But if 333.28s - 337.36s | you're approaching a bridge or a built up system, just 45 337.40s - 340.28s | seconds or even sometimes if these systems don't start, a 340.28s - 344.40s | minute or two minutes can end in emergency, like we saw in the 344.40s - 349.76s | previous slide. So what triggers a blackout? Well, bad fuel. 349.76s - 352.56s | Yeah, some of the cheapy fuel that you pick up at these ports, 352.56s - 357.20s | right? Ship rolling, some of the heavy seas can cause loss of 357.20s - 361.12s | pressure and cause the ship to blackout. Electrical problems, 361.12s - 365.40s | bad maintenance, etc, etc. It's long. The older the ship, the 365.40s - 370.68s | worse these problems get. And cruise ships do blackout. 2013 370.68s - 375.76s | Carnival Triumph was out of commission for a few days, due 375.76s - 380.08s | to the battery power fail several times. In 2019, the 380.08s - 384.24s | Viking Sky generator was out for service maintenance. Yet again, 384.24s - 386.76s | we see this. So it's totally possible that these 386.76s - 392.60s | circumstances can exist, that a ship can blackout. So like I 392.60s - 396.56s | said, you know, all the armchair warriors on the internet saying 397.32s - 401.76s | it was a hack. Well, we'll see. So let's take a look at the 401.76s - 407.76s | autopilot. So as we go, as we saw a slide early on, the 407.76s - 413.32s | autopilot can connect directly to the engine. But it's always 413.32s - 416.36s | possible to disconnect the autopilot and steer manually. As 416.36s - 418.92s | I said, this is very important. There's always a human in the 418.92s - 423.40s | loop. But if we take a look at the threat landscape, we're 423.40s - 425.88s | finding more and more that these systems are connected up to the 425.88s - 430.92s | internet. So firmware downloads and that. And that if we sort of 430.92s - 433.80s | break it down, and we can see this almost becomes like a sort


chunk_text:
380.08s - 384.24s | Viking Sky generator was out for service maintenance. Yet again, 384.24s - 386.76s | we see this. So it's totally possible that these 386.76s - 392.60s | circumstances can exist, that a ship can blackout. So like I 392.60s - 396.56s | said, you know, all the armchair warriors on the internet saying 397.32s - 401.76s | it was a hack. Well, we'll see. So let's take a look at the 401.76s - 407.76s | autopilot. So as we go, as we saw a slide early on, the 407.76s - 413.32s | autopilot can connect directly to the engine. But it's always 413.32s - 416.36s | possible to disconnect the autopilot and steer manually. As 416.36s - 418.92s | I said, this is very important. There's always a human in the 418.92s - 423.40s | loop. But if we take a look at the threat landscape, we're 423.40s - 425.88s | finding more and more that these systems are connected up to the 425.88s - 430.92s | internet. So firmware downloads and that. And that if we sort of 430.92s - 433.80s | break it down, and we can see this almost becomes like a sort 433.80s - 437.52s | of supply chain attack. But then you'd have to compromise the 437.52s - 442.04s | firmware supplies. You have to sign the firmware. So yes, 442.04s - 445.80s | possible, but very unlikely, unless you really expend a lot 445.80s - 450.80s | of energy going back and hacking the spyware. Propulsion, rarely 450.80s - 453.56s | connected to the internet. These are big, big chunky machines. 453.84s - 457.80s | This is your typical OT versus IT segregation at the end of the 457.80s - 462.64s | day. Attacks unlikely. And if it did happen, the bridge could 462.64s - 466.08s | manually override yet again, somebody, a person's in the 466.08s - 471.10s | loop. The power systems frequently network connected, 471.10s - 474.86s | fair enough. Right. And this is one of those, those, those 474.86s - 477.38s | situations are just becoming more and more connected as the 477.38s - 480.78s | years go by. But attack is unlikely in an event happening 480.78s - 483.70s | the bridge could manually override. Yet this recurring 483.70s - 487.58s | theme is that there's always somebody that can change a ship 487.58s -


chunk_text:
433.80s - 437.52s | of supply chain attack. But then you'd have to compromise the 437.52s - 442.04s | firmware supplies. You have to sign the firmware. So yes, 442.04s - 445.80s | possible, but very unlikely, unless you really expend a lot 445.80s - 450.80s | of energy going back and hacking the spyware. Propulsion, rarely 450.80s - 453.56s | connected to the internet. These are big, big chunky machines. 453.84s - 457.80s | This is your typical OT versus IT segregation at the end of the 457.80s - 462.64s | day. Attacks unlikely. And if it did happen, the bridge could 462.64s - 466.08s | manually override yet again, somebody, a person's in the 466.08s - 471.10s | loop. The power systems frequently network connected, 471.10s - 474.86s | fair enough. Right. And this is one of those, those, those 474.86s - 477.38s | situations are just becoming more and more connected as the 477.38s - 480.78s | years go by. But attack is unlikely in an event happening 480.78s - 483.70s | the bridge could manually override. Yet this recurring 483.70s - 487.58s | theme is that there's always somebody that can change a ship 487.58s - 492.82s | or it's going to be on bridge, etc. So conclusion, yes, ships 492.82s - 495.62s | can be hacked, but it takes time. It's a manual process, 495.66s - 502.02s | whoopsie-daisy. And was the MVW hacked? Well, no. It's 502.02s - 505.82s | practically impossible. I mean, it's possible, but it's very, 505.82s - 508.34s | very improbable. You need a large amount of time over there. 509.06s - 511.06s | You need to know the systems, you basically need to need 511.06s - 514.22s | engineer, tons of social, social engineering. So for an 514.22s - 516.94s | armchair hacker from, I don't know, your nation state 516.94s - 519.10s | somewhere, like hacking into the ship, very improbable. 519.90s - 523.66s | Unfortunately, polarized views from uninformed commentators do 523.66s - 526.30s | not help. You need to understand how these ships are 526.30s - 535.90s | architected. So last year, I had about 150 slides. And I managed 535.90s - 541.42s | to get to 120 of them before time got called. So I blasted 541.42s - 545.02s | through 30. So I'm going to do a recap of what I did last year.


chunk_text:
492.82s | or it's going to be on bridge, etc. So conclusion, yes, ships 492.82s - 495.62s | can be hacked, but it takes time. It's a manual process, 495.66s - 502.02s | whoopsie-daisy. And was the MVW hacked? Well, no. It's 502.02s - 505.82s | practically impossible. I mean, it's possible, but it's very, 505.82s - 508.34s | very improbable. You need a large amount of time over there. 509.06s - 511.06s | You need to know the systems, you basically need to need 511.06s - 514.22s | engineer, tons of social, social engineering. So for an 514.22s - 516.94s | armchair hacker from, I don't know, your nation state 516.94s - 519.10s | somewhere, like hacking into the ship, very improbable. 519.90s - 523.66s | Unfortunately, polarized views from uninformed commentators do 523.66s - 526.30s | not help. You need to understand how these ships are 526.30s - 535.90s | architected. So last year, I had about 150 slides. And I managed 535.90s - 541.42s | to get to 120 of them before time got called. So I blasted 541.42s - 545.02s | through 30. So I'm going to do a recap of what I did last year. 545.10s - 552.38s | And yeah, so this is the systems recap. Integrated Control and 552.38s - 555.10s | Monitoring System. This is the brains, the eyes of the ship. 555.42s - 560.54s | This controls the PLCs in the engine room, rider control, 560.54s - 564.78s | power management, these extremely, extremely important 564.78s - 569.14s | piece of equipment. Without it, the ship cannot operate. So from 569.14s - 572.74s | an attacker's point of view, this is a high value target. So 572.74s - 574.62s | it's something that we take a look at all the time while we're 574.62s - 579.82s | busy pen testing ships. This is the ECDIS, the charting system. 580.54s - 585.34s | This is these running redundant arrays. Basically, as you can 585.34s - 589.66s | see, there's a map on there, it tells you where you are in on 589.66s - 595.22s | the ocean. Obviously, without it, the captain could not know 595.22s - 597.18s | where he's supposed to be going and the crew don't know where 597.18s - 599.66s | they're going or where they are. So if these systems go down, 599.66s - 603.14s | then


chunk_text:
545.10s - 552.38s | And yeah, so this is the systems recap. Integrated Control and 552.38s - 555.10s | Monitoring System. This is the brains, the eyes of the ship. 555.42s - 560.54s | This controls the PLCs in the engine room, rider control, 560.54s - 564.78s | power management, these extremely, extremely important 564.78s - 569.14s | piece of equipment. Without it, the ship cannot operate. So from 569.14s - 572.74s | an attacker's point of view, this is a high value target. So 572.74s - 574.62s | it's something that we take a look at all the time while we're 574.62s - 579.82s | busy pen testing ships. This is the ECDIS, the charting system. 580.54s - 585.34s | This is these running redundant arrays. Basically, as you can 585.34s - 589.66s | see, there's a map on there, it tells you where you are in on 589.66s - 595.22s | the ocean. Obviously, without it, the captain could not know 595.22s - 597.18s | where he's supposed to be going and the crew don't know where 597.18s - 599.66s | they're going or where they are. So if these systems go down, 599.66s - 603.14s | then the ship has got to stop. But failing that, simply with 603.14s - 607.38s | some of the older ships, we got some old school maps, right? You 607.38s - 609.82s | can see the drawers over there. Those are actually all charts 609.82s - 613.18s | from the oceans around the world. And these get delivered 613.18s - 618.26s | by hand whenever there's an update. So it's quite, it's 618.26s - 621.42s | quite reassuring that you still have these manual methods of the 621.42s - 625.06s | ship knowing where they are at the end of the day. Safety 625.06s - 629.26s | management system. So this is a separate room, usually near the 629.26s - 636.70s | bridge, that whenever there's an emergency situation on board, it 636.70s - 639.70s | is organized over here. So this is very interesting from 639.70s - 642.98s | attacker's point of view, because it has tendrils into 642.98s - 648.58s | the rest of the ship. It is from the ICMS all the way to the 648.58s - 656.54s | ectus, pressurized doors, CCTV, fire alarm systems. This is so 656.54s - 659.54s | important at the end of


chunk_text:
the ship has got to stop. But failing that, simply with 603.14s - 607.38s | some of the older ships, we got some old school maps, right? You 607.38s - 609.82s | can see the drawers over there. Those are actually all charts 609.82s - 613.18s | from the oceans around the world. And these get delivered 613.18s - 618.26s | by hand whenever there's an update. So it's quite, it's 618.26s - 621.42s | quite reassuring that you still have these manual methods of the 621.42s - 625.06s | ship knowing where they are at the end of the day. Safety 625.06s - 629.26s | management system. So this is a separate room, usually near the 629.26s - 636.70s | bridge, that whenever there's an emergency situation on board, it 636.70s - 639.70s | is organized over here. So this is very interesting from 639.70s - 642.98s | attacker's point of view, because it has tendrils into 642.98s - 648.58s | the rest of the ship. It is from the ICMS all the way to the 648.58s - 656.54s | ectus, pressurized doors, CCTV, fire alarm systems. This is so 656.54s - 659.54s | important at the end of the day, because you basically can 659.58s - 665.78s | coordinate like somebody like with the lifeboats, etc. It's 666.38s - 669.98s | something to note as well that as the crew is running around 669.98s - 674.38s | trying to organize a emergency situation, they can use these 674.38s - 678.50s | iPads or these window systems to log in and take a look at what's 678.50s - 683.72s | going on at the same time. It's an idealized version of the IT 683.72s - 686.80s | versus OT system of ship, we've got internet coming down by 686.80s - 690.36s | VSAT into the core, we've got the corporate network, because 690.36s - 693.60s | as usual, you got your bean counters on the ship, your 693.60s - 696.64s | accountants and your people, then you got third parties, 696.64s - 702.08s | something like point of sales, etc. And your crew is obviously 702.08s - 704.84s | you know, you need to provide Netflix, etc. for your crew. And 704.84s - 708.28s | that's split up into Wi Fi and wired. You can see the line down 708.28s - 713.80s | the middle, you see the bridge


chunk_text:
the day, because you basically can 659.58s - 665.78s | coordinate like somebody like with the lifeboats, etc. It's 666.38s - 669.98s | something to note as well that as the crew is running around 669.98s - 674.38s | trying to organize a emergency situation, they can use these 674.38s - 678.50s | iPads or these window systems to log in and take a look at what's 678.50s - 683.72s | going on at the same time. It's an idealized version of the IT 683.72s - 686.80s | versus OT system of ship, we've got internet coming down by 686.80s - 690.36s | VSAT into the core, we've got the corporate network, because 690.36s - 693.60s | as usual, you got your bean counters on the ship, your 693.60s - 696.64s | accountants and your people, then you got third parties, 696.64s - 702.08s | something like point of sales, etc. And your crew is obviously 702.08s - 704.84s | you know, you need to provide Netflix, etc. for your crew. And 704.84s - 708.28s | that's split up into Wi Fi and wired. You can see the line down 708.28s - 713.80s | the middle, you see the bridge and the engine room. And this is 713.84s - 717.96s | what you want in the real world, but it doesn't always work out. 718.00s - 721.32s | Because, yeah, we'll see a little bit later. This is really 721.32s - 725.76s | how it looks like it's a mess. So it comes on the VSAT into the 725.76s - 729.40s | core network, and then RDP, not their protocol, but remote 729.40s - 733.40s | distribution points. And these are basically just big chunks of 733.40s - 735.96s | Cisco equipment, we can see in the next slide. And these are 735.96s - 741.40s | broken down via VLAN trunks into cabin switches. This is 741.40s - 744.60s | basically what it looks like this on the ship. So you anybody 744.60s - 748.72s | who's been in a data center, any on prem stuff, it looks exactly 748.72s - 752.48s | the same. It's all off the shelf stuff. It's nothing bespoke for 752.48s - 759.48s | the maritime industry. Breaking down further, we have the VLAN 759.48s - 764.16s | trunking down to the cabin switches. And we have it split 764.16s - 769.88s | off into


chunk_text:
and the engine room. And this is 713.84s - 717.96s | what you want in the real world, but it doesn't always work out. 718.00s - 721.32s | Because, yeah, we'll see a little bit later. This is really 721.32s - 725.76s | how it looks like it's a mess. So it comes on the VSAT into the 725.76s - 729.40s | core network, and then RDP, not their protocol, but remote 729.40s - 733.40s | distribution points. And these are basically just big chunks of 733.40s - 735.96s | Cisco equipment, we can see in the next slide. And these are 735.96s - 741.40s | broken down via VLAN trunks into cabin switches. This is 741.40s - 744.60s | basically what it looks like this on the ship. So you anybody 744.60s - 748.72s | who's been in a data center, any on prem stuff, it looks exactly 748.72s - 752.48s | the same. It's all off the shelf stuff. It's nothing bespoke for 752.48s - 759.48s | the maritime industry. Breaking down further, we have the VLAN 759.48s - 764.16s | trunking down to the cabin switches. And we have it split 764.16s - 769.88s | off into TVs, VoIPs, light, Wi-Fi, CTV, TV. The most 769.88s - 773.72s | important thing to remember on all this is it comes down over a 773.72s - 776.92s | single connection, right? And as an attacker, that is very 776.92s - 780.68s | interesting. So we got the propulsion system. This is 780.68s - 783.36s | Azipod. In the olden days, you used to have the, you know, the 783.36s - 786.96s | big rudders that used to, you have the prop wash. But now 786.96s - 791.16s | these are independent systems that you can control from the 791.16s - 795.64s | ICMS. And actually, the recent ones that we tested are 795.64s - 799.64s | controlled by Wi-Fi, just normal 2.4 gig Wi-Fi, right? Which is 799.64s - 802.36s | quite scary at the end of the day. This is not even dedicated 802.36s - 809.21s | cables at the end of the day. So yeah. So one of the things 809.21s - 813.53s | when we test ships is we walk around, this goes back to my 813.53s - 816.73s | early days in refinery, is you see pipes everywhere, you see 816.73s - 818.33s | cables


chunk_text:
TVs, VoIPs, light, Wi-Fi, CTV, TV. The most 769.88s - 773.72s | important thing to remember on all this is it comes down over a 773.72s - 776.92s | single connection, right? And as an attacker, that is very 776.92s - 780.68s | interesting. So we got the propulsion system. This is 780.68s - 783.36s | Azipod. In the olden days, you used to have the, you know, the 783.36s - 786.96s | big rudders that used to, you have the prop wash. But now 786.96s - 791.16s | these are independent systems that you can control from the 791.16s - 795.64s | ICMS. And actually, the recent ones that we tested are 795.64s - 799.64s | controlled by Wi-Fi, just normal 2.4 gig Wi-Fi, right? Which is 799.64s - 802.36s | quite scary at the end of the day. This is not even dedicated 802.36s - 809.21s | cables at the end of the day. So yeah. So one of the things 809.21s - 813.53s | when we test ships is we walk around, this goes back to my 813.53s - 816.73s | early days in refinery, is you see pipes everywhere, you see 816.73s - 818.33s | cables going everywhere, you don't know where everything is. 818.33s - 822.45s | So you spend such a large amount of time chasing stuff down. And 823.05s - 827.37s | because ships have this churn of engineers, etc., a lot of 827.37s - 830.97s | people don't know where the systems do, or even sometimes 830.97s - 833.21s | they leave the systems on, because they're too afraid to 833.21s - 834.65s | turn them off, because they don't know what it does, but 834.65s - 836.49s | they don't want to turn it off at the end of the day, right? So 836.49s - 838.61s | in case something goes wrong, it's like, okay, cool. So you 838.61s - 842.33s | have systems just running like this constantly. So we knew 842.33s - 846.21s | there was something coming in that monitored the fuel 846.53s - 849.29s | consumption. But we didn't know where it was, right? So 849.61s - 853.41s | eventually we opened up the panels, and we put it inside, 853.73s - 857.53s | and we found this little bugger over here. This is like a 857.53s - 861.85s | rugged PC. It's a Windows-based PC. But


chunk_text:
going everywhere, you don't know where everything is. 818.33s - 822.45s | So you spend such a large amount of time chasing stuff down. And 823.05s - 827.37s | because ships have this churn of engineers, etc., a lot of 827.37s - 830.97s | people don't know where the systems do, or even sometimes 830.97s - 833.21s | they leave the systems on, because they're too afraid to 833.21s - 834.65s | turn them off, because they don't know what it does, but 834.65s - 836.49s | they don't want to turn it off at the end of the day, right? So 836.49s - 838.61s | in case something goes wrong, it's like, okay, cool. So you 838.61s - 842.33s | have systems just running like this constantly. So we knew 842.33s - 846.21s | there was something coming in that monitored the fuel 846.53s - 849.29s | consumption. But we didn't know where it was, right? So 849.61s - 853.41s | eventually we opened up the panels, and we put it inside, 853.73s - 857.53s | and we found this little bugger over here. This is like a 857.53s - 861.85s | rugged PC. It's a Windows-based PC. But we wanted to know more 861.85s - 865.25s | of what it did, right? So you can see on the side over there, 867.05s - 870.01s | anybody who worked with OT systems a lot, you'll recognize 870.01s - 872.53s | that little box over there. That's an IP to serial 872.53s - 875.93s | connector. So what it does, it takes IP, Internet Protocol, 876.41s - 884.37s | then it changes it into serial bus. Now the thing is when you 884.37s - 888.85s | work in OT at the moment, these systems have been around for 30, 888.85s - 892.53s | 40 years, and they still operate on discrete systems. So this is 892.53s - 899.09s | why you have the IP to serial. So we wanted to model the attack 899.09s - 903.93s | surface and that. So what we did is we took a look. So we knew 903.93s - 906.97s | that the IP to serial was going to the bridge ICMS. This was 906.97s - 912.21s | going to the charting system. So it would track where we were at 912.21s - 914.93s | a certain time from one distance to the next. But


chunk_text:
we wanted to know more 861.85s - 865.25s | of what it did, right? So you can see on the side over there, 867.05s - 870.01s | anybody who worked with OT systems a lot, you'll recognize 870.01s - 872.53s | that little box over there. That's an IP to serial 872.53s - 875.93s | connector. So what it does, it takes IP, Internet Protocol, 876.41s - 884.37s | then it changes it into serial bus. Now the thing is when you 884.37s - 888.85s | work in OT at the moment, these systems have been around for 30, 888.85s - 892.53s | 40 years, and they still operate on discrete systems. So this is 892.53s - 899.09s | why you have the IP to serial. So we wanted to model the attack 899.09s - 903.93s | surface and that. So what we did is we took a look. So we knew 903.93s - 906.97s | that the IP to serial was going to the bridge ICMS. This was 906.97s - 912.21s | going to the charting system. So it would track where we were at 912.21s - 914.93s | a certain time from one distance to the next. But it was also 914.93s - 918.45s | talking to the PLCs on the main engine. It was asking for 918.45s - 921.09s | revolutions a second. It was asking for maybe fuel 921.09s - 925.93s | consumption. And then it was doing some fancy mathematics. 925.93s - 931.13s | It was predicting the fuel consumption. So what we did is 931.13s - 934.85s | once we took a look at the IP to serial connection going to the 934.85s - 938.69s | bridge, we noticed that instead of three wires, you can see 938.69s - 942.21s | there's two wires. There's the ground and one of the serial 942.21s - 945.73s | connections in there. We noticed that one of the wires was 945.73s - 950.01s | missing. So usually when you have a serial to serial 950.01s - 954.21s | connection, you pull the PLC or the piece of equipment and it 954.21s - 957.05s | will talk back to you. But that's how it would normally 957.05s - 959.85s | happen. What we found is it was transmit only. So the piece of 959.85s - 963.25s | equipment was just taking from the bridge, which is great. From


chunk_text:
it was also 914.93s - 918.45s | talking to the PLCs on the main engine. It was asking for 918.45s - 921.09s | revolutions a second. It was asking for maybe fuel 921.09s - 925.93s | consumption. And then it was doing some fancy mathematics. 925.93s - 931.13s | It was predicting the fuel consumption. So what we did is 931.13s - 934.85s | once we took a look at the IP to serial connection going to the 934.85s - 938.69s | bridge, we noticed that instead of three wires, you can see 938.69s - 942.21s | there's two wires. There's the ground and one of the serial 942.21s - 945.73s | connections in there. We noticed that one of the wires was 945.73s - 950.01s | missing. So usually when you have a serial to serial 950.01s - 954.21s | connection, you pull the PLC or the piece of equipment and it 954.21s - 957.05s | will talk back to you. But that's how it would normally 957.05s - 959.85s | happen. What we found is it was transmit only. So the piece of 959.85s - 963.25s | equipment was just taking from the bridge, which is great. From 963.25s - 965.53s | attackers point of view, there's nothing you can do. You can't 965.53s - 969.45s | inject anything down the line. Fantastic, right? But then we 969.45s - 973.01s | started taking a look at the connection from the IP to serial 973.01s - 977.25s | to the PLC. And that was using Modbus. Now Modbus, five 977.25s - 982.89s | minutes. Seriously? All right. So it's using Modbus, right? And 982.89s - 987.37s | Modbus was, that went quickly, right? And Modbus is like a, you 987.41s - 989.97s | have to call out to the piece of equipment for it to broadcast 989.97s - 994.13s | its value to you. So this is, this is interesting from 994.13s - 996.57s | attacker's point of view because now we have access to the 996.57s - 1000.57s | machine. So now we can inject values into the PLCs at the end 1000.57s - 1003.05s | of the day. And in terms of attack surface, this is very 1003.05s - 1007.69s | interesting to us. However, what was more interesting, forgive 1007.69s - 1010.33s | like I said, I got lots of slides, right? So what was more


chunk_text:
963.25s - 965.53s | attackers point of view, there's nothing you can do. You can't 965.53s - 969.45s | inject anything down the line. Fantastic, right? But then we 969.45s - 973.01s | started taking a look at the connection from the IP to serial 973.01s - 977.25s | to the PLC. And that was using Modbus. Now Modbus, five 977.25s - 982.89s | minutes. Seriously? All right. So it's using Modbus, right? And 982.89s - 987.37s | Modbus was, that went quickly, right? And Modbus is like a, you 987.41s - 989.97s | have to call out to the piece of equipment for it to broadcast 989.97s - 994.13s | its value to you. So this is, this is interesting from 994.13s - 996.57s | attacker's point of view because now we have access to the 996.57s - 1000.57s | machine. So now we can inject values into the PLCs at the end 1000.57s - 1003.05s | of the day. And in terms of attack surface, this is very 1003.05s - 1007.69s | interesting to us. However, what was more interesting, forgive 1007.69s - 1010.33s | like I said, I got lots of slides, right? So what was more 1010.33s - 1013.17s | interesting, we took a look at the system and we noticed we had 1013.17s - 1019.53s | TeamViewer on there, right? So yeah, yeah. I mean, what is more 1019.53s - 1023.21s | amusing, even more amusing, was that the fact that the company 1023.21s - 1025.85s | actually had stopped paying for the service four years before, 1025.85s - 1027.81s | right? But they were too afraid to turn it off, like I was 1027.81s - 1032.33s | saying before. So you had a machine that was not updated. It 1032.33s - 1036.53s | was still connected to the internet. You could potentially 1036.53s - 1039.17s | connect up to the PLC and ruin everything at the end of the 1039.17s - 1043.57s | day, right? So it was, we found this very amusing. But it was 1043.57s - 1048.05s | good. I, yeah, I'm going to have to blast through my slides 1048.05s - 1052.41s | again. I'm really sorry about this, guys. But how many 1052.41s - 1065.83s | minutes? Three minutes? Two minutes? Okay. Shit. Okay. So I'm 1065.83s - 1069.35s | going to blast through my slides quick. Next year when


chunk_text:
1010.33s - 1013.17s | interesting, we took a look at the system and we noticed we had 1013.17s - 1019.53s | TeamViewer on there, right? So yeah, yeah. I mean, what is more 1019.53s - 1023.21s | amusing, even more amusing, was that the fact that the company 1023.21s - 1025.85s | actually had stopped paying for the service four years before, 1025.85s - 1027.81s | right? But they were too afraid to turn it off, like I was 1027.81s - 1032.33s | saying before. So you had a machine that was not updated. It 1032.33s - 1036.53s | was still connected to the internet. You could potentially 1036.53s - 1039.17s | connect up to the PLC and ruin everything at the end of the 1039.17s - 1043.57s | day, right? So it was, we found this very amusing. But it was 1043.57s - 1048.05s | good. I, yeah, I'm going to have to blast through my slides 1048.05s - 1052.41s | again. I'm really sorry about this, guys. But how many 1052.41s - 1065.83s | minutes? Three minutes? Two minutes? Okay. Shit. Okay. So I'm 1065.83s - 1069.35s | going to blast through my slides quick. Next year when you come 1069.35s - 1071.55s | and see me talk, I'll do this properly. I'll do this first so 1071.71s - 1077.51s | I can actually get through this time. Basically, TLDR, we 1077.51s - 1081.75s | managed to compromise the trusses system from our cabins 1081.75s - 1087.53s | at the end of the day. So I'm going to run to the conclusion. 1087.53s - 1099.46s | Those are really interesting slides, aren't they? Sorry, 1099.46s - 1107.78s | guys. See TeamViewer again? Yeah. Okay. So I'm going to hack 1107.78s - 1110.38s | it up. So I actually had some stuff about regulation as well, 1110.38s - 1112.54s | but that's very boring. Nobody wants to go through that. Okay. 1113.18s - 1120.22s | So ships can be hacked, but it takes time and it takes 1120.22s - 1122.98s | presence. One of the things that we noticed that we have the 1122.98s - 1125.26s | advantage of when we're on the ship, we can talk to engineers, 1125.50s - 1128.06s | we can look at the documentation, right? We can see 1128.06s - 1131.82s | what's going on. We can run the lines. In an idealized world,


chunk_text:
you come 1069.35s - 1071.55s | and see me talk, I'll do this properly. I'll do this first so 1071.71s - 1077.51s | I can actually get through this time. Basically, TLDR, we 1077.51s - 1081.75s | managed to compromise the trusses system from our cabins 1081.75s - 1087.53s | at the end of the day. So I'm going to run to the conclusion. 1087.53s - 1099.46s | Those are really interesting slides, aren't they? Sorry, 1099.46s - 1107.78s | guys. See TeamViewer again? Yeah. Okay. So I'm going to hack 1107.78s - 1110.38s | it up. So I actually had some stuff about regulation as well, 1110.38s - 1112.54s | but that's very boring. Nobody wants to go through that. Okay. 1113.18s - 1120.22s | So ships can be hacked, but it takes time and it takes 1120.22s - 1122.98s | presence. One of the things that we noticed that we have the 1122.98s - 1125.26s | advantage of when we're on the ship, we can talk to engineers, 1125.50s - 1128.06s | we can look at the documentation, right? We can see 1128.06s - 1131.82s | what's going on. We can run the lines. In an idealized world, 1132.58s - 1136.06s | hackers are not going to sit on the other side of the world, go 1136.06s - 1138.82s | through the V set, take over the vessel. It's not going to 1138.82s - 1143.38s | happen. However, social engineering is still a factor 1143.38s - 1147.50s | that is something to consider. Convergence and modernization 1147.50s - 1150.34s | often introduce new risk. And this is true because a lot of 1150.34s - 1152.58s | the time we're getting IP to serial. Before we had discrete 1152.58s - 1157.94s | systems, now we have trunking, like we said before, and it's 1157.94s - 1161.38s | possible to RDP onto systems, et cetera, to TeamViewer, right? 1162.30s - 1165.06s | There's undocumented stuff everywhere. This is one of the 1165.06s - 1169.58s | things when we test the ship, we have a little AP, AP 1169.58s - 1173.54s | monitoring, and the client or the vendor has installed so many 1173.54s - 1177.18s | access points, right? That the client that we're testing have 1177.18s - 1181.90s | no idea what the hell is going on. Probably about six or seven 1181.90s - 1185.78s | undocumented APs on


chunk_text:
1132.58s - 1136.06s | hackers are not going to sit on the other side of the world, go 1136.06s - 1138.82s | through the V set, take over the vessel. It's not going to 1138.82s - 1143.38s | happen. However, social engineering is still a factor 1143.38s - 1147.50s | that is something to consider. Convergence and modernization 1147.50s - 1150.34s | often introduce new risk. And this is true because a lot of 1150.34s - 1152.58s | the time we're getting IP to serial. Before we had discrete 1152.58s - 1157.94s | systems, now we have trunking, like we said before, and it's 1157.94s - 1161.38s | possible to RDP onto systems, et cetera, to TeamViewer, right? 1162.30s - 1165.06s | There's undocumented stuff everywhere. This is one of the 1165.06s - 1169.58s | things when we test the ship, we have a little AP, AP 1169.58s - 1173.54s | monitoring, and the client or the vendor has installed so many 1173.54s - 1177.18s | access points, right? That the client that we're testing have 1177.18s - 1181.90s | no idea what the hell is going on. Probably about six or seven 1181.90s - 1185.78s | undocumented APs on a ship at any one time, right? Which is 1185.78s - 1188.90s | bonkers, right? Because I mean, all of these just bridge the man 1188.90s - 1193.46s | over there. It's like, yeah. It's yeah, so it's crazy. And 1193.46s - 1196.50s | that's it. Thank you for coming to see my talk.


chunk_text:
a ship at any one time, right? Which is 1185.78s - 1188.90s | bonkers, right? Because I mean, all of these just bridge the man 1188.90s - 1193.46s | over there. It's like, yeah. It's yeah, so it's crazy. And 1193.46s - 1196.50s | that's it. Thank you for coming to see my talk.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=l89qpmb2CAQ", "title": "DEF CON 32 - Evading Modern Defenses When Phishing with Pixels - Melvin Langvik", "description": "Dive into the art of phishing with QR codes! We'll cover the fundamentals of QR code phishing, revealing how these innocuous-looking images are used to deceive users into a false sense of legitimacy. After touching upon the basics, we'll explore creative tactics for obfuscating and hiding QR codes to ensure they reach their intended targets. As a sidetrack, we'll delve into how emails are rendered within the Outlook Mail Application and showcase some neat tricks that exploit its limitations for hiding QR codes from modern defensive solutions. Overall, the talk is intended to help testers up their QR code phishing game!", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1068, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.02s - 2.66s | This text was transcribed using whisper model: large-v2 All right, good morning audience. 2.66s - 4.42s | Welcome to the second day of DEF CON. 4.42s - 5.26s | Proud to be here. 5.26s - 7.66s | Hopefully everyone's had a great experience so far. 9.14s - 11.90s | I wanna kick things off by introducing our next speaker. 11.90s - 13.54s | He is coming all the way from Norway. 13.54s - 15.30s | So he's had a very long flight. 15.30s - 17.56s | So we definitely wanna give this guy a lot of attention. 17.56s - 19.26s | His name is Melvin Langvik 19.26s - 23.06s | and I'll read just a quick breakdown of his bio. 23.06s - 24.90s | Melvin is an accomplished professional 24.90s - 26.94s | with a diverse background in tech. 26.94s - 28.74s | He started his career as a developer, 28.74s - 30.10s | an integration consultant, 30.10s - 31.34s | gaining practical experience 31.34s - 33.90s | in distributing critical backend infrastructure 33.90s - 36.50s | for an international customer base. 36.50s - 38.58s | Melvin's passion for cybersecurity 38.58s - 43.22s | led him to transition into offensive security, the bad team. 43.22s - 45.18s | He previously worked for TrustedSec, 45.18s - 47.86s | which is an internationally recognized security company. 47.86s - 50.70s | As part of, as TrustedSec's targeted operations team, 50.70s - 53.66s | Melvin was tasked with performing targeted cyber attacks 53.66s - 55.08s | against some of the most mature 55.08s - 58.14s | and often largest


chunk_text:
coming all the way from Norway. 13.54s - 15.30s | So he's had a very long flight. 15.30s - 17.56s | So we definitely wanna give this guy a lot of attention. 17.56s - 19.26s | His name is Melvin Langvik 19.26s - 23.06s | and I'll read just a quick breakdown of his bio. 23.06s - 24.90s | Melvin is an accomplished professional 24.90s - 26.94s | with a diverse background in tech. 26.94s - 28.74s | He started his career as a developer, 28.74s - 30.10s | an integration consultant, 30.10s - 31.34s | gaining practical experience 31.34s - 33.90s | in distributing critical backend infrastructure 33.90s - 36.50s | for an international customer base. 36.50s - 38.58s | Melvin's passion for cybersecurity 38.58s - 43.22s | led him to transition into offensive security, the bad team. 43.22s - 45.18s | He previously worked for TrustedSec, 45.18s - 47.86s | which is an internationally recognized security company. 47.86s - 50.70s | As part of, as TrustedSec's targeted operations team, 50.70s - 53.66s | Melvin was tasked with performing targeted cyber attacks 53.66s - 55.08s | against some of the most mature 55.08s - 58.14s | and often largest companies in the world. 58.14s - 61.66s | Today, Melvin is with the offensive security team lead 61.66s - 63.90s | at a company called CovertAS. 63.90s - 66.82s | So please give Melvin a very warm welcome 66.82s - 68.60s | and listen to what he has to say. 69.58s - 70.42s | Thank you, Melvin. 70.42s - 71.58s | Thank you so much. 71.58s - 72.78s | Thank you so much, guys. 72.78s - 74.78s | Okay, so this talk is only 25 minutes. 74.78s - 76.38s | So the first portion is gonna be super quick 76.38s - 77.90s | and then towards the end, we'll slow down 77.90s - 79.62s | and I'll give you guys a nice demo, okay? 79.62s - 82.62s | So evading modern fences versus phishing with pixels. 82.62s - 85.94s | We're gonna talk about QR code phishing specifically. 85.94s - 87.18s | Quick introduction about myself, 87.18s - 89.74s | even though my biography got read up here. 89.74s - 90.74s | My name is Melvin Langvik. 90.74s - 92.38s | I go by the alias Flangvik. 92.38s - 93.22s | I'm the team lead 93.22s - 95.10s | for


chunk_text:
companies in the world. 58.14s - 61.66s | Today, Melvin is with the offensive security team lead 61.66s - 63.90s | at a company called CovertAS. 63.90s - 66.82s | So please give Melvin a very warm welcome 66.82s - 68.60s | and listen to what he has to say. 69.58s - 70.42s | Thank you, Melvin. 70.42s - 71.58s | Thank you so much. 71.58s - 72.78s | Thank you so much, guys. 72.78s - 74.78s | Okay, so this talk is only 25 minutes. 74.78s - 76.38s | So the first portion is gonna be super quick 76.38s - 77.90s | and then towards the end, we'll slow down 77.90s - 79.62s | and I'll give you guys a nice demo, okay? 79.62s - 82.62s | So evading modern fences versus phishing with pixels. 82.62s - 85.94s | We're gonna talk about QR code phishing specifically. 85.94s - 87.18s | Quick introduction about myself, 87.18s - 89.74s | even though my biography got read up here. 89.74s - 90.74s | My name is Melvin Langvik. 90.74s - 92.38s | I go by the alias Flangvik. 92.38s - 93.22s | I'm the team lead 93.22s - 95.10s | for a small Norwegian pentest company called Covert. 95.10s - 97.14s | Previously, I was at TrustedSec. 97.14s - 99.18s | I've done quite a few offensive security tools 99.18s - 100.02s | for the community. 100.02s - 101.34s | Maybe somebody recognizes sharp collection 101.34s - 102.66s | or team filtration. 102.66s - 105.90s | I also create trash, semi-good-ish infosec content 105.90s - 106.94s | on YouTube and Twitch. 106.94s - 109.26s | Stream, I don't wanna go on a stream every Sunday, 109.26s - 111.30s | but close to every Sunday, I do a stream. 112.86s - 114.62s | Like you guys, I'm a part-time alcoholic 114.62s - 116.02s | when I'm at conferences. 116.58s - 120.62s | I'm also the guy who did the meme-y C2 and EDR tier lists. 120.62s - 123.30s | Obviously, AnyDesk is the best C2 out there, right? 123.30s - 125.02s | So this is all a meme. 125.02s - 126.82s | Okay, so the game plan for this talk. 126.82s - 128.46s | We're gonna talk about QR codes one-on-one. 128.46s - 130.22s | We're gonna talk about phishing with QR codes. 130.22s - 131.90s | Some basic detection engineering. 131.90s


chunk_text:
a small Norwegian pentest company called Covert. 95.10s - 97.14s | Previously, I was at TrustedSec. 97.14s - 99.18s | I've done quite a few offensive security tools 99.18s - 100.02s | for the community. 100.02s - 101.34s | Maybe somebody recognizes sharp collection 101.34s - 102.66s | or team filtration. 102.66s - 105.90s | I also create trash, semi-good-ish infosec content 105.90s - 106.94s | on YouTube and Twitch. 106.94s - 109.26s | Stream, I don't wanna go on a stream every Sunday, 109.26s - 111.30s | but close to every Sunday, I do a stream. 112.86s - 114.62s | Like you guys, I'm a part-time alcoholic 114.62s - 116.02s | when I'm at conferences. 116.58s - 120.62s | I'm also the guy who did the meme-y C2 and EDR tier lists. 120.62s - 123.30s | Obviously, AnyDesk is the best C2 out there, right? 123.30s - 125.02s | So this is all a meme. 125.02s - 126.82s | Okay, so the game plan for this talk. 126.82s - 128.46s | We're gonna talk about QR codes one-on-one. 128.46s - 130.22s | We're gonna talk about phishing with QR codes. 130.22s - 131.90s | Some basic detection engineering. 131.90s - 134.22s | Obviously, not my field, but just some basic stuff. 134.22s - 137.74s | Image-less QR codes, question mark, potential profit, 137.74s - 139.18s | taking things a step further, 139.18s - 141.02s | and then we're gonna talk about the tool and toolkit 141.02s - 143.10s | I'm gonna be demoing and sort of releasing today 143.10s - 144.50s | called Crucible. 144.50s - 146.70s | Okay, so let's talk about some QR codes. 146.70s - 147.62s | What is a QR code? 147.62s - 149.38s | QR code is a quick response code. 149.38s - 150.50s | It's essentially a bar code 150.50s - 152.66s | that contains a given amount of data. 153.58s - 155.86s | A QR code works while you scan it using a device. 155.86s - 157.10s | Typically, it's a mobile, right? 157.10s - 158.22s | That scans the QR code, 158.22s - 160.18s | takes you to a link or some other data. 162.22s - 164.66s | The QR code itself has a couple of key factors. 164.66s - 167.34s | Finder patterns marked down there in purple 167.34s - 169.22s | is for the device you're scanning the QR


chunk_text:
- 134.22s | Obviously, not my field, but just some basic stuff. 134.22s - 137.74s | Image-less QR codes, question mark, potential profit, 137.74s - 139.18s | taking things a step further, 139.18s - 141.02s | and then we're gonna talk about the tool and toolkit 141.02s - 143.10s | I'm gonna be demoing and sort of releasing today 143.10s - 144.50s | called Crucible. 144.50s - 146.70s | Okay, so let's talk about some QR codes. 146.70s - 147.62s | What is a QR code? 147.62s - 149.38s | QR code is a quick response code. 149.38s - 150.50s | It's essentially a bar code 150.50s - 152.66s | that contains a given amount of data. 153.58s - 155.86s | A QR code works while you scan it using a device. 155.86s - 157.10s | Typically, it's a mobile, right? 157.10s - 158.22s | That scans the QR code, 158.22s - 160.18s | takes you to a link or some other data. 162.22s - 164.66s | The QR code itself has a couple of key factors. 164.66s - 167.34s | Finder patterns marked down there in purple 167.34s - 169.22s | is for the device you're scanning the QR code 169.22s - 171.46s | to identify where the QR code is. 171.46s - 172.90s | Is this a QR code or not? 172.90s - 175.06s | You got the alignment marker in green, 175.06s - 177.90s | sort of telling the device the position of the QR code 177.90s - 179.70s | so it knows which way to read it. 179.70s - 181.38s | And then you get the actual data modules, 181.38s - 183.14s | which is the black and white data 183.14s - 187.06s | between the alignment and finder markers. 187.06s - 189.02s | And then you have also error correction. 189.02s - 190.66s | I didn't know this before doing the talk, 190.66s - 195.06s | but QR codes can actually have error correction up to 30%. 195.06s - 197.74s | So if up to 30% of the QR code is missing, 197.74s - 200.34s | it's still readable depending on how it's generated. 201.18s - 204.46s | Different versions of QR codes refer to different size, 204.46s - 206.70s | how many modules are within. 206.70s - 210.46s | Think like the smallest one, I believe is like a 21 by 21. 210.46s -


chunk_text:
code 169.22s - 171.46s | to identify where the QR code is. 171.46s - 172.90s | Is this a QR code or not? 172.90s - 175.06s | You got the alignment marker in green, 175.06s - 177.90s | sort of telling the device the position of the QR code 177.90s - 179.70s | so it knows which way to read it. 179.70s - 181.38s | And then you get the actual data modules, 181.38s - 183.14s | which is the black and white data 183.14s - 187.06s | between the alignment and finder markers. 187.06s - 189.02s | And then you have also error correction. 189.02s - 190.66s | I didn't know this before doing the talk, 190.66s - 195.06s | but QR codes can actually have error correction up to 30%. 195.06s - 197.74s | So if up to 30% of the QR code is missing, 197.74s - 200.34s | it's still readable depending on how it's generated. 201.18s - 204.46s | Different versions of QR codes refer to different size, 204.46s - 206.70s | how many modules are within. 206.70s - 210.46s | Think like the smallest one, I believe is like a 21 by 21. 210.46s - 214.42s | Then you can go all up to like 172, I think, 171. 214.42s - 216.26s | And that will actually give you 40, 216.26s - 218.82s | a bit over 4,000 alphanumerical characters. 218.82s - 221.86s | So a QR code can be huge and can contain a lot of data. 221.86s - 223.90s | Typical use cases for us, it's much smaller 223.90s - 227.50s | and does contain like a series of numbers 227.50s - 228.98s | or URL or something like that. 229.94s - 232.70s | QR codes has a lot of legitimate use cases. 232.70s - 234.86s | If you ever charge your electric vehicle, 234.86s - 237.30s | if you ever booked like an e-bike or like a scooter, 237.30s - 239.82s | if you ever ordered at a restaurant during COVID, 239.82s - 240.78s | they use QR codes. 240.78s - 242.26s | You scan them, you get to a webpage 242.26s - 243.70s | and then you give them all your data 243.70s - 245.10s | and you get some food, right? 245.10s - 247.02s | So they have a ton of legitimate use cases 247.02s - 249.26s | and they're


chunk_text:
214.42s | Then you can go all up to like 172, I think, 171. 214.42s - 216.26s | And that will actually give you 40, 216.26s - 218.82s | a bit over 4,000 alphanumerical characters. 218.82s - 221.86s | So a QR code can be huge and can contain a lot of data. 221.86s - 223.90s | Typical use cases for us, it's much smaller 223.90s - 227.50s | and does contain like a series of numbers 227.50s - 228.98s | or URL or something like that. 229.94s - 232.70s | QR codes has a lot of legitimate use cases. 232.70s - 234.86s | If you ever charge your electric vehicle, 234.86s - 237.30s | if you ever booked like an e-bike or like a scooter, 237.30s - 239.82s | if you ever ordered at a restaurant during COVID, 239.82s - 240.78s | they use QR codes. 240.78s - 242.26s | You scan them, you get to a webpage 242.26s - 243.70s | and then you give them all your data 243.70s - 245.10s | and you get some food, right? 245.10s - 247.02s | So they have a ton of legitimate use cases 247.02s - 249.26s | and they're great, we use them all the time. 250.14s - 253.78s | The thing is that attackers also likes to use QR codes. 253.78s - 256.46s | I'm actually super proud of this meme. 256.46s - 259.34s | And why do attackers use QR codes? 259.34s - 261.30s | They're simple to create and easy to share. 261.30s - 262.54s | There's a bunch of online tools, 262.54s - 264.42s | there's libraries to use in scripting languages, 264.42s - 266.74s | there's pre-built offline tools, right? 266.74s - 269.98s | Easy to create, easy to share and therefore easy to abuse. 269.98s - 271.94s | Again, everybody knows what a QR code is. 271.94s - 274.66s | Even non-technical people working in large organizations 274.66s - 276.86s | have some sort of reference to QR codes, right? 276.86s - 278.46s | So it's definitely like a legitimate, 278.46s - 281.14s | looks like a legitimate delivery method. 281.14s - 282.70s | Sometimes we'll talk more about this, 282.70s - 285.46s | but typically it's easy to evade initial email filters 285.46s - 287.66s | and some sandbox solutions by delivering URLs 287.66s - 289.50s | or data in QR codes.


chunk_text:
great, we use them all the time. 250.14s - 253.78s | The thing is that attackers also likes to use QR codes. 253.78s - 256.46s | I'm actually super proud of this meme. 256.46s - 259.34s | And why do attackers use QR codes? 259.34s - 261.30s | They're simple to create and easy to share. 261.30s - 262.54s | There's a bunch of online tools, 262.54s - 264.42s | there's libraries to use in scripting languages, 264.42s - 266.74s | there's pre-built offline tools, right? 266.74s - 269.98s | Easy to create, easy to share and therefore easy to abuse. 269.98s - 271.94s | Again, everybody knows what a QR code is. 271.94s - 274.66s | Even non-technical people working in large organizations 274.66s - 276.86s | have some sort of reference to QR codes, right? 276.86s - 278.46s | So it's definitely like a legitimate, 278.46s - 281.14s | looks like a legitimate delivery method. 281.14s - 282.70s | Sometimes we'll talk more about this, 282.70s - 285.46s | but typically it's easy to evade initial email filters 285.46s - 287.66s | and some sandbox solutions by delivering URLs 287.66s - 289.50s | or data in QR codes. 289.50s - 292.78s | And actually I think they convey a sense of legitimacy. 292.78s - 295.46s | I asked a bunch of my friends who's not technical, 295.46s - 297.78s | can anybody create a QR code? 297.78s - 299.34s | And a lot of them thought no. 299.34s - 300.90s | A lot of them thought that you had to be 300.90s - 302.34s | some sort of legitimate entity, 302.34s - 303.62s | that you had to be an organization 303.62s - 306.50s | or get a license or whatever to create your QR code, 306.50s - 308.06s | which is obviously wrong, right? 308.06s - 310.70s | So I think that is underlying of why a lot of people 310.70s - 312.54s | feel QR code are very legitimate. 313.50s - 315.54s | And also the best thing about phishing, 315.54s - 316.70s | specifically with QR codes, 316.70s - 318.50s | is that you move the initial access 318.50s - 320.74s | of whatever you are giving to the victim 320.74s - 321.98s | off the main device. 321.98s - 324.54s | A lot of large corporate networks or large companies 324.54s - 326.74s |


chunk_text:
289.50s - 292.78s | And actually I think they convey a sense of legitimacy. 292.78s - 295.46s | I asked a bunch of my friends who's not technical, 295.46s - 297.78s | can anybody create a QR code? 297.78s - 299.34s | And a lot of them thought no. 299.34s - 300.90s | A lot of them thought that you had to be 300.90s - 302.34s | some sort of legitimate entity, 302.34s - 303.62s | that you had to be an organization 303.62s - 306.50s | or get a license or whatever to create your QR code, 306.50s - 308.06s | which is obviously wrong, right? 308.06s - 310.70s | So I think that is underlying of why a lot of people 310.70s - 312.54s | feel QR code are very legitimate. 313.50s - 315.54s | And also the best thing about phishing, 315.54s - 316.70s | specifically with QR codes, 316.70s - 318.50s | is that you move the initial access 318.50s - 320.74s | of whatever you are giving to the victim 320.74s - 321.98s | off the main device. 321.98s - 324.54s | A lot of large corporate networks or large companies 324.54s - 326.74s | will have heavily protected machines, 326.74s - 328.82s | but the mobile devices are either private, 328.82s - 330.70s | owned by the employee themselves, 330.70s - 332.90s | or maybe not as heavily enrolled 332.90s - 335.02s | or doesn't have the same defensive capabilities 335.02s - 337.78s | as the machine itself. 337.78s - 339.82s | Meaning that a potential defense, a SOC, 339.82s - 341.90s | wouldn't gain the same telemetry from that phone 341.90s - 343.14s | as they would from the device. 343.14s - 347.10s | I think this is true for many, many organizations out there. 347.10s - 349.50s | Okay, so obviously phishing with QR codes, 349.50s - 351.82s | I think everybody's seen a couple of these examples. 351.82s - 353.86s | I think the Microsoft multi-factor authentication one 353.86s - 355.30s | is by far the most abused, right? 355.30s - 357.18s | Because it's based on the legitimate use case 357.18s - 358.78s | where you set up a Microsoft account, 358.78s - 361.38s | you have to scan the QR code to set up your multi-factor app 361.38s - 363.46s | and therefore, you know, you have to re-authenticate


chunk_text:
will have heavily protected machines, 326.74s - 328.82s | but the mobile devices are either private, 328.82s - 330.70s | owned by the employee themselves, 330.70s - 332.90s | or maybe not as heavily enrolled 332.90s - 335.02s | or doesn't have the same defensive capabilities 335.02s - 337.78s | as the machine itself. 337.78s - 339.82s | Meaning that a potential defense, a SOC, 339.82s - 341.90s | wouldn't gain the same telemetry from that phone 341.90s - 343.14s | as they would from the device. 343.14s - 347.10s | I think this is true for many, many organizations out there. 347.10s - 349.50s | Okay, so obviously phishing with QR codes, 349.50s - 351.82s | I think everybody's seen a couple of these examples. 351.82s - 353.86s | I think the Microsoft multi-factor authentication one 353.86s - 355.30s | is by far the most abused, right? 355.30s - 357.18s | Because it's based on the legitimate use case 357.18s - 358.78s | where you set up a Microsoft account, 358.78s - 361.38s | you have to scan the QR code to set up your multi-factor app 361.38s - 363.46s | and therefore, you know, you have to re-authenticate 363.46s - 366.30s | or whatever the context is a couple of times a year. 366.30s - 368.06s | And that really makes a good phishing campaign. 368.06s - 369.66s | DocuSign is also heavily abused. 369.66s - 370.98s | Anything related to Microsoft, 371.22s - 374.54s | people love throwing Microsoft logos around, right? 374.54s - 376.50s | So a bit of detection engineering, 376.50s - 378.42s | how do we detect QR codes? 378.42s - 381.02s | I Googled this, which means I did great research 381.02s - 382.54s | on the subject, right? 382.54s - 384.82s | Found this blog post by Liam Jones, 384.82s - 386.26s | who created a basic detection rule 386.26s - 389.74s | for basically pulling out image attachments from emails. 389.74s - 392.46s | It then had some automation for parsing the images 392.46s - 394.34s | and looking for QR codes, 394.34s - 397.26s | essentially attempting to parse every image as a QR code 397.26s - 398.54s | and then look at the data, right? 398.54s - 400.22s | That's the manual way to do it. 400.22s - 401.82s | There's a couple of flaws in this rule. 401.82s


chunk_text:
363.46s - 366.30s | or whatever the context is a couple of times a year. 366.30s - 368.06s | And that really makes a good phishing campaign. 368.06s - 369.66s | DocuSign is also heavily abused. 369.66s - 370.98s | Anything related to Microsoft, 371.22s - 374.54s | people love throwing Microsoft logos around, right? 374.54s - 376.50s | So a bit of detection engineering, 376.50s - 378.42s | how do we detect QR codes? 378.42s - 381.02s | I Googled this, which means I did great research 381.02s - 382.54s | on the subject, right? 382.54s - 384.82s | Found this blog post by Liam Jones, 384.82s - 386.26s | who created a basic detection rule 386.26s - 389.74s | for basically pulling out image attachments from emails. 389.74s - 392.46s | It then had some automation for parsing the images 392.46s - 394.34s | and looking for QR codes, 394.34s - 397.26s | essentially attempting to parse every image as a QR code 397.26s - 398.54s | and then look at the data, right? 398.54s - 400.22s | That's the manual way to do it. 400.22s - 401.82s | There's a couple of flaws in this rule. 401.82s - 402.66s | You can probably spot it. 402.66s - 404.58s | You know, there's a bunch of more image extensions 404.58s - 406.90s | than PNG, JPEG, and SVG, 406.90s - 408.58s | but yeah, that's just an example, right? 408.58s - 409.98s | And then you have black box solutions, 409.98s - 412.22s | which we don't know how to work, like Microsoft Sentinel. 412.22s - 414.62s | If you give Microsoft some of your hard-earned money 414.62s - 416.62s | and get like an E5 or E3 or whatever 416.62s - 419.02s | their licensing model is at the time, 419.02s - 421.10s | you'll get this, which is Microsoft Sentinel. 421.10s - 423.74s | It will overwatch all your emails, 423.74s - 425.50s | inbound, outbound from the organization, 425.50s - 426.78s | and it will actually tell you 426.78s - 428.62s | if you got a URL from a QR code. 428.62s - 431.50s | You see, it will tag it as the source of this data 431.50s - 433.98s | is from a QR code, and it will give it a URL. 433.98s - 435.66s | And it will automatically browse through it. 435.66s


chunk_text:
- 402.66s | You can probably spot it. 402.66s - 404.58s | You know, there's a bunch of more image extensions 404.58s - 406.90s | than PNG, JPEG, and SVG, 406.90s - 408.58s | but yeah, that's just an example, right? 408.58s - 409.98s | And then you have black box solutions, 409.98s - 412.22s | which we don't know how to work, like Microsoft Sentinel. 412.22s - 414.62s | If you give Microsoft some of your hard-earned money 414.62s - 416.62s | and get like an E5 or E3 or whatever 416.62s - 419.02s | their licensing model is at the time, 419.02s - 421.10s | you'll get this, which is Microsoft Sentinel. 421.10s - 423.74s | It will overwatch all your emails, 423.74s - 425.50s | inbound, outbound from the organization, 425.50s - 426.78s | and it will actually tell you 426.78s - 428.62s | if you got a URL from a QR code. 428.62s - 431.50s | You see, it will tag it as the source of this data 431.50s - 433.98s | is from a QR code, and it will give it a URL. 433.98s - 435.66s | And it will automatically browse through it. 435.66s - 436.50s | It will take a look at it 436.50s - 438.78s | and try to determine if it's nasty or not, right? 438.78s - 441.58s | So detection solutions, defensive solutions out there 441.58s - 443.42s | are definitely aware of QR code phishing, 443.42s - 444.54s | and it's an established thing. 444.54s - 446.82s | We'll get back to this later. 446.82s - 449.26s | Okay, how about image-less delivery methods, right? 449.26s - 450.86s | I think when I say that, 450.86s - 452.38s | most of you are immediately gonna think 452.38s - 453.58s | about the ASCII art method, 453.58s - 454.62s | because it's a known method 454.62s - 457.30s | where you basically use different weird ASCII characters 457.30s - 458.86s | to represent the QR code. 458.86s - 460.82s | And the reason I say that this is a known method, 460.82s - 463.58s | because our well-known influencer, John Hammond, 463.58s - 465.06s | made a video about this four months ago, 465.06s - 467.50s | and at least two million people know about this now, 467.50s - 468.90s | so it's definitely known. 468.90s - 471.26s | Obviously,


chunk_text:
- 436.50s | It will take a look at it 436.50s - 438.78s | and try to determine if it's nasty or not, right? 438.78s - 441.58s | So detection solutions, defensive solutions out there 441.58s - 443.42s | are definitely aware of QR code phishing, 443.42s - 444.54s | and it's an established thing. 444.54s - 446.82s | We'll get back to this later. 446.82s - 449.26s | Okay, how about image-less delivery methods, right? 449.26s - 450.86s | I think when I say that, 450.86s - 452.38s | most of you are immediately gonna think 452.38s - 453.58s | about the ASCII art method, 453.58s - 454.62s | because it's a known method 454.62s - 457.30s | where you basically use different weird ASCII characters 457.30s - 458.86s | to represent the QR code. 458.86s - 460.82s | And the reason I say that this is a known method, 460.82s - 463.58s | because our well-known influencer, John Hammond, 463.58s - 465.06s | made a video about this four months ago, 465.06s - 467.50s | and at least two million people know about this now, 467.50s - 468.90s | so it's definitely known. 468.90s - 471.26s | Obviously, not to throw him under the bus, it's great. 471.26s - 473.26s | Just wanna say it's an established thing. 473.26s - 475.14s | And so when we wanna phish, 475.14s - 477.26s | if I wanted to phish without the use of images 477.26s - 479.50s | to avoid this detection that I just talked about, 479.50s - 482.22s | what could I possibly use for this? 482.22s - 484.74s | Well, I found this example in CSS. 484.74s - 487.10s | So this great guy called Jason Adelia, 487.10s - 488.58s | or whatever I butcher his name, 488.58s - 490.98s | he's a web developer or a web designer, 490.98s - 494.46s | and he has this CodePen link out on Google somewhere 494.46s - 496.18s | where he showcases his QR code 496.18s - 498.54s | to his website created with CSS. 498.54s - 501.02s | So he's actually using a blank white canvas 501.02s - 504.34s | and then using box shadows to fill in the black and white 504.34s - 505.74s | for the entire grid array, 505.74s - 507.98s | and it turns into this beautiful QR code. 507.98s - 509.38s | Now,


chunk_text:
not to throw him under the bus, it's great. 471.26s - 473.26s | Just wanna say it's an established thing. 473.26s - 475.14s | And so when we wanna phish, 475.14s - 477.26s | if I wanted to phish without the use of images 477.26s - 479.50s | to avoid this detection that I just talked about, 479.50s - 482.22s | what could I possibly use for this? 482.22s - 484.74s | Well, I found this example in CSS. 484.74s - 487.10s | So this great guy called Jason Adelia, 487.10s - 488.58s | or whatever I butcher his name, 488.58s - 490.98s | he's a web developer or a web designer, 490.98s - 494.46s | and he has this CodePen link out on Google somewhere 494.46s - 496.18s | where he showcases his QR code 496.18s - 498.54s | to his website created with CSS. 498.54s - 501.02s | So he's actually using a blank white canvas 501.02s - 504.34s | and then using box shadows to fill in the black and white 504.34s - 505.74s | for the entire grid array, 505.74s - 507.98s | and it turns into this beautiful QR code. 507.98s - 509.38s | Now, this looks interesting. 509.38s - 510.70s | This doesn't look like shit, right? 510.70s - 512.34s | So we could potentially use this. 512.34s - 514.34s | So me and ChatTPT sat down one night 514.34s - 516.42s | and we looked at some Python code, 516.42s - 518.66s | and I came up with this dirty piece of crap. 518.66s - 520.30s | Basically, creates a QR code, 520.30s - 522.50s | goes through every cell in the QR code, 522.50s - 524.30s | determines if the QR code is, 524.30s - 526.22s | or that pixel or cell is black, 526.22s - 528.42s | and then fills in the box shadow, the CSS, 528.42s - 530.46s | using his technique with that. 530.46s - 531.94s | And then this looks really great. 531.94s - 534.22s | Actually, a bunch of email clients will happily render this. 534.22s - 537.14s | Both Thunderbird and Apple Mail, the built-in Apple Mail, 537.14s - 539.74s | will render this as CSS, and it scans, it looks great, 539.74s - 540.86s | and it's not an image. 540.86s - 543.90s | So this will fly by basic detection for email filters 543.90s


chunk_text:
this looks interesting. 509.38s - 510.70s | This doesn't look like shit, right? 510.70s - 512.34s | So we could potentially use this. 512.34s - 514.34s | So me and ChatTPT sat down one night 514.34s - 516.42s | and we looked at some Python code, 516.42s - 518.66s | and I came up with this dirty piece of crap. 518.66s - 520.30s | Basically, creates a QR code, 520.30s - 522.50s | goes through every cell in the QR code, 522.50s - 524.30s | determines if the QR code is, 524.30s - 526.22s | or that pixel or cell is black, 526.22s - 528.42s | and then fills in the box shadow, the CSS, 528.42s - 530.46s | using his technique with that. 530.46s - 531.94s | And then this looks really great. 531.94s - 534.22s | Actually, a bunch of email clients will happily render this. 534.22s - 537.14s | Both Thunderbird and Apple Mail, the built-in Apple Mail, 537.14s - 539.74s | will render this as CSS, and it scans, it looks great, 539.74s - 540.86s | and it's not an image. 540.86s - 543.90s | So this will fly by basic detection for email filters 543.90s - 544.90s | because there's no image there. 544.90s - 546.94s | So there's obviously no QR code there, right? 546.94s - 549.74s | And of course, you can see that the CSS is not offset 549.74s - 551.38s | because centering things to CSS 551.38s - 552.82s | is an absolute fucking nightmare. 552.82s - 555.14s | So I didn't bother spending the needed two hours 555.14s - 556.02s | to center this thing. 556.02s - 557.34s | I just screenshots it. 557.34s - 560.10s | That's your issue now, but it is what it is. 560.10s - 561.70s | The sad thing about this, though, 561.70s - 565.54s | is that Outlook doesn't support this in the desktop client. 565.54s - 568.70s | The web version of Outlook will happily render CSS for you, 568.70s - 570.34s | but the, again, not centered, 570.34s - 573.62s | but the desktop client will not render CSS. 573.62s - 575.34s | This is because the Outlook desktop client 575.34s - 578.06s | is extremely sassy and, in general, 578.06s - 582.98s | just is very picky about what HTML tags you can use, 582.98s - 584.82s | what CSS you


chunk_text:
- 544.90s | because there's no image there. 544.90s - 546.94s | So there's obviously no QR code there, right? 546.94s - 549.74s | And of course, you can see that the CSS is not offset 549.74s - 551.38s | because centering things to CSS 551.38s - 552.82s | is an absolute fucking nightmare. 552.82s - 555.14s | So I didn't bother spending the needed two hours 555.14s - 556.02s | to center this thing. 556.02s - 557.34s | I just screenshots it. 557.34s - 560.10s | That's your issue now, but it is what it is. 560.10s - 561.70s | The sad thing about this, though, 561.70s - 565.54s | is that Outlook doesn't support this in the desktop client. 565.54s - 568.70s | The web version of Outlook will happily render CSS for you, 568.70s - 570.34s | but the, again, not centered, 570.34s - 573.62s | but the desktop client will not render CSS. 573.62s - 575.34s | This is because the Outlook desktop client 575.34s - 578.06s | is extremely sassy and, in general, 578.06s - 582.98s | just is very picky about what HTML tags you can use, 582.98s - 584.82s | what CSS you can use, and you can't. 584.82s - 587.78s | If you ever made an email in the Outlook desktop client, 587.78s - 588.82s | you know what I'm talking about. 588.82s - 590.70s | It's a nightmare, right? 590.70s - 592.38s | So it doesn't work, and it's kind of important 592.38s - 595.14s | because it turns out, at least based on one source, 595.14s - 597.30s | that the Outlook desktop client owns 597.30s - 600.58s | about 58.1% of desktop machines, 600.58s - 601.66s | so it's kind of important. 602.18s - 604.30s | When working against large organizations, 604.30s - 606.30s | by far, the experience I have 606.30s - 608.86s | is that most people use the Outlook desktop client. 608.86s - 610.50s | I think we can all agree on that, right? 610.50s - 611.66s | That's a given. 612.82s - 614.26s | Okay, so we got to take a step back then. 614.26s - 615.66s | CSS, sure, we can use that. 615.66s - 616.86s | We already scripted that way, 616.86s - 619.14s | but we got to find some other way. 619.14s - 622.30s | What other structure could we possibly


chunk_text:
can use, and you can't. 584.82s - 587.78s | If you ever made an email in the Outlook desktop client, 587.78s - 588.82s | you know what I'm talking about. 588.82s - 590.70s | It's a nightmare, right? 590.70s - 592.38s | So it doesn't work, and it's kind of important 592.38s - 595.14s | because it turns out, at least based on one source, 595.14s - 597.30s | that the Outlook desktop client owns 597.30s - 600.58s | about 58.1% of desktop machines, 600.58s - 601.66s | so it's kind of important. 602.18s - 604.30s | When working against large organizations, 604.30s - 606.30s | by far, the experience I have 606.30s - 608.86s | is that most people use the Outlook desktop client. 608.86s - 610.50s | I think we can all agree on that, right? 610.50s - 611.66s | That's a given. 612.82s - 614.26s | Okay, so we got to take a step back then. 614.26s - 615.66s | CSS, sure, we can use that. 615.66s - 616.86s | We already scripted that way, 616.86s - 619.14s | but we got to find some other way. 619.14s - 622.30s | What other structure could we possibly use 622.30s - 626.58s | to create a drawing, almost, of pixels? 626.58s - 628.46s | Like, what could we use, right? 628.46s - 632.18s | So the answer to that, at least one, is tables. 632.18s - 635.54s | So tables is something that Outlook desktop client supports. 635.54s - 638.50s | When I say tables, I don't mean like Excel tables. 638.50s - 642.14s | I mean like actual HTML tables and rows and columns, 642.14s - 643.62s | and they support styling. 643.62s - 647.50s | So you could take a table, and you can style each column 647.50s - 650.02s | in that either white color or black color, 650.02s - 651.66s | and you can create a QR code. 651.66s - 654.54s | So again, me and Chad TPT sat down one night, 654.54s - 655.82s | and we created this. 655.82s - 658.14s | So you set the cell spacing and the cell padding 658.98s - 662.18s | to zero or a given size for how big QR code you want to make, 662.18s - 663.54s | and then you basically start filling in, 663.54s - 666.34s | okay, this pixel of this QR


chunk_text:
use 622.30s - 626.58s | to create a drawing, almost, of pixels? 626.58s - 628.46s | Like, what could we use, right? 628.46s - 632.18s | So the answer to that, at least one, is tables. 632.18s - 635.54s | So tables is something that Outlook desktop client supports. 635.54s - 638.50s | When I say tables, I don't mean like Excel tables. 638.50s - 642.14s | I mean like actual HTML tables and rows and columns, 642.14s - 643.62s | and they support styling. 643.62s - 647.50s | So you could take a table, and you can style each column 647.50s - 650.02s | in that either white color or black color, 650.02s - 651.66s | and you can create a QR code. 651.66s - 654.54s | So again, me and Chad TPT sat down one night, 654.54s - 655.82s | and we created this. 655.82s - 658.14s | So you set the cell spacing and the cell padding 658.98s - 662.18s | to zero or a given size for how big QR code you want to make, 662.18s - 663.54s | and then you basically start filling in, 663.54s - 666.34s | okay, this pixel of this QR code is white. 666.34s - 668.98s | Let's pad this, or let's make the background color 668.98s - 670.82s | of this cell white or black, right? 670.82s - 672.30s | And then you go through the whole thing, 672.30s - 677.06s | and voila, you got a beautiful-looking table in HTML, 677.06s - 678.58s | and you got a beautiful-looking QR code 678.58s - 680.10s | in Outlook desktop client, right? 680.10s - 680.98s | And this looks good. 680.98s - 683.10s | I actually think this deserves a round of applause, 683.10s - 685.58s | to be perfectly honest with you. 685.58s - 686.66s | And this is really dumb. 687.10s - 688.58s | This is KISS all the way, right? 688.58s - 690.02s | It's super simple, super dumb. 690.02s - 691.02s | And is it effective? 691.02s - 691.94s | That's the big question. 691.94s - 693.18s | Is this effective? 693.18s - 696.46s | So I actually, you know, I reached into my paycheck, 696.46s - 698.78s | and I bought Microsoft Sentinel, XDR, EDR, 698.78s - 699.70s | whatever they call it now. 699.70s - 701.34s | They change name every week. 701.34s -


chunk_text:
code is white. 666.34s - 668.98s | Let's pad this, or let's make the background color 668.98s - 670.82s | of this cell white or black, right? 670.82s - 672.30s | And then you go through the whole thing, 672.30s - 677.06s | and voila, you got a beautiful-looking table in HTML, 677.06s - 678.58s | and you got a beautiful-looking QR code 678.58s - 680.10s | in Outlook desktop client, right? 680.10s - 680.98s | And this looks good. 680.98s - 683.10s | I actually think this deserves a round of applause, 683.10s - 685.58s | to be perfectly honest with you. 685.58s - 686.66s | And this is really dumb. 687.10s - 688.58s | This is KISS all the way, right? 688.58s - 690.02s | It's super simple, super dumb. 690.02s - 691.02s | And is it effective? 691.02s - 691.94s | That's the big question. 691.94s - 693.18s | Is this effective? 693.18s - 696.46s | So I actually, you know, I reached into my paycheck, 696.46s - 698.78s | and I bought Microsoft Sentinel, XDR, EDR, 698.78s - 699.70s | whatever they call it now. 699.70s - 701.34s | They change name every week. 701.34s - 704.06s | And I give them my money, and I wanted to test it. 704.06s - 706.50s | So first, I set up two accounts. 706.50s - 707.70s | I set up Microsoft Sentinel. 707.70s - 709.86s | I started monitoring incoming email traffic, 709.86s - 713.14s | and then I set out this QR code in a Base64, 713.14s - 715.50s | as a Base64 image embedded within the email, 715.50s - 717.62s | and obviously, Microsoft Sentinel picked this right up. 717.62s - 719.06s | It says, you know, this is a QR code. 719.06s - 720.10s | This is the URL. 720.10s - 723.10s | That's Rick Roll, if anybody recognized that. 723.10s - 725.54s | Hacks, Elite Hacks are to you if you recognize that. 725.54s - 727.82s | And then I tried sending a table, 727.82s - 729.50s | and lo and behold, nothing happened. 729.50s - 731.50s | So Microsoft Sentinel did not detect the table 731.50s - 733.82s | as an image or as a QR code at all, 733.82s - 735.58s | and didn't parse it, and therefore, 735.58s - 738.14s | as a defender, you don't have telemetry for this. 738.14s


chunk_text:
704.06s | And I give them my money, and I wanted to test it. 704.06s - 706.50s | So first, I set up two accounts. 706.50s - 707.70s | I set up Microsoft Sentinel. 707.70s - 709.86s | I started monitoring incoming email traffic, 709.86s - 713.14s | and then I set out this QR code in a Base64, 713.14s - 715.50s | as a Base64 image embedded within the email, 715.50s - 717.62s | and obviously, Microsoft Sentinel picked this right up. 717.62s - 719.06s | It says, you know, this is a QR code. 719.06s - 720.10s | This is the URL. 720.10s - 723.10s | That's Rick Roll, if anybody recognized that. 723.10s - 725.54s | Hacks, Elite Hacks are to you if you recognize that. 725.54s - 727.82s | And then I tried sending a table, 727.82s - 729.50s | and lo and behold, nothing happened. 729.50s - 731.50s | So Microsoft Sentinel did not detect the table 731.50s - 733.82s | as an image or as a QR code at all, 733.82s - 735.58s | and didn't parse it, and therefore, 735.58s - 738.14s | as a defender, you don't have telemetry for this. 738.14s - 739.78s | So if I send a bunch of phishing emails 739.78s - 741.42s | with QR codes generated as tables, 741.42s - 742.74s | the URL will not pop up. 742.74s - 743.70s | Nobody will spam it. 743.70s - 744.90s | No bot will hit it, 744.90s - 746.06s | and it will reach a target, 746.06s - 748.62s | and it's still scannable by mobile devices. 748.62s - 750.78s | So this works great. 750.78s - 752.22s | Now this, I've already done this. 752.22s - 754.90s | I talked about this at a conference a couple of months back. 754.90s - 757.42s | This is built into the tool Crucible, 757.42s - 758.70s | which I'll talk about later, 758.70s - 760.18s | and you can find that on GitHub. 760.18s - 763.18s | It works great, and yeah, it's cool. 763.18s - 765.70s | But let's think about it and take it a step further. 765.70s - 768.50s | So we can generate QR codes in CSS, sick. 768.50s - 771.34s | We can generate QR codes in tables, even sicker. 771.34s - 774.50s | But what about obfuscating email content 774.50s - 776.34s


chunk_text:
- 739.78s | So if I send a bunch of phishing emails 739.78s - 741.42s | with QR codes generated as tables, 741.42s - 742.74s | the URL will not pop up. 742.74s - 743.70s | Nobody will spam it. 743.70s - 744.90s | No bot will hit it, 744.90s - 746.06s | and it will reach a target, 746.06s - 748.62s | and it's still scannable by mobile devices. 748.62s - 750.78s | So this works great. 750.78s - 752.22s | Now this, I've already done this. 752.22s - 754.90s | I talked about this at a conference a couple of months back. 754.90s - 757.42s | This is built into the tool Crucible, 757.42s - 758.70s | which I'll talk about later, 758.70s - 760.18s | and you can find that on GitHub. 760.18s - 763.18s | It works great, and yeah, it's cool. 763.18s - 765.70s | But let's think about it and take it a step further. 765.70s - 768.50s | So we can generate QR codes in CSS, sick. 768.50s - 771.34s | We can generate QR codes in tables, even sicker. 771.34s - 774.50s | But what about obfuscating email content 774.50s - 776.34s | using tables? 776.34s - 777.34s | Because think about it. 777.34s - 779.54s | The table is essentially our drawing board. 779.54s - 781.10s | We can draw whatever we want. 781.10s - 784.14s | Each column in the table is a pixel for us, right? 784.14s - 786.58s | So we could draw the entire email. 786.58s - 791.02s | We could render HTML and draw the entire thing as a table. 791.02s - 793.14s | So this is what we dive into, 793.14s - 795.58s | and this was a bit of a nightmare, to be perfectly honest. 795.58s - 796.86s | This is the process. 796.86s - 799.86s | So we need to, so the point, what I wanna do, 799.86s - 801.06s | I guess I should go back on this. 801.06s - 803.38s | Why would you wanna do this in the first place, right? 803.38s - 806.34s | So more and more defensive solutions out there 806.34s - 809.46s | are using AI to get the context of the email you're sending. 809.46s - 810.66s | They're using risk scores. 810.66s - 812.98s | They're using a context-aware AI to understand, 812.98s -


chunk_text:
| using tables? 776.34s - 777.34s | Because think about it. 777.34s - 779.54s | The table is essentially our drawing board. 779.54s - 781.10s | We can draw whatever we want. 781.10s - 784.14s | Each column in the table is a pixel for us, right? 784.14s - 786.58s | So we could draw the entire email. 786.58s - 791.02s | We could render HTML and draw the entire thing as a table. 791.02s - 793.14s | So this is what we dive into, 793.14s - 795.58s | and this was a bit of a nightmare, to be perfectly honest. 795.58s - 796.86s | This is the process. 796.86s - 799.86s | So we need to, so the point, what I wanna do, 799.86s - 801.06s | I guess I should go back on this. 801.06s - 803.38s | Why would you wanna do this in the first place, right? 803.38s - 806.34s | So more and more defensive solutions out there 806.34s - 809.46s | are using AI to get the context of the email you're sending. 809.46s - 810.66s | They're using risk scores. 810.66s - 812.98s | They're using a context-aware AI to understand, 812.98s - 815.90s | you know, is this potentially a legitimate message 815.90s - 817.02s | being delivered to my user? 817.02s - 818.50s | And then based on the risk score, whatever, 818.50s - 821.62s | it will be delivered, sandboxed, looked at, whatever, right? 821.62s - 823.30s | So the thought behind this is that 823.30s - 826.38s | if we can obfuscate keywords in the email, 826.38s - 829.54s | like MFA, like QR, like re-authenticate, 829.54s - 832.18s | like Microsoft, right, it's gonna be much harder 832.18s - 834.94s | for the AI model to determine the context of the email 834.94s - 836.62s | and if it's legitimate or not. 836.62s - 838.34s | So the whole point behind this is 838.34s - 841.50s | I wanna take a keyword, say re-authenticate, 841.50s - 844.46s | and I wanna render that as an image, 844.46s - 846.54s | and then I wanna turn it into a table, 846.54s - 848.74s | and then I wanna replace the keyword 848.74s - 851.14s | in the email with that table. 851.14s - 852.62s | So there's no text there. 852.62s - 855.74s | It's a table representing the


chunk_text:
815.90s | you know, is this potentially a legitimate message 815.90s - 817.02s | being delivered to my user? 817.02s - 818.50s | And then based on the risk score, whatever, 818.50s - 821.62s | it will be delivered, sandboxed, looked at, whatever, right? 821.62s - 823.30s | So the thought behind this is that 823.30s - 826.38s | if we can obfuscate keywords in the email, 826.38s - 829.54s | like MFA, like QR, like re-authenticate, 829.54s - 832.18s | like Microsoft, right, it's gonna be much harder 832.18s - 834.94s | for the AI model to determine the context of the email 834.94s - 836.62s | and if it's legitimate or not. 836.62s - 838.34s | So the whole point behind this is 838.34s - 841.50s | I wanna take a keyword, say re-authenticate, 841.50s - 844.46s | and I wanna render that as an image, 844.46s - 846.54s | and then I wanna turn it into a table, 846.54s - 848.74s | and then I wanna replace the keyword 848.74s - 851.14s | in the email with that table. 851.14s - 852.62s | So there's no text there. 852.62s - 855.74s | It's a table representing the text. 855.74s - 856.58s | So there's no text. 856.58s - 858.50s | You can't select it, but it looks like a text. 858.50s - 861.30s | The end user will think it's text, but it's not. 861.30s - 862.82s | I went through this process. 862.82s - 865.42s | So basically, you give the Python script, 865.42s - 867.90s | the email, the HTML email that you wanna send, 867.90s - 868.74s | and then you tell it, 868.74s - 871.54s | hey, I wanna replace the keyword, re-authenticate. 871.54s - 873.38s | The Python script will then render the, 873.38s - 876.50s | no, the Python script will then inject a marker 876.50s - 878.74s | in that as to handle that word. 878.74s - 881.98s | So it will inject like a box around the word in HTML, 881.98s - 884.18s | and then it will render the entire email, 884.18s - 886.42s | and then they will use image recognition 886.42s - 888.74s | to cut out that box, 888.74s - 890.18s | and then it will remove the borders 890.18s - 891.70s | and turn it into a table. 892.66s - 894.34s | And this


chunk_text:
text. 855.74s - 856.58s | So there's no text. 856.58s - 858.50s | You can't select it, but it looks like a text. 858.50s - 861.30s | The end user will think it's text, but it's not. 861.30s - 862.82s | I went through this process. 862.82s - 865.42s | So basically, you give the Python script, 865.42s - 867.90s | the email, the HTML email that you wanna send, 867.90s - 868.74s | and then you tell it, 868.74s - 871.54s | hey, I wanna replace the keyword, re-authenticate. 871.54s - 873.38s | The Python script will then render the, 873.38s - 876.50s | no, the Python script will then inject a marker 876.50s - 878.74s | in that as to handle that word. 878.74s - 881.98s | So it will inject like a box around the word in HTML, 881.98s - 884.18s | and then it will render the entire email, 884.18s - 886.42s | and then they will use image recognition 886.42s - 888.74s | to cut out that box, 888.74s - 890.18s | and then it will remove the borders 890.18s - 891.70s | and turn it into a table. 892.66s - 894.34s | And this is dumb and complicated, 894.34s - 895.94s | and you would never think this would work, 895.94s - 897.18s | but it actually works. 897.18s - 900.10s | So I'm gonna demo that right now so you can see that. 900.10s - 904.22s | Hopefully, you can see my terminal now. 904.22s - 905.58s | Can you see a terminal? 905.58s - 906.42s | Great. 906.42s - 908.94s | I'll try to clear this 908.94s - 910.90s | and make it a bit bigger for you guys. 912.18s - 913.66s | Like, ooh. 913.66s - 915.66s | Okay, so this is Crucible. 915.66s - 917.34s | This is the help menu. 917.34s - 919.70s | You give it a URL that you want the QR code data, 920.22s - 922.42s | the data you want inside the QR code doesn't have to be URL, 922.42s - 923.78s | but typically it's URL. 923.78s - 925.58s | You wanna set a QR code size. 925.58s - 926.86s | You give it an input, 926.86s - 928.18s | so you give it like a typically 928.18s - 930.70s | like a phishing email template in HTML, 930.70s - 934.74s | and then


chunk_text:
is dumb and complicated, 894.34s - 895.94s | and you would never think this would work, 895.94s - 897.18s | but it actually works. 897.18s - 900.10s | So I'm gonna demo that right now so you can see that. 900.10s - 904.22s | Hopefully, you can see my terminal now. 904.22s - 905.58s | Can you see a terminal? 905.58s - 906.42s | Great. 906.42s - 908.94s | I'll try to clear this 908.94s - 910.90s | and make it a bit bigger for you guys. 912.18s - 913.66s | Like, ooh. 913.66s - 915.66s | Okay, so this is Crucible. 915.66s - 917.34s | This is the help menu. 917.34s - 919.70s | You give it a URL that you want the QR code data, 920.22s - 922.42s | the data you want inside the QR code doesn't have to be URL, 922.42s - 923.78s | but typically it's URL. 923.78s - 925.58s | You wanna set a QR code size. 925.58s - 926.86s | You give it an input, 926.86s - 928.18s | so you give it like a typically 928.18s - 930.70s | like a phishing email template in HTML, 930.70s - 934.74s | and then wherever the word QR underscore placeholder is 934.74s - 938.02s | will be replaced with the QR code table or CSS, 938.02s - 939.14s | and then you give it an output path 939.14s - 941.02s | if you don't want a random generated name. 941.02s - 942.62s | You can choose if you want the CSS method 942.62s - 943.50s | or the tables method, 943.50s - 945.98s | and you can also generate output in straight EML, 945.98s - 947.10s | which is an email format, 947.10s - 948.90s | so you can just open it in Outlook afterwards, 948.90s - 950.10s | which is super nice, 950.10s - 952.06s | and then you have the obfuscate method, 952.06s - 954.58s | so that's what I'll be demonstrating now. 954.58s - 955.70s | So in this command here, 955.70s - 958.02s | I'll be linking to Defcon.org. 958.02s - 960.50s | I'm using my MFA or QR code template, 960.50s - 964.26s | and then I'm obfuscating the keywords MFA, QR, and Microsoft, 964.26s - 967.90s | so those words will be pulled out of the email template 967.90s - 971.22s | and replaced with images illustrated as


chunk_text:
wherever the word QR underscore placeholder is 934.74s - 938.02s | will be replaced with the QR code table or CSS, 938.02s - 939.14s | and then you give it an output path 939.14s - 941.02s | if you don't want a random generated name. 941.02s - 942.62s | You can choose if you want the CSS method 942.62s - 943.50s | or the tables method, 943.50s - 945.98s | and you can also generate output in straight EML, 945.98s - 947.10s | which is an email format, 947.10s - 948.90s | so you can just open it in Outlook afterwards, 948.90s - 950.10s | which is super nice, 950.10s - 952.06s | and then you have the obfuscate method, 952.06s - 954.58s | so that's what I'll be demonstrating now. 954.58s - 955.70s | So in this command here, 955.70s - 958.02s | I'll be linking to Defcon.org. 958.02s - 960.50s | I'm using my MFA or QR code template, 960.50s - 964.26s | and then I'm obfuscating the keywords MFA, QR, and Microsoft, 964.26s - 967.90s | so those words will be pulled out of the email template 967.90s - 971.22s | and replaced with images illustrated as tables 971.22s - 974.12s | in the new output, 974.12s - 977.36s | so it worked, hopefully. 977.36s - 980.90s | I have a backup if it doesn't. 980.90s - 983.70s | Open Sesame. 983.70s - 986.46s | Placeholder, I think, no. 986.46s - 987.66s | Output, okay. 987.66s - 990.30s | Hopefully, this worked. 990.30s - 992.34s | Yeah. 992.34s - 994.10s | So this is a table QR code, 994.10s - 995.34s | and this is the... 995.34s - 996.58s | Fuck, it broke. 996.58s - 997.94s | Okay. 997.94s - 998.74s | It broke. 998.74s - 999.46s | Give me a second here. 999.46s - 1003.10s | I'll go back to the demo. 1003.10s - 1006.54s | So it looks like this if the demo worked correctly, 1006.54s - 1007.82s | and then this is the output, 1007.82s - 1010.22s | so this is the generated email. 1010.22s - 1013.86s | Can you spot the text that is tables? 1013.86s - 1014.66s | There is text. 1014.66s - 1018.34s | There are keywords in this email that is not text. 1018.34s - 1019.02s | Give you guys a second. 1019.02s - 1021.06s | Some of it is


chunk_text:
tables 971.22s - 974.12s | in the new output, 974.12s - 977.36s | so it worked, hopefully. 977.36s - 980.90s | I have a backup if it doesn't. 980.90s - 983.70s | Open Sesame. 983.70s - 986.46s | Placeholder, I think, no. 986.46s - 987.66s | Output, okay. 987.66s - 990.30s | Hopefully, this worked. 990.30s - 992.34s | Yeah. 992.34s - 994.10s | So this is a table QR code, 994.10s - 995.34s | and this is the... 995.34s - 996.58s | Fuck, it broke. 996.58s - 997.94s | Okay. 997.94s - 998.74s | It broke. 998.74s - 999.46s | Give me a second here. 999.46s - 1003.10s | I'll go back to the demo. 1003.10s - 1006.54s | So it looks like this if the demo worked correctly, 1006.54s - 1007.82s | and then this is the output, 1007.82s - 1010.22s | so this is the generated email. 1010.22s - 1013.86s | Can you spot the text that is tables? 1013.86s - 1014.66s | There is text. 1014.66s - 1018.34s | There are keywords in this email that is not text. 1018.34s - 1019.02s | Give you guys a second. 1019.02s - 1021.06s | Some of it is obvious. 1021.06s - 1023.10s | Some of it is not, 1023.10s - 1026.10s | and all of this is not text. 1026.10s - 1030.22s | This is tiny tables inserted into the email template, 1030.22s - 1032.66s | resulting in it looking like text, 1032.66s - 1036.46s | but it not being text. 1036.46s - 1037.18s | Round of applause. 1037.18s - 1044.54s | Cue that, and again, 1044.54s - 1048.34s | this works when you're not demoing it live at DEF CON, 1048.34s - 1050.50s | and that's basically all I got. 1050.50s - 1052.66s | Thank you so much, Adversary Village, for having me. 1052.66s - 1054.18s | I got stickers for the project. 1054.18s - 1055.62s | Scan this QR code, if you trust me, 1055.62s - 1056.90s | to get to the project, 1056.90s - 1058.50s | and yeah, go out there and fish somebody 1058.50s - 1062.50s | and improve our defenses by some degree. 1062.50s - 1064.50s | Thank you so much from me, guys.


chunk_text:
obvious. 1021.06s - 1023.10s | Some of it is not, 1023.10s - 1026.10s | and all of this is not text. 1026.10s - 1030.22s | This is tiny tables inserted into the email template, 1030.22s - 1032.66s | resulting in it looking like text, 1032.66s - 1036.46s | but it not being text. 1036.46s - 1037.18s | Round of applause. 1037.18s - 1044.54s | Cue that, and again, 1044.54s - 1048.34s | this works when you're not demoing it live at DEF CON, 1048.34s - 1050.50s | and that's basically all I got. 1050.50s - 1052.66s | Thank you so much, Adversary Village, for having me. 1052.66s - 1054.18s | I got stickers for the project. 1054.18s - 1055.62s | Scan this QR code, if you trust me, 1055.62s - 1056.90s | to get to the project, 1056.90s - 1058.50s | and yeah, go out there and fish somebody 1058.50s - 1062.50s | and improve our defenses by some degree. 1062.50s - 1064.50s | Thank you so much from me, guys.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=j3A5zQAAwcc", "title": "DEF CON 32 - Locksport Competitions: Compete in the Olympics of Locks -Matt Burrough", "description": "Picking locks is fun, but what if you want more? Ever considered competing against other lock enthusiasts? In this talk we'll discuss the exciting lock-related competitions that take place around the world, how to find them, and what it takes to compete and win.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1469, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 2.60s | This text was transcribed using whisper model: large-v2 So this is a talk about locksport competitions. 2.60s - 4.80s | We're going to talk about how you compete, 4.80s - 6.80s | what the competitions are like, how you get good, 6.80s - 8.00s | all those kinds of fun things. 8.00s - 13.10s | So here's our quick agenda, a little bit about who I am, 13.10s - 14.80s | who this guy next to me is. 14.80s - 16.50s | We'll talk about what locksport actually 16.50s - 18.60s | is, the different types of competitions, 18.60s - 21.50s | and where we go to do these things. 21.50s - 23.60s | So me, I'm Matt Burrow. 23.60s - 27.50s | I am a red team manager by day, on the weekends, and at night. 27.60s - 30.00s | I am also a co-organizer for Seattle Locksport. 30.00s - 34.28s | So shout out to all the Seattle people in the front. 34.28s - 36.88s | If you're in the Seattle area ever, feel free to come by. 36.88s - 38.88s | We meet a couple times a month, have a lot of fun, 38.88s - 39.68s | teach you how to pick locks. 39.68s - 40.58s | It's great. 40.58s - 42.18s | I've also written a couple of books. 42.18s - 45.48s | The most important one here is Locksport, came out this year. 45.48s - 47.08s | There I am on the cover. 47.08s - 49.88s | I have a co-author here with me as well from Locksport. 49.88s - 53.38s | If you want to come by the No Starch Press vendor booth 53.38s - 56.58s | at 2.30 today, we will be signing copies of the book. 56.58s - 58.38s | And I've competed in locksport competitions 58.38s - 61.48s | around the world since about 2016. 61.48s - 65.18s | With me here, I


chunk_text:
| I am a red team manager by day, on the weekends, and at night. 27.60s - 30.00s | I am also a co-organizer for Seattle Locksport. 30.00s - 34.28s | So shout out to all the Seattle people in the front. 34.28s - 36.88s | If you're in the Seattle area ever, feel free to come by. 36.88s - 38.88s | We meet a couple times a month, have a lot of fun, 38.88s - 39.68s | teach you how to pick locks. 39.68s - 40.58s | It's great. 40.58s - 42.18s | I've also written a couple of books. 42.18s - 45.48s | The most important one here is Locksport, came out this year. 45.48s - 47.08s | There I am on the cover. 47.08s - 49.88s | I have a co-author here with me as well from Locksport. 49.88s - 53.38s | If you want to come by the No Starch Press vendor booth 53.38s - 56.58s | at 2.30 today, we will be signing copies of the book. 56.58s - 58.38s | And I've competed in locksport competitions 58.38s - 61.48s | around the world since about 2016. 61.48s - 65.18s | With me here, I have Jos Valles. 65.18s - 67.48s | Good day. 67.48s - 69.38s | I'm Jos Valles, and like it says on the screen, 69.38s - 72.98s | I do security stuff as a day job. 72.98s - 76.28s | I used to be the president for tool.nl. 76.28s - 78.08s | That's the original tool, by the way. 78.08s - 81.18s | And, well, I wrote the book, but yada, yada, yada. 81.18s - 85.28s | And I've been into locksport for quite some while now. 85.28s - 90.28s | In 2006, I was my first dabble in competing. 90.28s - 93.78s | And three years after that, I decided to start winning. 93.78s - 95.68s | And, yeah, that's basically what happened. 95.68s - 101.09s | So, yeah, I mean, that's it. 101.09s - 101.69s | Take this one? 101.69s - 102.19s | Yeah. 102.19s - 103.69s | Yeah, there you go. 103.69s - 104.19s | Cool. 104.19s - 106.19s | So what is locksport? 106.19s - 108.49s | Notice the sport in particular. 108.49s - 111.09s | Definition of locksport, it is non-destructive opening 111.09s - 114.79s | of locks in a manner that the manufacturer never intended.


chunk_text:
have Jos Valles. 65.18s - 67.48s | Good day. 67.48s - 69.38s | I'm Jos Valles, and like it says on the screen, 69.38s - 72.98s | I do security stuff as a day job. 72.98s - 76.28s | I used to be the president for tool.nl. 76.28s - 78.08s | That's the original tool, by the way. 78.08s - 81.18s | And, well, I wrote the book, but yada, yada, yada. 81.18s - 85.28s | And I've been into locksport for quite some while now. 85.28s - 90.28s | In 2006, I was my first dabble in competing. 90.28s - 93.78s | And three years after that, I decided to start winning. 93.78s - 95.68s | And, yeah, that's basically what happened. 95.68s - 101.09s | So, yeah, I mean, that's it. 101.09s - 101.69s | Take this one? 101.69s - 102.19s | Yeah. 102.19s - 103.69s | Yeah, there you go. 103.69s - 104.19s | Cool. 104.19s - 106.19s | So what is locksport? 106.19s - 108.49s | Notice the sport in particular. 108.49s - 111.09s | Definition of locksport, it is non-destructive opening 111.09s - 114.79s | of locks in a manner that the manufacturer never intended. 114.79s - 117.49s | And we do this as a hobby and as a competition 117.49s - 119.19s | to see who can do it the fastest. 119.19s - 122.29s | And notice we didn't say lock picking, but opening of locks. 122.29s - 125.79s | That's an important distinction, and you'll see why in a minute. 125.79s - 127.19s | So why do we do this, right? 127.19s - 128.39s | What makes us tick? 128.39s - 131.69s | Why do we go travel around the world to do these things? 131.69s - 134.39s | Any of us, I think, who are into locksport for any amount of time 134.39s - 135.59s | see locks as a fun puzzle. 135.59s - 136.29s | It's a challenge. 136.29s - 137.89s | It's something you want to defeat. 137.89s - 140.79s | Just like hacking digitally, it's analog hacking, right? 140.79s - 142.49s | It's a fun thing to do. 142.49s - 145.09s | We also do it because we want to improve on our own skills. 145.09s - 146.69s | We want to show that we're the best. 146.69s - 148.49s | We want to set a personal best for


chunk_text:
114.79s - 117.49s | And we do this as a hobby and as a competition 117.49s - 119.19s | to see who can do it the fastest. 119.19s - 122.29s | And notice we didn't say lock picking, but opening of locks. 122.29s - 125.79s | That's an important distinction, and you'll see why in a minute. 125.79s - 127.19s | So why do we do this, right? 127.19s - 128.39s | What makes us tick? 128.39s - 131.69s | Why do we go travel around the world to do these things? 131.69s - 134.39s | Any of us, I think, who are into locksport for any amount of time 134.39s - 135.59s | see locks as a fun puzzle. 135.59s - 136.29s | It's a challenge. 136.29s - 137.89s | It's something you want to defeat. 137.89s - 140.79s | Just like hacking digitally, it's analog hacking, right? 140.79s - 142.49s | It's a fun thing to do. 142.49s - 145.09s | We also do it because we want to improve on our own skills. 145.09s - 146.69s | We want to show that we're the best. 146.69s - 148.49s | We want to set a personal best for ourselves. 148.49s - 150.89s | Maybe we want to brag to our friends or maybe mock them a little bit. 150.89s - 154.09s | So always good to show off to your friends and enemies. 154.09s - 155.59s | You could maybe get famous from this. 155.59s - 159.49s | Maybe not super famous, but you've probably all heard of LPL, 159.49s - 160.89s | very famous locksporter. 160.89s - 163.79s | There's several people who are well-known in the locksport community 163.79s - 167.19s | and even beyond that that regular normal non-DEF CON people have heard of. 167.19s - 169.19s | So you could maybe get famous. 169.19s - 170.89s | And then there are prizes. 170.89s - 171.69s | What kinds of prizes? 171.69s - 173.39s | Well, locks often. 173.39s - 174.79s | You can win trophies. 174.79s - 177.89s | You can win lock-picking gear, all kinds of fun things. 177.89s - 181.69s | Here we are winning at various things or at least placing. 181.69s - 185.49s | So it's fun to get recognized for doing something well. 185.49s - 187.09s | So yeah, come compete. 187.09s - 189.49s | You can win things.


chunk_text:
ourselves. 148.49s - 150.89s | Maybe we want to brag to our friends or maybe mock them a little bit. 150.89s - 154.09s | So always good to show off to your friends and enemies. 154.09s - 155.59s | You could maybe get famous from this. 155.59s - 159.49s | Maybe not super famous, but you've probably all heard of LPL, 159.49s - 160.89s | very famous locksporter. 160.89s - 163.79s | There's several people who are well-known in the locksport community 163.79s - 167.19s | and even beyond that that regular normal non-DEF CON people have heard of. 167.19s - 169.19s | So you could maybe get famous. 169.19s - 170.89s | And then there are prizes. 170.89s - 171.69s | What kinds of prizes? 171.69s - 173.39s | Well, locks often. 173.39s - 174.79s | You can win trophies. 174.79s - 177.89s | You can win lock-picking gear, all kinds of fun things. 177.89s - 181.69s | Here we are winning at various things or at least placing. 181.69s - 185.49s | So it's fun to get recognized for doing something well. 185.49s - 187.09s | So yeah, come compete. 187.09s - 189.49s | You can win things. 189.49s - 192.59s | All right, brief history of locksport, how it got started. 192.59s - 196.49s | Locksmiths have been picking locks and opening locks without keys forever. 196.49s - 198.19s | That's kind of their job. 198.19s - 202.99s | Starting in the 60s, there was the Model Railroad Club at MIT. 202.99s - 205.69s | They started kind of getting into places, wanting to pick locks. 205.69s - 208.69s | So a lot of it kind of spun out from there. 208.69s - 211.89s | Then in Europe, locksport really started taking off in the late 90s. 211.89s - 216.29s | SSDev in Germany was founded by people from the Chaos Computing Club. 216.29s - 217.69s | They met with people from Hope. 217.69s - 220.49s | And so then it kind of came to the US. 220.49s - 224.89s | In the Netherlands, we had the Dutch NVHS, 224.89s - 227.89s | which was the Dutch Association for Hinges and Locksport, 227.89s - 231.19s | which is also kind of a funny joke if you know Dutch. 231.19s - 234.59s | That then spun off into becoming TOOL, the original TOOL, 234.59s - 237.29s | TOOL-NL


chunk_text:
189.49s - 192.59s | All right, brief history of locksport, how it got started. 192.59s - 196.49s | Locksmiths have been picking locks and opening locks without keys forever. 196.49s - 198.19s | That's kind of their job. 198.19s - 202.99s | Starting in the 60s, there was the Model Railroad Club at MIT. 202.99s - 205.69s | They started kind of getting into places, wanting to pick locks. 205.69s - 208.69s | So a lot of it kind of spun out from there. 208.69s - 211.89s | Then in Europe, locksport really started taking off in the late 90s. 211.89s - 216.29s | SSDev in Germany was founded by people from the Chaos Computing Club. 216.29s - 217.69s | They met with people from Hope. 217.69s - 220.49s | And so then it kind of came to the US. 220.49s - 224.89s | In the Netherlands, we had the Dutch NVHS, 224.89s - 227.89s | which was the Dutch Association for Hinges and Locksport, 227.89s - 231.19s | which is also kind of a funny joke if you know Dutch. 231.19s - 234.59s | That then spun off into becoming TOOL, the original TOOL, 234.59s - 237.29s | TOOL-NL in 2002. 237.29s - 240.29s | And then from there, they had their first LOCKCON that year, 240.29s - 244.19s | which is, we'll talk about a very big competition and gathering of lock picking 244.19s - 246.29s | and various lock opening things in the Netherlands. 246.29s - 247.49s | It's awesome. 247.49s - 249.29s | And then eventually that trickled down into the US 249.29s - 253.49s | and TOOL-US was started around 2006 at Hope and then DEFCON that year. 253.49s - 255.59s | So that's the very brief history of locksport. 255.59s - 262.09s | So it's been going on now for, you know, 20, 30 years as a major sport. 262.09s - 264.69s | So I mentioned that lock picking is not the only thing. 264.69s - 267.99s | So there are various kinds of competitions that we have at all these big events. 267.99s - 270.29s | So we'll talk about the different kinds of competitions, what they're like, 270.29s - 273.79s | and then we'll talk about where you can go and do these things. 273.79s - 277.69s | So, of course, lock picking is the biggest event at all these various conferences


chunk_text:
in 2002. 237.29s - 240.29s | And then from there, they had their first LOCKCON that year, 240.29s - 244.19s | which is, we'll talk about a very big competition and gathering of lock picking 244.19s - 246.29s | and various lock opening things in the Netherlands. 246.29s - 247.49s | It's awesome. 247.49s - 249.29s | And then eventually that trickled down into the US 249.29s - 253.49s | and TOOL-US was started around 2006 at Hope and then DEFCON that year. 253.49s - 255.59s | So that's the very brief history of locksport. 255.59s - 262.09s | So it's been going on now for, you know, 20, 30 years as a major sport. 262.09s - 264.69s | So I mentioned that lock picking is not the only thing. 264.69s - 267.99s | So there are various kinds of competitions that we have at all these big events. 267.99s - 270.29s | So we'll talk about the different kinds of competitions, what they're like, 270.29s - 273.79s | and then we'll talk about where you can go and do these things. 273.79s - 277.69s | So, of course, lock picking is the biggest event at all these various conferences 277.69s - 279.69s | because that's what people think of when they think of locksport. 279.69s - 283.09s | It is the primary competition, but certainly not the only one. 283.19s - 285.59s | If you don't know about lock picking, walk through that curtain. 285.59s - 287.29s | You will be taught lock picking in five minutes. 287.29s - 289.59s | You'll open locks. It will be fun. 289.59s - 290.59s | If you know a bit about lock picking, 290.59s - 293.09s | what is it actually like to compete and do these things? 293.09s - 294.79s | We all gather at a conference. 294.79s - 296.59s | There are usually big round tables, 296.59s - 299.49s | often with like five to ten people sitting at these tables. 299.49s - 300.69s | Everyone gets a lock. 300.69s - 304.19s | You usually get about five minutes per lock to try to pick that lock. 304.19s - 307.19s | You record your time if you open it or did not open if you don't. 307.19s - 309.19s | After the five minutes, they say switch. 309.19s - 311.39s | You hand it to the person on your left


chunk_text:
277.69s - 279.69s | because that's what people think of when they think of locksport. 279.69s - 283.09s | It is the primary competition, but certainly not the only one. 283.19s - 285.59s | If you don't know about lock picking, walk through that curtain. 285.59s - 287.29s | You will be taught lock picking in five minutes. 287.29s - 289.59s | You'll open locks. It will be fun. 289.59s - 290.59s | If you know a bit about lock picking, 290.59s - 293.09s | what is it actually like to compete and do these things? 293.09s - 294.79s | We all gather at a conference. 294.79s - 296.59s | There are usually big round tables, 296.59s - 299.49s | often with like five to ten people sitting at these tables. 299.49s - 300.69s | Everyone gets a lock. 300.69s - 304.19s | You usually get about five minutes per lock to try to pick that lock. 304.19s - 307.19s | You record your time if you open it or did not open if you don't. 307.19s - 309.19s | After the five minutes, they say switch. 309.19s - 311.39s | You hand it to the person on your left or the person on your right. 311.39s - 312.99s | All the locks move around the table. 312.99s - 315.89s | You see how quickly you can open or how many locks you can open. 315.89s - 318.99s | The person at the table with the most opens moves on to the final round. 318.99s - 321.49s | Or if there's a tie, the person with the best cumulative time. 321.49s - 322.99s | And then there's a final round table. 322.99s - 324.99s | Same story. Pass the locks around. 324.99s - 326.49s | Usually harder locks in that round. 326.49s - 328.49s | And then you get your top three people. 328.49s - 330.99s | That's most lock picking competitions. 330.99s - 332.69s | So what does that look like? 332.69s - 334.89s | Here's me opening a lock at LockCon. 334.89s - 338.39s | Here's other people opening locks at LockFest, which is another great event. 338.39s - 339.89s | So yeah, sit at a table. 339.89s - 340.99s | You know, have a drink. 340.99s - 342.59s | Pick locks. Record your time. 342.59s - 344.09s | Lots of fun. 344.09s - 346.19s | Then there's


chunk_text:
or the person on your right. 311.39s - 312.99s | All the locks move around the table. 312.99s - 315.89s | You see how quickly you can open or how many locks you can open. 315.89s - 318.99s | The person at the table with the most opens moves on to the final round. 318.99s - 321.49s | Or if there's a tie, the person with the best cumulative time. 321.49s - 322.99s | And then there's a final round table. 322.99s - 324.99s | Same story. Pass the locks around. 324.99s - 326.49s | Usually harder locks in that round. 326.49s - 328.49s | And then you get your top three people. 328.49s - 330.99s | That's most lock picking competitions. 330.99s - 332.69s | So what does that look like? 332.69s - 334.89s | Here's me opening a lock at LockCon. 334.89s - 338.39s | Here's other people opening locks at LockFest, which is another great event. 338.39s - 339.89s | So yeah, sit at a table. 339.89s - 340.99s | You know, have a drink. 340.99s - 342.59s | Pick locks. Record your time. 342.59s - 344.09s | Lots of fun. 344.09s - 346.19s | Then there's Impressioning. 346.19s - 347.69s | We have the world expert in Impressioning. 347.69s - 349.69s | So I'll hand off to him. 349.69s - 351.29s | Again, hello. 351.29s - 355.79s | Like Matt said, there are several competitions that are run around the world. 355.79s - 357.09s | One of them is Impressioning. 357.09s - 358.19s | What is Impressioning? 358.19s - 359.59s | Well, Impressioning is opening locks. 359.59s - 362.99s | Otherwise, it wouldn't be part of a locksport. 362.99s - 365.99s | What Impressioning is, is the art of making a key 365.99s - 369.09s | without knowing what the key exactly looks like. 369.09s - 373.69s | So we're creating a key from scratch. 373.69s - 374.49s | How do we do that? 374.49s - 378.39s | We work from a uncut blank key. 378.39s - 384.19s | So like the keys hanging at your key duplication site. 384.19s - 385.39s | You take a blank key. 385.39s - 386.39s | You put that in the lock. 386.39s - 387.19s | It has to fit. 387.19s - 391.59s | So it has to be the correct type and brand of key. 391.59s - 394.09s |


chunk_text:
Impressioning. 346.19s - 347.69s | We have the world expert in Impressioning. 347.69s - 349.69s | So I'll hand off to him. 349.69s - 351.29s | Again, hello. 351.29s - 355.79s | Like Matt said, there are several competitions that are run around the world. 355.79s - 357.09s | One of them is Impressioning. 357.09s - 358.19s | What is Impressioning? 358.19s - 359.59s | Well, Impressioning is opening locks. 359.59s - 362.99s | Otherwise, it wouldn't be part of a locksport. 362.99s - 365.99s | What Impressioning is, is the art of making a key 365.99s - 369.09s | without knowing what the key exactly looks like. 369.09s - 373.69s | So we're creating a key from scratch. 373.69s - 374.49s | How do we do that? 374.49s - 378.39s | We work from a uncut blank key. 378.39s - 384.19s | So like the keys hanging at your key duplication site. 384.19s - 385.39s | You take a blank key. 385.39s - 386.39s | You put that in the lock. 386.39s - 387.19s | It has to fit. 387.19s - 391.59s | So it has to be the correct type and brand of key. 391.59s - 394.09s | And you start wiggling that key. 394.09s - 395.29s | You put some force on it. 395.29s - 401.09s | And your lock will leave some marks on the key 401.09s - 404.29s | where the depth of the key is not correct yet. 404.29s - 408.29s | So if you take out that key and you look at it quite closely, 408.29s - 414.49s | probably with some lights and some magnifying aids, 414.49s - 417.69s | then you figure out where the key is not correct yet. 417.69s - 421.39s | And then you file off just a little bit of material of that part. 421.39s - 422.49s | And then you rinse and repeat. 422.49s - 423.79s | Insert the key again. 423.79s - 424.59s | Start wiggling. 424.59s - 425.49s | Look at it. 425.49s - 427.99s | And then you keep on doing that. 427.99s - 430.99s | And in the end, you'll open. 430.99s - 432.29s | You need a bit of gear for that. 432.29s - 436.59s | This happens to be part of my gear. 436.59s - 438.99s | And it works basically the same, as Matt said, 438.99s - 442.59s |


chunk_text:
And you start wiggling that key. 394.09s - 395.29s | You put some force on it. 395.29s - 401.09s | And your lock will leave some marks on the key 401.09s - 404.29s | where the depth of the key is not correct yet. 404.29s - 408.29s | So if you take out that key and you look at it quite closely, 408.29s - 414.49s | probably with some lights and some magnifying aids, 414.49s - 417.69s | then you figure out where the key is not correct yet. 417.69s - 421.39s | And then you file off just a little bit of material of that part. 421.39s - 422.49s | And then you rinse and repeat. 422.49s - 423.79s | Insert the key again. 423.79s - 424.59s | Start wiggling. 424.59s - 425.49s | Look at it. 425.49s - 427.99s | And then you keep on doing that. 427.99s - 430.99s | And in the end, you'll open. 430.99s - 432.29s | You need a bit of gear for that. 432.29s - 436.59s | This happens to be part of my gear. 436.59s - 438.99s | And it works basically the same, as Matt said, 438.99s - 442.59s | how the normal picking works, except that everybody 442.59s - 444.19s | starts at the same time. 444.19s - 447.39s | So a competition might be, I don't know, 447.39s - 449.09s | 30 people in one room. 449.09s - 451.39s | Everybody gets the same lock. 451.39s - 453.79s | So the lock, same brand. 453.79s - 455.29s | But they're also keyed alike. 455.29s - 458.59s | We have no idea what the key is, but they're keyed alike. 458.59s - 463.19s | Because if the cut would be shallow for me, 463.19s - 466.49s | and Matt would be handed a deeper lock, 466.49s - 469.59s | then he has to put in more work. 469.59s - 471.99s | Because you have to recycle through this process 471.99s - 473.39s | over and over and over again. 473.39s - 475.59s | And also filing more. 475.59s - 477.79s | So to keep it a level playing field, 477.79s - 480.19s | everybody has the same lock. 480.19s - 481.69s | And then it's 3, 2, 1, go. 481.69s - 485.69s | And people start abusing their locks to get them open. 485.69s - 487.59s | A competition,


chunk_text:
how the normal picking works, except that everybody 442.59s - 444.19s | starts at the same time. 444.19s - 447.39s | So a competition might be, I don't know, 447.39s - 449.09s | 30 people in one room. 449.09s - 451.39s | Everybody gets the same lock. 451.39s - 453.79s | So the lock, same brand. 453.79s - 455.29s | But they're also keyed alike. 455.29s - 458.59s | We have no idea what the key is, but they're keyed alike. 458.59s - 463.19s | Because if the cut would be shallow for me, 463.19s - 466.49s | and Matt would be handed a deeper lock, 466.49s - 469.59s | then he has to put in more work. 469.59s - 471.99s | Because you have to recycle through this process 471.99s - 473.39s | over and over and over again. 473.39s - 475.59s | And also filing more. 475.59s - 477.79s | So to keep it a level playing field, 477.79s - 480.19s | everybody has the same lock. 480.19s - 481.69s | And then it's 3, 2, 1, go. 481.69s - 485.69s | And people start abusing their locks to get them open. 485.69s - 487.59s | A competition, a normal competition, 487.59s - 490.19s | first round takes about an hour. 490.19s - 493.69s | And the first maybe six, depending on where you are, 493.69s - 499.09s | the first six to open go in, progress to the final round. 499.09s - 503.09s | Which means they get six different locks. 503.09s - 504.29s | And they open them. 504.29s - 506.69s | And then you do that in a roundabout way, 506.69s - 508.39s | same as with the picking. 508.39s - 511.89s | So all the finalists open, they're all six locks. 511.89s - 514.99s | And then we figure out who opened the most. 514.99s - 516.29s | That person will win. 516.29s - 519.39s | And if that's a tie, then we're looking at times. 519.39s - 524.89s | And looking at times, of looking at marks, 524.89s - 526.89s | what are we actually looking for? 526.89s - 531.29s | Well, so we're filing those keys. 531.29s - 534.09s | We normally use round files for it, but that's all technical. 534.09s - 537.09s | So your key will look weirdish 537.09s - 540.79s | if you look at the shape of


chunk_text:
a normal competition, 487.59s - 490.19s | first round takes about an hour. 490.19s - 493.69s | And the first maybe six, depending on where you are, 493.69s - 499.09s | the first six to open go in, progress to the final round. 499.09s - 503.09s | Which means they get six different locks. 503.09s - 504.29s | And they open them. 504.29s - 506.69s | And then you do that in a roundabout way, 506.69s - 508.39s | same as with the picking. 508.39s - 511.89s | So all the finalists open, they're all six locks. 511.89s - 514.99s | And then we figure out who opened the most. 514.99s - 516.29s | That person will win. 516.29s - 519.39s | And if that's a tie, then we're looking at times. 519.39s - 524.89s | And looking at times, of looking at marks, 524.89s - 526.89s | what are we actually looking for? 526.89s - 531.29s | Well, so we're filing those keys. 531.29s - 534.09s | We normally use round files for it, but that's all technical. 534.09s - 537.09s | So your key will look weirdish 537.09s - 540.79s | if you look at the shape of the cuts because those are round. 540.79s - 543.09s | But that's also, for me, that's a good thing 543.09s - 545.19s | because that means that the bottom of that cut 545.19s - 549.19s | will be smooth instead of a sharp valley. 549.19s - 552.69s | And then you can actually way easier hunt for marks there. 552.69s - 555.79s | And you can see at the bottom of those two pictures, 555.79s - 558.79s | you can see quite distinct marks in this case. 558.79s - 560.49s | They're not always that clear. 560.49s - 563.09s | But well, for pictures, this is good. 563.09s - 565.19s | So yeah, it's a hand file. 565.19s - 569.29s | And like I said, first round is about an hour. 569.29s - 573.79s | And mostly about a half of the field will open within that a lot of time. 573.79s - 579.20s | Some people will be a bit faster. 579.20s - 580.50s | That's a law. 580.50s - 584.10s | Order of magnitude or so faster, maybe. 584.10s - 585.40s | Yeah, and then what other kinds of competitions? 585.40s - 588.50s | So there's also safe


chunk_text:
the cuts because those are round. 540.79s - 543.09s | But that's also, for me, that's a good thing 543.09s - 545.19s | because that means that the bottom of that cut 545.19s - 549.19s | will be smooth instead of a sharp valley. 549.19s - 552.69s | And then you can actually way easier hunt for marks there. 552.69s - 555.79s | And you can see at the bottom of those two pictures, 555.79s - 558.79s | you can see quite distinct marks in this case. 558.79s - 560.49s | They're not always that clear. 560.49s - 563.09s | But well, for pictures, this is good. 563.09s - 565.19s | So yeah, it's a hand file. 565.19s - 569.29s | And like I said, first round is about an hour. 569.29s - 573.79s | And mostly about a half of the field will open within that a lot of time. 573.79s - 579.20s | Some people will be a bit faster. 579.20s - 580.50s | That's a law. 580.50s - 584.10s | Order of magnitude or so faster, maybe. 584.10s - 585.40s | Yeah, and then what other kinds of competitions? 585.40s - 588.50s | So there's also safe manipulation or safe cracking, if you will. 588.50s - 591.40s | But here we don't have the entire safe shipping. 591.40s - 595.30s | Big metal boxes to competitions would be painful and expensive. 595.40s - 598.60s | So we just have the actual safe lock mounted on a piece of plastic. 598.60s - 603.20s | The idea here is to figure out how to open the safe dial in the fastest time, 603.20s - 604.40s | just like everything else. 604.40s - 605.90s | How you actually open a safe dial, 605.90s - 608.80s | it's a bit different than lock picking, than impressioning. 608.80s - 610.00s | Completely different mechanism, right? 610.00s - 611.70s | And so the attack is different. 611.70s - 615.20s | Instead of using straight feel like you would with lock picking, 615.20s - 617.60s | you're actually using sight and feel combined. 617.60s - 619.90s | And then you're doing a little bit of math homework, 619.90s - 622.10s | which is always fun in a competition. 622.10s - 625.50s | You're building very nice graphs to show how you open the lock. 625.50s - 629.40s | In competition, there's usually about three


chunk_text:
manipulation or safe cracking, if you will. 588.50s - 591.40s | But here we don't have the entire safe shipping. 591.40s - 595.30s | Big metal boxes to competitions would be painful and expensive. 595.40s - 598.60s | So we just have the actual safe lock mounted on a piece of plastic. 598.60s - 603.20s | The idea here is to figure out how to open the safe dial in the fastest time, 603.20s - 604.40s | just like everything else. 604.40s - 605.90s | How you actually open a safe dial, 605.90s - 608.80s | it's a bit different than lock picking, than impressioning. 608.80s - 610.00s | Completely different mechanism, right? 610.00s - 611.70s | And so the attack is different. 611.70s - 615.20s | Instead of using straight feel like you would with lock picking, 615.20s - 617.60s | you're actually using sight and feel combined. 617.60s - 619.90s | And then you're doing a little bit of math homework, 619.90s - 622.10s | which is always fun in a competition. 622.10s - 625.50s | You're building very nice graphs to show how you open the lock. 625.50s - 629.40s | In competition, there's usually about three locks that are very commonly used. 629.40s - 633.10s | I'd say the S&G 6730 is by far the most common. 633.10s - 634.60s | So if you want to start practicing this hobby, 634.60s - 636.30s | go on eBay and buy yourself one of those. 636.30s - 638.30s | They're usually about $50. 638.30s - 640.70s | There's also the Legarde 3300. 640.70s - 642.50s | That one is a little bit trickier. 642.50s - 645.10s | But if you want to practice a couple things, that's a good one to try. 645.10s - 648.60s | And then finally, the Big Red is just kind of the prettiest lock you can buy. 648.60s - 651.30s | Look, it's got nice red wheels. 651.30s - 654.10s | So what are we feeling for when we're actually manipulating this lock? 654.10s - 656.70s | You're dialing a number, and then you're going back. 656.70s - 658.50s | And if you know anything about how you open an actual safe, 658.50s - 661.30s | if you know the combination, you would dial, you know, the wheel, 661.30s - 664.70s | three different numbers, and then you go back to center, back


chunk_text:
locks that are very commonly used. 629.40s - 633.10s | I'd say the S&G 6730 is by far the most common. 633.10s - 634.60s | So if you want to start practicing this hobby, 634.60s - 636.30s | go on eBay and buy yourself one of those. 636.30s - 638.30s | They're usually about $50. 638.30s - 640.70s | There's also the Legarde 3300. 640.70s - 642.50s | That one is a little bit trickier. 642.50s - 645.10s | But if you want to practice a couple things, that's a good one to try. 645.10s - 648.60s | And then finally, the Big Red is just kind of the prettiest lock you can buy. 648.60s - 651.30s | Look, it's got nice red wheels. 651.30s - 654.10s | So what are we feeling for when we're actually manipulating this lock? 654.10s - 656.70s | You're dialing a number, and then you're going back. 656.70s - 658.50s | And if you know anything about how you open an actual safe, 658.50s - 661.30s | if you know the combination, you would dial, you know, the wheel, 661.30s - 664.70s | three different numbers, and then you go back to center, back to zero, 664.70s - 668.30s | and you rotate it, and this nose will drop in. 668.30s - 670.00s | It's not us. I don't think that's me. 670.00s - 672.40s | And we'll drop in and retract the bolt here. 672.40s - 674.90s | You can see the nose has dropped into that brass circle there. 674.90s - 677.60s | If it's not going to drop in, you'll see it rides along that brass circle, 677.60s - 680.20s | but then it actually collides with it on both sides. 680.20s - 683.60s | And where it collides is usually somewhere around 95 and 5. 683.60s - 688.90s | And so if you try a number, and then you try 95 and 5, try a different number, 688.90s - 691.40s | feel where those points are hitting. 691.40s - 695.90s | The closer you get to the correct code, the numbers will actually start to converge 695.90s - 700.50s | because that nose is actually going a little bit lower into that brass wheel. 700.50s - 705.70s | And so instead of 95 and 5, eventually you might get 96 and 4. 705.70s - 708.90s | And that's when you


chunk_text:
to zero, 664.70s - 668.30s | and you rotate it, and this nose will drop in. 668.30s - 670.00s | It's not us. I don't think that's me. 670.00s - 672.40s | And we'll drop in and retract the bolt here. 672.40s - 674.90s | You can see the nose has dropped into that brass circle there. 674.90s - 677.60s | If it's not going to drop in, you'll see it rides along that brass circle, 677.60s - 680.20s | but then it actually collides with it on both sides. 680.20s - 683.60s | And where it collides is usually somewhere around 95 and 5. 683.60s - 688.90s | And so if you try a number, and then you try 95 and 5, try a different number, 688.90s - 691.40s | feel where those points are hitting. 691.40s - 695.90s | The closer you get to the correct code, the numbers will actually start to converge 695.90s - 700.50s | because that nose is actually going a little bit lower into that brass wheel. 700.50s - 705.70s | And so instead of 95 and 5, eventually you might get 96 and 4. 705.70s - 708.90s | And that's when you know, okay, I found the correct number for one of those three digits. 708.90s - 711.50s | So you graph that. You build this graph out. 711.50s - 713.80s | You find that point, and then there's some tests you can do to figure out 713.80s - 715.50s | if it's the first, second, or third number. 715.50s - 719.50s | And then you start dialing the second number or third number until you get it open. 719.50s - 721.10s | There are some A's you can bring as well, 721.10s - 724.70s | like this sticker that you see on top of this safe dial you stuck on here. 724.70s - 729.50s | This gives you very fine gradients because it isn't always quite as clear as 95 to 94. 729.50s - 732.40s | Sometimes it's 95 to 94.5. 732.40s - 735.50s | And so this extra lines will help you find that exact number. 735.50s - 739.10s | So it's a time-consuming process, but some people get very fast at it 739.10s - 742.30s | and can open locks in, you know, 20 minutes maybe. 742.30s - 746.10s | In a regular competition with non-professionals spinning the wheels,


chunk_text:
know, okay, I found the correct number for one of those three digits. 708.90s - 711.50s | So you graph that. You build this graph out. 711.50s - 713.80s | You find that point, and then there's some tests you can do to figure out 713.80s - 715.50s | if it's the first, second, or third number. 715.50s - 719.50s | And then you start dialing the second number or third number until you get it open. 719.50s - 721.10s | There are some A's you can bring as well, 721.10s - 724.70s | like this sticker that you see on top of this safe dial you stuck on here. 724.70s - 729.50s | This gives you very fine gradients because it isn't always quite as clear as 95 to 94. 729.50s - 732.40s | Sometimes it's 95 to 94.5. 732.40s - 735.50s | And so this extra lines will help you find that exact number. 735.50s - 739.10s | So it's a time-consuming process, but some people get very fast at it 739.10s - 742.30s | and can open locks in, you know, 20 minutes maybe. 742.30s - 746.10s | In a regular competition with non-professionals spinning the wheels, 746.10s - 749.10s | it's, you know, two hours is probably a good time. 749.10s - 751.60s | Usually these competitions run during a larger event. 751.60s - 754.10s | So you have all day with the lock that you're playing with it 754.10s - 757.10s | while other people are giving talks or other people competing in other things. 757.10s - 758.00s | You can keep working on it. 758.00s - 763.00s | So that's typically how safe manipulation works at these events. 763.10s - 766.60s | And then finally, another type of competition we see a lot of is lever lock picking. 766.60s - 771.00s | This is particularly common in Europe where you have the kind of older lever style locks 771.00s - 773.40s | like you see a lot in England. 773.40s - 775.60s | Completely different tools, a little bit different skill set, 775.60s - 777.50s | but you're still basically just picking a lock. 777.50s - 778.50s | Same ideas. 778.50s - 781.60s | These locks are also a little bit bigger, a little bit heavier. 781.60s - 782.90s | So we're not passing them around. 782.90s - 786.60s | It's more kind of


chunk_text:
746.10s - 749.10s | it's, you know, two hours is probably a good time. 749.10s - 751.60s | Usually these competitions run during a larger event. 751.60s - 754.10s | So you have all day with the lock that you're playing with it 754.10s - 757.10s | while other people are giving talks or other people competing in other things. 757.10s - 758.00s | You can keep working on it. 758.00s - 763.00s | So that's typically how safe manipulation works at these events. 763.10s - 766.60s | And then finally, another type of competition we see a lot of is lever lock picking. 766.60s - 771.00s | This is particularly common in Europe where you have the kind of older lever style locks 771.00s - 773.40s | like you see a lot in England. 773.40s - 775.60s | Completely different tools, a little bit different skill set, 775.60s - 777.50s | but you're still basically just picking a lock. 777.50s - 778.50s | Same ideas. 778.50s - 781.60s | These locks are also a little bit bigger, a little bit heavier. 781.60s - 782.90s | So we're not passing them around. 782.90s - 786.60s | It's more kind of like the impressioning thing where you're sitting at one lock for a while 786.60s - 789.60s | and you see how fast you get it while other people try the same lock. 789.60s - 791.90s | Tools are often provided for you for these 791.90s - 795.00s | because the tools are very specialized per the manufacturer of locks. 795.00s - 799.20s | So most people aren't carrying around 50 different brands of tools for 50 different kinds of locks. 799.20s - 802.30s | So whoever is providing the locks for the competition often also provides the tools, 802.30s - 805.60s | which is a nice perk. 805.60s - 807.60s | We also have a bunch of crazy events. 807.60s - 812.00s | And I think there's actually one going on next door like right now, a dozer drill. 812.00s - 815.40s | But people, of course, get creative at different hacker cons. 815.40s - 816.50s | They want to try new things. 816.50s - 818.70s | And so you can find all kinds of different events. 818.70s - 821.80s | Dozer drill is kind of like what you see a photo of here on the screen. 821.80s - 824.50s


chunk_text:
like the impressioning thing where you're sitting at one lock for a while 786.60s - 789.60s | and you see how fast you get it while other people try the same lock. 789.60s - 791.90s | Tools are often provided for you for these 791.90s - 795.00s | because the tools are very specialized per the manufacturer of locks. 795.00s - 799.20s | So most people aren't carrying around 50 different brands of tools for 50 different kinds of locks. 799.20s - 802.30s | So whoever is providing the locks for the competition often also provides the tools, 802.30s - 805.60s | which is a nice perk. 805.60s - 807.60s | We also have a bunch of crazy events. 807.60s - 812.00s | And I think there's actually one going on next door like right now, a dozer drill. 812.00s - 815.40s | But people, of course, get creative at different hacker cons. 815.40s - 816.50s | They want to try new things. 816.50s - 818.70s | And so you can find all kinds of different events. 818.70s - 821.80s | Dozer drill is kind of like what you see a photo of here on the screen. 821.80s - 824.50s | This is kind of a simulation of a prison escape, right? 824.50s - 825.70s | You've been locked up. 825.70s - 827.20s | You need to get yourself out of handcuffs. 827.20s - 829.00s | And then you need to get yourself out of a jail cell. 829.00s - 831.70s | And then you need to get into a file cabinet to steal your police record. 831.70s - 835.30s | And then you need to get into a police car and steal it and drive away. 835.30s - 840.00s | So there are all kinds of different locks on the table to simulate that kind of escape. 840.00s - 842.30s | And then there's also different kinds of things like forensic challenges. 842.30s - 844.00s | Can you pick a lock without leaving marks in it? 844.00s - 845.80s | Or can you identify the marks that were left in it? 845.90s - 849.00s | Or can you tell what kind of pins are actually in this lock by feel? 849.00s - 849.70s | Is that a spool? 849.70s - 850.90s | Is it serrated? 850.90s - 852.30s | Those kinds of things. 852.30s - 854.80s | There's freestyle


chunk_text:
| This is kind of a simulation of a prison escape, right? 824.50s - 825.70s | You've been locked up. 825.70s - 827.20s | You need to get yourself out of handcuffs. 827.20s - 829.00s | And then you need to get yourself out of a jail cell. 829.00s - 831.70s | And then you need to get into a file cabinet to steal your police record. 831.70s - 835.30s | And then you need to get into a police car and steal it and drive away. 835.30s - 840.00s | So there are all kinds of different locks on the table to simulate that kind of escape. 840.00s - 842.30s | And then there's also different kinds of things like forensic challenges. 842.30s - 844.00s | Can you pick a lock without leaving marks in it? 844.00s - 845.80s | Or can you identify the marks that were left in it? 845.90s - 849.00s | Or can you tell what kind of pins are actually in this lock by feel? 849.00s - 849.70s | Is that a spool? 849.70s - 850.90s | Is it serrated? 850.90s - 852.30s | Those kinds of things. 852.30s - 854.80s | There's freestyle events, which is like go crazy. 854.80s - 856.00s | Bring whatever tool you want. 856.00s - 857.20s | Open the lock however you want. 857.20s - 859.10s | See how it goes. 859.10s - 860.50s | As long as it's non-destructive. 860.50s - 860.90s | Yeah, yeah. 860.90s - 862.20s | You can't cut the lock in half. 862.20s - 865.40s | But yeah. 865.40s - 869.80s | And then key duplication based on a photo rather than having the lock to try. 869.80s - 875.00s | Kind of like impressioning different kinds of boxes of locks, time blocks. 875.10s - 877.20s | You see things like under door tool things as well. 877.20s - 880.30s | Trying to get into buildings just bypassing the lock entirely. 880.30s - 881.60s | Or pick-tac-toe. 881.60s - 888.40s | It's something that the Foxpic people put together to pick locks and try to get the fastest, you know, to get three in a row. 888.40s - 890.50s | So all kinds of really fun, creative things. 890.50s - 895.40s | We like coming up with different kinds of competitions to always keep it fresh and interesting. 895.40s - 897.70s | So


chunk_text:
events, which is like go crazy. 854.80s - 856.00s | Bring whatever tool you want. 856.00s - 857.20s | Open the lock however you want. 857.20s - 859.10s | See how it goes. 859.10s - 860.50s | As long as it's non-destructive. 860.50s - 860.90s | Yeah, yeah. 860.90s - 862.20s | You can't cut the lock in half. 862.20s - 865.40s | But yeah. 865.40s - 869.80s | And then key duplication based on a photo rather than having the lock to try. 869.80s - 875.00s | Kind of like impressioning different kinds of boxes of locks, time blocks. 875.10s - 877.20s | You see things like under door tool things as well. 877.20s - 880.30s | Trying to get into buildings just bypassing the lock entirely. 880.30s - 881.60s | Or pick-tac-toe. 881.60s - 888.40s | It's something that the Foxpic people put together to pick locks and try to get the fastest, you know, to get three in a row. 888.40s - 890.50s | So all kinds of really fun, creative things. 890.50s - 895.40s | We like coming up with different kinds of competitions to always keep it fresh and interesting. 895.40s - 897.70s | So that brings us to where do you compete? 897.70s - 899.20s | We've talked about all different kinds of things. 899.20s - 899.50s | Okay. 899.50s - 900.70s | So we've gotten you excited about this. 900.70s - 902.40s | Hopefully you want to come give it a try. 902.40s - 906.60s | Where can you go to do this other than, you know, in DEF CON in the Lockpick Village? 906.60s - 909.40s | Well, probably the biggest and best event we'll start with first. 909.40s - 911.60s | And that's you, since you've run it before. 911.60s - 912.60s | Yeah. 912.60s - 914.70s | Hello. 914.70s - 917.50s | Like Matt said, you can compete, well, basically all over the world. 917.50s - 921.50s | But the one you really want to compete in and win is LockCon. 921.50s - 926.50s | So that's considered to be the, well, the Wimbledon of the Lockpick world. 926.50s - 929.20s | It's one of the oldest competitions there. 929.20s - 933.00s | It's, well, in the Netherlands, they do the Dutch Open. 933.00s - 933.60s | It's quite small. 933.60s - 937.70s | It's about 100 people, but those


chunk_text:
that brings us to where do you compete? 897.70s - 899.20s | We've talked about all different kinds of things. 899.20s - 899.50s | Okay. 899.50s - 900.70s | So we've gotten you excited about this. 900.70s - 902.40s | Hopefully you want to come give it a try. 902.40s - 906.60s | Where can you go to do this other than, you know, in DEF CON in the Lockpick Village? 906.60s - 909.40s | Well, probably the biggest and best event we'll start with first. 909.40s - 911.60s | And that's you, since you've run it before. 911.60s - 912.60s | Yeah. 912.60s - 914.70s | Hello. 914.70s - 917.50s | Like Matt said, you can compete, well, basically all over the world. 917.50s - 921.50s | But the one you really want to compete in and win is LockCon. 921.50s - 926.50s | So that's considered to be the, well, the Wimbledon of the Lockpick world. 926.50s - 929.20s | It's one of the oldest competitions there. 929.20s - 933.00s | It's, well, in the Netherlands, they do the Dutch Open. 933.00s - 933.60s | It's quite small. 933.60s - 937.70s | It's about 100 people, but those tend to be from all around the world. 937.70s - 939.00s | So it's brilliant. 939.00s - 942.00s | It's mostly, normally it's in October-ish. 942.00s - 945.20s | Takes about three days, so a long weekend. 945.20s - 947.20s | Last couple of times it was in a hotel. 947.20s - 949.80s | And so it's all catered, all done. 949.80s - 956.00s | And you'll be spending time with a lot of people and a lot of locks during that time. 956.00s - 962.00s | There will always be, well, just regular picking games. 962.00s - 964.30s | Impressioning also, definitely. 964.30s - 968.10s | Most of the time lever locks will do safe manipulation. 968.10s - 971.90s | Last year we had a car entry. 971.90s - 975.30s | There's just a lot of, lot of, lot of talks, and they keep on going on and on. 975.30s - 977.70s | It's really, really brilliant. 977.70s - 980.10s | It's fun times to be there. 980.10s - 981.90s | So, yeah, this is the same. 982.00s - 989.90s | Yeah, this, I mean, competitions, like I said, table to table, and also a lot of talks. 989.90s


chunk_text:
tend to be from all around the world. 937.70s - 939.00s | So it's brilliant. 939.00s - 942.00s | It's mostly, normally it's in October-ish. 942.00s - 945.20s | Takes about three days, so a long weekend. 945.20s - 947.20s | Last couple of times it was in a hotel. 947.20s - 949.80s | And so it's all catered, all done. 949.80s - 956.00s | And you'll be spending time with a lot of people and a lot of locks during that time. 956.00s - 962.00s | There will always be, well, just regular picking games. 962.00s - 964.30s | Impressioning also, definitely. 964.30s - 968.10s | Most of the time lever locks will do safe manipulation. 968.10s - 971.90s | Last year we had a car entry. 971.90s - 975.30s | There's just a lot of, lot of, lot of talks, and they keep on going on and on. 975.30s - 977.70s | It's really, really brilliant. 977.70s - 980.10s | It's fun times to be there. 980.10s - 981.90s | So, yeah, this is the same. 982.00s - 989.90s | Yeah, this, I mean, competitions, like I said, table to table, and also a lot of talks. 989.90s - 1001.60s | The picture on the right, that's actually a person that broke out of jail in a South African imprisonment. 1001.60s - 1007.60s | And yeah, he taught himself how to pick locks and to make tools to pick locks. 1007.60s - 1012.60s | And that was fun, because normally when he gets invited to talk about this stuff, 1012.60s - 1015.40s | they talk about how it was to be in prison, this and that. 1015.40s - 1022.20s | And this was the first time he could speak to a couple of geeks who were geeking out about how he made lockpicks. 1022.20s - 1025.30s | So that was a very, very fun experience. 1025.30s - 1031.30s | That's actually one of the very few talks that has been ever recorded at LockOn, 1031.30s - 1036.80s | because normally it's a non-cabaret event, at least non-publicity. 1036.80s - 1041.40s | And you tend to only can get in if you know people. 1041.40s - 1047.00s | So it's, well, it's not that a lot of what happens there is a secret, 1047.00s - 1049.00s | but a lot of our toys are quite expensive. 1049.00s - 1051.10s


chunk_text:
- 1001.60s | The picture on the right, that's actually a person that broke out of jail in a South African imprisonment. 1001.60s - 1007.60s | And yeah, he taught himself how to pick locks and to make tools to pick locks. 1007.60s - 1012.60s | And that was fun, because normally when he gets invited to talk about this stuff, 1012.60s - 1015.40s | they talk about how it was to be in prison, this and that. 1015.40s - 1022.20s | And this was the first time he could speak to a couple of geeks who were geeking out about how he made lockpicks. 1022.20s - 1025.30s | So that was a very, very fun experience. 1025.30s - 1031.30s | That's actually one of the very few talks that has been ever recorded at LockOn, 1031.30s - 1036.80s | because normally it's a non-cabaret event, at least non-publicity. 1036.80s - 1041.40s | And you tend to only can get in if you know people. 1041.40s - 1047.00s | So it's, well, it's not that a lot of what happens there is a secret, 1047.00s - 1049.00s | but a lot of our toys are quite expensive. 1049.00s - 1051.10s | And we just leave our toys out at night. 1051.10s - 1057.30s | And yeah, because it's a friendly group and it's a close-knit known group, you can actually do that. 1057.30s - 1061.40s | But it's a very, very, very fun event. 1061.40s - 1063.50s | Lockfest. 1063.50s - 1065.80s | And what are we going to do, lock up our toys? 1065.80s - 1068.10s | Yeah, yeah, yeah, it's locks, right? 1068.10s - 1069.70s | Yeah, no, and Tim was great. 1069.70s - 1071.60s | You know, you get some really, really good talks. 1071.60s - 1074.10s | I enjoy that part of it every year. 1074.10s - 1077.30s | You know, I think he even had a movie made about him, right? 1077.30s - 1078.90s | Daniel Radcliffe played him in the movies. 1078.90s - 1080.20s | Yeah. 1080.20s - 1082.20s | Yeah, very cool stuff. 1082.20s - 1085.90s | Cool. So if that's maybe a little too far for your first lockpicking competition, 1085.90s - 1088.90s | you can look a little bit closer to the U.S. if you're from here. 1088.90s - 1090.60s | We have Lockfest almost every year. 1090.60s - 1092.00s |


chunk_text:
| And we just leave our toys out at night. 1051.10s - 1057.30s | And yeah, because it's a friendly group and it's a close-knit known group, you can actually do that. 1057.30s - 1061.40s | But it's a very, very, very fun event. 1061.40s - 1063.50s | Lockfest. 1063.50s - 1065.80s | And what are we going to do, lock up our toys? 1065.80s - 1068.10s | Yeah, yeah, yeah, it's locks, right? 1068.10s - 1069.70s | Yeah, no, and Tim was great. 1069.70s - 1071.60s | You know, you get some really, really good talks. 1071.60s - 1074.10s | I enjoy that part of it every year. 1074.10s - 1077.30s | You know, I think he even had a movie made about him, right? 1077.30s - 1078.90s | Daniel Radcliffe played him in the movies. 1078.90s - 1080.20s | Yeah. 1080.20s - 1082.20s | Yeah, very cool stuff. 1082.20s - 1085.90s | Cool. So if that's maybe a little too far for your first lockpicking competition, 1085.90s - 1088.90s | you can look a little bit closer to the U.S. if you're from here. 1088.90s - 1090.60s | We have Lockfest almost every year. 1090.60s - 1092.00s | Hopefully we'll have it again next year. 1092.00s - 1094.00s | There was a pause for COVID. 1094.10s - 1095.90s | It's been in Seattle a number of years. 1095.90s - 1098.20s | I don't know where the next one will be, but hopefully soon. 1098.20s - 1100.50s | Go tell tool people you want to have Lockfest back. 1100.50s - 1101.90s | Make it happen. 1101.90s - 1104.00s | It's usually, again, a weekend-long event. 1104.00s - 1104.90s | There's lockpicking. 1104.90s - 1106.70s | There's safe opening. 1106.70s - 1110.10s | Here you can see the timed competition that I built with a couple of folks 1110.10s - 1113.60s | and people compete on to see how quickly they can get locks open. 1113.60s - 1114.80s | Again, a lot of good talks. 1114.80s - 1116.20s | Pretty small conference, again. 1116.20s - 1118.20s | You know, the lock community is a pretty tight-knit group, 1118.20s - 1121.20s | so maybe about 60, 80 people will show up for this. 1121.20s - 1122.30s | Just have a really good time. 1122.30s - 1124.90s | Have some good talks. 1124.90s - 1128.50s | If you're a little bit more


chunk_text:
Hopefully we'll have it again next year. 1092.00s - 1094.00s | There was a pause for COVID. 1094.10s - 1095.90s | It's been in Seattle a number of years. 1095.90s - 1098.20s | I don't know where the next one will be, but hopefully soon. 1098.20s - 1100.50s | Go tell tool people you want to have Lockfest back. 1100.50s - 1101.90s | Make it happen. 1101.90s - 1104.00s | It's usually, again, a weekend-long event. 1104.00s - 1104.90s | There's lockpicking. 1104.90s - 1106.70s | There's safe opening. 1106.70s - 1110.10s | Here you can see the timed competition that I built with a couple of folks 1110.10s - 1113.60s | and people compete on to see how quickly they can get locks open. 1113.60s - 1114.80s | Again, a lot of good talks. 1114.80s - 1116.20s | Pretty small conference, again. 1116.20s - 1118.20s | You know, the lock community is a pretty tight-knit group, 1118.20s - 1121.20s | so maybe about 60, 80 people will show up for this. 1121.20s - 1122.30s | Just have a really good time. 1122.30s - 1124.90s | Have some good talks. 1124.90s - 1128.50s | If you're a little bit more in the Midwest, there's always Locktoberfest in October. 1128.50s - 1131.10s | It is held by Tool Chicago. 1131.10s - 1132.10s | Seems like a really good event. 1132.10s - 1135.30s | I have not been there, but I always see photos, and it looks super fun. 1135.30s - 1138.00s | So maybe one day I'll make it out there when I can spare the time. 1138.00s - 1139.60s | But they have, you know, grilling. 1139.60s - 1142.00s | You can get some beer and some brats and go pick locks. 1142.00s - 1145.40s | So, you know, proper Locktoberfest. 1145.40s - 1148.30s | And here's a photo of some people winning some locks and other various picks 1148.30s - 1154.90s | and cool things from their conference from a couple of years ago. 1154.90s - 1160.10s | But if you're really into spending your AMLs, head out to Australia. 1160.10s - 1162.50s | Actually, well, this happened three times now, I think. 1162.50s - 1167.70s | In Melbourne, there is All Second. 1167.70s - 1171.30s | It's the same ish as the other events, but it's Australia, 1171.30s - 1174.60s | so it has a completely different feel


chunk_text:
in the Midwest, there's always Locktoberfest in October. 1128.50s - 1131.10s | It is held by Tool Chicago. 1131.10s - 1132.10s | Seems like a really good event. 1132.10s - 1135.30s | I have not been there, but I always see photos, and it looks super fun. 1135.30s - 1138.00s | So maybe one day I'll make it out there when I can spare the time. 1138.00s - 1139.60s | But they have, you know, grilling. 1139.60s - 1142.00s | You can get some beer and some brats and go pick locks. 1142.00s - 1145.40s | So, you know, proper Locktoberfest. 1145.40s - 1148.30s | And here's a photo of some people winning some locks and other various picks 1148.30s - 1154.90s | and cool things from their conference from a couple of years ago. 1154.90s - 1160.10s | But if you're really into spending your AMLs, head out to Australia. 1160.10s - 1162.50s | Actually, well, this happened three times now, I think. 1162.50s - 1167.70s | In Melbourne, there is All Second. 1167.70s - 1171.30s | It's the same ish as the other events, but it's Australia, 1171.30s - 1174.60s | so it has a completely different feel to it. 1174.60s - 1175.90s | Also, a lot of talks. 1175.90s - 1177.30s | Very interested. 1177.30s - 1181.50s | Speakers flown in from, well, basically all around the world. 1181.50s - 1186.20s | But the people there, so the attendants, are mainly Australians. 1186.20s - 1187.50s | And it's fun. It's brilliant. 1187.50s - 1191.20s | And, of course, for us international lockpickers, if you go there, 1191.20s - 1196.10s | they have different locks, and those locks are different beasts, 1196.10s - 1198.10s | and they need to be attacked in different ways. 1198.10s - 1200.10s | So that's very fun. 1200.10s - 1204.90s | That's normally in June, and, well, they have workshops locked and everything. 1205.00s - 1208.80s | So we did have picking there, master keying. 1208.80s - 1212.00s | We actually did have an impressioning event at one point, 1212.00s - 1215.50s | and they're also quite big on temper evidence. 1215.50s - 1221.40s | So, yeah, that's a very, very, very fun event. 1221.40s - 1227.60s | Toby, the head organizer, did take a break because of work and life and all the stuff. 1227.60s - 1232.70s | It'll probably happen again,


chunk_text:
to it. 1174.60s - 1175.90s | Also, a lot of talks. 1175.90s - 1177.30s | Very interested. 1177.30s - 1181.50s | Speakers flown in from, well, basically all around the world. 1181.50s - 1186.20s | But the people there, so the attendants, are mainly Australians. 1186.20s - 1187.50s | And it's fun. It's brilliant. 1187.50s - 1191.20s | And, of course, for us international lockpickers, if you go there, 1191.20s - 1196.10s | they have different locks, and those locks are different beasts, 1196.10s - 1198.10s | and they need to be attacked in different ways. 1198.10s - 1200.10s | So that's very fun. 1200.10s - 1204.90s | That's normally in June, and, well, they have workshops locked and everything. 1205.00s - 1208.80s | So we did have picking there, master keying. 1208.80s - 1212.00s | We actually did have an impressioning event at one point, 1212.00s - 1215.50s | and they're also quite big on temper evidence. 1215.50s - 1221.40s | So, yeah, that's a very, very, very fun event. 1221.40s - 1227.60s | Toby, the head organizer, did take a break because of work and life and all the stuff. 1227.60s - 1232.70s | It'll probably happen again, but probably not this year. 1232.70s - 1234.30s | Well, definitely not this year. 1234.30s - 1237.40s | Probably not next year as well, but it's still in the books. 1237.40s - 1240.10s | At some point that will happen. 1240.10s - 1244.90s | You see, well, a box of weird keys that they do have there, 1244.90s - 1250.50s | and some keys are giving a lecture about impressioning. 1250.50s - 1257.60s | Yeah, and then in Europe, well, like I said, there's lock-on in the Netherlands. 1257.60s - 1265.20s | The Germans do every now and then also have end impressioning competitions, 1265.20s - 1268.00s | and on a separate day, they'll do the lock-picking. 1268.00s - 1275.10s | And the Czech guys at the moment are also doing that. 1275.10s - 1279.80s | Smaller-ish group, so 90 people, it's rather close to Prague, 1279.80s - 1282.80s | and that, well, they're doing that for quite a couple of years now. 1282.80s - 1285.40s | And as you can see, they have a couple of sponsors, 1285.40s - 1288.40s | which is not always the case within the lock-picking community, 1288.40s - 1289.60s | at least for an


chunk_text:
but probably not this year. 1232.70s - 1234.30s | Well, definitely not this year. 1234.30s - 1237.40s | Probably not next year as well, but it's still in the books. 1237.40s - 1240.10s | At some point that will happen. 1240.10s - 1244.90s | You see, well, a box of weird keys that they do have there, 1244.90s - 1250.50s | and some keys are giving a lecture about impressioning. 1250.50s - 1257.60s | Yeah, and then in Europe, well, like I said, there's lock-on in the Netherlands. 1257.60s - 1265.20s | The Germans do every now and then also have end impressioning competitions, 1265.20s - 1268.00s | and on a separate day, they'll do the lock-picking. 1268.00s - 1275.10s | And the Czech guys at the moment are also doing that. 1275.10s - 1279.80s | Smaller-ish group, so 90 people, it's rather close to Prague, 1279.80s - 1282.80s | and that, well, they're doing that for quite a couple of years now. 1282.80s - 1285.40s | And as you can see, they have a couple of sponsors, 1285.40s - 1288.40s | which is not always the case within the lock-picking community, 1288.40s - 1289.60s | at least for an event. 1289.60s - 1295.10s | Normally, the prizes get sponsored and stuff like that, but that's about it-ish. 1295.10s - 1297.70s | Is this yours? 1297.70s - 1298.30s | And where else? 1298.30s - 1301.10s | There's always a few smaller conferences or conferences that are bigger, 1301.10s - 1303.80s | but where there's a smaller lock-picking portion to it, 1303.80s - 1306.90s | of course, DEF CON right through there. 1306.90s - 1309.00s | It's pretty big here, yeah. 1309.00s - 1310.70s | There's HOPE in New York. 1310.70s - 1313.90s | There's ShmooCon in DC, at least one more year. 1313.90s - 1319.40s | CCC, EMF, all the various Dutch hacker cons that change their name annoyingly every year. 1319.40s - 1321.20s | For God's reasons. 1321.20s - 1325.40s | All the various B-sides often have lock-picking events that you can go participate in, 1325.40s - 1329.60s | and then Hacker Hotel, again in the Netherlands. 1329.60s - 1333.50s | Other than that, there's also locksmithing and safe technician conferences. 1333.50s - 1335.10s | These tend to be a little bit more invite-only. 1335.10s - 1338.00s | You probably need to be part of a locksmithing association. 1338.00s


chunk_text:
event. 1289.60s - 1295.10s | Normally, the prizes get sponsored and stuff like that, but that's about it-ish. 1295.10s - 1297.70s | Is this yours? 1297.70s - 1298.30s | And where else? 1298.30s - 1301.10s | There's always a few smaller conferences or conferences that are bigger, 1301.10s - 1303.80s | but where there's a smaller lock-picking portion to it, 1303.80s - 1306.90s | of course, DEF CON right through there. 1306.90s - 1309.00s | It's pretty big here, yeah. 1309.00s - 1310.70s | There's HOPE in New York. 1310.70s - 1313.90s | There's ShmooCon in DC, at least one more year. 1313.90s - 1319.40s | CCC, EMF, all the various Dutch hacker cons that change their name annoyingly every year. 1319.40s - 1321.20s | For God's reasons. 1321.20s - 1325.40s | All the various B-sides often have lock-picking events that you can go participate in, 1325.40s - 1329.60s | and then Hacker Hotel, again in the Netherlands. 1329.60s - 1333.50s | Other than that, there's also locksmithing and safe technician conferences. 1333.50s - 1335.10s | These tend to be a little bit more invite-only. 1335.10s - 1338.00s | You probably need to be part of a locksmithing association. 1338.00s - 1340.00s | Some of those are easier or harder to join, 1340.00s - 1345.00s | but you can go and do safe cracking and hear a lot of talks about that if that's your thing, 1345.00s - 1349.60s | and they have cool prizes like gold-plated locks when you win sponsors. 1349.60s - 1351.40s | So, that is it. 1351.40s - 1353.20s | That is all the different kinds of competitions. 1353.20s - 1354.70s | Those are the different ways you can compete. 1354.70s - 1357.00s | We wanted to thank a few people. 1357.00s - 1358.20s | Our co-authors. 1358.20s - 1360.40s | There were five of us that wrote the book. 1360.40s - 1363.70s | Three of us are not here, so Walter, Nigel, and Banditos. 1363.70s - 1366.50s | Really appreciate the sections of the book that they wrote. 1366.50s - 1367.00s | It was great. 1367.00s - 1370.10s | I want to thank specifically Peter South, who was our technical reviewer, 1370.10s - 1373.50s | and who's also here in the front row and has helped out with Tool and Seattle Locksport 1373.50s - 1376.00s | and co-run Seattle Locksport with me. 1376.00s - 1377.40s


chunk_text:
- 1340.00s | Some of those are easier or harder to join, 1340.00s - 1345.00s | but you can go and do safe cracking and hear a lot of talks about that if that's your thing, 1345.00s - 1349.60s | and they have cool prizes like gold-plated locks when you win sponsors. 1349.60s - 1351.40s | So, that is it. 1351.40s - 1353.20s | That is all the different kinds of competitions. 1353.20s - 1354.70s | Those are the different ways you can compete. 1354.70s - 1357.00s | We wanted to thank a few people. 1357.00s - 1358.20s | Our co-authors. 1358.20s - 1360.40s | There were five of us that wrote the book. 1360.40s - 1363.70s | Three of us are not here, so Walter, Nigel, and Banditos. 1363.70s - 1366.50s | Really appreciate the sections of the book that they wrote. 1366.50s - 1367.00s | It was great. 1367.00s - 1370.10s | I want to thank specifically Peter South, who was our technical reviewer, 1370.10s - 1373.50s | and who's also here in the front row and has helped out with Tool and Seattle Locksport 1373.50s - 1376.00s | and co-run Seattle Locksport with me. 1376.00s - 1377.40s | Super great guy. 1377.40s - 1378.70s | Lucky Duck, thanks for being here. 1378.70s - 1380.90s | You're awesome and my favorite. 1380.90s - 1386.40s | Thanks to Random Person from the Internet for the background photo that was Creative Commons, 1386.40s - 1389.90s | and then also thanks to Tool US for letting us come here and speak, 1389.90s - 1392.20s | and to DEF CON for letting us speak. 1392.20s - 1395.30s | Finally, if you want to get in touch, here are all the things. 1395.30s - 1398.00s | You can go to links and find me or us. 1398.00s - 1403.30s | But more importantly, we will be here at the book signing at the NoStarch booth at 2.30 today. 1403.30s - 1405.70s | So if you do not have a copy of our book and you would like one 1405.70s - 1409.50s | and you wanted to have at least two author signatures and a tech reviewer signature, 1409.50s - 1413.30s | 2.30, just there, vendor area east. 1413.30s - 1414.80s | We will be sitting there and signing things. 1414.80s - 1415.70s | So come say hi. 1415.70s - 1416.90s | Come get


chunk_text:
| Super great guy. 1377.40s - 1378.70s | Lucky Duck, thanks for being here. 1378.70s - 1380.90s | You're awesome and my favorite. 1380.90s - 1386.40s | Thanks to Random Person from the Internet for the background photo that was Creative Commons, 1386.40s - 1389.90s | and then also thanks to Tool US for letting us come here and speak, 1389.90s - 1392.20s | and to DEF CON for letting us speak. 1392.20s - 1395.30s | Finally, if you want to get in touch, here are all the things. 1395.30s - 1398.00s | You can go to links and find me or us. 1398.00s - 1403.30s | But more importantly, we will be here at the book signing at the NoStarch booth at 2.30 today. 1403.30s - 1405.70s | So if you do not have a copy of our book and you would like one 1405.70s - 1409.50s | and you wanted to have at least two author signatures and a tech reviewer signature, 1409.50s - 1413.30s | 2.30, just there, vendor area east. 1413.30s - 1414.80s | We will be sitting there and signing things. 1414.80s - 1415.70s | So come say hi. 1415.70s - 1416.90s | Come get books signed. 1416.90s - 1417.70s | Thank you so much. 1417.70s - 1418.50s | One more thing. 1418.50s - 1419.10s | Yes, yes. 1419.10s - 1421.30s | One more thing, hot from the press. 1421.30s - 1427.60s | As of last week, this book also exists in a Braille format. 1427.60s - 1429.50s | Cool. 1429.50s - 1431.10s | Yes, very cool. 1431.10s - 1436.80s | That is currently only in Europe because it has been transcribed there to make that happen. 1436.80s - 1441.80s | But as I understood, I am completely new to this format and this world. 1441.80s - 1446.00s | I do have a couple of blind friends, but of course, I don't do Braille. 1446.00s - 1451.40s | Apparently, the way it works, if it does exist in Europe, 1451.40s - 1454.20s | then it automagically will, at some point, 1454.20s - 1459.60s | will become available in American Braille libraries as well. 1459.60s - 1465.22s | So we think it's awesome. 1465.22s - 1466.32s | Thank you, DEF CON. 1466.32s - 1467.32s | Thank you.


chunk_text:
books signed. 1416.90s - 1417.70s | Thank you so much. 1417.70s - 1418.50s | One more thing. 1418.50s - 1419.10s | Yes, yes. 1419.10s - 1421.30s | One more thing, hot from the press. 1421.30s - 1427.60s | As of last week, this book also exists in a Braille format. 1427.60s - 1429.50s | Cool. 1429.50s - 1431.10s | Yes, very cool. 1431.10s - 1436.80s | That is currently only in Europe because it has been transcribed there to make that happen. 1436.80s - 1441.80s | But as I understood, I am completely new to this format and this world. 1441.80s - 1446.00s | I do have a couple of blind friends, but of course, I don't do Braille. 1446.00s - 1451.40s | Apparently, the way it works, if it does exist in Europe, 1451.40s - 1454.20s | then it automagically will, at some point, 1454.20s - 1459.60s | will become available in American Braille libraries as well. 1459.60s - 1465.22s | So we think it's awesome. 1465.22s - 1466.32s | Thank you, DEF CON. 1466.32s - 1467.32s | Thank you.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=fqFKbDib8CY", "title": "DEF CON 32 - Manufacturing Lessons Learned, Lessons Taught - Tim Chase", "description": "Manufacturing continues to be a top targeted sector by cyber threat actors, especially by ransomware. Dragos 2023 Year In Review showed that 70% of all ransomware victims were manufacturers. The Global Resilience Federation Ransomware Report shows very similar figures. There are some specific elements that make manufacturing a particularly attractive target for ransomware such as the lack of network security and segmentation, IT compromise that often leads to operational disruption (even if there is not OT network intrusion), manufacturing having tight margins, a lack of a compliance regime, and organizational size all contributing. Manufacturing continues to be a top targeted sector by cyber threat actors, especially by ransomware. Dragos 2023 Year In Review showed that 70% of all ransomware victims were manufacturers. The Global Resilience Federation Ransomware Report shows very similar figures. There are some specific elements that make manufacturing a particularly attractive target for ransomware such as the lack of network security and segmentation, IT compromise that often leads to operational disruption (even if there is not OT network intrusion), manufacturing having tight margins, a lack of a compliance regime, and organizational size all contributing.\n\nWhile manufacturing as a whole lags many other critical infrastructure sectors in aspects of cyber security there is a category that manufacturing has consistently led other industry verticals in, automation and device connectivity in the operational technology domain. Manufacturer\u2019s OT network environments increasingly are set up as a network or hyper connected IIoT devices, where all data goes to the cloud and often comes back from the cloud to offer changes, and all participants have access into the OT network domain allowing manufacturing to push the boundaries of what products are technically possible, what production efficiencies are possible, and how OT environments can scale as never before.\n\nThis has obviously come with downside risks that manufacturers are only now beginning to grapple with and to make meaningful changes to better protect their networks and the gains they have made. Their growing pains can serve as roadmap of what to do and what not to do as many other OT intensive industry verticals are moving very quickly into similar use cases.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1427, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 4.96s | This text was transcribed using whisper model: large-v2 My name is Tim Chase, and


chunk_text:
size all contributing.\n\nWhile manufacturing as a whole lags many other critical infrastructure sectors in aspects of cyber security there is a category that manufacturing has consistently led other industry verticals in, automation and device connectivity in the operational technology domain. Manufacturer\u2019s OT network environments increasingly are set up as a network or hyper connected IIoT devices, where all data goes to the cloud and often comes back from the cloud to offer changes, and all participants have access into the OT network domain allowing manufacturing to push the boundaries of what products are technically possible, what production efficiencies are possible, and how OT environments can scale as never before.\n\nThis has obviously come with downside risks that manufacturers are only now beginning to grapple with and to make meaningful changes to better protect their networks and the gains they have made. Their growing pains can serve as roadmap of what to do and what not to do as many other OT intensive industry verticals are moving very quickly into similar use cases.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1427, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 4.96s | This text was transcribed using whisper model: large-v2 My name is Tim Chase, and for the better part of a decade, I have supported a number of 4.96s - 10.36s | different critical and vital infrastructures, primarily by working in what are called information 10.36s - 15.58s | sharing and analysis centers for a number of different kind of sector-specific ISACs 15.58s - 18.44s | and ISAUs. 18.44s - 24.04s | So this talk is not about what ISACs are, and it's not about specifically what the manufacturing 24.04s - 28.84s | ISAC is, but if you're interested in what ISACs are, what they do, how they kind of 28.84s - 33.00s | work in the overall sort of information security space, I'd love to talk with you about that 33.00s - 38.88s | or manufacturing ISAC if you have any questions about that or any other topic after the presentation. 38.88s - 44.20s | And depending on how quickly I go, there might even be time for Q&A if you guys have any 44.20s - 45.20s | questions. 45.20s - 50.96s | So a couple of things about manufacturing before we get going. 50.96s - 54.36s | Manufacturing is defined by the United States government and some other entities as like 54.36s -


chunk_text:
for the better part of a decade, I have supported a number of 4.96s - 10.36s | different critical and vital infrastructures, primarily by working in what are called information 10.36s - 15.58s | sharing and analysis centers for a number of different kind of sector-specific ISACs 15.58s - 18.44s | and ISAUs. 18.44s - 24.04s | So this talk is not about what ISACs are, and it's not about specifically what the manufacturing 24.04s - 28.84s | ISAC is, but if you're interested in what ISACs are, what they do, how they kind of 28.84s - 33.00s | work in the overall sort of information security space, I'd love to talk with you about that 33.00s - 38.88s | or manufacturing ISAC if you have any questions about that or any other topic after the presentation. 38.88s - 44.20s | And depending on how quickly I go, there might even be time for Q&A if you guys have any 44.20s - 45.20s | questions. 45.20s - 50.96s | So a couple of things about manufacturing before we get going. 50.96s - 54.36s | Manufacturing is defined by the United States government and some other entities as like 54.36s - 60.44s | an industry vertical, and I've worked now sort of for manufacturing ISAC and leading 60.44s - 66.52s | that for two and a half-ish years, and it's the first industry vertical that's not really 66.52s - 67.52s | a vertical. 67.52s - 68.52s | It's not a vertical. 68.52s - 72.74s | It's actually like a horizontal modality that supports every single industry. 72.74s - 79.60s | It's not discrete like oil and gases or finances or, you know, electrical or something. 79.60s - 85.68s | And so it's kind of hard to generalize, and because of the size and type of manufacturing, 85.68s - 90.12s | it's also hard to kind of generalize manufacturing. 90.12s - 94.52s | With that said, we're going to make some generalizations about manufacturing. 94.52s - 98.16s | So we're going to start off with the good news about manufacturing. 98.16s - 103.52s | The good news is that manufacturers are really, really good at manufacturing, and I know that 103.52s - 104.52s | goes without saying. 104.52s - 106.36s | You're like, well, yeah, it's their business. 106.36s - 110.44s | But I think that all of us could think of


chunk_text:
60.44s | an industry vertical, and I've worked now sort of for manufacturing ISAC and leading 60.44s - 66.52s | that for two and a half-ish years, and it's the first industry vertical that's not really 66.52s - 67.52s | a vertical. 67.52s - 68.52s | It's not a vertical. 68.52s - 72.74s | It's actually like a horizontal modality that supports every single industry. 72.74s - 79.60s | It's not discrete like oil and gases or finances or, you know, electrical or something. 79.60s - 85.68s | And so it's kind of hard to generalize, and because of the size and type of manufacturing, 85.68s - 90.12s | it's also hard to kind of generalize manufacturing. 90.12s - 94.52s | With that said, we're going to make some generalizations about manufacturing. 94.52s - 98.16s | So we're going to start off with the good news about manufacturing. 98.16s - 103.52s | The good news is that manufacturers are really, really good at manufacturing, and I know that 103.52s - 104.52s | goes without saying. 104.52s - 106.36s | You're like, well, yeah, it's their business. 106.36s - 110.44s | But I think that all of us could think of like other industries that they're not good 110.44s - 112.04s | at their jobs. 112.04s - 114.64s | But manufacturers are really great at manufacturing. 114.64s - 120.68s | In fact, in human history, large portions of human history are essentially defined by 120.68s - 124.68s | technologies that manufacturers created to be better manufacturers. 124.68s - 130.04s | So whether that's use of water as a power source or steam or now electricity or, you 130.04s - 133.56s | know, now digitization of the manufacturing space. 133.56s - 138.80s | All of those were entirely or largely a result of sort of manufacturers wanting to manufacture 138.80s - 144.64s | more, better, faster, and able to do that, they needed to find and harness new technologies. 144.64s - 150.74s | So they're really good at not only embracing new technology, but actually creating technology 150.74s - 155.60s | that didn't exist to facilitate manufacturing. 155.60s - 160.96s | Now we've moved past the point that, you know, we're using electricity to kind of help automate 161.08s - 166.24s | and we're using, you know, digital systems to help automate and increase productivity. 166.24s - 171.52s | But now, manufacturing


chunk_text:
like other industries that they're not good 110.44s - 112.04s | at their jobs. 112.04s - 114.64s | But manufacturers are really great at manufacturing. 114.64s - 120.68s | In fact, in human history, large portions of human history are essentially defined by 120.68s - 124.68s | technologies that manufacturers created to be better manufacturers. 124.68s - 130.04s | So whether that's use of water as a power source or steam or now electricity or, you 130.04s - 133.56s | know, now digitization of the manufacturing space. 133.56s - 138.80s | All of those were entirely or largely a result of sort of manufacturers wanting to manufacture 138.80s - 144.64s | more, better, faster, and able to do that, they needed to find and harness new technologies. 144.64s - 150.74s | So they're really good at not only embracing new technology, but actually creating technology 150.74s - 155.60s | that didn't exist to facilitate manufacturing. 155.60s - 160.96s | Now we've moved past the point that, you know, we're using electricity to kind of help automate 161.08s - 166.24s | and we're using, you know, digital systems to help automate and increase productivity. 166.24s - 171.52s | But now, manufacturing is moving headlong into that kind of cloud-based infrastructure, 171.52s - 177.40s | which is heavily, you know, narrow AI and machine learning enabled to do a number of 177.40s - 178.64s | different things. 178.64s - 187.12s | I would say that I think about AI in manufacturing kind of the way that I do the Internet circa 187.12s - 189.12s | 1993 to 1995. 189.12s - 190.16s | We know a few different things. 190.16s - 196.96s | We know it's going to be a big deal and we already have a number of use cases that we're 196.96s - 199.64s | using it for and it's phenomenal. 199.64s - 203.92s | And then the third thing is we have enough, if we're being honest, humility to realize 203.92s - 209.28s | we don't exactly know where it's going to go and how it's actually going to affect what 209.28s - 210.28s | we do. 210.28s - 215.72s | But, so there's sort of some similarities there in terms of new transformative technologies. 215.72s - 220.96s | So the last thing about manufacturing, and this is actually a positive, I think, overall, 220.96s - 226.08s | is that


chunk_text:
is moving headlong into that kind of cloud-based infrastructure, 171.52s - 177.40s | which is heavily, you know, narrow AI and machine learning enabled to do a number of 177.40s - 178.64s | different things. 178.64s - 187.12s | I would say that I think about AI in manufacturing kind of the way that I do the Internet circa 187.12s - 189.12s | 1993 to 1995. 189.12s - 190.16s | We know a few different things. 190.16s - 196.96s | We know it's going to be a big deal and we already have a number of use cases that we're 196.96s - 199.64s | using it for and it's phenomenal. 199.64s - 203.92s | And then the third thing is we have enough, if we're being honest, humility to realize 203.92s - 209.28s | we don't exactly know where it's going to go and how it's actually going to affect what 209.28s - 210.28s | we do. 210.28s - 215.72s | But, so there's sort of some similarities there in terms of new transformative technologies. 215.72s - 220.96s | So the last thing about manufacturing, and this is actually a positive, I think, overall, 220.96s - 226.08s | is that manufacturers are their production and profit motivated, right? 226.08s - 232.32s | It's actually what helps them to focus on and get better at the manufacturing process. 232.32s - 237.68s | And what I mean by that is that manufacturers, you know, are businesses and manufacturers 237.68s - 243.96s | think how do I make as many widgets as possible, as fast as possible for the lowest unit cost 244.04s - 245.84s | per widget as possible. 245.84s - 252.80s | And so they make decisions based upon that framework and it makes them better manufacturers. 252.80s - 258.76s | Now, with that being said, there are some downsides to that. 258.76s - 263.88s | So the last point about how that framework that they use to determine where they're going 263.88s - 269.84s | to spend resources and what they're going to prioritize, manufacturers are really, really 269.84s - 271.76s | bad at cybersecurity. 271.76s - 277.28s | And the reason is, as it turns out, cybersecurity doesn't make widgets. 277.28s - 281.28s | And so when they're thinking and prioritizing in that framework, I want to make as many 281.28s - 287.88s | widgets as possible, as fast


chunk_text:
manufacturers are their production and profit motivated, right? 226.08s - 232.32s | It's actually what helps them to focus on and get better at the manufacturing process. 232.32s - 237.68s | And what I mean by that is that manufacturers, you know, are businesses and manufacturers 237.68s - 243.96s | think how do I make as many widgets as possible, as fast as possible for the lowest unit cost 244.04s - 245.84s | per widget as possible. 245.84s - 252.80s | And so they make decisions based upon that framework and it makes them better manufacturers. 252.80s - 258.76s | Now, with that being said, there are some downsides to that. 258.76s - 263.88s | So the last point about how that framework that they use to determine where they're going 263.88s - 269.84s | to spend resources and what they're going to prioritize, manufacturers are really, really 269.84s - 271.76s | bad at cybersecurity. 271.76s - 277.28s | And the reason is, as it turns out, cybersecurity doesn't make widgets. 277.28s - 281.28s | And so when they're thinking and prioritizing in that framework, I want to make as many 281.28s - 287.88s | widgets as possible, as fast as possible, as low unit costs as possible, the security 287.88s - 293.72s | aspect usually loses out in that discussion. 293.72s - 300.12s | That being said, as we know here, I mean, you're all here at DEF CON, there are consequences 300.20s - 304.52s | from chronically under-resourcing security in that process. 304.52s - 309.24s | And I think that a lot of those consequences are sort of coming home to roost for manufacturers, 309.24s - 315.00s | especially as that attack surface is growing exponentially for them. 315.00s - 319.52s | And there's just a lot more badness out there that can touch them. 319.52s - 321.98s | Some of it's not even specifically directed at them. 321.98s - 325.34s | Some of it is specifically directed at them. 325.34s - 329.22s | One of those I would say is ransomware. 329.22s - 335.50s | And there's a few reasons that ransomware operators really, really love manufacturers. 335.50s - 341.38s | And the victimology is pretty narrow on what they're going after. 341.38s - 350.70s | Number one, manufacturers' networks are typically flat and not really well segmented. 350.70s - 358.70s | Number two, they oftentimes utilize


chunk_text:
as possible, as low unit costs as possible, the security 287.88s - 293.72s | aspect usually loses out in that discussion. 293.72s - 300.12s | That being said, as we know here, I mean, you're all here at DEF CON, there are consequences 300.20s - 304.52s | from chronically under-resourcing security in that process. 304.52s - 309.24s | And I think that a lot of those consequences are sort of coming home to roost for manufacturers, 309.24s - 315.00s | especially as that attack surface is growing exponentially for them. 315.00s - 319.52s | And there's just a lot more badness out there that can touch them. 319.52s - 321.98s | Some of it's not even specifically directed at them. 321.98s - 325.34s | Some of it is specifically directed at them. 325.34s - 329.22s | One of those I would say is ransomware. 329.22s - 335.50s | And there's a few reasons that ransomware operators really, really love manufacturers. 335.50s - 341.38s | And the victimology is pretty narrow on what they're going after. 341.38s - 350.70s | Number one, manufacturers' networks are typically flat and not really well segmented. 350.70s - 358.70s | Number two, they oftentimes utilize enterprise ERP systems that everyone in that organization, 358.70s - 363.34s | whether they're working in sales in the front office or they're working on the plant floor, 363.34s - 368.90s | have access to, to see where manufacturing processes are in line and pull down necessary 368.90s - 372.54s | files for manufacturing process or whatever. 372.54s - 378.62s | That is a giant vulnerability because it requires, obviously, IT and internet access inside of 378.62s - 380.06s | the plant floor. 380.42s - 388.38s | But it's also why a lot of times, if there's only IT intrusions in a ransomware, for instance, 388.38s - 390.70s | it could be other things as well. 390.70s - 396.46s | But if you're like me and you read a lot of SEC 8K disclosures, they all kind of sound 396.46s - 404.22s | the same, but they only ever reference IT compromise, unauthorized access into IT spaces. 404.22s - 409.10s | But if you read between the lines and you see that there's been operational or manufacturing 409.10s - 411.02s | compromise, you're like, well, how is that possible? 411.02s - 412.70s | They only got into the IT. 412.70s


chunk_text:
enterprise ERP systems that everyone in that organization, 358.70s - 363.34s | whether they're working in sales in the front office or they're working on the plant floor, 363.34s - 368.90s | have access to, to see where manufacturing processes are in line and pull down necessary 368.90s - 372.54s | files for manufacturing process or whatever. 372.54s - 378.62s | That is a giant vulnerability because it requires, obviously, IT and internet access inside of 378.62s - 380.06s | the plant floor. 380.42s - 388.38s | But it's also why a lot of times, if there's only IT intrusions in a ransomware, for instance, 388.38s - 390.70s | it could be other things as well. 390.70s - 396.46s | But if you're like me and you read a lot of SEC 8K disclosures, they all kind of sound 396.46s - 404.22s | the same, but they only ever reference IT compromise, unauthorized access into IT spaces. 404.22s - 409.10s | But if you read between the lines and you see that there's been operational or manufacturing 409.10s - 411.02s | compromise, you're like, well, how is that possible? 411.02s - 412.70s | They only got into the IT. 412.70s - 414.02s | Why is your plant down? 414.02s - 418.42s | Why are you not producing furniture or Clorox bleach products or whatever? 418.42s - 424.06s | And the answer is that the reliance on that ERP system, they can't generate orders. 424.06s - 428.02s | They can't pull down the necessary files to load into manufacturing processes. 428.02s - 434.86s | So compromising just an IT system has direct OT effects. 434.86s - 441.98s | And because it's stopping production, even if it's only in the IT environment, manufacturers, 441.98s - 444.10s | number one, pay quickly. 444.10s - 450.18s | Number two, they're targeting sort of mid-level enterprises, manufacturers where they're large 450.18s - 454.66s | enough to be able to pay a decent-sized ransom, but they're not large enough to have really 454.66s - 458.54s | sophisticated sort of enterprise security solutions and the like. 458.54s - 464.34s | So it's this kind of sweet spot that ransomware operators take advantage of routinely. 464.34s - 470.96s | And so for the last two years especially, we track our organization and the parent company 470.96s - 473.54s | that we're a part of, the Global Resilience Federation.


chunk_text:
- 414.02s | Why is your plant down? 414.02s - 418.42s | Why are you not producing furniture or Clorox bleach products or whatever? 418.42s - 424.06s | And the answer is that the reliance on that ERP system, they can't generate orders. 424.06s - 428.02s | They can't pull down the necessary files to load into manufacturing processes. 428.02s - 434.86s | So compromising just an IT system has direct OT effects. 434.86s - 441.98s | And because it's stopping production, even if it's only in the IT environment, manufacturers, 441.98s - 444.10s | number one, pay quickly. 444.10s - 450.18s | Number two, they're targeting sort of mid-level enterprises, manufacturers where they're large 450.18s - 454.66s | enough to be able to pay a decent-sized ransom, but they're not large enough to have really 454.66s - 458.54s | sophisticated sort of enterprise security solutions and the like. 458.54s - 464.34s | So it's this kind of sweet spot that ransomware operators take advantage of routinely. 464.34s - 470.96s | And so for the last two years especially, we track our organization and the parent company 470.96s - 473.54s | that we're a part of, the Global Resilience Federation. 473.54s - 474.54s | You can go. 474.54s - 478.90s | I think the most recent semiannual ransomware report will be out in about a week. 478.90s - 481.86s | It's free on our website, grf.org. 481.86s - 485.94s | But our analysts, it's pretty time-consuming because our analysts have to actually go out 485.94s - 490.54s | and scrape all the Torque leak sites about the data on the ransomware and the victims. 490.54s - 491.74s | But we collect a lot of data. 491.74s - 494.62s | We've got four years of data. 494.62s - 498.50s | And just a few pieces of data that we collect are, number one, who the ransomware operator 498.50s - 500.92s | was that had the victim. 500.92s - 502.50s | Number two, who the victim was. 502.50s - 507.50s | Number three, geographically, at least headquarter-wise, where the victim is located. 507.50s - 511.50s | And number four, what industry that victim is. 511.50s - 515.76s | And so we're able to kind of parse the data and see trends and the like. 515.76s - 519.50s | And that's how we know ransomware is by far the most targeted industry. 519.50s


chunk_text:
473.54s - 474.54s | You can go. 474.54s - 478.90s | I think the most recent semiannual ransomware report will be out in about a week. 478.90s - 481.86s | It's free on our website, grf.org. 481.86s - 485.94s | But our analysts, it's pretty time-consuming because our analysts have to actually go out 485.94s - 490.54s | and scrape all the Torque leak sites about the data on the ransomware and the victims. 490.54s - 491.74s | But we collect a lot of data. 491.74s - 494.62s | We've got four years of data. 494.62s - 498.50s | And just a few pieces of data that we collect are, number one, who the ransomware operator 498.50s - 500.92s | was that had the victim. 500.92s - 502.50s | Number two, who the victim was. 502.50s - 507.50s | Number three, geographically, at least headquarter-wise, where the victim is located. 507.50s - 511.50s | And number four, what industry that victim is. 511.50s - 515.76s | And so we're able to kind of parse the data and see trends and the like. 515.76s - 519.50s | And that's how we know ransomware is by far the most targeted industry. 519.50s - 523.82s | I think a lot of different organizations, security researchers and the like, have said 523.82s - 528.62s | that roughly speaking, about between two-thirds and three-quarters of all ransomware incidents 528.62s - 530.60s | are focused at manufacturers. 530.60s - 533.84s | So they really have a giant target on their back. 533.84s - 539.06s | This is, I think, one of the things that, as we'll go and see, is actually helpful because 539.06s - 544.18s | they had to learn some of the lessons of the bad decisions they were making to start making 544.18s - 546.42s | good decisions. 546.42s - 549.10s | So where do we go from here? 549.70s - 553.70s | It's a pretty bad place, the security landscape. 553.70s - 559.14s | I want to make a caveat here and say that, like I said, we couldn't generalize manufacturers. 559.14s - 563.34s | There are manufacturers that are literally the most sophisticated from an operational 563.34s - 569.38s | cyber perspective down to people that are maybe really large companies but are doing 569.38s - 570.70s | almost nothing. 570.70s - 572.06s | So it runs the gambit. 572.06s -


chunk_text:
- 523.82s | I think a lot of different organizations, security researchers and the like, have said 523.82s - 528.62s | that roughly speaking, about between two-thirds and three-quarters of all ransomware incidents 528.62s - 530.60s | are focused at manufacturers. 530.60s - 533.84s | So they really have a giant target on their back. 533.84s - 539.06s | This is, I think, one of the things that, as we'll go and see, is actually helpful because 539.06s - 544.18s | they had to learn some of the lessons of the bad decisions they were making to start making 544.18s - 546.42s | good decisions. 546.42s - 549.10s | So where do we go from here? 549.70s - 553.70s | It's a pretty bad place, the security landscape. 553.70s - 559.14s | I want to make a caveat here and say that, like I said, we couldn't generalize manufacturers. 559.14s - 563.34s | There are manufacturers that are literally the most sophisticated from an operational 563.34s - 569.38s | cyber perspective down to people that are maybe really large companies but are doing 569.38s - 570.70s | almost nothing. 570.70s - 572.06s | So it runs the gambit. 572.06s - 579.38s | But again, we're going to kind of talk about generalities that I see. 579.38s - 583.02s | Number one is that manufacturing is a little bit different. 583.02s - 587.18s | And I know that I'm speaking on behalf of ICS Village and manufacturing does run a lot 587.18s - 590.42s | of industrial protocols and the like. 590.42s - 597.66s | But manufacturing is a little bit different in general because, well, first, in this space, 597.66s - 603.06s | whether it's here at DEF CON or S4 or something, we hear a lot about IT-OT convergence. 603.06s - 607.38s | And it's been a sort of buzzword bingo for the last almost 20 years. 607.38s - 612.10s | The thing is, that term really doesn't apply to manufacturing for the most part. 612.10s - 616.86s | And the reason is, you can't converge something that was never separated. 616.86s - 622.26s | And most manufacturing networks were really never separated in a meaningful way, either 622.26s - 624.70s | physically or logically. 624.70s - 626.46s | And so that term really doesn't apply. 627.26s - 631.78s | They're just basically running a network and some of


chunk_text:
579.38s | But again, we're going to kind of talk about generalities that I see. 579.38s - 583.02s | Number one is that manufacturing is a little bit different. 583.02s - 587.18s | And I know that I'm speaking on behalf of ICS Village and manufacturing does run a lot 587.18s - 590.42s | of industrial protocols and the like. 590.42s - 597.66s | But manufacturing is a little bit different in general because, well, first, in this space, 597.66s - 603.06s | whether it's here at DEF CON or S4 or something, we hear a lot about IT-OT convergence. 603.06s - 607.38s | And it's been a sort of buzzword bingo for the last almost 20 years. 607.38s - 612.10s | The thing is, that term really doesn't apply to manufacturing for the most part. 612.10s - 616.86s | And the reason is, you can't converge something that was never separated. 616.86s - 622.26s | And most manufacturing networks were really never separated in a meaningful way, either 622.26s - 624.70s | physically or logically. 624.70s - 626.46s | And so that term really doesn't apply. 627.26s - 631.78s | They're just basically running a network and some of it is used to send emails and some 631.78s - 634.26s | of it is used on the plant floor. 634.26s - 640.22s | Again, generalizing, sometimes they're really big, but still, in general, that's commonly 640.22s - 641.38s | the case. 641.38s - 645.94s | Number two is the networks themselves are becoming less industrial. 645.94s - 652.26s | The last presentation was showing that converter from a serial connection that was running 652.26s - 655.38s | Modbus to an IP connection. 656.30s - 658.14s | That's very common. 658.14s - 663.58s | Legacy systems might have one of those dongles that is changing from a legacy protocol and 663.58s - 667.34s | a serial connection to a more kind of IP-centric network. 667.34s - 669.06s | But that's the way that things are going. 669.06s - 671.14s | There's a lot of reasons for that. 671.14s - 675.30s | Some of those are mainly having to do with the technology leap sort of into the cloud 675.30s - 679.98s | and AI enablement, meaning that the speed that things need to flow, the data needs to 679.98s - 684.84s | flow at, and how much data needs to


chunk_text:
it is used to send emails and some 631.78s - 634.26s | of it is used on the plant floor. 634.26s - 640.22s | Again, generalizing, sometimes they're really big, but still, in general, that's commonly 640.22s - 641.38s | the case. 641.38s - 645.94s | Number two is the networks themselves are becoming less industrial. 645.94s - 652.26s | The last presentation was showing that converter from a serial connection that was running 652.26s - 655.38s | Modbus to an IP connection. 656.30s - 658.14s | That's very common. 658.14s - 663.58s | Legacy systems might have one of those dongles that is changing from a legacy protocol and 663.58s - 667.34s | a serial connection to a more kind of IP-centric network. 667.34s - 669.06s | But that's the way that things are going. 669.06s - 671.14s | There's a lot of reasons for that. 671.14s - 675.30s | Some of those are mainly having to do with the technology leap sort of into the cloud 675.30s - 679.98s | and AI enablement, meaning that the speed that things need to flow, the data needs to 679.98s - 684.84s | flow at, and how much data needs to transit that network, you're not going to do that 684.84s - 691.24s | on simple serial networks. 691.24s - 694.36s | And I say the networks are becoming less industrial, not the nodes. 694.36s - 697.76s | At the end of the day, there's still going to be an industrial process going on and they 697.76s - 703.48s | might have, at least for that thing, some proprietary protocol for the process itself, 703.48s - 707.68s | but the network on the plant floor, and it could be multiple locations, multiple production 707.68s - 715.12s | facilities, they're not like kind of older school serial networks. 715.12s - 717.62s | That is a challenge. 717.62s - 719.36s | It makes it easier to build out. 719.36s - 722.28s | And he was also talking about the use of Wi-Fi in industrial applications. 722.28s - 724.88s | That is becoming increasingly common. 724.88s - 728.28s | Also, those aren't necessarily the best secured. 728.28s - 732.48s | The thinking that they have is like in the same way that people used to think about industrial 732.48s - 737.60s | networks and why they didn't do security in it at all was,


chunk_text:
transit that network, you're not going to do that 684.84s - 691.24s | on simple serial networks. 691.24s - 694.36s | And I say the networks are becoming less industrial, not the nodes. 694.36s - 697.76s | At the end of the day, there's still going to be an industrial process going on and they 697.76s - 703.48s | might have, at least for that thing, some proprietary protocol for the process itself, 703.48s - 707.68s | but the network on the plant floor, and it could be multiple locations, multiple production 707.68s - 715.12s | facilities, they're not like kind of older school serial networks. 715.12s - 717.62s | That is a challenge. 717.62s - 719.36s | It makes it easier to build out. 719.36s - 722.28s | And he was also talking about the use of Wi-Fi in industrial applications. 722.28s - 724.88s | That is becoming increasingly common. 724.88s - 728.28s | Also, those aren't necessarily the best secured. 728.28s - 732.48s | The thinking that they have is like in the same way that people used to think about industrial 732.48s - 737.60s | networks and why they didn't do security in it at all was, well, the network sort of ends 737.72s - 738.72s | at the fence line. 738.72s - 743.16s | So we don't have to worry about securing that inside, but that's not true. 743.16s - 745.16s | We all know that that's not true. 745.16s - 753.56s | Okay, so manufacturing is sort of, everyone is focusing now on manufacturing from a sales 753.56s - 758.24s | and vendor perspective, solutions providers, all of a sudden, my phone rings a lot more 758.24s - 763.26s | from those people that want to discuss manufacturing because they're really sweet on manufacturing. 763.26s - 768.30s | But one of the things we need to consider, because manufacturing is different, is that 768.30s - 774.58s | any of those solutions, which they do need them, they need to be able to extend to less 774.58s - 776.36s | industrial applications. 776.36s - 781.30s | So we have really, and I'm not going to name names, but we all can think of them like so 781.30s - 782.82s | telepathy out to everyone. 782.82s - 787.86s | There are really great organizations that have incredible industrial network security 787.86s - 790.62s | tooling. 790.62s -


chunk_text:
well, the network sort of ends 737.72s - 738.72s | at the fence line. 738.72s - 743.16s | So we don't have to worry about securing that inside, but that's not true. 743.16s - 745.16s | We all know that that's not true. 745.16s - 753.56s | Okay, so manufacturing is sort of, everyone is focusing now on manufacturing from a sales 753.56s - 758.24s | and vendor perspective, solutions providers, all of a sudden, my phone rings a lot more 758.24s - 763.26s | from those people that want to discuss manufacturing because they're really sweet on manufacturing. 763.26s - 768.30s | But one of the things we need to consider, because manufacturing is different, is that 768.30s - 774.58s | any of those solutions, which they do need them, they need to be able to extend to less 774.58s - 776.36s | industrial applications. 776.36s - 781.30s | So we have really, and I'm not going to name names, but we all can think of them like so 781.30s - 782.82s | telepathy out to everyone. 782.82s - 787.86s | There are really great organizations that have incredible industrial network security 787.86s - 790.62s | tooling. 790.62s - 796.58s | And there are really great tools for cloud security, but there's not really something 796.58s - 802.50s | that's kind of going all the way from base metal to AI-enabled cloud infrastructure. 802.50s - 807.46s | And so there's seams in that security, even if you implemented all the tools that are 807.46s - 810.26s | currently available. 810.26s - 815.90s | And even in that industrial network, the applications and the types of manufacturing that's going 815.90s - 819.42s | on is becoming, I say less industrial. 819.42s - 824.82s | It's essentially moving more towards sort of an IT-like landscape where manufacturing 824.82s - 829.50s | devices are sort of just nodes at the end of an IT network, no different than a printer. 829.50s - 837.42s | You can send it commands, but it doesn't look like legacy ICS environments. 837.42s - 841.42s | Number two, I already mentioned that it needs to extend up to sort of cloud environments 841.42s - 847.08s | to seal off some of those security gaps that we have from tooling from an ICS environment 847.08s - 849.92s | or a sort of cloud environment. 849.92s - 854.52s |


chunk_text:
796.58s | And there are really great tools for cloud security, but there's not really something 796.58s - 802.50s | that's kind of going all the way from base metal to AI-enabled cloud infrastructure. 802.50s - 807.46s | And so there's seams in that security, even if you implemented all the tools that are 807.46s - 810.26s | currently available. 810.26s - 815.90s | And even in that industrial network, the applications and the types of manufacturing that's going 815.90s - 819.42s | on is becoming, I say less industrial. 819.42s - 824.82s | It's essentially moving more towards sort of an IT-like landscape where manufacturing 824.82s - 829.50s | devices are sort of just nodes at the end of an IT network, no different than a printer. 829.50s - 837.42s | You can send it commands, but it doesn't look like legacy ICS environments. 837.42s - 841.42s | Number two, I already mentioned that it needs to extend up to sort of cloud environments 841.42s - 847.08s | to seal off some of those security gaps that we have from tooling from an ICS environment 847.08s - 849.92s | or a sort of cloud environment. 849.92s - 854.52s | And then number three, and this is really important, is it needs to extend down to smaller 854.52s - 855.76s | manufacturers. 855.76s - 860.64s | Most manufacturers, there are over a hundred thousand in the United States alone, are very 860.64s - 863.76s | small organizations, very small organizations. 863.76s - 867.24s | Prior to this, I didn't have enough time to do a site survey and take some pictures for 867.24s - 872.12s | slides and stuff to make it look pretty, but I was going to go to a manufacturer that they 872.12s - 874.24s | make cardboard boxes. 874.36s - 878.40s | Some of them are really intricate in terms of cutting and everything that have multiple 878.40s - 883.22s | folds and display stands and all that kind of stuff, but they don't have a lot going 883.22s - 885.84s | on from a security perspective. 885.84s - 890.60s | Some of that is okay because some of their systems don't really connect directly to IT 890.60s - 894.40s | networks, but it doesn't, yeah. 894.40s - 899.48s | It needs, some of these tools need to be able to go down and scale down,


chunk_text:
And then number three, and this is really important, is it needs to extend down to smaller 854.52s - 855.76s | manufacturers. 855.76s - 860.64s | Most manufacturers, there are over a hundred thousand in the United States alone, are very 860.64s - 863.76s | small organizations, very small organizations. 863.76s - 867.24s | Prior to this, I didn't have enough time to do a site survey and take some pictures for 867.24s - 872.12s | slides and stuff to make it look pretty, but I was going to go to a manufacturer that they 872.12s - 874.24s | make cardboard boxes. 874.36s - 878.40s | Some of them are really intricate in terms of cutting and everything that have multiple 878.40s - 883.22s | folds and display stands and all that kind of stuff, but they don't have a lot going 883.22s - 885.84s | on from a security perspective. 885.84s - 890.60s | Some of that is okay because some of their systems don't really connect directly to IT 890.60s - 894.40s | networks, but it doesn't, yeah. 894.40s - 899.48s | It needs, some of these tools need to be able to go down and scale down, not just up. 899.48s - 902.96s | And then I put in here, don't forget the cyber poor, and that kind of goes back to those 902.96s - 904.72s | small manufacturers. 904.72s - 912.96s | Most of my members are large organizations, they're global Fortune 500 or even 100 companies, 912.96s - 917.04s | but their supply chains are really small. 917.04s - 921.72s | It gets really small really, really quickly that are their upstream suppliers. 921.72s - 929.54s | And so at Manufacturing ISAC, we're working currently with Don Capelli, OT CERT, to create 929.54s - 935.22s | kind of free training and training modules for those organizations completely free of 935.22s - 939.46s | charge, working with some of the larger vendors to bring them in to get their supply chains 939.46s - 943.38s | to try to reach some of those organizations that need the help. 943.38s - 947.22s | Some of them don't know they need the help, but to try to connect them to those resources. 947.22s - 953.06s | So maybe next year I can let you know how that endeavor goes. 953.06s - 957.86s | So we've talked about where manufacturing


chunk_text:
not just up. 899.48s - 902.96s | And then I put in here, don't forget the cyber poor, and that kind of goes back to those 902.96s - 904.72s | small manufacturers. 904.72s - 912.96s | Most of my members are large organizations, they're global Fortune 500 or even 100 companies, 912.96s - 917.04s | but their supply chains are really small. 917.04s - 921.72s | It gets really small really, really quickly that are their upstream suppliers. 921.72s - 929.54s | And so at Manufacturing ISAC, we're working currently with Don Capelli, OT CERT, to create 929.54s - 935.22s | kind of free training and training modules for those organizations completely free of 935.22s - 939.46s | charge, working with some of the larger vendors to bring them in to get their supply chains 939.46s - 943.38s | to try to reach some of those organizations that need the help. 943.38s - 947.22s | Some of them don't know they need the help, but to try to connect them to those resources. 947.22s - 953.06s | So maybe next year I can let you know how that endeavor goes. 953.06s - 957.86s | So we've talked about where manufacturing was. 957.86s - 964.62s | They've always been sort of a global leader in technology, not only adoption, but creation 964.62s - 966.30s | of new technology. 966.30s - 969.46s | And they've sort of fallen behind in that security. 969.46s - 974.34s | And I think that it's because they haven't understood that that security is actually 974.34s - 976.18s | part of their manufacturing process. 976.18s - 979.18s | It needs to be thought of as part of the process itself. 979.18s - 983.70s | And every single business does many, many different things that may not be, as you think 983.70s - 990.30s | about it, you know, discreetly aligned with that business and what you do, but you still 990.30s - 991.30s | have to do it anyway. 991.30s - 993.74s | You know, you have like HR folks and you do payroll. 993.74s - 997.42s | Well, that's not making potato chips if you make potato chips, but it's still an important 997.42s - 1000.14s | process nonetheless. 1000.14s - 1005.26s | So here's why I think that, you know, manufacturers will go from cyber deniers to security high 1005.26s - 1006.26s | flyers. 1006.26s


chunk_text:
was. 957.86s - 964.62s | They've always been sort of a global leader in technology, not only adoption, but creation 964.62s - 966.30s | of new technology. 966.30s - 969.46s | And they've sort of fallen behind in that security. 969.46s - 974.34s | And I think that it's because they haven't understood that that security is actually 974.34s - 976.18s | part of their manufacturing process. 976.18s - 979.18s | It needs to be thought of as part of the process itself. 979.18s - 983.70s | And every single business does many, many different things that may not be, as you think 983.70s - 990.30s | about it, you know, discreetly aligned with that business and what you do, but you still 990.30s - 991.30s | have to do it anyway. 991.30s - 993.74s | You know, you have like HR folks and you do payroll. 993.74s - 997.42s | Well, that's not making potato chips if you make potato chips, but it's still an important 997.42s - 1000.14s | process nonetheless. 1000.14s - 1005.26s | So here's why I think that, you know, manufacturers will go from cyber deniers to security high 1005.26s - 1006.26s | flyers. 1006.26s - 1010.56s | It's because generally speaking, it's in their DNA to innovate. 1010.56s - 1014.92s | They just haven't recognized yet that that needs to be a part of what they need to do. 1014.92s - 1020.64s | And this ultimately is sort of that top line, that executive leadership. 1020.64s - 1024.56s | When they get the idea that this is something, this is the innovation they need to do to 1024.56s - 1025.56s | make things work. 1025.56s - 1030.12s | So if they're looking at the new hotness of whatever that cloud infrastructure is going 1030.12s - 1034.08s | to help them do to move to the next level, if they understand that a part of that is 1034.08s - 1040.24s | security and that that security needs to move up and down, that buy-in is going to 1040.24s - 1047.80s | potentially allow them to leapfrog over some other industries that are, well, they're currently 1047.80s - 1054.40s | seen as more security mature in their ICS industrial programs. 1054.40s - 1058.88s | I actually think that this is basically the core, the heart of the talk. 1058.88s - 1064.40s | I actually think that


chunk_text:
- 1010.56s | It's because generally speaking, it's in their DNA to innovate. 1010.56s - 1014.92s | They just haven't recognized yet that that needs to be a part of what they need to do. 1014.92s - 1020.64s | And this ultimately is sort of that top line, that executive leadership. 1020.64s - 1024.56s | When they get the idea that this is something, this is the innovation they need to do to 1024.56s - 1025.56s | make things work. 1025.56s - 1030.12s | So if they're looking at the new hotness of whatever that cloud infrastructure is going 1030.12s - 1034.08s | to help them do to move to the next level, if they understand that a part of that is 1034.08s - 1040.24s | security and that that security needs to move up and down, that buy-in is going to 1040.24s - 1047.80s | potentially allow them to leapfrog over some other industries that are, well, they're currently 1047.80s - 1054.40s | seen as more security mature in their ICS industrial programs. 1054.40s - 1058.88s | I actually think that this is basically the core, the heart of the talk. 1058.88s - 1064.40s | I actually think that manufacturing, while they're doing a terrible job right now, if 1064.40s - 1070.28s | I come back in a year where currently there are not tools that do all of those things 1070.28s - 1072.68s | that I just talked about, I think there will be. 1072.68s - 1078.32s | And I think that the manufacturers themselves will be some of the ones to, at least in partnership 1078.32s - 1084.08s | with new vendors or on their own, will actually create those tools. 1084.08s - 1089.84s | And then as they mature and utilize those tools and that process long enough, where 1089.84s - 1094.72s | other industries that are in that ICS environment that are thinking about and want to use some 1094.72s - 1100.00s | of those tools and want to move into a cloud environment, they're sort of fence sitters 1100.00s - 1103.48s | and they're going to wait and watch to see what happens to the manufacturers. 1103.48s - 1105.76s | Let them be the canaries in the coal mine. 1105.76s - 1110.24s | And when nothing bad happens, you're going to start to see that they're going to adopt 1110.24s - 1112.66s | that


chunk_text:
manufacturing, while they're doing a terrible job right now, if 1064.40s - 1070.28s | I come back in a year where currently there are not tools that do all of those things 1070.28s - 1072.68s | that I just talked about, I think there will be. 1072.68s - 1078.32s | And I think that the manufacturers themselves will be some of the ones to, at least in partnership 1078.32s - 1084.08s | with new vendors or on their own, will actually create those tools. 1084.08s - 1089.84s | And then as they mature and utilize those tools and that process long enough, where 1089.84s - 1094.72s | other industries that are in that ICS environment that are thinking about and want to use some 1094.72s - 1100.00s | of those tools and want to move into a cloud environment, they're sort of fence sitters 1100.00s - 1103.48s | and they're going to wait and watch to see what happens to the manufacturers. 1103.48s - 1105.76s | Let them be the canaries in the coal mine. 1105.76s - 1110.24s | And when nothing bad happens, you're going to start to see that they're going to adopt 1110.24s - 1112.66s | that type of technology in the future, I believe. 1112.66s - 1115.08s | So check back with me on that. 1115.08s - 1117.70s | So it all starts with the executive leadership. 1117.70s - 1119.06s | They're the ones that steer the ship. 1119.06s - 1122.06s | They're the ones that do the resourcing. 1122.06s - 1126.42s | And they have a couple of things that are pushing them. 1126.42s - 1132.98s | Number one is that they're looking at what's happening currently inside of the manufacturing 1132.98s - 1133.98s | space. 1133.98s - 1139.02s | They're looking at their competitors and their vendors and suppliers getting popped every 1139.02s - 1140.02s | single day. 1140.34s - 1146.10s | Oftentimes with ransomware, sometimes other, but they're being affected. 1146.10s - 1151.00s | And as a result, they have to understand that the crosshairs are on them too. 1151.00s - 1155.18s | So it kind of focuses their attention. 1155.18s - 1159.10s | That being said, I think that generally speaking, the meetings that I have with a lot of those 1159.10s - 1166.90s | executives, my opinion is that most of them are not necessarily thinking correctly about 1166.90s - 1168.62s


chunk_text:
type of technology in the future, I believe. 1112.66s - 1115.08s | So check back with me on that. 1115.08s - 1117.70s | So it all starts with the executive leadership. 1117.70s - 1119.06s | They're the ones that steer the ship. 1119.06s - 1122.06s | They're the ones that do the resourcing. 1122.06s - 1126.42s | And they have a couple of things that are pushing them. 1126.42s - 1132.98s | Number one is that they're looking at what's happening currently inside of the manufacturing 1132.98s - 1133.98s | space. 1133.98s - 1139.02s | They're looking at their competitors and their vendors and suppliers getting popped every 1139.02s - 1140.02s | single day. 1140.34s - 1146.10s | Oftentimes with ransomware, sometimes other, but they're being affected. 1146.10s - 1151.00s | And as a result, they have to understand that the crosshairs are on them too. 1151.00s - 1155.18s | So it kind of focuses their attention. 1155.18s - 1159.10s | That being said, I think that generally speaking, the meetings that I have with a lot of those 1159.10s - 1166.90s | executives, my opinion is that most of them are not necessarily thinking correctly about 1166.90s - 1168.62s | the decisions they've made. 1168.62s - 1173.74s | They don't actually understand the risks that they're accepting in the business, not 1173.74s - 1176.22s | doing something. 1176.22s - 1177.22s | That's changing now. 1177.22s - 1180.10s | I think they understand. 1180.10s - 1181.10s | I want to go over there. 1181.10s - 1183.54s | I've been going over there after this. 1183.54s - 1187.38s | I think they're understanding now how much risk they're accepting by not doing certain 1187.38s - 1188.38s | things. 1188.38s - 1190.72s | So that's one of the things that's changing. 1190.72s - 1197.08s | Number two, it doesn't hurt that there are new sort of compliance and regulatory requirements 1197.08s - 1199.68s | on them that also are focusing their attention. 1199.68s - 1201.36s | So it's not new. 1201.36s - 1207.52s | It's new-ish, but SEC requirements that require them to have certain officers in their company 1207.52s - 1213.00s | that have certain roles for information security and cybersecurity. 1213.00s - 1219.08s | The new CERCIA Act is going to change some things too, because now they're going to have 1219.08s - 1222.00s | to report a lot of


chunk_text:
| the decisions they've made. 1168.62s - 1173.74s | They don't actually understand the risks that they're accepting in the business, not 1173.74s - 1176.22s | doing something. 1176.22s - 1177.22s | That's changing now. 1177.22s - 1180.10s | I think they understand. 1180.10s - 1181.10s | I want to go over there. 1181.10s - 1183.54s | I've been going over there after this. 1183.54s - 1187.38s | I think they're understanding now how much risk they're accepting by not doing certain 1187.38s - 1188.38s | things. 1188.38s - 1190.72s | So that's one of the things that's changing. 1190.72s - 1197.08s | Number two, it doesn't hurt that there are new sort of compliance and regulatory requirements 1197.08s - 1199.68s | on them that also are focusing their attention. 1199.68s - 1201.36s | So it's not new. 1201.36s - 1207.52s | It's new-ish, but SEC requirements that require them to have certain officers in their company 1207.52s - 1213.00s | that have certain roles for information security and cybersecurity. 1213.00s - 1219.08s | The new CERCIA Act is going to change some things too, because now they're going to have 1219.08s - 1222.00s | to report a lot of the things that they didn't before. 1222.00s - 1228.72s | I also see that some of the more traditionally cyber-mature industries, a lot of that talent 1228.72s - 1230.72s | is moving to manufacturing. 1230.72s - 1234.92s | So on most of the calls, 70% of the time, one of those people who's leading that security 1234.92s - 1239.80s | program, a CISO or someone else, is coming from finance or someplace else that has a 1239.80s - 1243.16s | more mature process. 1243.16s - 1246.48s | So the next question is, do I see any change now? 1246.48s - 1249.12s | Because I'm telling you what I think will happen in the future, but is there anything 1249.12s - 1250.60s | happening now? 1250.60s - 1254.16s | The answer is kind of, maybe some glimmers. 1254.16s - 1256.56s | This is messy data, so you don't need to look at the data. 1256.56s - 1258.72s | The colors are the only thing that matter, really. 1258.72s - 1260.68s | But I told you about that ransomware report. 1260.68s - 1265.32s | So in our semi-annual and annual ransomware report, the weekly ransomware report is more 1265.32s - 1268.36s |


chunk_text:
the things that they didn't before. 1222.00s - 1228.72s | I also see that some of the more traditionally cyber-mature industries, a lot of that talent 1228.72s - 1230.72s | is moving to manufacturing. 1230.72s - 1234.92s | So on most of the calls, 70% of the time, one of those people who's leading that security 1234.92s - 1239.80s | program, a CISO or someone else, is coming from finance or someplace else that has a 1239.80s - 1243.16s | more mature process. 1243.16s - 1246.48s | So the next question is, do I see any change now? 1246.48s - 1249.12s | Because I'm telling you what I think will happen in the future, but is there anything 1249.12s - 1250.60s | happening now? 1250.60s - 1254.16s | The answer is kind of, maybe some glimmers. 1254.16s - 1256.56s | This is messy data, so you don't need to look at the data. 1256.56s - 1258.72s | The colors are the only thing that matter, really. 1258.72s - 1260.68s | But I told you about that ransomware report. 1260.68s - 1265.32s | So in our semi-annual and annual ransomware report, the weekly ransomware report is more 1265.32s - 1268.36s | tactical, just a lot more data on the victims. 1268.36s - 1272.04s | The semi-annual and the annual are sort of higher level and talk about trends in that 1272.04s - 1273.44s | landscape. 1273.44s - 1278.40s | And so I had to write my portions for the communities that I lead, including manufacturing. 1278.40s - 1279.40s | So this is manufacturing. 1279.40s - 1281.36s | So I'm just kind of dumping some of the data. 1281.36s - 1286.80s | And this was whether or not, for each one of those weeks, whether manufacturing was 1286.80s - 1288.36s | the most targeted sector. 1288.36s - 1289.36s | Okay? 1289.36s - 1293.56s | So every single week, we got the top sector targeted, right? 1293.56s - 1298.72s | The rightmost column was, well actually, the first four or five columns are like this past 1298.72s - 1300.32s | six months that I was writing on. 1300.32s - 1304.56s | But then I was like, well, I should probably look at the previous six months too, to kind 1304.56s - 1307.14s | of do a compare and contrast over that time period. 1307.14s - 1313.32s | So the rightmost column is the


chunk_text:
tactical, just a lot more data on the victims. 1268.36s - 1272.04s | The semi-annual and the annual are sort of higher level and talk about trends in that 1272.04s - 1273.44s | landscape. 1273.44s - 1278.40s | And so I had to write my portions for the communities that I lead, including manufacturing. 1278.40s - 1279.40s | So this is manufacturing. 1279.40s - 1281.36s | So I'm just kind of dumping some of the data. 1281.36s - 1286.80s | And this was whether or not, for each one of those weeks, whether manufacturing was 1286.80s - 1288.36s | the most targeted sector. 1288.36s - 1289.36s | Okay? 1289.36s - 1293.56s | So every single week, we got the top sector targeted, right? 1293.56s - 1298.72s | The rightmost column was, well actually, the first four or five columns are like this past 1298.72s - 1300.32s | six months that I was writing on. 1300.32s - 1304.56s | But then I was like, well, I should probably look at the previous six months too, to kind 1304.56s - 1307.14s | of do a compare and contrast over that time period. 1307.14s - 1313.32s | So the rightmost column is the Q3, Q4 of 2023. 1313.32s - 1318.94s | And then the other column that's kind of in the center is the first six months, Q1, Q2 1318.94s - 1320.76s | of 2024. 1320.76s - 1327.70s | There's a lot more red in the far right hand column, the second half of 2023, and a lot 1327.70s - 1336.74s | less red in the first half of 2024, 40% less times they were the most targeted sector for 1337.34s - 1342.82s | that week, and a 20% overall reduction in the amount of victims. 1342.82s - 1346.42s | Now, I think it's too soon to tell whether this is like a real change. 1346.42s - 1352.70s | I also would note that we saw that they were, the victims themselves were moving down in 1352.70s - 1357.02s | organizational size, which means that some of those midsize organizations that do have 1357.02s - 1364.74s | means in order to improve their situation are doing that, and they're becoming not victims. 1364.74s - 1366.58s | So anyway, there's my glimmers of hope. 1366.58s - 1370.90s | I've got one minute, and so I don't know if that's long enough for Q&A, but


chunk_text:
Q3, Q4 of 2023. 1313.32s - 1318.94s | And then the other column that's kind of in the center is the first six months, Q1, Q2 1318.94s - 1320.76s | of 2024. 1320.76s - 1327.70s | There's a lot more red in the far right hand column, the second half of 2023, and a lot 1327.70s - 1336.74s | less red in the first half of 2024, 40% less times they were the most targeted sector for 1337.34s - 1342.82s | that week, and a 20% overall reduction in the amount of victims. 1342.82s - 1346.42s | Now, I think it's too soon to tell whether this is like a real change. 1346.42s - 1352.70s | I also would note that we saw that they were, the victims themselves were moving down in 1352.70s - 1357.02s | organizational size, which means that some of those midsize organizations that do have 1357.02s - 1364.74s | means in order to improve their situation are doing that, and they're becoming not victims. 1364.74s - 1366.58s | So anyway, there's my glimmers of hope. 1366.58s - 1370.90s | I've got one minute, and so I don't know if that's long enough for Q&A, but we can 1370.90s - 1373.10s | try if anyone has a question. 1373.10s - 1378.68s | I can't see anyone. 1378.68s - 1379.68s | No questions? 1379.68s - 1395.91s | A question. 1395.91s - 1398.95s | How to make cybersecurity sexy for manufacturing? 1398.95s - 1402.83s | I honestly don't think we can, because at the end of the day, they're business. 1402.83s - 1407.07s | They're making decisions based upon business, but I think that that's a strong enough case 1407.07s - 1415.78s | for them to do the right thing, I think, but we'll see. 1415.78s - 1419.74s | Maybe one more, and then I'll jump down, but we can talk afterwards. 1419.74s - 1420.74s | All right. 1420.74s - 1421.74s | Well, thanks, everybody. 1421.74s - 1425.50s | I want to go see what's next door.


chunk_text:
we can 1370.90s - 1373.10s | try if anyone has a question. 1373.10s - 1378.68s | I can't see anyone. 1378.68s - 1379.68s | No questions? 1379.68s - 1395.91s | A question. 1395.91s - 1398.95s | How to make cybersecurity sexy for manufacturing? 1398.95s - 1402.83s | I honestly don't think we can, because at the end of the day, they're business. 1402.83s - 1407.07s | They're making decisions based upon business, but I think that that's a strong enough case 1407.07s - 1415.78s | for them to do the right thing, I think, but we'll see. 1415.78s - 1419.74s | Maybe one more, and then I'll jump down, but we can talk afterwards. 1419.74s - 1420.74s | All right. 1420.74s - 1421.74s | Well, thanks, everybody. 1421.74s - 1425.50s | I want to go see what's next door.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=kGvU_MuxZ2c", "title": "DEF CON 32 - Introduction to IPv6 - Denis Smajlovic\u0301", "description": "Most of the Internet today is running on a legacy version of the Internet Protocol: IPv4. Despite of this, the number of engineers, especially in security, who know how to use IPv6 is relatively low. In this talk we take you through why today\u2019s Internet does not live up to its original vision, take you back to the past to show you what the IPv4 Internet used to look like, and, through this, reveal the secrets that will allow you finally understand IPv6.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1518, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 5.00s | This text was transcribed using whisper model: large-v2 It is now the top of the hour. Good morning. And now we have, um, our second talk of the day, 9.54s - 14.54s | our second of four, uh, sponsored by the packet hacking, the packet hacking village. And 17.38s - 22.38s | we are honored to have Dennis Smilovich, uh, on IPv6. Dennis, take it away. 23.38s - 28.38s | Thank you. Hi. Yeah, as Ming said, my name is, uh, Dennis Smilovich. I'm a 32.78s - 36.18s | principal security consultant at Nova Information Security based in San Francisco, 36.18s - 40.66s | California. And so IPv6 was something that I used to struggle with a lot. I've seen 40.66s - 43.52s | when working with different clients that it's a general thing in the security 43.52s - 47.62s | community that it's kind of this thing that's hard to understand and we prefer 47.64s - 52.14s | keeping our infrastructure on the, like, legacy IP version, which it actually is, 52.14s - 56.22s | uh, when you're working with IPv4. And so when going through this process of 56.22s - 61.36s | wanting to understand IPv6, what really happened was that, um, I, I, I realized 61.36s - 64.90s | after going through everything that, uh, the reason that it was so hard is that 64.90s - 70.56s | because over the years, IPv4 has gotten so many like extensions and natting and 70.56s - 74.16s | other technologies that you're putting in place that is, they're making the 74.18s - 78.98s | internet work, but really they're abstracting from what was actually intended. And 78.98s - 83.12s | so when, when understanding IPv6, what


chunk_text:
36.18s | principal security consultant at Nova Information Security based in San Francisco, 36.18s - 40.66s | California. And so IPv6 was something that I used to struggle with a lot. I've seen 40.66s - 43.52s | when working with different clients that it's a general thing in the security 43.52s - 47.62s | community that it's kind of this thing that's hard to understand and we prefer 47.64s - 52.14s | keeping our infrastructure on the, like, legacy IP version, which it actually is, 52.14s - 56.22s | uh, when you're working with IPv4. And so when going through this process of 56.22s - 61.36s | wanting to understand IPv6, what really happened was that, um, I, I, I realized 61.36s - 64.90s | after going through everything that, uh, the reason that it was so hard is that 64.90s - 70.56s | because over the years, IPv4 has gotten so many like extensions and natting and 70.56s - 74.16s | other technologies that you're putting in place that is, they're making the 74.18s - 78.98s | internet work, but really they're abstracting from what was actually intended. And 78.98s - 83.12s | so when, when understanding IPv6, what we really need to do is to dial back, 83.12s - 87.62s | understand IPv4 and from that it's really easy to jump the next step because then 87.62s - 92.80s | IPv6 is just a couple of more bits and a different way to write things. Um, so 92.80s - 97.80s | yeah, I hope, uh, this is gonna be useful to you. So, um, with IPv4 all of my 98.36s - 104.52s | knowledge had come from practical use and that boiled down to something like the 104.52s - 109.46s | following. And so this might also be the case for some of you. My understanding was 109.46s - 114.80s | that this was an IP address, which it also is, and that the subnet mask is probably 114.80s - 119.80s | 255.255.255.0, but you know, only DHCP really knows. And the last one was that the 122.20s - 127.78s | default gateway was the same IP as my IP, but just with a one at the end. So, 128.26s - 132.72s | these are not like set in stone. They're, that, that's not actually how things work, 132.72s - 136.96s | but it's so close to like


chunk_text:
we really need to do is to dial back, 83.12s - 87.62s | understand IPv4 and from that it's really easy to jump the next step because then 87.62s - 92.80s | IPv6 is just a couple of more bits and a different way to write things. Um, so 92.80s - 97.80s | yeah, I hope, uh, this is gonna be useful to you. So, um, with IPv4 all of my 98.36s - 104.52s | knowledge had come from practical use and that boiled down to something like the 104.52s - 109.46s | following. And so this might also be the case for some of you. My understanding was 109.46s - 114.80s | that this was an IP address, which it also is, and that the subnet mask is probably 114.80s - 119.80s | 255.255.255.0, but you know, only DHCP really knows. And the last one was that the 122.20s - 127.78s | default gateway was the same IP as my IP, but just with a one at the end. So, 128.26s - 132.72s | these are not like set in stone. They're, that, that's not actually how things work, 132.72s - 136.96s | but it's so close to like the configuration that you see most of the times that you can 136.96s - 142.24s | probably wing it by doing something like that. And so that continued on to being that an 142.24s - 147.24s | IP address is something, a private IP address is one that starts with 192.168.something, 149.64s - 154.38s | that's something, or 10.something, that's something, that's something. And I didn't 154.38s - 158.96s | really understand why, I just knew that like, that was probably a private IP address and 158.96s - 163.96s | the rest was the internet. And so the, this configuration that I'm showing up here, it's a 166.56s - 172.10s | fine way to do it. Now, this, this is not gonna work if we're working with a network 172.10s - 177.88s | that's not like very standard or what we see in like all our home routers. And that's 177.88s - 182.44s | where, you know, it becomes a problem and we try to set this up and then the network 182.44s - 187.38s | doesn't actually work. Um, so specifically this configuration is limited to exactly 187.38s - 193.56s | 250 free client devices. And so you'll pretty


chunk_text:
the configuration that you see most of the times that you can 136.96s - 142.24s | probably wing it by doing something like that. And so that continued on to being that an 142.24s - 147.24s | IP address is something, a private IP address is one that starts with 192.168.something, 149.64s - 154.38s | that's something, or 10.something, that's something, that's something. And I didn't 154.38s - 158.96s | really understand why, I just knew that like, that was probably a private IP address and 158.96s - 163.96s | the rest was the internet. And so the, this configuration that I'm showing up here, it's a 166.56s - 172.10s | fine way to do it. Now, this, this is not gonna work if we're working with a network 172.10s - 177.88s | that's not like very standard or what we see in like all our home routers. And that's 177.88s - 182.44s | where, you know, it becomes a problem and we try to set this up and then the network 182.44s - 187.38s | doesn't actually work. Um, so specifically this configuration is limited to exactly 187.38s - 193.56s | 250 free client devices. And so you'll pretty quickly outgrow that for a private network. But 193.56s - 199.62s | let's take a look at what these, at what these numbers actually mean. Um, so again, this 199.62s - 204.64s | is an IP address. It consists of 4, we'll call them fields for now. 1, 2, 3, 4. And they 204.88s - 209.88s | each can have a value between 0 and 255, giving us 256 possibilities for each field. And 212.98s - 216.92s | now each of those numbers, they actually represent a binary value. We know that that's how 216.92s - 221.92s | computers work. And so to represent 256 bits, uh, 256 possibilities in binary, you need 8 224.36s - 229.36s | bits. And so every one of the fields, um, is 8 bits. And that's what's called an octet. 229.66s - 234.66s | Like we have 1 octet, 2 octets, 3 octets, 4 octets. And that gives us 32 bits. Every IPv4 238.56s - 243.56s | address is 32 bits and that's full stop. So next up is the subnet mask. Here we have 244.74s - 250.14s | 255.255.255.0 which is a very common configuration as I mentioned in like most of our


chunk_text:
quickly outgrow that for a private network. But 193.56s - 199.62s | let's take a look at what these, at what these numbers actually mean. Um, so again, this 199.62s - 204.64s | is an IP address. It consists of 4, we'll call them fields for now. 1, 2, 3, 4. And they 204.88s - 209.88s | each can have a value between 0 and 255, giving us 256 possibilities for each field. And 212.98s - 216.92s | now each of those numbers, they actually represent a binary value. We know that that's how 216.92s - 221.92s | computers work. And so to represent 256 bits, uh, 256 possibilities in binary, you need 8 224.36s - 229.36s | bits. And so every one of the fields, um, is 8 bits. And that's what's called an octet. 229.66s - 234.66s | Like we have 1 octet, 2 octets, 3 octets, 4 octets. And that gives us 32 bits. Every IPv4 238.56s - 243.56s | address is 32 bits and that's full stop. So next up is the subnet mask. Here we have 244.74s - 250.14s | 255.255.255.0 which is a very common configuration as I mentioned in like most of our 250.14s - 255.78s | home routers. Um, and so what the subnet mask actually does is that it makes your computer 255.80s - 260.14s | understand where to send a packet. If I need to send a packet to another machine that's on the 260.14s - 267.08s | same network as me, on the same WiFi or behind the same router, it's in the same LAN, um, I 267.08s - 272.26s | need to send it out on that. But if I want to send a packet somewhere else, a server on the 272.26s - 276.56s | internet for instance, I can't reach that. And so I have to send it to my router. But there 276.56s - 280.52s | needs to be some kind of mechanism where the computer can distinguish whether the packet 280.54s - 286.38s | goes one way or the other way. And that's what the subnet mask does. Um, so if we convert this 286.38s - 291.38s | to binary, what we see, I didn't have to use a calculator for this by the way. Um, we see 294.22s - 299.56s | that this is what the subnet mask becomes and so part of the


chunk_text:
250.14s - 255.78s | home routers. Um, and so what the subnet mask actually does is that it makes your computer 255.80s - 260.14s | understand where to send a packet. If I need to send a packet to another machine that's on the 260.14s - 267.08s | same network as me, on the same WiFi or behind the same router, it's in the same LAN, um, I 267.08s - 272.26s | need to send it out on that. But if I want to send a packet somewhere else, a server on the 272.26s - 276.56s | internet for instance, I can't reach that. And so I have to send it to my router. But there 276.56s - 280.52s | needs to be some kind of mechanism where the computer can distinguish whether the packet 280.54s - 286.38s | goes one way or the other way. And that's what the subnet mask does. Um, so if we convert this 286.38s - 291.38s | to binary, what we see, I didn't have to use a calculator for this by the way. Um, we see 294.22s - 299.56s | that this is what the subnet mask becomes and so part of the reason why subnet masks can be a 299.56s - 305.34s | bit like intimidating to understand is because 255.255.255.0 doesn't really mean 305.34s - 309.44s | anything. It's only when we look at the binary representation that we can understand what the 309.46s - 314.70s | computer is actually doing. So let's take a look at that. On top is the IP address of my 314.70s - 320.40s | machine and on the bottom is the IP address that I want to speak to. And so in between those, we 320.40s - 325.68s | put the subnet mask. And so basically what the computer does is that it takes the, the 325.68s - 331.52s | subnet mask, it looks at it, if there's a one, the top one and the bottom one have, have to 331.52s - 336.96s | match. So if we look at the first ductet of the subnet mask, all of the first eight bits in 336.98s - 342.92s | both IP addresses have to match. If they do match, the packet is destined for our local network. 342.92s - 347.52s | If they don't match, we have to send it off to someone else who can


chunk_text:
reason why subnet masks can be a 299.56s - 305.34s | bit like intimidating to understand is because 255.255.255.0 doesn't really mean 305.34s - 309.44s | anything. It's only when we look at the binary representation that we can understand what the 309.46s - 314.70s | computer is actually doing. So let's take a look at that. On top is the IP address of my 314.70s - 320.40s | machine and on the bottom is the IP address that I want to speak to. And so in between those, we 320.40s - 325.68s | put the subnet mask. And so basically what the computer does is that it takes the, the 325.68s - 331.52s | subnet mask, it looks at it, if there's a one, the top one and the bottom one have, have to 331.52s - 336.96s | match. So if we look at the first ductet of the subnet mask, all of the first eight bits in 336.98s - 342.92s | both IP addresses have to match. If they do match, the packet is destined for our local network. 342.92s - 347.52s | If they don't match, we have to send it off to someone else who can figure out how to get the 347.52s - 353.50s | packet where it needs to be. Um, so we take a look at the first, they have to match. All first 353.50s - 359.14s | eight bits match. The second ductet, okay, they're all ones, so they all have to match. We look 359.14s - 364.38s | at the two addresses, they all match. The third ductet of the subnet mask are, are all ones, so 364.40s - 368.34s | they all have to match. And we look at the source address, my IP address and the 368.34s - 373.34s | destination address. Um, and they also match. And so for the last ductet of the subnet mask, 376.62s - 381.68s | after checking all of them, we see that they don't actually have to match, which is very 381.68s - 387.26s | convenient because they, they don't match. So, uh, that's fine. This packet is destined for my 387.26s - 393.90s | local network, so I can just send it out on the network. Um, but if we change that, I've 393.92s - 398.66s | changed the destination address to the address that Google.com was resolving to at one


chunk_text:
figure out how to get the 347.52s - 353.50s | packet where it needs to be. Um, so we take a look at the first, they have to match. All first 353.50s - 359.14s | eight bits match. The second ductet, okay, they're all ones, so they all have to match. We look 359.14s - 364.38s | at the two addresses, they all match. The third ductet of the subnet mask are, are all ones, so 364.40s - 368.34s | they all have to match. And we look at the source address, my IP address and the 368.34s - 373.34s | destination address. Um, and they also match. And so for the last ductet of the subnet mask, 376.62s - 381.68s | after checking all of them, we see that they don't actually have to match, which is very 381.68s - 387.26s | convenient because they, they don't match. So, uh, that's fine. This packet is destined for my 387.26s - 393.90s | local network, so I can just send it out on the network. Um, but if we change that, I've 393.92s - 398.66s | changed the destination address to the address that Google.com was resolving to at one point 398.66s - 404.26s | when I made this presentation. Um, and so when we look at this, already from the beginning, we 404.26s - 411.04s | see that the, our subnet mask says that if a packet is destined for the local network, all of 411.04s - 416.04s | the bits in the first ductet have to match. And we see that that's not the case. So we already 416.04s - 422.22s | know by just checking the first one, um, that this packet is not destined for the local 422.24s - 427.48s | network. And so because of that, we send it to the default gateway, which is the last 427.48s - 434.48s | parameter that we, we configure. And so I'm going to do something that's a little bad. Um, I'm 434.48s - 439.92s | going, gonna go back to the previous slide and I'm gonna remove these so that we only have the 439.92s - 445.72s | subnet mask left. And I know that I just told you how all of this works, but we don't really 445.80s - 450.80s | need it anymore. So because subnet masks are confusing, uh, when there's a much, much


chunk_text:
point 398.66s - 404.26s | when I made this presentation. Um, and so when we look at this, already from the beginning, we 404.26s - 411.04s | see that the, our subnet mask says that if a packet is destined for the local network, all of 411.04s - 416.04s | the bits in the first ductet have to match. And we see that that's not the case. So we already 416.04s - 422.22s | know by just checking the first one, um, that this packet is not destined for the local 422.24s - 427.48s | network. And so because of that, we send it to the default gateway, which is the last 427.48s - 434.48s | parameter that we, we configure. And so I'm going to do something that's a little bad. Um, I'm 434.48s - 439.92s | going, gonna go back to the previous slide and I'm gonna remove these so that we only have the 439.92s - 445.72s | subnet mask left. And I know that I just told you how all of this works, but we don't really 445.80s - 450.80s | need it anymore. So because subnet masks are confusing, uh, when there's a much, much shorter 453.60s - 458.58s | way to actually write this. If you look at the, the binary representation here, it's very 458.58s - 464.08s | simple. It's a bunch of ones and then it's a bunch of zeros. And so in modern network, um, the, 464.08s - 468.92s | the ones and the zeros in the subnet mask, they have to be contiguous and they always have to 468.92s - 475.52s | start with the ones and then they have the zeros. So the easier way to represent this would be 475.52s - 480.80s | to just write it in something called CIDR notation. And so the only thing that you do is 480.80s - 486.76s | that you count how many ones do we have before the zero. In this case, we have eight, we have 486.76s - 494.08s | 16 and we have 24. And so that because of that, instead of writing both our IP address and our 494.08s - 500.08s | subnet mask, we can just write our IP address in CIDR notation. And by that we're actually 500.12s - 505.12s | representing both values. So we end up with 192.168.1.27 slash 24. Um, and this


chunk_text:
shorter 453.60s - 458.58s | way to actually write this. If you look at the, the binary representation here, it's very 458.58s - 464.08s | simple. It's a bunch of ones and then it's a bunch of zeros. And so in modern network, um, the, 464.08s - 468.92s | the ones and the zeros in the subnet mask, they have to be contiguous and they always have to 468.92s - 475.52s | start with the ones and then they have the zeros. So the easier way to represent this would be 475.52s - 480.80s | to just write it in something called CIDR notation. And so the only thing that you do is 480.80s - 486.76s | that you count how many ones do we have before the zero. In this case, we have eight, we have 486.76s - 494.08s | 16 and we have 24. And so that because of that, instead of writing both our IP address and our 494.08s - 500.08s | subnet mask, we can just write our IP address in CIDR notation. And by that we're actually 500.12s - 505.12s | representing both values. So we end up with 192.168.1.27 slash 24. Um, and this is going to 508.76s - 516.33s | be really important for when we take a look at IPv6. So we get away with that and we still 516.33s - 521.61s | can't avoid, uh, having to specify a default gateway, but at least this is much, uh, more 521.61s - 528.18s | condensed and easier to understand and not as redundant as what we were looking at before. 528.22s - 533.64s | So before we use all this knowledge to learn about IPv6, I just want to quickly go over the 533.64s - 538.72s | layout of the current allocations of the IPv4 internet. And so that essentially means how 538.72s - 544.96s | many addresses do we have and what are they used for. So this one is from January 2023. Not 544.96s - 548.60s | much has changed in the meantime. Um, and what's very interesting is that you can see it's 548.60s - 555.44s | very, very, very full except for the two boxes up in the corner. Um, it's, it's, it's, it's 555.46s - 562.24s | taken, um, like they're small, uh, minor allocations within like other networks that you 562.24s - 567.24s | might still


chunk_text:
is going to 508.76s - 516.33s | be really important for when we take a look at IPv6. So we get away with that and we still 516.33s - 521.61s | can't avoid, uh, having to specify a default gateway, but at least this is much, uh, more 521.61s - 528.18s | condensed and easier to understand and not as redundant as what we were looking at before. 528.22s - 533.64s | So before we use all this knowledge to learn about IPv6, I just want to quickly go over the 533.64s - 538.72s | layout of the current allocations of the IPv4 internet. And so that essentially means how 538.72s - 544.96s | many addresses do we have and what are they used for. So this one is from January 2023. Not 544.96s - 548.60s | much has changed in the meantime. Um, and what's very interesting is that you can see it's 548.60s - 555.44s | very, very, very full except for the two boxes up in the corner. Um, it's, it's, it's, it's 555.46s - 562.24s | taken, um, like they're small, uh, minor allocations within like other networks that you 562.24s - 567.24s | might still be able to get, uh, from like the regional, uh, internet registries. Um, but it's 569.12s - 574.12s | full, like this is very, very full. Um, and so, um, then someone might say and have also said 577.46s - 581.96s | that, oh, but why don't we just repurpose the multicast space or the future use space? Like 581.98s - 587.72s | they made a very nice convenient block up in the top, right? So why don't we just like use 587.72s - 592.56s | that? Like it's for future use. So we'll just start like using it. Um, and so the problem is 592.56s - 597.96s | that a lot of devices have actually have hard coded that, uh, these addresses cannot be used 597.96s - 602.64s | or some engineers decided that they could use them to do like some internal stuff. And so 602.64s - 606.68s | using them for actual IP addresses is not, uh, something that can actually be done. Like I 606.70s - 614.04s | would obviously never name anyone who would do this. Um, but, um, oh, I, I, I might be some 614.04s - 620.72s | technical glitches or something. Um,


chunk_text:
be able to get, uh, from like the regional, uh, internet registries. Um, but it's 569.12s - 574.12s | full, like this is very, very full. Um, and so, um, then someone might say and have also said 577.46s - 581.96s | that, oh, but why don't we just repurpose the multicast space or the future use space? Like 581.98s - 587.72s | they made a very nice convenient block up in the top, right? So why don't we just like use 587.72s - 592.56s | that? Like it's for future use. So we'll just start like using it. Um, and so the problem is 592.56s - 597.96s | that a lot of devices have actually have hard coded that, uh, these addresses cannot be used 597.96s - 602.64s | or some engineers decided that they could use them to do like some internal stuff. And so 602.64s - 606.68s | using them for actual IP addresses is not, uh, something that can actually be done. Like I 606.70s - 614.04s | would obviously never name anyone who would do this. Um, but, um, oh, I, I, I might be some 614.04s - 620.72s | technical glitches or something. Um, that was completely unrelated to what I just said. Um, 620.72s - 626.98s | so a challenge for all of you, by the way, how many, can someone count how many times USDOD 626.98s - 632.06s | appears in like the internet routing table? It's a lot of times and it's like, okay, I mean, do 632.08s - 638.12s | they need that many IP addresses? Uh, what do you say? Fort motor company has a slash eight. 638.12s - 644.82s | And so from what we talked about before, we know that that means that the first octet is set 644.82s - 650.30s | like the number before the first dot of the IPV4 address. In this case it would be 19. The 650.30s - 656.90s | rest is theirs. So every public IPV4 address that starts with 19 belongs to Fort motor 656.92s - 663.52s | company. Now we have less than 256 of those to share between all the people on the planet. So 663.52s - 668.52s | Fort, the car company, they own one 223rd of the internet. And that takes me to my point, it's, 672.60s - 677.60s | it's unsustainable. Um, so after knowing


chunk_text:
that was completely unrelated to what I just said. Um, 620.72s - 626.98s | so a challenge for all of you, by the way, how many, can someone count how many times USDOD 626.98s - 632.06s | appears in like the internet routing table? It's a lot of times and it's like, okay, I mean, do 632.08s - 638.12s | they need that many IP addresses? Uh, what do you say? Fort motor company has a slash eight. 638.12s - 644.82s | And so from what we talked about before, we know that that means that the first octet is set 644.82s - 650.30s | like the number before the first dot of the IPV4 address. In this case it would be 19. The 650.30s - 656.90s | rest is theirs. So every public IPV4 address that starts with 19 belongs to Fort motor 656.92s - 663.52s | company. Now we have less than 256 of those to share between all the people on the planet. So 663.52s - 668.52s | Fort, the car company, they own one 223rd of the internet. And that takes me to my point, it's, 672.60s - 677.60s | it's unsustainable. Um, so after knowing all of this, we know it's 32 bits, like this is an IPV4 680.64s - 686.78s | address. And you look at it and you're thinking, oh, this would all be solved if we just had 686.78s - 693.02s | more bits, like double the bits. That's a lot of bits. That's 64 bits. And that would give us 693.02s - 697.86s | more addresses. Sure. But if we go back and look at the allocations of the IPV4 internet, we 697.86s - 703.94s | see that not only is it very full, we also see that the same entities appear multiple times, 703.94s - 710.48s | essentially meaning that people run out and then they grab like another block. And so it would 710.48s - 716.22s | be really cool if we could make a system that had so many addresses that as soon as we make an 716.22s - 721.76s | allocation, the person that we've given it to will never outgrow it. Like we'll just give them 721.76s - 728.00s | so ridiculously many IP addresses that you'll only ever need one block that's gonna show up in 728.00s - 733.00s | like the internet routing table.


chunk_text:
all of this, we know it's 32 bits, like this is an IPV4 680.64s - 686.78s | address. And you look at it and you're thinking, oh, this would all be solved if we just had 686.78s - 693.02s | more bits, like double the bits. That's a lot of bits. That's 64 bits. And that would give us 693.02s - 697.86s | more addresses. Sure. But if we go back and look at the allocations of the IPV4 internet, we 697.86s - 703.94s | see that not only is it very full, we also see that the same entities appear multiple times, 703.94s - 710.48s | essentially meaning that people run out and then they grab like another block. And so it would 710.48s - 716.22s | be really cool if we could make a system that had so many addresses that as soon as we make an 716.22s - 721.76s | allocation, the person that we've given it to will never outgrow it. Like we'll just give them 721.76s - 728.00s | so ridiculously many IP addresses that you'll only ever need one block that's gonna show up in 728.00s - 733.00s | like the internet routing table. And so 128 bits, like it's not double, it's double the double and 735.88s - 742.08s | it's a lot of bits. And so just to be sure that we're all on the same page, um, when we add a 742.08s - 748.02s | bit, it's not double the IP address. When we add, when we say, when we go from 32 bits to 64 748.02s - 753.62s | bits, it's not double the addresses. When we go from 32 bits to 33 bits, it's double the 753.62s - 759.40s | addresses. So every time we add a bit, uh, 33 bits is double the IPV4 internet, 34 bits is four 759.40s - 765.94s | times the IPV4 internet, 35, eight times that. And you get the drill, but 128 is like a lot of IP 765.94s - 771.98s | addresses. I think someone told me that the IPV6 internet is so huge that, uh, there's 771.98s - 778.28s | addresses enough to represent every grain of sand on, on the globe or every star in the visible 778.28s - 785.62s | universe or something crazy like that. Um, yeah. So that brings me to our next section. So to


chunk_text:
And so 128 bits, like it's not double, it's double the double and 735.88s - 742.08s | it's a lot of bits. And so just to be sure that we're all on the same page, um, when we add a 742.08s - 748.02s | bit, it's not double the IP address. When we add, when we say, when we go from 32 bits to 64 748.02s - 753.62s | bits, it's not double the addresses. When we go from 32 bits to 33 bits, it's double the 753.62s - 759.40s | addresses. So every time we add a bit, uh, 33 bits is double the IPV4 internet, 34 bits is four 759.40s - 765.94s | times the IPV4 internet, 35, eight times that. And you get the drill, but 128 is like a lot of IP 765.94s - 771.98s | addresses. I think someone told me that the IPV6 internet is so huge that, uh, there's 771.98s - 778.28s | addresses enough to represent every grain of sand on, on the globe or every star in the visible 778.28s - 785.62s | universe or something crazy like that. Um, yeah. So that brings me to our next section. So to 785.62s - 790.72s | represent 128 bits, we can't use the same system with octets as we used in IPV4 and just 790.72s - 795.72s | separate them with a dot. It would look horrible. So IPV6 addresses work a bit differently. And 800.28s - 805.40s | so this is the IPV6 address that again, Google.com resolved to at some point when I was 805.40s - 810.20s | doing this presentation. And it looks way more confusing than an IPV4 address. And that's 810.20s - 814.80s | like the big thing that I hear with people in IPV6, like, oh, I look at the addresses and like 814.82s - 821.12s | my head starts hurting and it's so confusing, which is true. But, um, what is really cool is 821.12s - 825.84s | that we can start breaking this up and understand how it works. And suddenly it goes from 825.84s - 830.84s | being like a random string of like colons and letters and stuff to actually making, uh, to 833.28s - 838.32s | actually making sense. So let's try to take a look at that. Um, first of all, the numbers 838.32s - 843.42s | there in hex,


chunk_text:
785.62s - 790.72s | represent 128 bits, we can't use the same system with octets as we used in IPV4 and just 790.72s - 795.72s | separate them with a dot. It would look horrible. So IPV6 addresses work a bit differently. And 800.28s - 805.40s | so this is the IPV6 address that again, Google.com resolved to at some point when I was 805.40s - 810.20s | doing this presentation. And it looks way more confusing than an IPV4 address. And that's 810.20s - 814.80s | like the big thing that I hear with people in IPV6, like, oh, I look at the addresses and like 814.82s - 821.12s | my head starts hurting and it's so confusing, which is true. But, um, what is really cool is 821.12s - 825.84s | that we can start breaking this up and understand how it works. And suddenly it goes from 825.84s - 830.84s | being like a random string of like colons and letters and stuff to actually making, uh, to 833.28s - 838.32s | actually making sense. So let's try to take a look at that. Um, first of all, the numbers 838.32s - 843.42s | there in hex, uh, and we'll get there in a second. Um, but before we go that, I'm just gonna 843.44s - 848.84s | tell you that we have eight fields and each of them are 16 bits. So you have 16 bits, then a 848.84s - 855.32s | colon, 16 bits, then a colon, 16 bits, you get the drill. Um, and now, so to make this easier, 855.32s - 860.32s | we're just gonna have a look at the last field. Um, and so the thing is that we have 16 862.76s - 868.36s | bits here and we know that the whole IPV4 internet is 32 bits. So actually with only two 868.38s - 873.38s | fields from an IPV6 address, we can already represent all addresses in the IPV4 internet. 875.66s - 880.66s | Um, yeah. So, uh, in hex, just to understand hex, we count from zero and then we count up to F. 884.36s - 889.36s | And so that's done by 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E, F, 0, 1, 2, 3, 4, 5, 6, 7, 8. 899.14s - 904.14s | 9, A, B, C, D, E,


chunk_text:
uh, and we'll get there in a second. Um, but before we go that, I'm just gonna 843.44s - 848.84s | tell you that we have eight fields and each of them are 16 bits. So you have 16 bits, then a 848.84s - 855.32s | colon, 16 bits, then a colon, 16 bits, you get the drill. Um, and now, so to make this easier, 855.32s - 860.32s | we're just gonna have a look at the last field. Um, and so the thing is that we have 16 862.76s - 868.36s | bits here and we know that the whole IPV4 internet is 32 bits. So actually with only two 868.38s - 873.38s | fields from an IPV6 address, we can already represent all addresses in the IPV4 internet. 875.66s - 880.66s | Um, yeah. So, uh, in hex, just to understand hex, we count from zero and then we count up to F. 884.36s - 889.36s | And so that's done by 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E, F, 0, 1, 2, 3, 4, 5, 6, 7, 8. 899.14s - 904.14s | 9, A, B, C, D, E, F, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E, F. And it just keeps 911.44s - 916.02s | counting like that. Um, very important to understand to get like how these addresses are 916.02s - 921.02s | actually, um, why they look so weird. Okay. Does that make sense? Okay. So, now that we 923.66s - 927.32s | understand the basics of how hex numbers work, let's try to understand what information we 927.32s - 933.76s | can extrapolate from the different parts of an address. Um, it's not a rule, but like most 933.76s - 940.70s | IPV6 addresses consists of a host, that's the first orange part, and then an, uh, sorry, a 940.70s - 945.70s | host, the blue last part, and the network, the first orange part. Um, and, um, they're often 947.84s - 954.04s | separated in the middle by 64 bits for the network, here in orange, and, uh, 64 bits for the 954.04s - 959.04s | host, here in blue. Um, so what we learned about in the IPV4 section, this would be a slash 64, 961.60s - 966.62s | uh, because the blue part is


chunk_text:
F, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, A, B, C, D, E, F. And it just keeps 911.44s - 916.02s | counting like that. Um, very important to understand to get like how these addresses are 916.02s - 921.02s | actually, um, why they look so weird. Okay. Does that make sense? Okay. So, now that we 923.66s - 927.32s | understand the basics of how hex numbers work, let's try to understand what information we 927.32s - 933.76s | can extrapolate from the different parts of an address. Um, it's not a rule, but like most 933.76s - 940.70s | IPV6 addresses consists of a host, that's the first orange part, and then an, uh, sorry, a 940.70s - 945.70s | host, the blue last part, and the network, the first orange part. Um, and, um, they're often 947.84s - 954.04s | separated in the middle by 64 bits for the network, here in orange, and, uh, 64 bits for the 954.04s - 959.04s | host, here in blue. Um, so what we learned about in the IPV4 section, this would be a slash 64, 961.60s - 966.62s | uh, because the blue part is our network, when we, uh, have an address that has the same first 968.94s - 974.26s | half as ours, we can send it to our local network, if it's an address outside of that, we have to 974.26s - 979.26s | send it to someone who knows how to pass it on, uh, usually our default gateway. So, um, the 980.02s - 985.02s | reason that having 64 bits in the host, uh, in the, yeah, in the host part, um, is actually 990.26s - 995.26s | that it allows for some pretty cool features. Um, and so, one of them is stateless, address 997.00s - 1002.14s | auto-configuration, and the other one is privacy extensions. And so I'm just gonna go over 1002.14s - 1007.08s | what they are, because then we'll actually see how, like, we go from having a network, and 1007.10s - 1012.48s | then actually setting the last part. Because when you look at an IPV6 address, unless you've 1012.48s - 1017.48s | set it statically, you're not gonna see 0, 0, 0, 0, 0, 0, 1, A, 0, 0, 0, 0, uh, and, um, 1019.82s - 1025.76s | counting up like that. Um,


chunk_text:
our network, when we, uh, have an address that has the same first 968.94s - 974.26s | half as ours, we can send it to our local network, if it's an address outside of that, we have to 974.26s - 979.26s | send it to someone who knows how to pass it on, uh, usually our default gateway. So, um, the 980.02s - 985.02s | reason that having 64 bits in the host, uh, in the, yeah, in the host part, um, is actually 990.26s - 995.26s | that it allows for some pretty cool features. Um, and so, one of them is stateless, address 997.00s - 1002.14s | auto-configuration, and the other one is privacy extensions. And so I'm just gonna go over 1002.14s - 1007.08s | what they are, because then we'll actually see how, like, we go from having a network, and 1007.10s - 1012.48s | then actually setting the last part. Because when you look at an IPV6 address, unless you've 1012.48s - 1017.48s | set it statically, you're not gonna see 0, 0, 0, 0, 0, 0, 1, A, 0, 0, 0, 0, uh, and, um, 1019.82s - 1025.76s | counting up like that. Um, so what stateless address, uh, configuration is actually really 1025.76s - 1031.42s | cool, um, it uses the 64 bits that we have available as the subnet of the network, um, and 1031.44s - 1037.82s | then it generates an IP address by itself, just from knowing the first network part. And the 1037.82s - 1043.86s | process is called EUI64, and what it does is that it takes the, uh, 48-bit MAC address of the 1043.86s - 1049.20s | network interface, and then it expands it to 64 bits. So by that, we have, like, our network, 1049.20s - 1055.00s | which is the orange part, and then the last part is decided, uh, by calculating it based on 1055.02s - 1060.02s | the MAC address that the interface has. Um, and so, without doing any DHCP or anything, by 1063.26s - 1068.80s | just knowing the network that we're working on, our computer can pick an address for itself, 1068.80s - 1073.70s | because MAC addresses are pretty unique, it's unlikely that it's gonna clash with anything, 1073.70s - 1079.24s | it's supposed to be unique, and, um, by that, we can just pick an address by ourselves,


chunk_text:
so what stateless address, uh, configuration is actually really 1025.76s - 1031.42s | cool, um, it uses the 64 bits that we have available as the subnet of the network, um, and 1031.44s - 1037.82s | then it generates an IP address by itself, just from knowing the first network part. And the 1037.82s - 1043.86s | process is called EUI64, and what it does is that it takes the, uh, 48-bit MAC address of the 1043.86s - 1049.20s | network interface, and then it expands it to 64 bits. So by that, we have, like, our network, 1049.20s - 1055.00s | which is the orange part, and then the last part is decided, uh, by calculating it based on 1055.02s - 1060.02s | the MAC address that the interface has. Um, and so, without doing any DHCP or anything, by 1063.26s - 1068.80s | just knowing the network that we're working on, our computer can pick an address for itself, 1068.80s - 1073.70s | because MAC addresses are pretty unique, it's unlikely that it's gonna clash with anything, 1073.70s - 1079.24s | it's supposed to be unique, and, um, by that, we can just pick an address by ourselves, we 1079.26s - 1085.66s | don't need to be told what IP address is available on the network. Um, and the second cool 1085.66s - 1090.30s | feature is privacy extensions, so with pretty much every device on the versions of, on version 1090.30s - 1096.34s | 6 of the internet, um, you're suddenly vulnerable to tracking. If someone, maybe someone 1096.34s - 1101.38s | realized before that if you have the same MAC address between every network that you move 1101.38s - 1107.82s | across, you'll be easy, pretty easy to track. And so, uh, that would be pretty, pretty, pretty 1107.86s - 1112.54s | problematic that, like, you can be correlated across, like, many different networks. Um, so 1112.54s - 1117.54s | what privacy extensions does is that it works by changing your IP address regularly, um, so we 1119.40s - 1124.42s | have the 64 bits in our host part, and they just change, like, over time. You visit a website, it 1128.06s - 1132.66s | uses one address, you visit another website, it uses another address, after some time it 1132.66s - 1138.94s | changes to a third address, and it, it cycles through them, which


chunk_text:
we 1079.26s - 1085.66s | don't need to be told what IP address is available on the network. Um, and the second cool 1085.66s - 1090.30s | feature is privacy extensions, so with pretty much every device on the versions of, on version 1090.30s - 1096.34s | 6 of the internet, um, you're suddenly vulnerable to tracking. If someone, maybe someone 1096.34s - 1101.38s | realized before that if you have the same MAC address between every network that you move 1101.38s - 1107.82s | across, you'll be easy, pretty easy to track. And so, uh, that would be pretty, pretty, pretty 1107.86s - 1112.54s | problematic that, like, you can be correlated across, like, many different networks. Um, so 1112.54s - 1117.54s | what privacy extensions does is that it works by changing your IP address regularly, um, so we 1119.40s - 1124.42s | have the 64 bits in our host part, and they just change, like, over time. You visit a website, it 1128.06s - 1132.66s | uses one address, you visit another website, it uses another address, after some time it 1132.66s - 1138.94s | changes to a third address, and it, it cycles through them, which is pretty cool. Like, it, it 1138.94s - 1143.94s | gives, uh, an increased level of privacy. Um, so the reason, um, yeah. And then I just 1152.66s - 1157.36s | wanted to mention, uh, the last really cool feature about IPv6 is that when, when you have 1157.36s - 1163.00s | this huge space, when you have 64 bits to work with, um, you do get the thing that, like, 1163.00s - 1168.48s | suddenly your, the subnets that you're making, the smallest meaningful subnet that you're 1168.48s - 1173.92s | making, 64 bits, which is very standard, um, you can make them smaller, but, like, you make a 1173.92s - 1179.96s | 64-bit subnet, and suddenly it can contain pretty much an endless amount of addresses. Like, if 1179.96s - 1185.62s | you're working with IPv4, you have to decide, okay, do we want this network to be a slash 64? 1185.62s - 1191.36s | Then we have 250 free addresses that can join that network. With IPv6, you just always do a 1191.36s - 1196.36s | slash 64. Did I say 64 the other time? Yeah. With IPv4, uh, you'll usually make a slash 24 1199.60s -


chunk_text:
is pretty cool. Like, it, it 1138.94s - 1143.94s | gives, uh, an increased level of privacy. Um, so the reason, um, yeah. And then I just 1152.66s - 1157.36s | wanted to mention, uh, the last really cool feature about IPv6 is that when, when you have 1157.36s - 1163.00s | this huge space, when you have 64 bits to work with, um, you do get the thing that, like, 1163.00s - 1168.48s | suddenly your, the subnets that you're making, the smallest meaningful subnet that you're 1168.48s - 1173.92s | making, 64 bits, which is very standard, um, you can make them smaller, but, like, you make a 1173.92s - 1179.96s | 64-bit subnet, and suddenly it can contain pretty much an endless amount of addresses. Like, if 1179.96s - 1185.62s | you're working with IPv4, you have to decide, okay, do we want this network to be a slash 64? 1185.62s - 1191.36s | Then we have 250 free addresses that can join that network. With IPv6, you just always do a 1191.36s - 1196.36s | slash 64. Did I say 64 the other time? Yeah. With IPv4, uh, you'll usually make a slash 24 1199.60s - 1205.68s | network for your home network that limits it to 250 free addresses. Um, and then, like, if 1205.68s - 1209.68s | you're an enterprise setting or something, you need to start making address plans to make sure 1209.68s - 1214.02s | that there will be enough addresses, uh, considering what it is that you want to do, and 1214.02s - 1217.66s | then maybe you get an office in the future, and then suddenly, ah, it doesn't fit into the 1217.68s - 1222.26s | address plan, and then you're kind of screwed because you're, you're out of addresses. With 1222.26s - 1228.44s | IPv6, you always, you, you can always make a slash 64 subnet, and you basically are able to 1228.44s - 1233.34s | put in, there, there's not a limit of 250 free or however many you've specified when you 1233.34s - 1238.78s | designed a network. Um, you can just have pretty much an endless amount of machines be on 1238.78s - 1247.92s | that network, which is a pretty cool feature. So, um, now that you know how to read an IPv6 1247.92s - 1252.76s | address, looking at just, like, the same plain


chunk_text:
1205.68s | network for your home network that limits it to 250 free addresses. Um, and then, like, if 1205.68s - 1209.68s | you're an enterprise setting or something, you need to start making address plans to make sure 1209.68s - 1214.02s | that there will be enough addresses, uh, considering what it is that you want to do, and 1214.02s - 1217.66s | then maybe you get an office in the future, and then suddenly, ah, it doesn't fit into the 1217.68s - 1222.26s | address plan, and then you're kind of screwed because you're, you're out of addresses. With 1222.26s - 1228.44s | IPv6, you always, you, you can always make a slash 64 subnet, and you basically are able to 1228.44s - 1233.34s | put in, there, there's not a limit of 250 free or however many you've specified when you 1233.34s - 1238.78s | designed a network. Um, you can just have pretty much an endless amount of machines be on 1238.78s - 1247.92s | that network, which is a pretty cool feature. So, um, now that you know how to read an IPv6 1247.92s - 1252.76s | address, looking at just, like, the same plain thing as we did before should hopefully be 1252.76s - 1258.80s | easier, um, and, and hopefully, also, you know, not just easier to understand, but also easier 1258.80s - 1264.36s | to remember, uh, because if you work in the same environment, uh, it's very likely that the 1264.36s - 1271.64s | first 64 bits are going to be the same. Uh, we know that, like, uh, depending on where you are 1271.64s - 1277.40s | geographically, or where you got your IP addresses from, the first part of the, the, the 1277.40s - 1283.40s | range that you got is usually going to be the same. So, as you work with this, things are going 1283.40s - 1289.44s | to be pretty, uh, pretty familiar. Um, and then you know the first part, and then the last part 1289.44s - 1293.80s | is just up to you when you design the network. It's either going to be decided by the host 1293.80s - 1298.80s | itself, or maybe you set it statically, and it actually becomes something like 0, 0, 0, 0, 0, 0, 1298.80s - 1307.12s | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,


chunk_text:
thing as we did before should hopefully be 1252.76s - 1258.80s | easier, um, and, and hopefully, also, you know, not just easier to understand, but also easier 1258.80s - 1264.36s | to remember, uh, because if you work in the same environment, uh, it's very likely that the 1264.36s - 1271.64s | first 64 bits are going to be the same. Uh, we know that, like, uh, depending on where you are 1271.64s - 1277.40s | geographically, or where you got your IP addresses from, the first part of the, the, the 1277.40s - 1283.40s | range that you got is usually going to be the same. So, as you work with this, things are going 1283.40s - 1289.44s | to be pretty, uh, pretty familiar. Um, and then you know the first part, and then the last part 1289.44s - 1293.80s | is just up to you when you design the network. It's either going to be decided by the host 1293.80s - 1298.80s | itself, or maybe you set it statically, and it actually becomes something like 0, 0, 0, 0, 0, 0, 1298.80s - 1307.12s | 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1. Um, so, uh, let's just see how you should handle these 1307.12s - 1312.92s | addresses when using them. Um, you heard me say, you heard me mention, like, a lot of zeros 1312.92s - 1317.92s | there. And so what's really cool is that we're actually allowed to do this, where instead of 1317.92s - 1324.44s | putting four zeros in each field, we just put one, like a zero is a zero. And then, like, 1324.44s - 1328.44s | moving on from that, like, we're also allowed to do something else. We have three fields of 1328.44s - 1333.80s | zeros here right next to each other. Um, and we're allowed to shorten that by doing a double 1333.80s - 1342.04s | colon. Uh, we know that an IPv6 address is 128 bits. So, if we see an address and we have a 1342.04s - 1347.64s | double colon, it means that everything between, you just expand it up to 128 bits in that 1347.64s - 1354.20s | section with zeros. And then you have, like, the full IPv6 address. Uh, you can only have one 1354.20s - 1359.00s | double colon, though. So, that's very important


chunk_text:
1. Um, so, uh, let's just see how you should handle these 1307.12s - 1312.92s | addresses when using them. Um, you heard me say, you heard me mention, like, a lot of zeros 1312.92s - 1317.92s | there. And so what's really cool is that we're actually allowed to do this, where instead of 1317.92s - 1324.44s | putting four zeros in each field, we just put one, like a zero is a zero. And then, like, 1324.44s - 1328.44s | moving on from that, like, we're also allowed to do something else. We have three fields of 1328.44s - 1333.80s | zeros here right next to each other. Um, and we're allowed to shorten that by doing a double 1333.80s - 1342.04s | colon. Uh, we know that an IPv6 address is 128 bits. So, if we see an address and we have a 1342.04s - 1347.64s | double colon, it means that everything between, you just expand it up to 128 bits in that 1347.64s - 1354.20s | section with zeros. And then you have, like, the full IPv6 address. Uh, you can only have one 1354.20s - 1359.00s | double colon, though. So, that's very important to, uh, to know. Because if you had multiple 1359.00s - 1364.28s | double colons, it wouldn't know, like, where the section in between them, uh, would go with all 1364.28s - 1370.44s | the zeros. Um, so, and I think this is maybe what trips up a lot of people. Like, you both have, 1370.44s - 1376.12s | like, hex numbers and you have colons in your IP address and you have double colons and then you 1376.12s - 1383.24s | have, like, slashes. And then it just becomes, like, way too abstract from what you're familiar 1383.24s - 1393.00s | with. Um, yeah. So, the next thing that would probably be really good to just mention is how 1393.00s - 1399.56s | do you browse the web with this? We know that protocol handlers, HTTP, HTTPS, use colons. So, 1399.56s - 1405.24s | if you suddenly have a protocol handler, HTTPS colon slash slash. And then you have this address, 1405.24s - 1413.96s | like, that seems to, like, mess something up. Um, so, the problem with pasting it, yeah, 1413.96s - 1418.04s | in the address bar is what I just mentioned. Like, colons are used to


chunk_text:
to, uh, to know. Because if you had multiple 1359.00s - 1364.28s | double colons, it wouldn't know, like, where the section in between them, uh, would go with all 1364.28s - 1370.44s | the zeros. Um, so, and I think this is maybe what trips up a lot of people. Like, you both have, 1370.44s - 1376.12s | like, hex numbers and you have colons in your IP address and you have double colons and then you 1376.12s - 1383.24s | have, like, slashes. And then it just becomes, like, way too abstract from what you're familiar 1383.24s - 1393.00s | with. Um, yeah. So, the next thing that would probably be really good to just mention is how 1393.00s - 1399.56s | do you browse the web with this? We know that protocol handlers, HTTP, HTTPS, use colons. So, 1399.56s - 1405.24s | if you suddenly have a protocol handler, HTTPS colon slash slash. And then you have this address, 1405.24s - 1413.96s | like, that seems to, like, mess something up. Um, so, the problem with pasting it, yeah, 1413.96s - 1418.04s | in the address bar is what I just mentioned. Like, colons are used to indicate protocol handlers and 1418.04s - 1422.68s | used to indicate port numbers. So, putting in an address with a bunch of colons is just gonna make 1422.68s - 1427.72s | everything more confusing. Um, so, that's not going to work. And so, what we instead do is that 1427.72s - 1434.12s | we put this address in square brackets. And then we press enter. And then we browse the web. Um, 1434.12s - 1438.84s | so, that's just, like, a good thing that's good to be aware of because you understand IPv6. You 1438.84s - 1443.00s | know how the addresses work. You see this. You're, like, oh, I want to try to browse to an IPv6 1443.00s - 1447.40s | address. And then it doesn't work because your browser's, like, what are all these colons doing? 1447.40s - 1455.40s | Um, but this is the way to do it. So, lastly, in this section, I'm just gonna, uh, end it the 1455.40s - 1461.48s | same way that I did with the other one by showing you a map of the internet. And so, in this case, 1461.48s - 1467.32s | it's IPv6. And as you can see


chunk_text:
indicate protocol handlers and 1418.04s - 1422.68s | used to indicate port numbers. So, putting in an address with a bunch of colons is just gonna make 1422.68s - 1427.72s | everything more confusing. Um, so, that's not going to work. And so, what we instead do is that 1427.72s - 1434.12s | we put this address in square brackets. And then we press enter. And then we browse the web. Um, 1434.12s - 1438.84s | so, that's just, like, a good thing that's good to be aware of because you understand IPv6. You 1438.84s - 1443.00s | know how the addresses work. You see this. You're, like, oh, I want to try to browse to an IPv6 1443.00s - 1447.40s | address. And then it doesn't work because your browser's, like, what are all these colons doing? 1447.40s - 1455.40s | Um, but this is the way to do it. So, lastly, in this section, I'm just gonna, uh, end it the 1455.40s - 1461.48s | same way that I did with the other one by showing you a map of the internet. And so, in this case, 1461.48s - 1467.32s | it's IPv6. And as you can see here, our idea of using double double the amount of bits, 1467.32s - 1471.72s | as in an IPv4 address, it achieved what we wanted. Like, everyone seems to have pretty much 1472.28s - 1480.60s | one large IP block. And it's not a scattered mess that we saw with IPv4. Um, and so, 1480.68s - 1490.36s | essentially, uh, this is not even the whole IPv6 internet. This is just a part of the IPv6 1490.36s - 1497.40s | internet that we have allocated today. So, uh, people say, will we run out of addresses? 1499.24s - 1504.20s | And it seems like we're only having a couple of seconds left. Will we run out of addresses? No, 1504.20s - 1510.52s | because this is one eighth of the IPv6 internet. And we can fuck up seven more times until we're 1510.52s - 1512.52s | out. Thank you very much.


chunk_text:
here, our idea of using double double the amount of bits, 1467.32s - 1471.72s | as in an IPv4 address, it achieved what we wanted. Like, everyone seems to have pretty much 1472.28s - 1480.60s | one large IP block. And it's not a scattered mess that we saw with IPv4. Um, and so, 1480.68s - 1490.36s | essentially, uh, this is not even the whole IPv6 internet. This is just a part of the IPv6 1490.36s - 1497.40s | internet that we have allocated today. So, uh, people say, will we run out of addresses? 1499.24s - 1504.20s | And it seems like we're only having a couple of seconds left. Will we run out of addresses? No, 1504.20s - 1510.52s | because this is one eighth of the IPv6 internet. And we can fuck up seven more times until we're 1510.52s - 1512.52s | out. Thank you very much.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=jrlvMXfftec", "title": "DEF CON 32 - MoWireless MoProblems: Modular Wireless Survey Sys. & Data Analytics - G Horvath, W Tam", "description": "Often there are times to collect #allTheWireless, but with that comes some planning, we've created a modular survey system and developed an Elastic-based analytic platform named PacketGlass to visualize and explore the terabytes of information collected over multiple surveys. Our system collects all data types supported by Kismet plus raw PCAP data, ingests the data, and displays tens of millions of devices in an easy to query and display manner. Using different parsing techniques, We plan to show how to build one of these survey platforms and discuss the methodology used to transform Elastic into a robust analytical platform.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1269, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 5.00s | This text was transcribed using whisper model: large-v2 Alright, good afternoon everyone and this next talk that is sponsored by the Packet Hacking 7.80s - 12.80s | Village. Is More Money More Problems, oh actually I'm wrong, sorry. Is Mo Wireless More 14.08s - 21.77s | Problems by Jeff Harv, uh, Jeff Horvath and Winston Tam. 24.41s - 27.35s | Hey guys, how you doing? Thanks for, uh, thanks for coming out to our talk today. Uh, Mo 27.35s - 30.81s | Wireless, Mo Problems, modular wireless security systems and the data analytics at 31.03s - 33.73s | the Packet Hacking Village. Welcome. Uh, I'm Jeff Horvath from Alsatian Consulting. Uh, 33.73s - 39.07s | presenting with me today is Winston Tam from Uplinks LLC. Hello. So tell you guys a little 39.07s - 42.61s | bit about me. I did 13 years in the army as an intelligence officer. I did 10 of those 42.61s - 47.65s | years in special operations units. Uh, once I got out of the military, I started Alsatian 47.65s - 51.35s | Consulting. Uh, and there's our website if you ever want to check us out. We do cyber 51.35s - 56.23s | security, uh, digital signature reduction, personal data protection to private sector 56.25s - 60.85s | and public sector individuals. Uh, I have a BA in political science from Drexel 60.85s - 64.69s | University. I have a master's in information security engineering from the Sands 64.69s - 68.89s | Institute. And with that I got 10 GAAC certifications and there's my analyst ID


