# MediaChunks

chunk_text:
to their packets. 1329.41s - 1333.17s | So once again, it's very simple things that you can add 1333.17s - 1335.45s | just to block these kind of attacks. 1337.65s - 1339.91s | I've also included in this PowerPoint some reading material 1339.91s - 1342.57s | because I know you guys like to read and you want more things to read. 1342.91s - 1347.45s | So a lot of these briefs are on Sparta, like how we thought of the idea. 1347.91s - 1351.21s | We've also included a lot of links to Sparta, like how to get started with it, 1351.21s - 1354.01s | where to get started with it, because it's a huge application. 1354.71s - 1357.87s | And there's a lot of different media examples of other talks 1357.87s - 1360.21s | that have been done on this kind of sort of same topic. 1360.99s - 1365.89s | I've also included these more DEF CON talks that my colleague, 1365.89s - 1369.61s | Brandon Bailey, have done, also including some of the SISAT work he's done 1369.81s - 1374.01s | and a lot of different papers and articles that also talk about different 1374.01s - 1376.85s | attack vectors and countermeasures that you can include. 1378.15s - 1380.05s | And that's it. 1381.89s - 1384.79s | So thank you very much. 1386.25s - 1391.96s | Good. I can't see anything. 1392.56s - 1396.14s | All right. I can't see that light is black. 1397.74s - 1398.94s | Are there any questions? 1399.70s - 1401.80s | I can't see if they have any questions, though. 1403.60s - 1411.61s | Anybody have any questions? 1422.68s - 1427.24s | So with this is just assuming CFS, which CFS, if you're not aware, 1427.24s - 1431.10s | is NASA's open source satellite kind of information. 1431.10s - 1434.40s | So you can actually go to their GitHub, download CFS and build your own spacecraft. 1435.10s - 1439.78s | So CFS has this methodology in which, like I said, it uploads or it starts 1440.14s - 1443.90s | all of its flight applications through those ISO files. 1444.20s - 1447.90s | So if, you know, say I wanted to do a supply chain attack, 1447.90s - 1452.84s | I would just find that development server and just put my ISO file in there. 1453.00s - 1456.98s | Or if they had like


chunk_text:
attack vectors and countermeasures that you can include. 1378.15s - 1380.05s | And that's it. 1381.89s - 1384.79s | So thank you very much. 1386.25s - 1391.96s | Good. I can't see anything. 1392.56s - 1396.14s | All right. I can't see that light is black. 1397.74s - 1398.94s | Are there any questions? 1399.70s - 1401.80s | I can't see if they have any questions, though. 1403.60s - 1411.61s | Anybody have any questions? 1422.68s - 1427.24s | So with this is just assuming CFS, which CFS, if you're not aware, 1427.24s - 1431.10s | is NASA's open source satellite kind of information. 1431.10s - 1434.40s | So you can actually go to their GitHub, download CFS and build your own spacecraft. 1435.10s - 1439.78s | So CFS has this methodology in which, like I said, it uploads or it starts 1440.14s - 1443.90s | all of its flight applications through those ISO files. 1444.20s - 1447.90s | So if, you know, say I wanted to do a supply chain attack, 1447.90s - 1452.84s | I would just find that development server and just put my ISO file in there. 1453.00s - 1456.98s | Or if they had like upload file protocol like CFTP, 1457.64s - 1461.30s | then I would be able to upload my own startup script and just do another reboot. 1462.24s - 1464.10s | So there's a lot of different methods 1464.10s - 1467.28s | in which I could get that flight application on to the actual system. 1471.62s - 1477.20s | Yeah. Yes. 1477.20s - 1482.11s | Any other questions? 1482.31s - 1484.11s | All right. Thanks, guys.


chunk_text:
upload file protocol like CFTP, 1457.64s - 1461.30s | then I would be able to upload my own startup script and just do another reboot. 1462.24s - 1464.10s | So there's a lot of different methods 1464.10s - 1467.28s | in which I could get that flight application on to the actual system. 1471.62s - 1477.20s | Yeah. Yes. 1477.20s - 1482.11s | Any other questions? 1482.31s - 1484.11s | All right. Thanks, guys.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=IIH4qR_X3Hs", "title": "DEF CON 32 - Fool us Once, fool us twice Hacking Norwegian Banks - Per Thorsheim", "description": "In 2021 we could get access to all personal bank accounts at the largest bank in Norway by using a single page paper form sent by snailmail. In addition to stealing all their money, we could also see all account transactions for the last 10 years, with details. In 2024 we have done the same thing to another bank. Why didn't the banks learn the first time? In this talk we'll explain what we did, lessons learned and why paper ID still is relevant and important to us all.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1331, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 9.00s | This text was transcribed using whisper model: large-v2 So just for the audience, we will do our talk and then we have some time afterwards to answer any questions. 9.00s - 17.00s | We are really interested in feedback from people from, well not from Norway where we are from, but from US and any other country in the world. 17.00s - 22.00s | And we will also be around here both on tomorrow and on Sunday. 22.00s - 24.00s | But it's time to get started. 24.00s - 30.00s | Hello, my name is Per, I'm from Norway and I have with me Cecilia. 30.00s - 38.00s | And we are going to talk about Fool Me Once, Fool Me Twice, Hacking Norwegian Banks Using Paper ID. 38.00s - 41.00s | So Cecilia, about yourself. 41.00s - 43.00s | Yes. 43.00s - 49.00s | Whenever people ask me, how did you get into security, I have to tell them, my background is psychology. 49.00s - 52.00s | I don't know anything about programming. 52.00s - 57.00s | I have a master's in philosophy of technology. 57.00s - 62.00s | And I have a background as a software tester. I've been doing that for years. 62.00s - 67.00s | And after testing a lot of software, that's how I got into security. 67.00s - 70.00s | More specifically, abusability. 70.00s - 78.00s | I, by the way, I love, I adore humans. I may elude a few individuals, but I love humans in general. 78.00s - 80.00s | Yeah. 80.00s - 90.00s | So when I do software testing, I keep asking myself, how can


chunk_text:
on Sunday. 22.00s - 24.00s | But it's time to get started. 24.00s - 30.00s | Hello, my name is Per, I'm from Norway and I have with me Cecilia. 30.00s - 38.00s | And we are going to talk about Fool Me Once, Fool Me Twice, Hacking Norwegian Banks Using Paper ID. 38.00s - 41.00s | So Cecilia, about yourself. 41.00s - 43.00s | Yes. 43.00s - 49.00s | Whenever people ask me, how did you get into security, I have to tell them, my background is psychology. 49.00s - 52.00s | I don't know anything about programming. 52.00s - 57.00s | I have a master's in philosophy of technology. 57.00s - 62.00s | And I have a background as a software tester. I've been doing that for years. 62.00s - 67.00s | And after testing a lot of software, that's how I got into security. 67.00s - 70.00s | More specifically, abusability. 70.00s - 78.00s | I, by the way, I love, I adore humans. I may elude a few individuals, but I love humans in general. 78.00s - 80.00s | Yeah. 80.00s - 90.00s | So when I do software testing, I keep asking myself, how can I mess up someone's life with this software? 90.00s - 94.00s | And of course, I'm asking this because I'm a nice person, because I want to fix it. 94.00s - 97.00s | I'm not trying to mess up your lives. 97.00s - 105.18s | Yeah. And on September 1st, it's to the day, 30 years since I started in information security. 105.18s - 107.18s | So that's the stuff I know. 107.18s - 111.18s | I have a very healthy obsession into passwords. 111.18s - 115.18s | I'm also divorced. There's no connection there, of course. 115.18s - 123.18s | And been working in my two previous positions as a CISO for what we normally would say big corporations, 123.18s - 127.18s | that would be very small sized companies here in the US. 127.18s - 133.18s | And yeah, I have done all kinds of stuff within information security. 133.18s - 140.18s | But today, it's a little bit more, you know, the basics of our talks has to do a little bit with hacking. 140.18s - 148.18s | The term abusability, I, you know, show of hands, do you know the term abusability and what we mean


chunk_text:
I mess up someone's life with this software? 90.00s - 94.00s | And of course, I'm asking this because I'm a nice person, because I want to fix it. 94.00s - 97.00s | I'm not trying to mess up your lives. 97.00s - 105.18s | Yeah. And on September 1st, it's to the day, 30 years since I started in information security. 105.18s - 107.18s | So that's the stuff I know. 107.18s - 111.18s | I have a very healthy obsession into passwords. 111.18s - 115.18s | I'm also divorced. There's no connection there, of course. 115.18s - 123.18s | And been working in my two previous positions as a CISO for what we normally would say big corporations, 123.18s - 127.18s | that would be very small sized companies here in the US. 127.18s - 133.18s | And yeah, I have done all kinds of stuff within information security. 133.18s - 140.18s | But today, it's a little bit more, you know, the basics of our talks has to do a little bit with hacking. 140.18s - 148.18s | The term abusability, I, you know, show of hands, do you know the term abusability and what we mean by that? 148.18s - 150.18s | Some do. Okay, very quickly. 150.18s - 156.18s | Abusability, again, I'm going to use a piece of software to make your life really, really bad. 156.18s - 160.18s | As a stalker, your ex, your spouse, for that matter, and so on. 160.18s - 165.18s | And then we also have responsible disclosure, which should also be known to you. 165.18s - 172.18s | The work that we two do together, you know, we are, it is very important for us to follow responsible disclosure. 172.18s - 175.18s | We don't want to mess up things for real. 175.18s - 178.18s | We find problems and we try to fix them. 178.18s - 184.18s | We don't want to give any recipe for the bad actors out there to do bad things. 184.18s - 189.18s | And Norway, where we live, we are four and a half, five million people. 189.18s - 193.18s | So it's a small country in population. 193.18s - 195.18s | And we are very indigital. 195.18s - 201.18s | I actually found out just a short while ago, I suddenly had to sign a piece of paper. 201.18s


chunk_text:
by that? 148.18s - 150.18s | Some do. Okay, very quickly. 150.18s - 156.18s | Abusability, again, I'm going to use a piece of software to make your life really, really bad. 156.18s - 160.18s | As a stalker, your ex, your spouse, for that matter, and so on. 160.18s - 165.18s | And then we also have responsible disclosure, which should also be known to you. 165.18s - 172.18s | The work that we two do together, you know, we are, it is very important for us to follow responsible disclosure. 172.18s - 175.18s | We don't want to mess up things for real. 175.18s - 178.18s | We find problems and we try to fix them. 178.18s - 184.18s | We don't want to give any recipe for the bad actors out there to do bad things. 184.18s - 189.18s | And Norway, where we live, we are four and a half, five million people. 189.18s - 193.18s | So it's a small country in population. 193.18s - 195.18s | And we are very indigital. 195.18s - 201.18s | I actually found out just a short while ago, I suddenly had to sign a piece of paper. 201.18s - 205.18s | And I discovered that I don't have a pen at home. 205.18s - 212.18s | And I tried to remember, and it's probably like four or five years since the last time I actually used a pen. 212.18s - 219.18s | Whenever I do interact with the government for healthcare, for insurance, banks, whatever, I do it online. 219.18s - 227.81s | And the last time I used cash back at home in Norway, I'm not sure, really. 227.81s - 231.81s | Four, five, six, seven years ago, maybe, something like that. 231.81s - 235.81s | We use card and we have Apple Pay, Google Pay, and all that stuff. 235.81s - 240.81s | What we don't do, yes, is we don't do our elections online. 241.81s - 247.81s | And if it is up to me, we're going to continue doing that on paper. 247.81s - 250.81s | But okay, so we can do credit checks. 250.81s - 254.81s | We have a debt register, so you can go online and find out how much money you owe. 254.81s - 263.81s | And also, if you want to get a mortgage for a house or a


chunk_text:
- 205.18s | And I discovered that I don't have a pen at home. 205.18s - 212.18s | And I tried to remember, and it's probably like four or five years since the last time I actually used a pen. 212.18s - 219.18s | Whenever I do interact with the government for healthcare, for insurance, banks, whatever, I do it online. 219.18s - 227.81s | And the last time I used cash back at home in Norway, I'm not sure, really. 227.81s - 231.81s | Four, five, six, seven years ago, maybe, something like that. 231.81s - 235.81s | We use card and we have Apple Pay, Google Pay, and all that stuff. 235.81s - 240.81s | What we don't do, yes, is we don't do our elections online. 241.81s - 247.81s | And if it is up to me, we're going to continue doing that on paper. 247.81s - 250.81s | But okay, so we can do credit checks. 250.81s - 254.81s | We have a debt register, so you can go online and find out how much money you owe. 254.81s - 263.81s | And also, if you want to get a mortgage for a house or a car, anything like that, the bank can check how much money do you owe to which companies, as an example. 263.81s - 268.81s | So it's sort of like, I would say, a very transparent society that we have. 268.81s - 269.81s | And we trust our government. 269.81s - 273.81s | We trust each other, which can be a problem sometimes. 273.81s - 277.81s | But again, we are really happy about the democracy that we have in Norway. 277.81s - 285.81s | And, of course, we're a little bit curious about how this works in the U.S., being here right now. 285.81s - 294.81s | And this talk is a little bit about power of attorney, giving somebody else access to your bank account. 295.81s - 298.81s | In Norway, it's easy to do. 298.81s - 300.81s | You can do it online. 300.81s - 308.81s | I can log on to my bank and I can say that I want my friend Cecilia to have access to my bank account because I'm sick, I'm disabled. 308.81s - 310.81s | I'm going to the hospital for surgery. 310.81s - 315.81s | I will be away for some time


chunk_text:
car, anything like that, the bank can check how much money do you owe to which companies, as an example. 263.81s - 268.81s | So it's sort of like, I would say, a very transparent society that we have. 268.81s - 269.81s | And we trust our government. 269.81s - 273.81s | We trust each other, which can be a problem sometimes. 273.81s - 277.81s | But again, we are really happy about the democracy that we have in Norway. 277.81s - 285.81s | And, of course, we're a little bit curious about how this works in the U.S., being here right now. 285.81s - 294.81s | And this talk is a little bit about power of attorney, giving somebody else access to your bank account. 295.81s - 298.81s | In Norway, it's easy to do. 298.81s - 300.81s | You can do it online. 300.81s - 308.81s | I can log on to my bank and I can say that I want my friend Cecilia to have access to my bank account because I'm sick, I'm disabled. 308.81s - 310.81s | I'm going to the hospital for surgery. 310.81s - 315.81s | I will be away for some time and I will allow her to handle my financial stuff. 316.81s - 323.81s | This can be useful in romantic partnerships for kids. 325.81s - 332.81s | And, of course, as I said, if you have disabilities and stuff like that, this can be really useful. 332.81s - 339.81s | At least that's what we saw from the advertisements from the banks that came about many years ago. 339.81s - 342.81s | They said, do not give away your digital identity to somebody else. 342.81s - 345.81s | Give them a power of attorney access to your account instead. 345.81s - 347.81s | That's the proper way of doing it. 347.81s - 351.81s | Because we have a digital ID in Norway called Bank ID. 351.81s - 355.81s | I used to be a CISO there, so I know a lot about it. 355.81s - 358.81s | And that's your digital ID that is legally you. 358.81s - 361.81s | So never give that away to anyone. 362.81s - 376.79s | Now, this gets interesting because if I give Cecilia access to my bank account, we saw this and I have no special needs. 376.79s - 379.79s | I don't


chunk_text:
and I will allow her to handle my financial stuff. 316.81s - 323.81s | This can be useful in romantic partnerships for kids. 325.81s - 332.81s | And, of course, as I said, if you have disabilities and stuff like that, this can be really useful. 332.81s - 339.81s | At least that's what we saw from the advertisements from the banks that came about many years ago. 339.81s - 342.81s | They said, do not give away your digital identity to somebody else. 342.81s - 345.81s | Give them a power of attorney access to your account instead. 345.81s - 347.81s | That's the proper way of doing it. 347.81s - 351.81s | Because we have a digital ID in Norway called Bank ID. 351.81s - 355.81s | I used to be a CISO there, so I know a lot about it. 355.81s - 358.81s | And that's your digital ID that is legally you. 358.81s - 361.81s | So never give that away to anyone. 362.81s - 376.79s | Now, this gets interesting because if I give Cecilia access to my bank account, we saw this and I have no special needs. 376.79s - 379.79s | I don't need anyone to handle my finances in the same way around. 379.79s - 388.79s | But the bank said we have a paper form to do this as well because in some cases you don't have Bank ID. 388.79s - 393.79s | As an example, Norway is now receiving quite a lot of Ukrainian refugees. 393.79s - 395.79s | I'm happy that we do that. 395.79s - 399.79s | But since we don't have a credit history for them, we don't know anything about them. 399.79s - 405.79s | They will have to wait for quite some time before they get into the digital society of Norway. 405.79s - 409.79s | Then you have disabled people, people that have a legal guardian. 409.79s - 417.79s | As an example, they will not receive a Bank ID because you can do quite a few stupid things with a legal ID online as well. 417.79s - 423.79s | So I thought that, well, Cecilia, we got to test this stuff. 423.79s - 426.79s | Would you like access to my bank account? 426.79s - 430.79s | And she said, yeah, sure. 430.79s - 432.79s | Let's try it out. 432.79s - 434.79s


chunk_text:
need anyone to handle my finances in the same way around. 379.79s - 388.79s | But the bank said we have a paper form to do this as well because in some cases you don't have Bank ID. 388.79s - 393.79s | As an example, Norway is now receiving quite a lot of Ukrainian refugees. 393.79s - 395.79s | I'm happy that we do that. 395.79s - 399.79s | But since we don't have a credit history for them, we don't know anything about them. 399.79s - 405.79s | They will have to wait for quite some time before they get into the digital society of Norway. 405.79s - 409.79s | Then you have disabled people, people that have a legal guardian. 409.79s - 417.79s | As an example, they will not receive a Bank ID because you can do quite a few stupid things with a legal ID online as well. 417.79s - 423.79s | So I thought that, well, Cecilia, we got to test this stuff. 423.79s - 426.79s | Would you like access to my bank account? 426.79s - 430.79s | And she said, yeah, sure. 430.79s - 432.79s | Let's try it out. 432.79s - 434.79s | Let's see what happens. 434.79s - 438.79s | And by the way, I tend to sometimes be a bit stupid on these things. 438.79s - 442.79s | I like to challenge people and usually I'm proven wrong and I regret it. 442.79s - 444.79s | But here's the thing. 444.79s - 447.79s | So the challenge was sort of for Cecilia. 447.79s - 455.79s | Instead of giving her legal access, it was like a game of you will try to obtain a legal access to my account. 455.79s - 456.79s | But we are cooperating on this. 456.79s - 458.79s | So, you know, we don't break the law. 458.79s - 460.79s | We don't break the rules of the bank. 460.79s - 467.79s | But you will need to get access to my bank account using a paper form, plain old paper. 467.79s - 469.79s | And let's see if that is going to work. 469.79s - 475.35s | Yes. 475.35s - 479.88s | Banks have a lot of security. 479.88s - 481.88s | A lot of security. 481.88s - 489.88s | If you're going to do any kind of pen testing or hacking or bounty hunting,


chunk_text:
| Let's see what happens. 434.79s - 438.79s | And by the way, I tend to sometimes be a bit stupid on these things. 438.79s - 442.79s | I like to challenge people and usually I'm proven wrong and I regret it. 442.79s - 444.79s | But here's the thing. 444.79s - 447.79s | So the challenge was sort of for Cecilia. 447.79s - 455.79s | Instead of giving her legal access, it was like a game of you will try to obtain a legal access to my account. 455.79s - 456.79s | But we are cooperating on this. 456.79s - 458.79s | So, you know, we don't break the law. 458.79s - 460.79s | We don't break the rules of the bank. 460.79s - 467.79s | But you will need to get access to my bank account using a paper form, plain old paper. 467.79s - 469.79s | And let's see if that is going to work. 469.79s - 475.35s | Yes. 475.35s - 479.88s | Banks have a lot of security. 479.88s - 481.88s | A lot of security. 481.88s - 489.88s | If you're going to do any kind of pen testing or hacking or bounty hunting, don't bother with the banks. 489.88s - 491.88s | There's so many measures in place. 491.88s - 499.88s | However, it's important to remember that those measures that I have in place, they're not your security measures. 499.88s - 501.88s | They are their security measure. 501.88s - 503.88s | And most of the time there's an overlap. 503.88s - 507.88s | You don't want to get robbed and they don't want to be the bank that gets robbed. 507.88s - 513.88s | However, once in a while, these things tend to split. 513.88s - 517.22s | This is the paper form. 517.22s - 526.22s | The challenge is, of course, I have to figure out his name, his address, his social security number, his bank account number. 526.22s - 529.22s | I also need some witnesses. 529.22s - 534.22s | And I need to sign it, both as him and me. 534.22s - 539.22s | And this is very interesting because, well, name and address, look up the phone book. 539.22s - 540.22s | It's not difficult. 540.22s - 545.22s | Social security numbers are not secrets. 545.22s - 547.22s | They are absolutely not secrets. 547.22s - 550.22s


chunk_text:
don't bother with the banks. 489.88s - 491.88s | There's so many measures in place. 491.88s - 499.88s | However, it's important to remember that those measures that I have in place, they're not your security measures. 499.88s - 501.88s | They are their security measure. 501.88s - 503.88s | And most of the time there's an overlap. 503.88s - 507.88s | You don't want to get robbed and they don't want to be the bank that gets robbed. 507.88s - 513.88s | However, once in a while, these things tend to split. 513.88s - 517.22s | This is the paper form. 517.22s - 526.22s | The challenge is, of course, I have to figure out his name, his address, his social security number, his bank account number. 526.22s - 529.22s | I also need some witnesses. 529.22s - 534.22s | And I need to sign it, both as him and me. 534.22s - 539.22s | And this is very interesting because, well, name and address, look up the phone book. 539.22s - 540.22s | It's not difficult. 540.22s - 545.22s | Social security numbers are not secrets. 545.22s - 547.22s | They are absolutely not secrets. 547.22s - 550.22s | They are treated like secrets, but they are not secrets. 550.22s - 553.22s | It's an identification number. 553.22s - 556.22s | So it's a predictable number. 556.22s - 558.22s | Roughly speaking, doesn't take a lot of guessing. 558.22s - 564.22s | And also, there was some services that were very helpful letting me verify it. 564.22s - 567.22s | They didn't know that. 567.22s - 571.22s | The most difficult part here is actually the bank account number. 571.22s - 579.22s | Now, bank account numbers are by design not a secret. 579.22s - 581.22s | They're not secret. 581.22s - 585.22s | However, I didn't happen to have his bank account number. 585.22s - 590.22s | We got a little bit help, but we found a way around it. 590.22s - 596.22s | Some back and forth, and we got hold, or I got a hold of his bank account number. 596.22s - 598.22s | Witnesses, beautiful. 598.22s - 600.22s | I love all the helpful people around. 600.22s - 604.22s | They're not always sure what they're signing, but they are very helpful. 604.22s - 606.22s | Thank you for your service. 606.22s - 608.22s


chunk_text:
| They are treated like secrets, but they are not secrets. 550.22s - 553.22s | It's an identification number. 553.22s - 556.22s | So it's a predictable number. 556.22s - 558.22s | Roughly speaking, doesn't take a lot of guessing. 558.22s - 564.22s | And also, there was some services that were very helpful letting me verify it. 564.22s - 567.22s | They didn't know that. 567.22s - 571.22s | The most difficult part here is actually the bank account number. 571.22s - 579.22s | Now, bank account numbers are by design not a secret. 579.22s - 581.22s | They're not secret. 581.22s - 585.22s | However, I didn't happen to have his bank account number. 585.22s - 590.22s | We got a little bit help, but we found a way around it. 590.22s - 596.22s | Some back and forth, and we got hold, or I got a hold of his bank account number. 596.22s - 598.22s | Witnesses, beautiful. 598.22s - 600.22s | I love all the helpful people around. 600.22s - 604.22s | They're not always sure what they're signing, but they are very helpful. 604.22s - 606.22s | Thank you for your service. 606.22s - 608.22s | Signature. 608.22s - 618.22s | Signature is very, very, very interesting because when did you last sign your name on a piece of paper? 618.22s - 620.22s | This week? 620.22s - 621.22s | Last week? 621.22s - 622.22s | A month? 622.22s - 627.22s | I don't sign my name on anything, and I don't sign my name on anything and give it to the bank. 627.22s - 637.22s | So if they're going to compare my signature, and probably his as well, it's going to be to a very, very, very old signature. 637.22s - 643.54s | So that was the part that I was nervous about. 643.54s - 645.54s | So yeah. 645.54s - 652.54s | You're 100% not surprised, but yes, I did get access. 652.54s - 660.54s | I didn't know what was going to happen when we started this project, but we discovered there were absolutely no controls. 660.54s - 665.54s | And most surprisingly, he didn't get notified. 665.54s - 667.54s | I didn't get notified. 667.54s - 671.54s | I just happened to discover I have access now. 671.54s - 674.54s | One evening that I was logging on to see


chunk_text:
| Signature. 608.22s - 618.22s | Signature is very, very, very interesting because when did you last sign your name on a piece of paper? 618.22s - 620.22s | This week? 620.22s - 621.22s | Last week? 621.22s - 622.22s | A month? 622.22s - 627.22s | I don't sign my name on anything, and I don't sign my name on anything and give it to the bank. 627.22s - 637.22s | So if they're going to compare my signature, and probably his as well, it's going to be to a very, very, very old signature. 637.22s - 643.54s | So that was the part that I was nervous about. 643.54s - 645.54s | So yeah. 645.54s - 652.54s | You're 100% not surprised, but yes, I did get access. 652.54s - 660.54s | I didn't know what was going to happen when we started this project, but we discovered there were absolutely no controls. 660.54s - 665.54s | And most surprisingly, he didn't get notified. 665.54s - 667.54s | I didn't get notified. 667.54s - 671.54s | I just happened to discover I have access now. 671.54s - 674.54s | One evening that I was logging on to see how is it going? 674.54s - 676.54s | Do I get access soon? 676.54s - 680.54s | Yes, I have full access. 680.54s - 681.54s | Full access. 681.54s - 682.54s | I have full access. 682.54s - 687.54s | I have 10 years of your history, banking history. 687.54s - 689.54s | I didn't really think about that. 689.54s - 693.54s | She could actually see 10 years of transactions on my credit card. 693.54s - 698.54s | That was like shit. 698.54s - 700.54s | I know you really well. 700.54s - 701.54s | I did get... 701.54s - 707.54s | I had already been several times to Vegas. 707.54s - 711.54s | Yes, you are my retirement plan. 711.54s - 716.54s | Anyways, yes, I did get all your money as well. 716.54s - 722.54s | What I didn't, what I couldn't do was pay his bills. 722.54s - 730.54s | If I was going to do this for legal and good reasons to help you out and not just mess around with you, 730.54s - 734.54s | paying the bills is the most important part of this. 734.54s - 736.54s | Anyways. 736.54s - 739.54s |


chunk_text:
how is it going? 674.54s - 676.54s | Do I get access soon? 676.54s - 680.54s | Yes, I have full access. 680.54s - 681.54s | Full access. 681.54s - 682.54s | I have full access. 682.54s - 687.54s | I have 10 years of your history, banking history. 687.54s - 689.54s | I didn't really think about that. 689.54s - 693.54s | She could actually see 10 years of transactions on my credit card. 693.54s - 698.54s | That was like shit. 698.54s - 700.54s | I know you really well. 700.54s - 701.54s | I did get... 701.54s - 707.54s | I had already been several times to Vegas. 707.54s - 711.54s | Yes, you are my retirement plan. 711.54s - 716.54s | Anyways, yes, I did get all your money as well. 716.54s - 722.54s | What I didn't, what I couldn't do was pay his bills. 722.54s - 730.54s | If I was going to do this for legal and good reasons to help you out and not just mess around with you, 730.54s - 734.54s | paying the bills is the most important part of this. 734.54s - 736.54s | Anyways. 736.54s - 739.54s | She could do all the bad things. 739.54s - 745.54s | And the one thing that I really want her to help me with because I'm sick or disabled is to pay my bills. 745.54s - 749.54s | And that's the one thing she couldn't do. 749.54s - 752.54s | And she can't do that today either. 752.54s - 756.54s | So we have been sort of saying like this system is... 756.54s - 758.54s | It doesn't actually work. 758.54s - 761.54s | No, it does not work. 761.54s - 763.54s | Anyways, we're very nice people. 763.54s - 765.54s | You can trust us, really. 765.54s - 769.54s | So, of course, we did the right thing. 769.54s - 773.54s | Number one, we did tell the banks. 773.54s - 777.54s | We also let them fix the issue before we told anyone else. 777.54s - 782.54s | Now, this was an on-page project, so we can't tell anyone else. 782.54s - 788.54s | And then we dutifully warned the public. 788.54s - 790.54s | Let me emphasize that. 790.54s - 797.54s | We warned the public by going into the newspapers, telling about this so that other


chunk_text:
She could do all the bad things. 739.54s - 745.54s | And the one thing that I really want her to help me with because I'm sick or disabled is to pay my bills. 745.54s - 749.54s | And that's the one thing she couldn't do. 749.54s - 752.54s | And she can't do that today either. 752.54s - 756.54s | So we have been sort of saying like this system is... 756.54s - 758.54s | It doesn't actually work. 758.54s - 761.54s | No, it does not work. 761.54s - 763.54s | Anyways, we're very nice people. 763.54s - 765.54s | You can trust us, really. 765.54s - 769.54s | So, of course, we did the right thing. 769.54s - 773.54s | Number one, we did tell the banks. 773.54s - 777.54s | We also let them fix the issue before we told anyone else. 777.54s - 782.54s | Now, this was an on-page project, so we can't tell anyone else. 782.54s - 788.54s | And then we dutifully warned the public. 788.54s - 790.54s | Let me emphasize that. 790.54s - 797.54s | We warned the public by going into the newspapers, telling about this so that other banks, 797.54s - 799.54s | because there are more than, you know, a few. 799.54s - 800.54s | There's a lot of them. 800.54s - 809.54s | I cannot spend all my evenings and weekends fixing their stuff and giving them one-on-one consultations unpaid. 809.54s - 816.54s | So, you know, they have to learn from what's out in the media and so on. 816.54s - 823.54s | So we did this, exhaled, waited a little bit. 823.54s - 827.20s | Do you want to go on? 827.20s - 834.20s | You know, you find a vulnerability and go public about it as soon as it's been fixed in one bank. 834.20s - 838.20s | And the reason for going public is to warn all the other banks that we found this vulnerability 838.20s - 848.20s | and you should check your systems, your procedures for checking paper forms and the hand signature on them. 848.20s - 854.20s | And we thought they actually read the articles and did that. 854.20s - 856.20s | So we waited a couple of years. 856.20s - 862.20s | And then it was like, do you think they have fixed it now? 862.20s -


chunk_text:
banks, 797.54s - 799.54s | because there are more than, you know, a few. 799.54s - 800.54s | There's a lot of them. 800.54s - 809.54s | I cannot spend all my evenings and weekends fixing their stuff and giving them one-on-one consultations unpaid. 809.54s - 816.54s | So, you know, they have to learn from what's out in the media and so on. 816.54s - 823.54s | So we did this, exhaled, waited a little bit. 823.54s - 827.20s | Do you want to go on? 827.20s - 834.20s | You know, you find a vulnerability and go public about it as soon as it's been fixed in one bank. 834.20s - 838.20s | And the reason for going public is to warn all the other banks that we found this vulnerability 838.20s - 848.20s | and you should check your systems, your procedures for checking paper forms and the hand signature on them. 848.20s - 854.20s | And we thought they actually read the articles and did that. 854.20s - 856.20s | So we waited a couple of years. 856.20s - 862.20s | And then it was like, do you think they have fixed it now? 862.20s - 865.20s | And then we went at it at the new bank. 865.20s - 868.20s | And yeah, you know the answer. 868.20s - 871.20s | We did it again, the exact same way. 871.20s - 877.20s | But we also found some interesting differences between the first bank and the second bank. 877.20s - 882.20s | And that was also with approximately four years between those two hacks. 882.20s - 891.20s | And in the new hack, the second bank that we did this, suddenly we saw that, well, 891.20s - 900.20s | me as the account owner, I could actually see that her name was on the transactions that she had done on sort of like my behalf. 900.20s - 907.20s | She couldn't pay my bills, but she could move all my money to a foreign account in Aruba or someplace like that. 907.20s - 909.20s | Go figure. 910.20s - 913.20s | Perfect power attorney access. 913.20s - 916.20s | And it's also important to say this is, you know, it's all or nothing. 916.20s - 918.20s | There's no granular access here. 918.20s - 920.20s | All or nothing access. 920.20s - 924.20s | So


chunk_text:
865.20s | And then we went at it at the new bank. 865.20s - 868.20s | And yeah, you know the answer. 868.20s - 871.20s | We did it again, the exact same way. 871.20s - 877.20s | But we also found some interesting differences between the first bank and the second bank. 877.20s - 882.20s | And that was also with approximately four years between those two hacks. 882.20s - 891.20s | And in the new hack, the second bank that we did this, suddenly we saw that, well, 891.20s - 900.20s | me as the account owner, I could actually see that her name was on the transactions that she had done on sort of like my behalf. 900.20s - 907.20s | She couldn't pay my bills, but she could move all my money to a foreign account in Aruba or someplace like that. 907.20s - 909.20s | Go figure. 910.20s - 913.20s | Perfect power attorney access. 913.20s - 916.20s | And it's also important to say this is, you know, it's all or nothing. 916.20s - 918.20s | There's no granular access here. 918.20s - 920.20s | All or nothing access. 920.20s - 924.20s | So that was a good thing compared to the previous test. 924.20s - 930.20s | Now I could see that the transactions had been carried out by Cecilia or myself. 930.20s - 935.20s | First bank, all transactions showed up as I did it. 935.20s - 938.20s | I even called the bank and I said, I didn't do this. 938.20s - 940.20s | And they said, yes, you did. 940.20s - 945.20s | And I say, well, I have sort of a legal guardian or power attorney given to another friend. 945.20s - 950.20s | And they said, well, it's, you know, if you trust that person, that's your problem, not ours. 950.20s - 951.20s | So there we go. 951.20s - 957.20s | So it was good to see that in the second bank, I could actually see she had been doing transactions. 957.20s - 960.20s | But there was also some bad things here. 962.20s - 963.20s | Cecilia? 963.20s - 964.20s | Yeah. 964.20s - 976.20s | So there was only one bank that had started improving the interfaces to help people like Ped that may get taken advantage of and robbed by loved ones. 976.20s -


chunk_text:
that was a good thing compared to the previous test. 924.20s - 930.20s | Now I could see that the transactions had been carried out by Cecilia or myself. 930.20s - 935.20s | First bank, all transactions showed up as I did it. 935.20s - 938.20s | I even called the bank and I said, I didn't do this. 938.20s - 940.20s | And they said, yes, you did. 940.20s - 945.20s | And I say, well, I have sort of a legal guardian or power attorney given to another friend. 945.20s - 950.20s | And they said, well, it's, you know, if you trust that person, that's your problem, not ours. 950.20s - 951.20s | So there we go. 951.20s - 957.20s | So it was good to see that in the second bank, I could actually see she had been doing transactions. 957.20s - 960.20s | But there was also some bad things here. 962.20s - 963.20s | Cecilia? 963.20s - 964.20s | Yeah. 964.20s - 976.20s | So there was only one bank that had started improving the interfaces to help people like Ped that may get taken advantage of and robbed by loved ones. 976.20s - 987.20s | And this is the conclusion from the investigation and the project is that protecting yourself from this kind of fraud or scam is pretty much impossible. 987.20s - 991.20s | Because a lot of the time you, well, you don't get notified. 991.20s - 995.20s | And it's hard to see that someone else have access to your account. 995.20s - 1002.20s | And when you don't see in transaction list the different names, it's even more, you end up gaslighting yourself. 1002.20s - 1005.20s | What did, did I buy that online? 1005.20s - 1006.20s | I didn't know that. 1006.20s - 1012.20s | You know, you start questioning yourself, should I get my brain tested? 1012.20s - 1014.20s | Is this early dementia? 1014.20s - 1018.20s | You know, so super hard to see if someone have access. 1018.20s - 1020.20s | And that is not a good thing. 1021.20s - 1025.20s | Now, of course, I don't know, like, is there anyone here? 1025.20s - 1027.20s | No, you don't have to put your hand up. 1027.20s - 1035.20s | But I hope some of you either working at bank or at least have a


chunk_text:
987.20s | And this is the conclusion from the investigation and the project is that protecting yourself from this kind of fraud or scam is pretty much impossible. 987.20s - 991.20s | Because a lot of the time you, well, you don't get notified. 991.20s - 995.20s | And it's hard to see that someone else have access to your account. 995.20s - 1002.20s | And when you don't see in transaction list the different names, it's even more, you end up gaslighting yourself. 1002.20s - 1005.20s | What did, did I buy that online? 1005.20s - 1006.20s | I didn't know that. 1006.20s - 1012.20s | You know, you start questioning yourself, should I get my brain tested? 1012.20s - 1014.20s | Is this early dementia? 1014.20s - 1018.20s | You know, so super hard to see if someone have access. 1018.20s - 1020.20s | And that is not a good thing. 1021.20s - 1025.20s | Now, of course, I don't know, like, is there anyone here? 1025.20s - 1027.20s | No, you don't have to put your hand up. 1027.20s - 1035.20s | But I hope some of you either working at bank or at least have a bank and feel like complaining to them. 1035.20s - 1041.20s | Because what's really important is to be notified ahead of time. 1041.20s - 1045.20s | Not just like five minutes, but a week at least. 1045.20s - 1054.20s | So that the sick and disabled pet have time to worry and figure out and get out of his sick bed and call the bank and say, 1054.20s - 1056.20s | Hey, I got this notification. 1056.20s - 1057.20s | I don't know what's going on. 1057.20s - 1058.20s | Could you tell me? 1058.20s - 1061.20s | So they can stop it before I rob him. 1061.20s - 1069.77s | It should absolutely be visible for the account holder to see who's done transactions on his account. 1069.77s - 1079.77s | And if I can really, really ask difficult and ask, can we get transaction limits and co-signing for bigger amounts? 1079.77s - 1084.77s | It is insane that I can tell there's an all or nothing. 1084.77s - 1088.77s | Now, what can you do except from complaining to your bank? 1088.77s - 1090.77s | Because you should. 1091.77s - 1097.77s | If you need a power of


chunk_text:
bank and feel like complaining to them. 1035.20s - 1041.20s | Because what's really important is to be notified ahead of time. 1041.20s - 1045.20s | Not just like five minutes, but a week at least. 1045.20s - 1054.20s | So that the sick and disabled pet have time to worry and figure out and get out of his sick bed and call the bank and say, 1054.20s - 1056.20s | Hey, I got this notification. 1056.20s - 1057.20s | I don't know what's going on. 1057.20s - 1058.20s | Could you tell me? 1058.20s - 1061.20s | So they can stop it before I rob him. 1061.20s - 1069.77s | It should absolutely be visible for the account holder to see who's done transactions on his account. 1069.77s - 1079.77s | And if I can really, really ask difficult and ask, can we get transaction limits and co-signing for bigger amounts? 1079.77s - 1084.77s | It is insane that I can tell there's an all or nothing. 1084.77s - 1088.77s | Now, what can you do except from complaining to your bank? 1088.77s - 1090.77s | Because you should. 1091.77s - 1097.77s | If you need a power of attorney or are going to have a what's called a joint account that we have here in the US. 1097.77s - 1100.77s | Make sure it's a new account. 1100.77s - 1109.77s | Sweetie, whoever you're sharing your account with, they don't need to know the last 10 years what you've been up to. 1109.77s - 1114.77s | Also, you need to spread your money out on several accounts or banks. 1114.77s - 1121.77s | I'm very aware that banking in the US is very much a locking situation because of your credit system. 1121.77s - 1123.77s | But try spread it out. 1123.77s - 1132.77s | So in case it turns out whoever you're trusting is not as trustworthy, you're not losing all of your money. 1132.77s - 1134.77s | That's it, really. 1134.77s - 1137.77s | That's the only advice I can give you. 1137.77s - 1140.77s | Now, do you have any questions? 1149.15s - 1151.15s | Yes. 1151.15s - 1153.15s | Say again. 1153.15s - 1155.15s | Nothing. 1155.15s - 1158.15s | No, but I can tell what I did with the money. 1158.15s - 1161.15s | Yeah, that's okay. 1161.15s - 1163.15s | Tell them


chunk_text:
attorney or are going to have a what's called a joint account that we have here in the US. 1097.77s - 1100.77s | Make sure it's a new account. 1100.77s - 1109.77s | Sweetie, whoever you're sharing your account with, they don't need to know the last 10 years what you've been up to. 1109.77s - 1114.77s | Also, you need to spread your money out on several accounts or banks. 1114.77s - 1121.77s | I'm very aware that banking in the US is very much a locking situation because of your credit system. 1121.77s - 1123.77s | But try spread it out. 1123.77s - 1132.77s | So in case it turns out whoever you're trusting is not as trustworthy, you're not losing all of your money. 1132.77s - 1134.77s | That's it, really. 1134.77s - 1137.77s | That's the only advice I can give you. 1137.77s - 1140.77s | Now, do you have any questions? 1149.15s - 1151.15s | Yes. 1151.15s - 1153.15s | Say again. 1153.15s - 1155.15s | Nothing. 1155.15s - 1158.15s | No, but I can tell what I did with the money. 1158.15s - 1161.15s | Yeah, that's okay. 1161.15s - 1163.15s | Tell them what you did with my money. 1163.15s - 1165.15s | I'm a very nice person. 1165.15s - 1171.15s | So in addition to transfer a very small amount to myself, I, of course, donated to cancer. 1171.15s - 1173.15s | Breast cancer, I think, specifically. 1173.15s - 1175.15s | Breast cancer research. 1175.15s - 1184.15s | However, you may not be familiar with European law, but if you donate money or contact any organization, they are allowed to contact you. 1184.15s - 1186.15s | Right, Ped? 1186.15s - 1190.15s | So earlier this year, I was visiting Gdansk in Poland. 1190.15s - 1196.15s | I went for the first time in my life to one of the concentration camps to remember history. 1196.15s - 1200.15s | I'm walking in the streets in Gdansk, relaxing for a few days. 1200.15s - 1205.15s | My phone calls, I answer because I usually do that. 1205.15s - 1213.15s | And it's a Norwegian cancer society or something like that in Norway calling me like, oh, thank you so much for your gift to us. 1213.15s - 1219.15s | And we would really like to ask you if you're interested in supporting us anymore.


chunk_text:
what you did with my money. 1163.15s - 1165.15s | I'm a very nice person. 1165.15s - 1171.15s | So in addition to transfer a very small amount to myself, I, of course, donated to cancer. 1171.15s - 1173.15s | Breast cancer, I think, specifically. 1173.15s - 1175.15s | Breast cancer research. 1175.15s - 1184.15s | However, you may not be familiar with European law, but if you donate money or contact any organization, they are allowed to contact you. 1184.15s - 1186.15s | Right, Ped? 1186.15s - 1190.15s | So earlier this year, I was visiting Gdansk in Poland. 1190.15s - 1196.15s | I went for the first time in my life to one of the concentration camps to remember history. 1196.15s - 1200.15s | I'm walking in the streets in Gdansk, relaxing for a few days. 1200.15s - 1205.15s | My phone calls, I answer because I usually do that. 1205.15s - 1213.15s | And it's a Norwegian cancer society or something like that in Norway calling me like, oh, thank you so much for your gift to us. 1213.15s - 1219.15s | And we would really like to ask you if you're interested in supporting us anymore. 1219.15s - 1225.03s | And I was like, dementia? 1225.03s - 1227.03s | I'm just 52. 1227.03s - 1232.03s | Like, did I ever donate to the Norwegian Cancer Association? 1232.03s - 1234.03s | Ah. 1234.03s - 1239.03s | You know, I got to come back to you again, but it's a really good cause. 1239.03s - 1242.03s | And yeah, I would probably donate more money later on. 1242.03s - 1247.03s | And then it came to me like somebody had access to my bank accounts. 1247.03s - 1250.03s | So, well, a really good cause. 1250.03s - 1251.03s | Fully supported. 1251.03s - 1252.03s | Donate again. 1252.03s - 1255.03s | But that was, yeah, that was a little bit of surprise. 1255.03s - 1262.03s | We can also go back to the paper form just to make sure that you really understand the lack of controls. 1262.03s - 1269.03s | We used several colored pens to sign the form. 1269.03s - 1274.03s | We had several people write our names first and last name and so on. 1274.03s - 1277.03s | So if you look at the fill out paper form, it's like crazy. 1277.03s - 1279.03s


chunk_text:
1219.15s - 1225.03s | And I was like, dementia? 1225.03s - 1227.03s | I'm just 52. 1227.03s - 1232.03s | Like, did I ever donate to the Norwegian Cancer Association? 1232.03s - 1234.03s | Ah. 1234.03s - 1239.03s | You know, I got to come back to you again, but it's a really good cause. 1239.03s - 1242.03s | And yeah, I would probably donate more money later on. 1242.03s - 1247.03s | And then it came to me like somebody had access to my bank accounts. 1247.03s - 1250.03s | So, well, a really good cause. 1250.03s - 1251.03s | Fully supported. 1251.03s - 1252.03s | Donate again. 1252.03s - 1255.03s | But that was, yeah, that was a little bit of surprise. 1255.03s - 1262.03s | We can also go back to the paper form just to make sure that you really understand the lack of controls. 1262.03s - 1269.03s | We used several colored pens to sign the form. 1269.03s - 1274.03s | We had several people write our names first and last name and so on. 1274.03s - 1277.03s | So if you look at the fill out paper form, it's like crazy. 1277.03s - 1279.03s | It's it doesn't make sense at all. 1279.03s - 1282.03s | And of course, the signatures were completely wrong as well. 1282.03s - 1289.03s | So if they did a signature verification against my 30 year old signature on file that they have in my bank, 1289.03s - 1293.03s | it's like it doesn't look anything like my original signature at all. 1293.03s - 1295.03s | So they didn't verify anything. 1295.03s - 1297.03s | It just went through. 1297.03s - 1300.03s | That was crazy to us. 1300.03s - 1308.03s | So going forward into a more digital world, be it in the US or in Iceland or Japan or wherever you are, 1308.03s - 1314.03s | remember that going digital, there will still be a lot of people that need to use paper forms. 1314.03s - 1320.03s | And the security of those paper forms has to be equal to the digital security that you're implementing. 1320.03s - 1324.03s | And that's sort of the important end of our talk here. 1324.03s - 1326.03s | And we'll be around for a little bit. 1326.03s - 1327.03s | So questions, feel free. 1327.03s - 1329.03s | Thank you


chunk_text:
| It's it doesn't make sense at all. 1279.03s - 1282.03s | And of course, the signatures were completely wrong as well. 1282.03s - 1289.03s | So if they did a signature verification against my 30 year old signature on file that they have in my bank, 1289.03s - 1293.03s | it's like it doesn't look anything like my original signature at all. 1293.03s - 1295.03s | So they didn't verify anything. 1295.03s - 1297.03s | It just went through. 1297.03s - 1300.03s | That was crazy to us. 1300.03s - 1308.03s | So going forward into a more digital world, be it in the US or in Iceland or Japan or wherever you are, 1308.03s - 1314.03s | remember that going digital, there will still be a lot of people that need to use paper forms. 1314.03s - 1320.03s | And the security of those paper forms has to be equal to the digital security that you're implementing. 1320.03s - 1324.03s | And that's sort of the important end of our talk here. 1324.03s - 1326.03s | And we'll be around for a little bit. 1326.03s - 1327.03s | So questions, feel free. 1327.03s - 1329.03s | Thank you so much again.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=IyInMgXj4k4", "title": "DEF CON 32 Finding 0days in Vilo Home Routers Justin Mott & Ava Petersen", "description": "From January to May 2024, a team of student researchers at Brigham Young University looked for 0days in a consumer-grade home router made by Vilo Living. By April 2024, they had found 9 zero days, 6 of which were critical. This presentation covers the process they went through from initial reconnaissance to hardware hacking to finding buffer overflows to reporting the bugs to the organization. Outline: Initial recon - OSINT on the company, previous vulnerabilities released (none), and black-box interactions with network services on the LAN Hardware hacking - identifying chips on the board, connecting to the UART interface, deciphering boot up info, dumping the flash memory (didn\u2019t work), and observing reads/writes by the CPU to flash memory to obtain the firmware Cloud enumeration - discovering the AWS S3 buckets and IoT infrastructure, tracing cloud interactions (authenticating to the router remotely, retrieving MQTT certificates, etc.) Firmware enumeration - kernel + libc version, arch, how to emulate binaries on an x86 machine, compiling code to run on the router, what binary does what, etc. Vulnerability discovery - finishing reversing custom TCP protocol for mobile app-router interactions, searching for stack overflows, lack of authentication, command injection (and accidentally bricking 3 routers), info leaks, reviewing the 9 vulnerabilities we discovered, weaponizing and chaining some of the vulnerabilities, etc. Vendor disclosure - difficulty contacting the vendor in May 2024 with vulnerability details (they were almost dead), how the disclosure process went, filing for CVEs in June, publishing vuln details in August Conclusion - how stupid easy it is to hack IoT devices, how IoT vendors treat security issues, where future research can focus", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1685, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 6.40s | This text was transcribed using whisper model: large-v2 uh good afternoon ladies gentlemen and hackers all around we are very very excited to be here 6.40s - 12.16s | with you today we're excited to share what we've done this year um the light's a little bright so 12.16s - 18.24s | i can't see you but i'm trusting that there's people out there so um as always keep your hands 18.24s - 23.12s | and and feet inside of the vehicles at all times um and enjoy the ride we're excited 23.12s - 30.72s | um


chunk_text:
for mobile app-router interactions, searching for stack overflows, lack of authentication, command injection (and accidentally bricking 3 routers), info leaks, reviewing the 9 vulnerabilities we discovered, weaponizing and chaining some of the vulnerabilities, etc. Vendor disclosure - difficulty contacting the vendor in May 2024 with vulnerability details (they were almost dead), how the disclosure process went, filing for CVEs in June, publishing vuln details in August Conclusion - how stupid easy it is to hack IoT devices, how IoT vendors treat security issues, where future research can focus", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1685, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 6.40s | This text was transcribed using whisper model: large-v2 uh good afternoon ladies gentlemen and hackers all around we are very very excited to be here 6.40s - 12.16s | with you today we're excited to share what we've done this year um the light's a little bright so 12.16s - 18.24s | i can't see you but i'm trusting that there's people out there so um as always keep your hands 18.24s - 23.12s | and and feet inside of the vehicles at all times um and enjoy the ride we're excited 23.12s - 30.72s | um okay so this is what we're going to go over today what i really want to point out is the link 30.72s - 37.28s | at the bottom it is a github link if you would like to follow along see more details actual 37.28s - 42.40s | code and the firmware of what we've gone through you can go ahead we published it about 30 minutes 42.40s - 46.96s | ago so you can go in and follow through or if you would just like to listen to the talk follow 46.96s - 52.64s | along and then maybe view it at the end there is a qr code that we have that you can scan i 52.64s - 59.55s | promise you it's not a rickroll um it'll just give you this github link okay first we'll do 59.55s - 65.39s | some introductions my name is justin applegate i am a rising graduate student at brigham young 65.39s - 73.55s | university um i am an avid ctfr i play for project sekai and the u.s cyber team i am avid peterson 73.55s - 79.95s | i'm also an undergraduate student at byu and i go by


chunk_text:
okay so this is what we're going to go over today what i really want to point out is the link 30.72s - 37.28s | at the bottom it is a github link if you would like to follow along see more details actual 37.28s - 42.40s | code and the firmware of what we've gone through you can go ahead we published it about 30 minutes 42.40s - 46.96s | ago so you can go in and follow through or if you would just like to listen to the talk follow 46.96s - 52.64s | along and then maybe view it at the end there is a qr code that we have that you can scan i 52.64s - 59.55s | promise you it's not a rickroll um it'll just give you this github link okay first we'll do 59.55s - 65.39s | some introductions my name is justin applegate i am a rising graduate student at brigham young 65.39s - 73.55s | university um i am an avid ctfr i play for project sekai and the u.s cyber team i am avid peterson 73.55s - 79.95s | i'm also an undergraduate student at byu and i go by the handle delta blue jay and i am justin 80.51s - 86.35s | i am also a graduate student at byu and i go by the handle castor burris thank you yes i go by 86.35s - 91.87s | lego clones um if you've if you see me around the last member of our team for this project his name 91.87s - 97.79s | is wyatt pangirl he goes by spouting whale um he just graduated from byu he was not able to make 97.79s - 106.08s | it today um but he was an invaluable member of our team so let's just go over the project real 106.08s - 111.52s | quick but first i want to present to you the router graveyard we managed to break not one but 111.52s - 117.76s | two but three routers along the way of this journey um we really wanted to apply some ctf skills to a 117.76s - 125.52s | real life situation so we uh picked a router a device and and tried to hike into it so we formed 125.52s - 131.28s | our team we picked a timeline of about a semester long project and uh saw


chunk_text:
the handle delta blue jay and i am justin 80.51s - 86.35s | i am also a graduate student at byu and i go by the handle castor burris thank you yes i go by 86.35s - 91.87s | lego clones um if you've if you see me around the last member of our team for this project his name 91.87s - 97.79s | is wyatt pangirl he goes by spouting whale um he just graduated from byu he was not able to make 97.79s - 106.08s | it today um but he was an invaluable member of our team so let's just go over the project real 106.08s - 111.52s | quick but first i want to present to you the router graveyard we managed to break not one but 111.52s - 117.76s | two but three routers along the way of this journey um we really wanted to apply some ctf skills to a 117.76s - 125.52s | real life situation so we uh picked a router a device and and tried to hike into it so we formed 125.52s - 131.28s | our team we picked a timeline of about a semester long project and uh saw what we could get from 131.28s - 141.01s | there um so the device we picked was this vilo router uh home mesh wi-fi device so as any 141.01s - 146.53s | vulnerability researcher or security researcher does when you first start against a new target 146.53s - 151.17s | you want to do reconnaissance you want to oscent you want to figure out what has been done before 151.17s - 157.25s | so i don't have to reinvent the wheel so this is some of the results that of what we went through 157.25s - 162.53s | vilo living is the company that produced the routers that we went after they were a startup 162.53s - 168.21s | founded in 2021 so they're pretty they're pretty new pretty recent and they only have two products 168.21s - 174.85s | as of today they are both mesh routers one sports wi-fi five the other wi-fi six we search for cves 174.85s - 180.45s | that have been released any sort of technical deep dive or breakdown or even a consumer review that 180.45s - 184.77s | might go into some of the features a little bit and we didn't find


chunk_text:
what we could get from 131.28s - 141.01s | there um so the device we picked was this vilo router uh home mesh wi-fi device so as any 141.01s - 146.53s | vulnerability researcher or security researcher does when you first start against a new target 146.53s - 151.17s | you want to do reconnaissance you want to oscent you want to figure out what has been done before 151.17s - 157.25s | so i don't have to reinvent the wheel so this is some of the results that of what we went through 157.25s - 162.53s | vilo living is the company that produced the routers that we went after they were a startup 162.53s - 168.21s | founded in 2021 so they're pretty they're pretty new pretty recent and they only have two products 168.21s - 174.85s | as of today they are both mesh routers one sports wi-fi five the other wi-fi six we search for cves 174.85s - 180.45s | that have been released any sort of technical deep dive or breakdown or even a consumer review that 180.45s - 184.77s | might go into some of the features a little bit and we didn't find anything so between the fact 184.77s - 189.49s | that it's a new company um the fact that we didn't see anything any other research that 189.49s - 193.89s | that had been done before and it was pretty cheap it was one of the cheapest routers that we could 193.89s - 199.01s | find on amazon we were thinking all right this is perfect for some college students to get our feet 199.01s - 205.57s | wet get involved find some cves just get used to the router hacking scene um a couple of notes i 205.57s - 211.89s | know a lot of routers especially the older ones are administered through a web interface you 211.89s - 218.53s | connect to the LAN or to the WAN you type in 192.168.1.1 in your browser it pops up that's how 218.53s - 223.49s | you set it up this was not the case with us and with this router it was all managed through an 223.49s - 229.09s | app on your phone kind of a new age thing um they said they have a bug bounty program when we did 229.09s - 233.89s | some research in order


chunk_text:
anything so between the fact 184.77s - 189.49s | that it's a new company um the fact that we didn't see anything any other research that 189.49s - 193.89s | that had been done before and it was pretty cheap it was one of the cheapest routers that we could 193.89s - 199.01s | find on amazon we were thinking all right this is perfect for some college students to get our feet 199.01s - 205.57s | wet get involved find some cves just get used to the router hacking scene um a couple of notes i 205.57s - 211.89s | know a lot of routers especially the older ones are administered through a web interface you 211.89s - 218.53s | connect to the LAN or to the WAN you type in 192.168.1.1 in your browser it pops up that's how 218.53s - 223.49s | you set it up this was not the case with us and with this router it was all managed through an 223.49s - 229.09s | app on your phone kind of a new age thing um they said they have a bug bounty program when we did 229.09s - 233.89s | some research in order to access the bug bounty program you had to sign an NDA and be a part of 233.89s - 239.97s | their beta testing group um which i we didn't know what the NDA looked like so we reached out and 239.97s - 243.97s | said hey we want to join the beta testing group can you send us the NDA and they just never got 243.97s - 247.81s | back to us so we were like well i guess we'll just risk it for the biscuit go for it anyway 247.81s - 253.09s | see what we find um and last thing the firmware was not released by the vendor it's not something 253.09s - 256.61s | that we could just download and go through we had to go ahead and recover that ourselves 257.57s - 265.01s | this led to the three main goals for us today um first was to acquire the firmware that way it's a 265.01s - 270.13s | white box test and not a black box test you can see the code it makes it a lot easier to actually 270.13s - 275.65s | turn memory corruption vulnerabilities into exploits then we wanted to


chunk_text:
to access the bug bounty program you had to sign an NDA and be a part of 233.89s - 239.97s | their beta testing group um which i we didn't know what the NDA looked like so we reached out and 239.97s - 243.97s | said hey we want to join the beta testing group can you send us the NDA and they just never got 243.97s - 247.81s | back to us so we were like well i guess we'll just risk it for the biscuit go for it anyway 247.81s - 253.09s | see what we find um and last thing the firmware was not released by the vendor it's not something 253.09s - 256.61s | that we could just download and go through we had to go ahead and recover that ourselves 257.57s - 265.01s | this led to the three main goals for us today um first was to acquire the firmware that way it's a 265.01s - 270.13s | white box test and not a black box test you can see the code it makes it a lot easier to actually 270.13s - 275.65s | turn memory corruption vulnerabilities into exploits then we wanted to pop a shell actually 275.65s - 280.85s | get a shell on the device that makes debugging and extracting the latest version of the firmware 280.85s - 287.49s | much easier and our third goal was to find as many pre-authentication remote code execution 287.49s - 292.53s | vulnerabilities as we could that's kind of the holy grail anyone that does not have administrator 292.53s - 297.33s | access to this router that can run whatever code that they want on it so those were the goals that 297.33s - 303.89s | we had when we approached it so obviously the next step was to start enumerating our attack surface 304.85s - 309.57s | so we went and dissembles disassembled the router and this is what we ended up with 309.57s - 315.17s | uh and we found some uart pins so we tried to solder to them and that was the death of router 315.17s - 323.73s | number one uh you may be gone but it will live forever on in our hearts uh the second router 323.73s - 330.45s | had better pins that were easy to solder to so then we hooked it up uh got


chunk_text:
pop a shell actually 275.65s - 280.85s | get a shell on the device that makes debugging and extracting the latest version of the firmware 280.85s - 287.49s | much easier and our third goal was to find as many pre-authentication remote code execution 287.49s - 292.53s | vulnerabilities as we could that's kind of the holy grail anyone that does not have administrator 292.53s - 297.33s | access to this router that can run whatever code that they want on it so those were the goals that 297.33s - 303.89s | we had when we approached it so obviously the next step was to start enumerating our attack surface 304.85s - 309.57s | so we went and dissembles disassembled the router and this is what we ended up with 309.57s - 315.17s | uh and we found some uart pins so we tried to solder to them and that was the death of router 315.17s - 323.73s | number one uh you may be gone but it will live forever on in our hearts uh the second router 323.73s - 330.45s | had better pins that were easy to solder to so then we hooked it up uh got a linux log on screen 331.17s - 334.29s | uh the problem is we didn't know the password and it wasn't an easy one 335.25s - 340.21s | and the ur interface died after 30 seconds after boot and it was really hard to even try to put 340.21s - 347.25s | in a password because it printed out how much time you had left every second as a result there 347.25s - 354.53s | was no free shell from this interface so we moved on we went to go and look at the vilo app we pulled 354.53s - 361.49s | the apk from google play um and apparently the other members of our team think that mobile rev 361.49s - 370.37s | sucks um i thought it was a great time we found some firebase info um various cloud service stuff 370.37s - 376.21s | on the app but the biggest important thing that we found was a custom uh service running on tcp port 376.77s - 384.93s | 5 4 3 2 this was used for wrap apt to router interactions when the router had not yet gotten 384.93s - 389.97s | at internet access uh this


chunk_text:
a linux log on screen 331.17s - 334.29s | uh the problem is we didn't know the password and it wasn't an easy one 335.25s - 340.21s | and the ur interface died after 30 seconds after boot and it was really hard to even try to put 340.21s - 347.25s | in a password because it printed out how much time you had left every second as a result there 347.25s - 354.53s | was no free shell from this interface so we moved on we went to go and look at the vilo app we pulled 354.53s - 361.49s | the apk from google play um and apparently the other members of our team think that mobile rev 361.49s - 370.37s | sucks um i thought it was a great time we found some firebase info um various cloud service stuff 370.37s - 376.21s | on the app but the biggest important thing that we found was a custom uh service running on tcp port 376.77s - 384.93s | 5 4 3 2 this was used for wrap apt to router interactions when the router had not yet gotten 384.93s - 389.97s | at internet access uh this was used to get do all that setup it would spin this up they would 389.97s - 394.37s | talk to each other over this they had a custom protocol that we reversed engineer to learn how 394.37s - 403.97s | that was working go on next slide so this is kind of the overview at a 15 byte header and a payload 404.53s - 411.81s | um the header had uh all the fields that you see there not all op codes had payloads but many did 411.81s - 418.69s | and they were usually encrypted using this weird xxt plus custom uh obfuscation layer 418.69s - 424.61s | random things basically the app had a hard-coded key that obfuscated and then sent to the router 424.61s - 429.17s | and the router encrypted a new key and sent it back but it was all reversible and so we were 429.17s - 435.65s | able to go from the hard-coded key and generate our own ones to be able to talk to it uh which 435.65s - 442.53s | made it really easy to start once we were able to get the source for it uh start sending messages


chunk_text:
was used to get do all that setup it would spin this up they would 389.97s - 394.37s | talk to each other over this they had a custom protocol that we reversed engineer to learn how 394.37s - 403.97s | that was working go on next slide so this is kind of the overview at a 15 byte header and a payload 404.53s - 411.81s | um the header had uh all the fields that you see there not all op codes had payloads but many did 411.81s - 418.69s | and they were usually encrypted using this weird xxt plus custom uh obfuscation layer 418.69s - 424.61s | random things basically the app had a hard-coded key that obfuscated and then sent to the router 424.61s - 429.17s | and the router encrypted a new key and sent it back but it was all reversible and so we were 429.17s - 435.65s | able to go from the hard-coded key and generate our own ones to be able to talk to it uh which 435.65s - 442.53s | made it really easy to start once we were able to get the source for it uh start sending messages 442.53s - 451.97s | back and forth and uh exploit some of our some of the things we found so then we needed still 451.97s - 457.41s | needed to get the firmware off of it um we saw that there was a flash memory chip of the model 457.41s - 464.37s | on the slide we tried some software utilities and they only gave us bad data so then we got this 464.37s - 470.77s | salie logic analyzer and then it just worked uh we just hooked it up we fired up their software 470.77s - 476.69s | we turned the router on we got all of the spi data straight to their software and then we could just 476.69s - 481.33s | decode it and there was the binary and we extracted the firmware and then we had everything that was 481.33s - 486.77s | on the router just like that we spent about a month getting to this point trying all sorts of 486.77s - 491.33s | different stuff and like literally it took us about two hours and then we had everything on it 491.33s - 500.02s | the moment we plugged this in so


chunk_text:
442.53s - 451.97s | back and forth and uh exploit some of our some of the things we found so then we needed still 451.97s - 457.41s | needed to get the firmware off of it um we saw that there was a flash memory chip of the model 457.41s - 464.37s | on the slide we tried some software utilities and they only gave us bad data so then we got this 464.37s - 470.77s | salie logic analyzer and then it just worked uh we just hooked it up we fired up their software 470.77s - 476.69s | we turned the router on we got all of the spi data straight to their software and then we could just 476.69s - 481.33s | decode it and there was the binary and we extracted the firmware and then we had everything that was 481.33s - 486.77s | on the router just like that we spent about a month getting to this point trying all sorts of 486.77s - 491.33s | different stuff and like literally it took us about two hours and then we had everything on it 491.33s - 500.02s | the moment we plugged this in so this is just a look at what uh that spi data looked like in the 500.02s - 506.26s | software it was super easy once we had it um we have a more technical deep dive on exactly what 506.26s - 513.46s | that is and the python scripts we use to translate this into the binary on the github yep so check 513.46s - 518.66s | out the github if you want to see more about how that's done um at this point we had the firmware 518.66s - 524.50s | we had accomplished goal number one now we wanted to look for vulnerabilities and establish a shell 524.50s - 529.06s | so before you start looking for vulnerabilities it's usually a good idea to figure out 529.06s - 536.82s | how to emulate the firmware on your own machine um this specific device had a 32-bit little endian 536.82s - 543.46s | MIPS processor so that's what all the the binaries were compiled to be using most of us have x86 or 543.46s - 547.86s | even arm machines and so that's not something that we can run natively so we decided to use 547.86s - 554.26s |


chunk_text:
this is just a look at what uh that spi data looked like in the 500.02s - 506.26s | software it was super easy once we had it um we have a more technical deep dive on exactly what 506.26s - 513.46s | that is and the python scripts we use to translate this into the binary on the github yep so check 513.46s - 518.66s | out the github if you want to see more about how that's done um at this point we had the firmware 518.66s - 524.50s | we had accomplished goal number one now we wanted to look for vulnerabilities and establish a shell 524.50s - 529.06s | so before you start looking for vulnerabilities it's usually a good idea to figure out 529.06s - 536.82s | how to emulate the firmware on your own machine um this specific device had a 32-bit little endian 536.82s - 543.46s | MIPS processor so that's what all the the binaries were compiled to be using most of us have x86 or 543.46s - 547.86s | even arm machines and so that's not something that we can run natively so we decided to use 547.86s - 554.26s | qemu which was statically compiled along with chroot and some precise gdb breakpoints that we 554.26s - 559.46s | had figured out after some reverse engineering in Ghidra in order to actually emulate the firmware 559.46s - 564.50s | and get it running on one of our machines this makes it significantly easier to fuzz for 564.50s - 570.74s | vulnerabilities to test things out um to to create exploits once you find a vulnerability 570.74s - 576.34s | in addition we wanted the ability to compile our own executables that we can place on the 576.34s - 581.22s | device and run them because a lot of these embedded devices do not have the executables 581.22s - 586.34s | that you would like to have on there for example netcat or whatnot um this one didn't even have 586.34s - 593.54s | who am i um and so we wanted to be able to create our own stuff now this device used uc libc as its 593.62s - 600.82s | libc library um uc libc was actually pretty much discontinued or unmaintained since 2012 and so 600.82s - 607.86s | someone created a fork called it uc libc ng


chunk_text:
qemu which was statically compiled along with chroot and some precise gdb breakpoints that we 554.26s - 559.46s | had figured out after some reverse engineering in Ghidra in order to actually emulate the firmware 559.46s - 564.50s | and get it running on one of our machines this makes it significantly easier to fuzz for 564.50s - 570.74s | vulnerabilities to test things out um to to create exploits once you find a vulnerability 570.74s - 576.34s | in addition we wanted the ability to compile our own executables that we can place on the 576.34s - 581.22s | device and run them because a lot of these embedded devices do not have the executables 581.22s - 586.34s | that you would like to have on there for example netcat or whatnot um this one didn't even have 586.34s - 593.54s | who am i um and so we wanted to be able to create our own stuff now this device used uc libc as its 593.62s - 600.82s | libc library um uc libc was actually pretty much discontinued or unmaintained since 2012 and so 600.82s - 607.86s | someone created a fork called it uc libc ng or next generation um and so that is what we used 607.86s - 612.74s | along with buildroot to build a toolchain so that we could compile our own executables it worked 613.38s - 618.26s | for the most part not all the time um the bindshell that we had created and used for 618.26s - 623.86s | one of our exploits worked just fine we were able to compile gdb server but every time we 623.86s - 628.66s | tried to connect we tried to connect to it remotely it kept segfaulting it could be because 628.66s - 634.02s | we're using uc libc ng it could just be a skill issue on our part i'm not sure something happened 634.02s - 640.66s | there this is what it looks like when you actually have it emulated so like i said we're using ch 640.66s - 646.50s | root to mount the file system so that um the executable can find the libraries that it's 646.50s - 652.02s | looking for at the hard-coded path that it has then we have a statically compiled qemu which 652.02s - 659.06s | runs it now you can see a dash g1234


chunk_text:
or next generation um and so that is what we used 607.86s - 612.74s | along with buildroot to build a toolchain so that we could compile our own executables it worked 613.38s - 618.26s | for the most part not all the time um the bindshell that we had created and used for 618.26s - 623.86s | one of our exploits worked just fine we were able to compile gdb server but every time we 623.86s - 628.66s | tried to connect we tried to connect to it remotely it kept segfaulting it could be because 628.66s - 634.02s | we're using uc libc ng it could just be a skill issue on our part i'm not sure something happened 634.02s - 640.66s | there this is what it looks like when you actually have it emulated so like i said we're using ch 640.66s - 646.50s | root to mount the file system so that um the executable can find the libraries that it's 646.50s - 652.02s | looking for at the hard-coded path that it has then we have a statically compiled qemu which 652.02s - 659.06s | runs it now you can see a dash g1234 if you're not super familiar with qemu or gdb this opens 659.06s - 666.02s | up a remote debugging session on the local port 1234 which means on a separate terminal than what 666.02s - 674.18s | you see here you can open up gdb server um or gdb uh multi-arch and then connect to that local port 674.18s - 679.46s | and now you're running the firmware here but you can debug it with your own gdb setup in another 679.46s - 684.26s | terminal and then because this one opens up a socket and expects communication you have to 684.26s - 690.34s | open up a third terminal to actually send data to this service we got all that figured out again 690.34s - 696.42s | more details are in the github repo if you would like to see how that's done at this point we spent 696.42s - 703.06s | about a month and a half approximately six weeks looking for vulnerabilities in the vilo routers 703.06s - 709.46s | like we said the holy grail is pre-authentication rce we found nine vulnerabilities total in the the 709.46s - 714.18s | four months that we had for


chunk_text:
if you're not super familiar with qemu or gdb this opens 659.06s - 666.02s | up a remote debugging session on the local port 1234 which means on a separate terminal than what 666.02s - 674.18s | you see here you can open up gdb server um or gdb uh multi-arch and then connect to that local port 674.18s - 679.46s | and now you're running the firmware here but you can debug it with your own gdb setup in another 679.46s - 684.26s | terminal and then because this one opens up a socket and expects communication you have to 684.26s - 690.34s | open up a third terminal to actually send data to this service we got all that figured out again 690.34s - 696.42s | more details are in the github repo if you would like to see how that's done at this point we spent 696.42s - 703.06s | about a month and a half approximately six weeks looking for vulnerabilities in the vilo routers 703.06s - 709.46s | like we said the holy grail is pre-authentication rce we found nine vulnerabilities total in the the 709.46s - 714.18s | four months that we had for this project six of them were critical and three of them were medium 714.18s - 719.38s | out of those six critical vulnerabilities four of them were pre-authentication buffer overflow 719.38s - 725.46s | vulnerabilities now we had only figured out how to exploit one of them because three of them were on 725.46s - 731.54s | a version of the firmware that had canaries enabled for that and so we were actually able to 731.54s - 736.98s | overwrite the instruction pointer and execute our own code except for one of them we were able to 738.10s - 743.38s | and while we were working on trying to develop exploits see if we can get past these mitigations 743.38s - 748.18s | we accidentally discovered a blind authenticated command injection now we're going to go over three 748.82s - 753.70s | specific vulnerabilities the ones we found most entertaining for you guys today um i also want 753.70s - 759.62s | to note most of these bugs are present in the service the custom service running on port 5432 759.62s - 764.66s | that we talked a little bit about um these are the vulnerabilities up here so you


chunk_text:
this project six of them were critical and three of them were medium 714.18s - 719.38s | out of those six critical vulnerabilities four of them were pre-authentication buffer overflow 719.38s - 725.46s | vulnerabilities now we had only figured out how to exploit one of them because three of them were on 725.46s - 731.54s | a version of the firmware that had canaries enabled for that and so we were actually able to 731.54s - 736.98s | overwrite the instruction pointer and execute our own code except for one of them we were able to 738.10s - 743.38s | and while we were working on trying to develop exploits see if we can get past these mitigations 743.38s - 748.18s | we accidentally discovered a blind authenticated command injection now we're going to go over three 748.82s - 753.70s | specific vulnerabilities the ones we found most entertaining for you guys today um i also want 753.70s - 759.62s | to note most of these bugs are present in the service the custom service running on port 5432 759.62s - 764.66s | that we talked a little bit about um these are the vulnerabilities up here so you can see the 764.66s - 770.10s | four buffer overflows are at the top um they're all 9.6 criticals there was an info leak and some 770.10s - 775.22s | lack of authentication um we have reserved cve numbers through mitre they're not published yet 775.22s - 779.70s | since we just published our public repo earlier today but we have reserved the numbers and they 779.70s - 787.50s | are in the same order that you see up here okay the first vulnerability that i want to talk about 787.50s - 793.02s | today is the lack of authentication in this custom service so as my team team member said 793.02s - 799.50s | most of the communications from the app to the router went through aws except if you if you're 799.50s - 804.94s | not connected to the internet you need some way to set it up so that goes through this service 804.94s - 809.74s | the thing is because it has hard-coded keys and there's really no authentication inside of it 809.74s - 816.78s | anyone that is that is on the LAN and knows how to speak this protocol can um can control the


chunk_text:
can see the 764.66s - 770.10s | four buffer overflows are at the top um they're all 9.6 criticals there was an info leak and some 770.10s - 775.22s | lack of authentication um we have reserved cve numbers through mitre they're not published yet 775.22s - 779.70s | since we just published our public repo earlier today but we have reserved the numbers and they 779.70s - 787.50s | are in the same order that you see up here okay the first vulnerability that i want to talk about 787.50s - 793.02s | today is the lack of authentication in this custom service so as my team team member said 793.02s - 799.50s | most of the communications from the app to the router went through aws except if you if you're 799.50s - 804.94s | not connected to the internet you need some way to set it up so that goes through this service 804.94s - 809.74s | the thing is because it has hard-coded keys and there's really no authentication inside of it 809.74s - 816.78s | anyone that is that is on the LAN and knows how to speak this protocol can um can control the 816.78s - 821.50s | router pretty much so anything that you can do they can do for example you invite a friend over 821.50s - 826.06s | you give them the wi-fi password they're now on the wi-fi they can control the router the same way 826.06s - 831.98s | that you can they can see and change your ssid your password pppui username and password they 831.98s - 837.18s | can reboot it they can even exploit all of these vulnerabilities that was very useful for us because 837.18s - 843.50s | then a lot of the buffer overflows that we found became um unauthenticated rce vulnerabilities and 843.58s - 849.10s | not authenticated rce vulnerabilities the other important thing to note is while this service was 849.10s - 855.74s | used for initial setup when the router didn't have internet access it stayed up the whole time that 855.74s - 863.10s | the router was on even if it did so it was just always available no matter what so we first found 863.10s - 869.10s | the the first buffer overflow in this local app set router token function um we talked about how 869.10s - 875.18s


chunk_text:
816.78s - 821.50s | router pretty much so anything that you can do they can do for example you invite a friend over 821.50s - 826.06s | you give them the wi-fi password they're now on the wi-fi they can control the router the same way 826.06s - 831.98s | that you can they can see and change your ssid your password pppui username and password they 831.98s - 837.18s | can reboot it they can even exploit all of these vulnerabilities that was very useful for us because 837.18s - 843.50s | then a lot of the buffer overflows that we found became um unauthenticated rce vulnerabilities and 843.58s - 849.10s | not authenticated rce vulnerabilities the other important thing to note is while this service was 849.10s - 855.74s | used for initial setup when the router didn't have internet access it stayed up the whole time that 855.74s - 863.10s | the router was on even if it did so it was just always available no matter what so we first found 863.10s - 869.10s | the the first buffer overflow in this local app set router token function um we talked about how 869.10s - 875.18s | there are different messages that are differentiated by opcodes so the opcode 0x3e updates 875.18s - 881.74s | a token and a time zone using an encrypted json object encryption coming from this weird xxt and 881.74s - 887.42s | obfuscation that we talked about um if you are familiar with c and memory corruption you'll see 887.42s - 893.50s | this sscanf function immediately will stand out to you because it takes the token and pulls it 893.50s - 899.42s | into a fixed length buffer token but it doesn't check the length of the string so if token is for 899.42s - 905.18s | example only 16 bytes and you send a token that is 20 bytes you now have a four byte overflow 905.18s - 910.46s | pretty obvious so our next goal was how can we actually exploit this we don't want to just say 910.46s - 916.14s | oh this is a vulnerability we want to prove impact plus it's kind of fun doing this um for mitigations 916.14s - 921.74s | pi and canaries were disabled or at least that's what we thought we had later learned that in 921.74s - 927.50s |


chunk_text:
| there are different messages that are differentiated by opcodes so the opcode 0x3e updates 875.18s - 881.74s | a token and a time zone using an encrypted json object encryption coming from this weird xxt and 881.74s - 887.42s | obfuscation that we talked about um if you are familiar with c and memory corruption you'll see 887.42s - 893.50s | this sscanf function immediately will stand out to you because it takes the token and pulls it 893.50s - 899.42s | into a fixed length buffer token but it doesn't check the length of the string so if token is for 899.42s - 905.18s | example only 16 bytes and you send a token that is 20 bytes you now have a four byte overflow 905.18s - 910.46s | pretty obvious so our next goal was how can we actually exploit this we don't want to just say 910.46s - 916.14s | oh this is a vulnerability we want to prove impact plus it's kind of fun doing this um for mitigations 916.14s - 921.74s | pi and canaries were disabled or at least that's what we thought we had later learned that in 921.74s - 927.50s | in the latest version of the firmware canaries were enabled and this ended up not being exploitable 927.50s - 930.70s | but we didn't know that we were dealing with an older version of the firmware it was the 930.70s - 935.74s | the newest one that we could get our hands on but it still wasn't the latest one so we were 935.74s - 940.78s | trying to figure out how can we exploit this we just have a generic buffer overflow vulnerability 941.50s - 947.18s | if you if you're into you know binary exploitation ROP probably comes to mind ROP is a little bit 947.18s - 952.14s | difficult in MIPS because it doesn't have a return instruction yeah you can still kind 952.14s - 958.06s | of get it but it makes it significantly more difficult as a side note um based off of what 958.06s - 963.18s | we had to do here I decided to make a CTF challenge with very very similar conditions 963.18s - 968.46s | that I wrote myself we released it as a part of BYU CTF 2024 if you would like to do that 968.46s - 975.39s | yourself


chunk_text:
in the latest version of the firmware canaries were enabled and this ended up not being exploitable 927.50s - 930.70s | but we didn't know that we were dealing with an older version of the firmware it was the 930.70s - 935.74s | the newest one that we could get our hands on but it still wasn't the latest one so we were 935.74s - 940.78s | trying to figure out how can we exploit this we just have a generic buffer overflow vulnerability 941.50s - 947.18s | if you if you're into you know binary exploitation ROP probably comes to mind ROP is a little bit 947.18s - 952.14s | difficult in MIPS because it doesn't have a return instruction yeah you can still kind 952.14s - 958.06s | of get it but it makes it significantly more difficult as a side note um based off of what 958.06s - 963.18s | we had to do here I decided to make a CTF challenge with very very similar conditions 963.18s - 968.46s | that I wrote myself we released it as a part of BYU CTF 2024 if you would like to do that 968.46s - 975.39s | yourself give yourself a challenge you can look it up it's available on github um so 976.35s - 980.51s | how do we exploit this well we wanted to find kind of a one-shot gadget where we could just 980.51s - 984.75s | return there and then it would do everything for us and we didn't have to chain multiple gadgets 984.75s - 990.35s | together because of the overflow we could control the RA register or the return address register 990.35s - 996.43s | and the S8 register which is pretty much the stack pointer so we figured if we can control S8 996.43s - 1002.59s | and point it to a user controlled bash command and then set the instruction pointer to go to this 1003.07s - 1010.59s | gadget win right you profit ASLR is enabled so we can't use stack values but because pi is disabled 1010.59s - 1014.59s | we know where all the global variables are so we started looking through to see 1014.59s - 1020.35s | what global variables can we control that we can easily put our own command inside of it 1021.31s - 1025.55s | so us being the intelligent people that


chunk_text:
give yourself a challenge you can look it up it's available on github um so 976.35s - 980.51s | how do we exploit this well we wanted to find kind of a one-shot gadget where we could just 980.51s - 984.75s | return there and then it would do everything for us and we didn't have to chain multiple gadgets 984.75s - 990.35s | together because of the overflow we could control the RA register or the return address register 990.35s - 996.43s | and the S8 register which is pretty much the stack pointer so we figured if we can control S8 996.43s - 1002.59s | and point it to a user controlled bash command and then set the instruction pointer to go to this 1003.07s - 1010.59s | gadget win right you profit ASLR is enabled so we can't use stack values but because pi is disabled 1010.59s - 1014.59s | we know where all the global variables are so we started looking through to see 1014.59s - 1020.35s | what global variables can we control that we can easily put our own command inside of it 1021.31s - 1025.55s | so us being the intelligent people that we are decided to put a semicolon reboot semicolon in 1025.55s - 1030.27s | there we ran it and nothing happened so we rebooted it just to make sure that we hadn't 1030.27s - 1035.55s | messed anything up and we ended up messing something up by doing that um the router just 1035.55s - 1041.63s | kept rebooting and it never actually got online turns out there's a uh an authenticated command 1041.63s - 1047.55s | injection vulnerability that Ava will now go over so after we found our accidental command 1047.55s - 1051.87s | injection vulnerability we went back to find the code that was responsible for this um so we ended 1051.87s - 1058.03s | up finding it in the sysconf binary which is run on boot um so as you can see here it formats a 1058.03s - 1063.23s | udhcpc bash command with several variables including the router host name and then it 1063.23s - 1071.63s | pipes that directly into the system function and so because we can control the router host name 1071.63s - 1077.47s | through the viral app we can get arbitrary rce by just setting that host name to a


chunk_text:
we are decided to put a semicolon reboot semicolon in 1025.55s - 1030.27s | there we ran it and nothing happened so we rebooted it just to make sure that we hadn't 1030.27s - 1035.55s | messed anything up and we ended up messing something up by doing that um the router just 1035.55s - 1041.63s | kept rebooting and it never actually got online turns out there's a uh an authenticated command 1041.63s - 1047.55s | injection vulnerability that Ava will now go over so after we found our accidental command 1047.55s - 1051.87s | injection vulnerability we went back to find the code that was responsible for this um so we ended 1051.87s - 1058.03s | up finding it in the sysconf binary which is run on boot um so as you can see here it formats a 1058.03s - 1063.23s | udhcpc bash command with several variables including the router host name and then it 1063.23s - 1071.63s | pipes that directly into the system function and so because we can control the router host name 1071.63s - 1077.47s | through the viral app we can get arbitrary rce by just setting that host name to a bash command 1077.47s - 1082.43s | um so we can verify that this command actually has been run by looking at the boot output which 1082.43s - 1087.31s | you can see here on the right you can see the output of that command right there we got this 1087.31s - 1093.23s | output from the ur interface that we connected to initially so there are a few limitations with 1093.23s - 1098.27s | this exploit um namely that the injected command is run only once on booting the router as well 1098.27s - 1104.83s | as that the router host name is limited to a length of 30 characters so as a result we had 1104.83s - 1110.27s | to write our payload into several 30 byte sections um which we what we ended up doing with that is 1110.27s - 1115.07s | write a script to the slash foley directory um which is one of the few directories that is both 1115.07s - 1120.67s | writable and persistent on the router um and so we wrote a script that itself then downloads a 1120.67s - 1127.31s | a longer script from the internet using wget um and runs


chunk_text:
bash command 1077.47s - 1082.43s | um so we can verify that this command actually has been run by looking at the boot output which 1082.43s - 1087.31s | you can see here on the right you can see the output of that command right there we got this 1087.31s - 1093.23s | output from the ur interface that we connected to initially so there are a few limitations with 1093.23s - 1098.27s | this exploit um namely that the injected command is run only once on booting the router as well 1098.27s - 1104.83s | as that the router host name is limited to a length of 30 characters so as a result we had 1104.83s - 1110.27s | to write our payload into several 30 byte sections um which we what we ended up doing with that is 1110.27s - 1115.07s | write a script to the slash foley directory um which is one of the few directories that is both 1115.07s - 1120.67s | writable and persistent on the router um and so we wrote a script that itself then downloads a 1120.67s - 1127.31s | a longer script from the internet using wget um and runs that now we also found that the 1127.95s - 1131.79s | router does not have an internet connection at the time of running the injected command 1132.35s - 1137.95s | so we had to make our script um or our payload wait 20 seconds before running our first script 1138.27s - 1143.07s | so after we wrote our first payload um it then downloads and executes a second payload which 1143.07s - 1149.63s | itself then downloads and executes a compiled cbind shell um which we can connect to via netcat 1149.63s - 1153.39s | and so through this bind shell we were able to gain our first shell on the router 1154.35s - 1158.91s | so as you can see here we're able to netcat into the router and find that we have gained a shell 1158.91s - 1170.88s | as the root user okay so once april had come around we had reached our four months it was the end of 1170.88s - 1177.36s | the semester we had to wrap up the project and we decided you know let's reach out to the vendor 1177.36s - 1181.52s | try and get in contact send them the details


chunk_text:
that now we also found that the 1127.95s - 1131.79s | router does not have an internet connection at the time of running the injected command 1132.35s - 1137.95s | so we had to make our script um or our payload wait 20 seconds before running our first script 1138.27s - 1143.07s | so after we wrote our first payload um it then downloads and executes a second payload which 1143.07s - 1149.63s | itself then downloads and executes a compiled cbind shell um which we can connect to via netcat 1149.63s - 1153.39s | and so through this bind shell we were able to gain our first shell on the router 1154.35s - 1158.91s | so as you can see here we're able to netcat into the router and find that we have gained a shell 1158.91s - 1170.88s | as the root user okay so once april had come around we had reached our four months it was the end of 1170.88s - 1177.36s | the semester we had to wrap up the project and we decided you know let's reach out to the vendor 1177.36s - 1181.52s | try and get in contact send them the details for the vulnerabilities let's see if we can get this 1181.52s - 1186.56s | patched it was actually pretty much like it was a pretty big pain to get in contact with them they 1186.56s - 1192.16s | had an email address listed in their terms of service but it didn't exist it just bounced back 1192.16s - 1196.08s | we reached out to a couple other email addresses on their website we tried to guess the email 1196.08s - 1200.88s | addresses none of that worked we reached out over social media they have youtube they have 1200.88s - 1205.36s | i think facebook maybe in an instagram we didn't hear back from that we filed a couple support 1205.36s - 1211.76s | tickets and eventually we got a response from them um they put us in contact with the actual 1211.76s - 1216.80s | developers and the developers said hey thank you for for sending us this we'll take a look at it 1216.80s - 1222.32s | we'll get back to you on it this is the the overall timeline of what we did so we started 1222.32s - 1229.28s | the project in january we finished it


chunk_text:
for the vulnerabilities let's see if we can get this 1181.52s - 1186.56s | patched it was actually pretty much like it was a pretty big pain to get in contact with them they 1186.56s - 1192.16s | had an email address listed in their terms of service but it didn't exist it just bounced back 1192.16s - 1196.08s | we reached out to a couple other email addresses on their website we tried to guess the email 1196.08s - 1200.88s | addresses none of that worked we reached out over social media they have youtube they have 1200.88s - 1205.36s | i think facebook maybe in an instagram we didn't hear back from that we filed a couple support 1205.36s - 1211.76s | tickets and eventually we got a response from them um they put us in contact with the actual 1211.76s - 1216.80s | developers and the developers said hey thank you for for sending us this we'll take a look at it 1216.80s - 1222.32s | we'll get back to you on it this is the the overall timeline of what we did so we started 1222.32s - 1229.28s | the project in january we finished it up in early april we reached out to them and it took us a month 1229.28s - 1234.24s | before we actually got in contact and we said hey here are the details for these nine vulnerabilities 1234.24s - 1238.80s | we are giving you a 90 day deadline we are happy to help if you have any questions if you want us 1238.80s - 1244.64s | to elaborate etc we followed up a month later didn't hear anything we followed up two weeks 1244.64s - 1249.60s | after that we didn't hear anything and as we had told them we went ahead and filed cve numbers for 1249.60s - 1254.00s | mitre we then followed up two weeks later and they said we're working on it we'll publish 1254.00s - 1258.56s | something pretty soon here we'll get it out to you um so the 90 day disclosure deadline was a 1258.56s - 1263.44s | couple days ago we timed this for our talk today um and the vendors actually reached out to us 1264.08s - 1268.56s | like the day before we left here for defcon and said hey we've pushed a new firmware update can 1268.56s -


chunk_text:
up in early april we reached out to them and it took us a month 1229.28s - 1234.24s | before we actually got in contact and we said hey here are the details for these nine vulnerabilities 1234.24s - 1238.80s | we are giving you a 90 day deadline we are happy to help if you have any questions if you want us 1238.80s - 1244.64s | to elaborate etc we followed up a month later didn't hear anything we followed up two weeks 1244.64s - 1249.60s | after that we didn't hear anything and as we had told them we went ahead and filed cve numbers for 1249.60s - 1254.00s | mitre we then followed up two weeks later and they said we're working on it we'll publish 1254.00s - 1258.56s | something pretty soon here we'll get it out to you um so the 90 day disclosure deadline was a 1258.56s - 1263.44s | couple days ago we timed this for our talk today um and the vendors actually reached out to us 1264.08s - 1268.56s | like the day before we left here for defcon and said hey we've pushed a new firmware update can 1268.56s - 1273.92s | you check that and we said yes just not right now so we haven't looked at it yet um we'll take a 1273.92s - 1277.76s | look at that there but they have been somewhat responsive after we finally got in contact with 1277.76s - 1286.64s | them um just a quick conclusion we expected it to be a lot easier to get started um to get the 1286.64s - 1291.60s | firmware to find the initial vulnerability and get that initial root shell it took us two months to 1291.60s - 1296.72s | get to that point um so we were a little surprised about that that's also probably attributed to the 1296.72s - 1302.16s | lack of experience on our part um but then once we got in and we got the firmware we were able 1302.16s - 1307.36s | to find a lot of bugs and not a lot of time and we only looked at a very very small portion of 1307.36s - 1311.60s | the attack surface um there is still a lot more space for bugs if that's something that you're 1311.60s - 1315.68s | interested in looking for go to the


chunk_text:
1273.92s | you check that and we said yes just not right now so we haven't looked at it yet um we'll take a 1273.92s - 1277.76s | look at that there but they have been somewhat responsive after we finally got in contact with 1277.76s - 1286.64s | them um just a quick conclusion we expected it to be a lot easier to get started um to get the 1286.64s - 1291.60s | firmware to find the initial vulnerability and get that initial root shell it took us two months to 1291.60s - 1296.72s | get to that point um so we were a little surprised about that that's also probably attributed to the 1296.72s - 1302.16s | lack of experience on our part um but then once we got in and we got the firmware we were able 1302.16s - 1307.36s | to find a lot of bugs and not a lot of time and we only looked at a very very small portion of 1307.36s - 1311.60s | the attack surface um there is still a lot more space for bugs if that's something that you're 1311.60s - 1315.68s | interested in looking for go to the github repo you'll notice that there are holes in the 1315.68s - 1321.44s | documentation that we just didn't have time to fill in um and we've we've hacked into a couple 1321.44s - 1327.60s | other devices since then and we found that the the cheaper lower quality devices hacking them 1327.60s - 1334.32s | is very very similar iot and embedded products still have a long long way to go when it comes to 1334.40s - 1339.60s | security so this is the qr code if you want to go ahead and go to the github repo and look at 1339.60s - 1344.80s | the details if you would like to connect with us on linkedin we also have ours our our links up 1344.80s - 1368.00s | here um what time are we at 53 are there any questions yes yeah feel free come on up don't 1368.00s - 1392.48s | expect that okay so the question was what method did you use to find the vulnerabilities was it 1392.48s - 1399.12s | fuzzing was it manual code analysis um we did not use any fuzzing um fuzzing is a little bit 1399.12s - 1402.56s | more


chunk_text:
github repo you'll notice that there are holes in the 1315.68s - 1321.44s | documentation that we just didn't have time to fill in um and we've we've hacked into a couple 1321.44s - 1327.60s | other devices since then and we found that the the cheaper lower quality devices hacking them 1327.60s - 1334.32s | is very very similar iot and embedded products still have a long long way to go when it comes to 1334.40s - 1339.60s | security so this is the qr code if you want to go ahead and go to the github repo and look at 1339.60s - 1344.80s | the details if you would like to connect with us on linkedin we also have ours our our links up 1344.80s - 1368.00s | here um what time are we at 53 are there any questions yes yeah feel free come on up don't 1368.00s - 1392.48s | expect that okay so the question was what method did you use to find the vulnerabilities was it 1392.48s - 1399.12s | fuzzing was it manual code analysis um we did not use any fuzzing um fuzzing is a little bit 1399.12s - 1402.56s | more difficult it's not impossible but it's a little bit more difficult when you have a closed 1402.64s - 1408.24s | source binary normally you would compile source code with some sort of sanitizer and then fuzz it 1408.24s - 1412.08s | from there but because it was closed source and it was mips and we're not super experienced with 1412.08s - 1417.60s | fuzzing we went the manual route so we just searched through the code um by hand and ghidra 1417.60s - 1428.94s | decompiling it to find it thank you other questions going once going twice yes right here 1428.94s - 1442.90s | yeah feel free to come up speak that protocol you could do basically any router administration 1442.90s - 1448.02s | could you not set the host name of the router from there and trigger a reboot and make that 1448.02s - 1453.06s | authenticated hostname injection uh let's make command injection to an unauthenticated injection 1453.06s - 1460.34s | because there's no credentials from that path perfect so the question was um like since um 1460.98s - 1467.06s | since that how would you say that um since the the local service is unauthenticated it


chunk_text:
difficult it's not impossible but it's a little bit more difficult when you have a closed 1402.64s - 1408.24s | source binary normally you would compile source code with some sort of sanitizer and then fuzz it 1408.24s - 1412.08s | from there but because it was closed source and it was mips and we're not super experienced with 1412.08s - 1417.60s | fuzzing we went the manual route so we just searched through the code um by hand and ghidra 1417.60s - 1428.94s | decompiling it to find it thank you other questions going once going twice yes right here 1428.94s - 1442.90s | yeah feel free to come up speak that protocol you could do basically any router administration 1442.90s - 1448.02s | could you not set the host name of the router from there and trigger a reboot and make that 1448.02s - 1453.06s | authenticated hostname injection uh let's make command injection to an unauthenticated injection 1453.06s - 1460.34s | because there's no credentials from that path perfect so the question was um like since um 1460.98s - 1467.06s | since that how would you say that um since the the local service is unauthenticated it was the 1467.06s - 1471.78s | question was about can we use that to turn the router hostname injection to an unauthenticated 1471.78s - 1476.98s | unauthenticated command injection um i think the answer to that is no kind of at least not that we 1476.98s - 1481.22s | know of not that we know of because the router hostname um the process of setting that actually 1481.22s - 1486.66s | goes through aws and so that was one area that we didn't have a lot of time to explore there are 1486.66s - 1490.98s | some keys associated with logging into that aws service um which is it's possible that those 1490.98s - 1496.26s | itself are vulnerable in some way but simply having access to the local service is not enough 1496.26s - 1502.10s | to set the router hostname yeah so a large part of the mobile app was just dealing with the aws 1502.10s - 1506.18s | api we didn't have a whole lot of time to go through that so it may be possible but from what 1506.18s - 1510.42s | we had seen we could only do that if you were authenticated if you


chunk_text:
was the 1467.06s - 1471.78s | question was about can we use that to turn the router hostname injection to an unauthenticated 1471.78s - 1476.98s | unauthenticated command injection um i think the answer to that is no kind of at least not that we 1476.98s - 1481.22s | know of not that we know of because the router hostname um the process of setting that actually 1481.22s - 1486.66s | goes through aws and so that was one area that we didn't have a lot of time to explore there are 1486.66s - 1490.98s | some keys associated with logging into that aws service um which is it's possible that those 1490.98s - 1496.26s | itself are vulnerable in some way but simply having access to the local service is not enough 1496.26s - 1502.10s | to set the router hostname yeah so a large part of the mobile app was just dealing with the aws 1502.10s - 1506.18s | api we didn't have a whole lot of time to go through that so it may be possible but from what 1506.18s - 1510.42s | we had seen we could only do that if you were authenticated if you already had the app set up 1510.42s - 1541.07s | with the router thank you i think we got one back there so the question was for someone who 1541.07s - 1546.03s | was new to hardware hacking and new to vulnerability research do you think following these steps would 1546.03s - 1550.43s | be good to learn some hardware hacking and do you think springboarding off of the research that we 1550.43s - 1555.79s | done would be a good way to get started um first off i'm still kind of a noob so i don't know that 1555.79s - 1561.47s | i have the best advice but i would say this is something that you definitely can do um for 1561.47s - 1565.79s | hardware hacking this was kind of my first exposure to it um and i learned a lot there's 1565.79s - 1570.67s | a lot of resources out there defcon has their hardware hacking village um i think reproducing 1570.67s - 1575.63s | these steps and going through it should be would be very very helpful um we do have some extensive 1575.63s - 1579.87s | write-ups specifically on the hardware part we spent more


chunk_text:
already had the app set up 1510.42s - 1541.07s | with the router thank you i think we got one back there so the question was for someone who 1541.07s - 1546.03s | was new to hardware hacking and new to vulnerability research do you think following these steps would 1546.03s - 1550.43s | be good to learn some hardware hacking and do you think springboarding off of the research that we 1550.43s - 1555.79s | done would be a good way to get started um first off i'm still kind of a noob so i don't know that 1555.79s - 1561.47s | i have the best advice but i would say this is something that you definitely can do um for 1561.47s - 1565.79s | hardware hacking this was kind of my first exposure to it um and i learned a lot there's 1565.79s - 1570.67s | a lot of resources out there defcon has their hardware hacking village um i think reproducing 1570.67s - 1575.63s | these steps and going through it should be would be very very helpful um we do have some extensive 1575.63s - 1579.87s | write-ups specifically on the hardware part we spent more time documenting that because it was 1579.87s - 1586.83s | newer for us so hopefully it's it's helpful um as for finding cves um if you want to find cves and 1586.83s - 1591.79s | iot devices this is probably the easiest way to do it it does take a little bit of knowledge when 1591.79s - 1596.43s | it comes to memory corruption and whatnot but if you have an introduction to c and assembly and 1596.43s - 1600.43s | memory corruption and you want to find your own it's just a matter of looking through the code 1600.43s - 1605.07s | there is just so much code that we haven't even gone through so i would absolutely recommend that 1605.07s - 1621.78s | yes any other questions yes okay so the question is how do you get future firmware updates so this 1621.78s - 1628.02s | is kind of a tricky question we looked into it a little bit um initially there was an api endpoint 1628.02s - 1632.90s | just an http web server where you were able to say hey what is the latest firmware can you give 1632.90s - 1638.42s | me a link to


chunk_text:
time documenting that because it was 1579.87s - 1586.83s | newer for us so hopefully it's it's helpful um as for finding cves um if you want to find cves and 1586.83s - 1591.79s | iot devices this is probably the easiest way to do it it does take a little bit of knowledge when 1591.79s - 1596.43s | it comes to memory corruption and whatnot but if you have an introduction to c and assembly and 1596.43s - 1600.43s | memory corruption and you want to find your own it's just a matter of looking through the code 1600.43s - 1605.07s | there is just so much code that we haven't even gone through so i would absolutely recommend that 1605.07s - 1621.78s | yes any other questions yes okay so the question is how do you get future firmware updates so this 1621.78s - 1628.02s | is kind of a tricky question we looked into it a little bit um initially there was an api endpoint 1628.02s - 1632.90s | just an http web server where you were able to say hey what is the latest firmware can you give 1632.90s - 1638.42s | me a link to it um the thing is it didn't actually give you the latest firmware so we talked about 1638.42s - 1642.74s | one of the buffer overflows that we tried to exploit that did not have stack canaries we 1642.74s - 1646.98s | thought that was the latest firmware version because we got it from that endpoint um pretty 1646.98s - 1653.14s | early on in the process um but the actual device had later firmware that i think it gets through 1653.14s - 1662.26s | the aws um like iot it uses encrypted mqtt communications um and so somehow it gets the 1662.26s - 1667.46s | update from that we have not fully reverse engineered that process we don't know how it is 1667.46s - 1678.16s | but it is somewhere within the aws mqtt sort of setup in there other questions going once 1678.16s - 1683.44s | going twice all right thank you for coming to our talk we appreciate it


chunk_text:
it um the thing is it didn't actually give you the latest firmware so we talked about 1638.42s - 1642.74s | one of the buffer overflows that we tried to exploit that did not have stack canaries we 1642.74s - 1646.98s | thought that was the latest firmware version because we got it from that endpoint um pretty 1646.98s - 1653.14s | early on in the process um but the actual device had later firmware that i think it gets through 1653.14s - 1662.26s | the aws um like iot it uses encrypted mqtt communications um and so somehow it gets the 1662.26s - 1667.46s | update from that we have not fully reverse engineered that process we don't know how it is 1667.46s - 1678.16s | but it is somewhere within the aws mqtt sort of setup in there other questions going once 1678.16s - 1683.44s | going twice all right thank you for coming to our talk we appreciate it


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=MIbQf08H5so", "title": "DEF CON 32 - Top 10 Cybersecurity Trends in Critical Infrastructure for 2024 - Mars Cheng", "description": "In recent years, we have witnessed a surge in attacks aimed at critical infrastructure, varying widely in scope and impact depending on the region. While the definition of critical infrastructure differs by country, it typically encompasses essential sectors such as oil, natural gas, water, power, and manufacturing. The ramifications of these attacks are complex and often unpredictable.\n\nTo gain a clearer understanding of the state of critical infrastructure globally, starting in 2023, we will annually survey 300 CISOs or security directors across different countries in this sector. We will share the data-driven insights to offer a detailed examination of the current conditions and challenges faced by these crucial systems. By comparing trends across different years, countries, and industries, our goal is to enhance the security and resilience of critical infrastructures worldwide.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1473, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.85s - 13.53s | This text was transcribed using whisper model: large-v2 All right, so welcome to Creators Stage 2, 2.30, and I'm Arshad, and I'm honored to be 13.53s - 21.65s | great here again, on behalf of ICS Village here, and today we are going to present this 21.65s - 28.77s | talk will be to mapping the landscape for the top 10 critical infrastructure search 28.77s - 39.45s | terrains here for 2024. And I will say, usually we will meet some situation is we know OT 39.45s - 45.37s | security is very critical, but we don't know how real critical in a different industry 45.37s - 52.13s | is very chaos. We know that attacks, we know there are many attacks, ransomware, APT attacks, 52.61s - 60.01s | what kinds of thinking behind of most OT operator or OT industry CISOs. So we do a lot of 60.01s - 65.85s | research on that, and we want to know how we can do that. And I'm Mark Chen from Taiwan, and 65.85s - 72.97s | now I'm the social manager of TS1 Networks, and I also is the executive director of the 72.97s - 76.81s | Association of Hacks in Taiwan. It's a very awesome and powerful association, and we 76.81s - 81.49s | organized many cybersecurity conference or competition things, and also spoke at a major 81.73s - 89.61s | cybersecurity conference.


chunk_text:
of ICS Village here, and today we are going to present this 21.65s - 28.77s | talk will be to mapping the landscape for the top 10 critical infrastructure search 28.77s - 39.45s | terrains here for 2024. And I will say, usually we will meet some situation is we know OT 39.45s - 45.37s | security is very critical, but we don't know how real critical in a different industry 45.37s - 52.13s | is very chaos. We know that attacks, we know there are many attacks, ransomware, APT attacks, 52.61s - 60.01s | what kinds of thinking behind of most OT operator or OT industry CISOs. So we do a lot of 60.01s - 65.85s | research on that, and we want to know how we can do that. And I'm Mark Chen from Taiwan, and 65.85s - 72.97s | now I'm the social manager of TS1 Networks, and I also is the executive director of the 72.97s - 76.81s | Association of Hacks in Taiwan. It's a very awesome and powerful association, and we 76.81s - 81.49s | organized many cybersecurity conference or competition things, and also spoke at a major 81.73s - 89.61s | cybersecurity conference. Also, I just finished our talk for yesterday, Brighad USA 2094. So it's 89.61s - 96.97s | me here for reference. Okay, I think. And also, so for the top 10 critical infrastructure 96.97s - 103.69s | situation and search terrain here. Before we started, we need to know that one thing first 103.69s - 115.85s | here is we do this survey for 2023 and 2024. And this survey, we collected many cybersecurity 115.85s - 123.13s | CISOs in the OT industry, including the 2023 for general manufacturing, in the automotive 123.13s - 129.61s | manufacturing, pharmaceutical manufacturing, oil and gas. And also, we also do a lot of things in 129.69s - 136.97s | 2024, and we increased it as a scope here. So for the reference, we know now in 2024, we have 136.97s - 143.05s | more higher percentage for those people in charge of OT cybersecurity and budget and everything, 143.05s - 150.25s | so on the management level. And first, what is the top 10 for first one for policy? We know every 150.25s - 157.61s | country everywhere they know the cybersecurity for OT environment is very important. But how 157.61s - 164.49s


chunk_text:
Also, I just finished our talk for yesterday, Brighad USA 2094. So it's 89.61s - 96.97s | me here for reference. Okay, I think. And also, so for the top 10 critical infrastructure 96.97s - 103.69s | situation and search terrain here. Before we started, we need to know that one thing first 103.69s - 115.85s | here is we do this survey for 2023 and 2024. And this survey, we collected many cybersecurity 115.85s - 123.13s | CISOs in the OT industry, including the 2023 for general manufacturing, in the automotive 123.13s - 129.61s | manufacturing, pharmaceutical manufacturing, oil and gas. And also, we also do a lot of things in 129.69s - 136.97s | 2024, and we increased it as a scope here. So for the reference, we know now in 2024, we have 136.97s - 143.05s | more higher percentage for those people in charge of OT cybersecurity and budget and everything, 143.05s - 150.25s | so on the management level. And first, what is the top 10 for first one for policy? We know every 150.25s - 157.61s | country everywhere they know the cybersecurity for OT environment is very important. But how 157.61s - 164.49s | important is it for that? So we just go through from the policy, you will see here from March 2023 164.49s - 171.69s | to now, there are many policies, sometimes they were related with the OT environment, or ICS 171.69s - 177.77s | policies, or like for example, in the EU, recently, yes, we have a cyber serious ad happened. 177.77s - 183.77s | And also in every industry, including Taiwan, Korea, Japan, they also design their some security 183.77s - 189.61s | law, or the regulation for OT and critical infrastructure environment. So we know the 189.61s - 196.57s | process is going on that, to know how to process that or that on those environments. 197.53s - 202.57s | And for people, according to our observation, these very interesting things is, we know the 202.57s - 209.69s | security awareness and the training of OT operators. Here, we focus on OT operators, 209.69s - 216.33s | it's very, very not enough. Why we say that? So here's the evidence here. We know there are many 216.33s - 221.77s | OT security incidents, including phishing email, for the root cause, including phishing email, 221.77s - 227.21s |


chunk_text:
| important is it for that? So we just go through from the policy, you will see here from March 2023 164.49s - 171.69s | to now, there are many policies, sometimes they were related with the OT environment, or ICS 171.69s - 177.77s | policies, or like for example, in the EU, recently, yes, we have a cyber serious ad happened. 177.77s - 183.77s | And also in every industry, including Taiwan, Korea, Japan, they also design their some security 183.77s - 189.61s | law, or the regulation for OT and critical infrastructure environment. So we know the 189.61s - 196.57s | process is going on that, to know how to process that or that on those environments. 197.53s - 202.57s | And for people, according to our observation, these very interesting things is, we know the 202.57s - 209.69s | security awareness and the training of OT operators. Here, we focus on OT operators, 209.69s - 216.33s | it's very, very not enough. Why we say that? So here's the evidence here. We know there are many 216.33s - 221.77s | OT security incidents, including phishing email, for the root cause, including phishing email, 221.77s - 227.21s | or some employee actions, sometimes it will be malicious motivations, or sometimes it will be 227.21s - 234.81s | unintentional. But here, you will see between 2023 and 2024 here, there is still something different. 235.29s - 243.69s | For 2023, phishing email, employee actions, they will be the root cause for the OT security 243.69s - 250.97s | incident. And for the 2024 ransomware attack, and for the mobility patch. But we know the one key 250.97s - 259.85s | reason is, even in 2024, our answer from those CISOs in the OT environment, the answer 260.65s - 269.13s | ransomware is their first priority, and the key root cause for the OT security incident. 269.13s - 279.13s | But let's be aware, one thing is, the thing is, the ransomware attack is not totally performed 279.13s - 288.09s | by those attackers. Sometimes they also put some hold on the environment issue in the OT industry. 288.09s - 295.13s | So that's why those attackers can leverage those vulnerabilities, or those issues, 295.13s - 306.09s | to take over the entire OT environment. So that's why we say the security awareness and training 306.09s - 311.21s | is


chunk_text:
or some employee actions, sometimes it will be malicious motivations, or sometimes it will be 227.21s - 234.81s | unintentional. But here, you will see between 2023 and 2024 here, there is still something different. 235.29s - 243.69s | For 2023, phishing email, employee actions, they will be the root cause for the OT security 243.69s - 250.97s | incident. And for the 2024 ransomware attack, and for the mobility patch. But we know the one key 250.97s - 259.85s | reason is, even in 2024, our answer from those CISOs in the OT environment, the answer 260.65s - 269.13s | ransomware is their first priority, and the key root cause for the OT security incident. 269.13s - 279.13s | But let's be aware, one thing is, the thing is, the ransomware attack is not totally performed 279.13s - 288.09s | by those attackers. Sometimes they also put some hold on the environment issue in the OT industry. 288.09s - 295.13s | So that's why those attackers can leverage those vulnerabilities, or those issues, 295.13s - 306.09s | to take over the entire OT environment. So that's why we say the security awareness and training 306.09s - 311.21s | is not enough for this moment, for those environments here. And for the people, 311.21s - 315.69s | we also say human resource gap for OT security professionals. Why we say that? 316.25s - 320.17s | Why we say that? The shortage for the cybersecurity professionals here, 320.17s - 326.97s | is we focus on many environments here for like, like the integration between IT and OT environment. 327.93s - 332.25s | So we know the one thing is, in the OT environment, there are many industries, 332.25s - 340.73s | such as chemical or pharmaceuticals. But the key point is, in a different industry, they have 341.29s - 347.61s | different OT security professional requirements. However, in this stage, in this moment, 347.61s - 353.05s | those OT security professionals still have to rely on IT security professionals. 353.05s - 359.37s | So we will say they are not integrated, they still rely on IT environment. So the real thing is, 359.37s - 366.01s | those OT guys or those OT security staff, they don't know, those IT people don't know how to 366.81s - 374.01s | run the real OT cybersecurity things. So that's why we say they lack


chunk_text:
not enough for this moment, for those environments here. And for the people, 311.21s - 315.69s | we also say human resource gap for OT security professionals. Why we say that? 316.25s - 320.17s | Why we say that? The shortage for the cybersecurity professionals here, 320.17s - 326.97s | is we focus on many environments here for like, like the integration between IT and OT environment. 327.93s - 332.25s | So we know the one thing is, in the OT environment, there are many industries, 332.25s - 340.73s | such as chemical or pharmaceuticals. But the key point is, in a different industry, they have 341.29s - 347.61s | different OT security professional requirements. However, in this stage, in this moment, 347.61s - 353.05s | those OT security professionals still have to rely on IT security professionals. 353.05s - 359.37s | So we will say they are not integrated, they still rely on IT environment. So the real thing is, 359.37s - 366.01s | those OT guys or those OT security staff, they don't know, those IT people don't know how to 366.81s - 374.01s | run the real OT cybersecurity things. So that's why we say they lack the OT and IT integration. 380.73s - 386.73s | And also, the talent gap is also difficult to hire. So for OT security professionals, 386.73s - 393.13s | for example, if you need to do the OT security in a semiconductor, first thing, you need to know 393.13s - 398.97s | what kinds of things, semiconductor process, what is the operation for the semiconductor industry, 399.61s - 404.25s | what is the semiconductor security issue, what are the different things between the 404.25s - 409.53s | semiconductor or IT environment for cybersecurity for the 3As. So we need to know that. And also, 409.53s - 416.25s | if we also judge that, and we are hard to hire those professionals for the semiconductor. 416.25s - 421.69s | So that's why security professionals are not enough here, and also hire high quality people 422.41s - 429.13s | for the hiring. And in 2024, we also know those security teams, they don't have enough 429.13s - 435.77s | capabilities to deal with those OT security things and incidents. The things we encounter 435.77s - 442.49s | and we have from our survey is, those CISOs usually will answer, they need to seek


chunk_text:
the OT and IT integration. 380.73s - 386.73s | And also, the talent gap is also difficult to hire. So for OT security professionals, 386.73s - 393.13s | for example, if you need to do the OT security in a semiconductor, first thing, you need to know 393.13s - 398.97s | what kinds of things, semiconductor process, what is the operation for the semiconductor industry, 399.61s - 404.25s | what is the semiconductor security issue, what are the different things between the 404.25s - 409.53s | semiconductor or IT environment for cybersecurity for the 3As. So we need to know that. And also, 409.53s - 416.25s | if we also judge that, and we are hard to hire those professionals for the semiconductor. 416.25s - 421.69s | So that's why security professionals are not enough here, and also hire high quality people 422.41s - 429.13s | for the hiring. And in 2024, we also know those security teams, they don't have enough 429.13s - 435.77s | capabilities to deal with those OT security things and incidents. The things we encounter 435.77s - 442.49s | and we have from our survey is, those CISOs usually will answer, they need to seek for third-party help 443.29s - 449.45s | to handle OT security incidents. Their own OT security incidents or IT security teams 449.45s - 455.45s | are hard to deal with those key incidents in their OT environment. They need to seek help. 455.45s - 461.93s | So there will be a security professional leakage here. So that's why we need to 461.93s - 469.05s | try to engage and make the IT and OT security teams to correlate with each other. And we need 469.05s - 473.29s | to know how to increase the high quality OT security professionals. We need to perform a 473.29s - 478.89s | kind of training. We need to know the operation process. Some people will say, we don't need to 478.89s - 484.41s | know the different semiconductor or different industry process we can do the OT cybersecurity. 484.41s - 490.57s | I will say totally wrong, because their operation is still different in each environment. For chemical, 490.57s - 493.29s | for pharmaceutical, they have different operations, they have different machines, 494.09s - 500.25s | they have different parameters or issues on that. So it's very different. And therefore, 500.25s - 504.65s |


chunk_text:
for third-party help 443.29s - 449.45s | to handle OT security incidents. Their own OT security incidents or IT security teams 449.45s - 455.45s | are hard to deal with those key incidents in their OT environment. They need to seek help. 455.45s - 461.93s | So there will be a security professional leakage here. So that's why we need to 461.93s - 469.05s | try to engage and make the IT and OT security teams to correlate with each other. And we need 469.05s - 473.29s | to know how to increase the high quality OT security professionals. We need to perform a 473.29s - 478.89s | kind of training. We need to know the operation process. Some people will say, we don't need to 478.89s - 484.41s | know the different semiconductor or different industry process we can do the OT cybersecurity. 484.41s - 490.57s | I will say totally wrong, because their operation is still different in each environment. For chemical, 490.57s - 493.29s | for pharmaceutical, they have different operations, they have different machines, 494.09s - 500.25s | they have different parameters or issues on that. So it's very different. And therefore, 500.25s - 504.65s | there will be more attack factors targeting critical infrastructure and OT than enterprise 504.65s - 511.29s | environment. So why we say that? I will say the most simplified thing is, OT has more 511.29s - 518.97s | large scope for attackers. Between the IT and OT, so we will say IT, we don't mention IT here, 518.97s - 523.85s | but for the OT environment, they have more and more devices on that. They have more and more 523.85s - 530.73s | operations on that. So they have thousands or hundreds of thousands of devices, operations, 530.73s - 540.01s | process parameters, or everything on that, more than IT for over 100 times. So nowadays, 540.01s - 545.61s | the IT and OT are already converging. We say, usually, we will have some proof later, 545.61s - 552.49s | but we know the IT and OT are already converging. So if I bring those IT operations, OT operations 552.49s - 558.25s | on the attack surface, we will face those attack factors more than the IT environment here. 559.21s - 565.93s | So for example, communication protocol. OT environments still use legacy OT communication 565.93s - 572.89s | protocols,


chunk_text:
there will be more attack factors targeting critical infrastructure and OT than enterprise 504.65s - 511.29s | environment. So why we say that? I will say the most simplified thing is, OT has more 511.29s - 518.97s | large scope for attackers. Between the IT and OT, so we will say IT, we don't mention IT here, 518.97s - 523.85s | but for the OT environment, they have more and more devices on that. They have more and more 523.85s - 530.73s | operations on that. So they have thousands or hundreds of thousands of devices, operations, 530.73s - 540.01s | process parameters, or everything on that, more than IT for over 100 times. So nowadays, 540.01s - 545.61s | the IT and OT are already converging. We say, usually, we will have some proof later, 545.61s - 552.49s | but we know the IT and OT are already converging. So if I bring those IT operations, OT operations 552.49s - 558.25s | on the attack surface, we will face those attack factors more than the IT environment here. 559.21s - 565.93s | So for example, communication protocol. OT environments still use legacy OT communication 565.93s - 572.89s | protocols, such as Modbus, such as Mailsoft, Mailsec, or different vendor protocols. They 572.89s - 580.73s | usually are encrypted protocols. They are very high risk. And also, those PLCs, those servers 580.73s - 586.33s | that are never patched, or even patched, they have more and more applications. So we will say, 586.89s - 592.49s | those attack factors are higher than the IT environment. So that's why we say that those 592.49s - 598.09s | attack factors are higher. And also, not only malware, not only insider threat, 598.73s - 606.81s | the OT environment depends on their features in a different OT environment or industry. 606.81s - 612.17s | Sometimes they will leverage GPS. For example, some power plants will use GPS to locate their 612.17s - 616.97s | time, because time accuracy is very important in the power plant and power industry or energy. 617.53s - 622.89s | Or sometimes for semiconductor, for manufacturing, they are more taking care of third-party and 622.89s - 629.53s | supply chain threats, because they are already aware those attacks can successfully enter their 629.53s - 634.09s | environment, basically, from third-party, from supply chain. For semiconductor, 634.73s - 641.45s |


chunk_text:
such as Modbus, such as Mailsoft, Mailsec, or different vendor protocols. They 572.89s - 580.73s | usually are encrypted protocols. They are very high risk. And also, those PLCs, those servers 580.73s - 586.33s | that are never patched, or even patched, they have more and more applications. So we will say, 586.89s - 592.49s | those attack factors are higher than the IT environment. So that's why we say that those 592.49s - 598.09s | attack factors are higher. And also, not only malware, not only insider threat, 598.73s - 606.81s | the OT environment depends on their features in a different OT environment or industry. 606.81s - 612.17s | Sometimes they will leverage GPS. For example, some power plants will use GPS to locate their 612.17s - 616.97s | time, because time accuracy is very important in the power plant and power industry or energy. 617.53s - 622.89s | Or sometimes for semiconductor, for manufacturing, they are more taking care of third-party and 622.89s - 629.53s | supply chain threats, because they are already aware those attacks can successfully enter their 629.53s - 634.09s | environment, basically, from third-party, from supply chain. For semiconductor, 634.73s - 641.45s | it's a very interesting thing. Usually, they buy devices. These devices may be already 642.25s - 648.49s | $1 million, $2 million already. But those devices are even expensive. But they are already deployed 648.49s - 654.81s | in the virus inside the devices before they provide to those semiconductor industries. 655.53s - 661.45s | So before that, the supply chain also will increase the attack factor on the environment. 661.93s - 670.81s | And also, 5G security and satellite. Recently, TS1 also noticed a very interesting part is 671.77s - 678.17s | satellite. And we also do a lot of research on satellite risk. We know nowadays, 678.17s - 683.45s | in a different industry, they also deploy, and they need to make long-distance issues 683.45s - 690.97s | to solve the long-distance issue. They need to use the satellite or 5G to solve the connection 690.97s - 696.81s | problem, communication problem. But however, I will say, unfortunately, those satellite devices 697.53s - 704.57s | usually are encrypted or are not secure at all after our survey. So we will say, 704.57s - 710.17s | in a straight landscape or a straight attack surface part, the OT environment


chunk_text:
it's a very interesting thing. Usually, they buy devices. These devices may be already 642.25s - 648.49s | $1 million, $2 million already. But those devices are even expensive. But they are already deployed 648.49s - 654.81s | in the virus inside the devices before they provide to those semiconductor industries. 655.53s - 661.45s | So before that, the supply chain also will increase the attack factor on the environment. 661.93s - 670.81s | And also, 5G security and satellite. Recently, TS1 also noticed a very interesting part is 671.77s - 678.17s | satellite. And we also do a lot of research on satellite risk. We know nowadays, 678.17s - 683.45s | in a different industry, they also deploy, and they need to make long-distance issues 683.45s - 690.97s | to solve the long-distance issue. They need to use the satellite or 5G to solve the connection 690.97s - 696.81s | problem, communication problem. But however, I will say, unfortunately, those satellite devices 697.53s - 704.57s | usually are encrypted or are not secure at all after our survey. So we will say, 704.57s - 710.17s | in a straight landscape or a straight attack surface part, the OT environment is more and 710.17s - 718.41s | larger than IT environment in this moment. And five, I will say, endless ransomware. 718.41s - 724.89s | This term may not be targeted by OT environment. But unfortunately, those OT environments, 724.89s - 731.93s | they have IT environment. And those IT environments, if a server were attacked by ransomware, 731.93s - 738.41s | usually will impact on OT industry. And we will show the evidence later here. 738.41s - 744.73s | So for the survey evaluation in 2023, we noticed, and we also raised the issue, 744.73s - 751.45s | is ransomware still is a major attack in 2023? There are still a lot of attacks or security 751.45s - 758.65s | incidents in the OT environment or in OT industry related with ransomware. Because those ransomware 758.65s - 766.97s | will choose a valuable target. Who has money? Who has most powerful money? They will attack 766.97s - 772.89s | those industries or those companies because they can ransom that more easily. And in fact, 772.89s - 777.21s | they are right. For manufacturing, for chemical, for the car industry, 777.93s - 782.81s | automation industry, automotive industry, they are


chunk_text:
is more and 710.17s - 718.41s | larger than IT environment in this moment. And five, I will say, endless ransomware. 718.41s - 724.89s | This term may not be targeted by OT environment. But unfortunately, those OT environments, 724.89s - 731.93s | they have IT environment. And those IT environments, if a server were attacked by ransomware, 731.93s - 738.41s | usually will impact on OT industry. And we will show the evidence later here. 738.41s - 744.73s | So for the survey evaluation in 2023, we noticed, and we also raised the issue, 744.73s - 751.45s | is ransomware still is a major attack in 2023? There are still a lot of attacks or security 751.45s - 758.65s | incidents in the OT environment or in OT industry related with ransomware. Because those ransomware 758.65s - 766.97s | will choose a valuable target. Who has money? Who has most powerful money? They will attack 766.97s - 772.89s | those industries or those companies because they can ransom that more easily. And in fact, 772.89s - 777.21s | they are right. For manufacturing, for chemical, for the car industry, 777.93s - 782.81s | automation industry, automotive industry, they are right. They will pay the ransom. 784.65s - 790.89s | And for the third, I will say IT and OT are highly convergent. Unfortunately, 790.89s - 798.41s | this highly convergent is very good and also bad. Why good? Because for operators, 798.41s - 803.77s | they are more easily to operate everything, every process in OT and IT control system. 803.77s - 812.33s | But what is the bad? The bad is the most OT environment is impacted by IT incidents. 812.41s - 818.57s | So we can see the table here in 2023. Yes, we have over 143 821.21s - 827.85s | direct label or above. The answer is they are strongly or suddenly affected by 828.89s - 834.57s | they have incidents by IT environment, but those incidents also impact on OT environment. 835.29s - 844.09s | And in 2024, the percentage is increasing a little bit to 97% in total. So the key point, 844.09s - 852.25s | the key thing is those attacks if impact IT environment almost will impact OT environment 852.25s - 860.09s | according to our survey. So that will be the bad part for the OT environment nowadays for 860.09s -


chunk_text:
right. They will pay the ransom. 784.65s - 790.89s | And for the third, I will say IT and OT are highly convergent. Unfortunately, 790.89s - 798.41s | this highly convergent is very good and also bad. Why good? Because for operators, 798.41s - 803.77s | they are more easily to operate everything, every process in OT and IT control system. 803.77s - 812.33s | But what is the bad? The bad is the most OT environment is impacted by IT incidents. 812.41s - 818.57s | So we can see the table here in 2023. Yes, we have over 143 821.21s - 827.85s | direct label or above. The answer is they are strongly or suddenly affected by 828.89s - 834.57s | they have incidents by IT environment, but those incidents also impact on OT environment. 835.29s - 844.09s | And in 2024, the percentage is increasing a little bit to 97% in total. So the key point, 844.09s - 852.25s | the key thing is those attacks if impact IT environment almost will impact OT environment 852.25s - 860.09s | according to our survey. So that will be the bad part for the OT environment nowadays for 860.09s - 867.69s | our automation here. And also, we also survey and ask our people one question is, 868.73s - 877.05s | OT security incident in the past 12 months, and we also have 59% people answer say yes, 877.77s - 886.65s | or not only, but not OT security incident, but also they don't have, but they also don't provide 886.65s - 894.25s | or don't do any forensics or investigation on that, even they get alert. So main is visibility, 894.25s - 901.69s | I will say visibility. Those people answer say yes, is they realize, they also notice, 901.69s - 906.41s | they have system, they monitoring, those incidents happened, they can handle that. 906.97s - 915.37s | But the one part is, they may not have enough mechanism to monitor, to find the attacker is 915.37s - 921.13s | ongoing, or already be performed by those attacker. They don't know how. So they don't 921.13s - 926.09s | have forensics or investigation on that. And so that's why we conduct the answer together to the 926.09s - 934.97s | 95, 59% here. They're very interesting. And also, but this table I will say very interesting, 934.97s -


chunk_text:
867.69s | our automation here. And also, we also survey and ask our people one question is, 868.73s - 877.05s | OT security incident in the past 12 months, and we also have 59% people answer say yes, 877.77s - 886.65s | or not only, but not OT security incident, but also they don't have, but they also don't provide 886.65s - 894.25s | or don't do any forensics or investigation on that, even they get alert. So main is visibility, 894.25s - 901.69s | I will say visibility. Those people answer say yes, is they realize, they also notice, 901.69s - 906.41s | they have system, they monitoring, those incidents happened, they can handle that. 906.97s - 915.37s | But the one part is, they may not have enough mechanism to monitor, to find the attacker is 915.37s - 921.13s | ongoing, or already be performed by those attacker. They don't know how. So they don't 921.13s - 926.09s | have forensics or investigation on that. And so that's why we conduct the answer together to the 926.09s - 934.97s | 95, 59% here. They're very interesting. And also, but this table I will say very interesting, 934.97s - 940.65s | because it's already a little bit different with our thinking here. So here is where we 940.81s - 947.05s | real-time recovery for the OT attack remain a challenge here. You will see the major 948.01s - 954.41s | attackers, such as APT attacks, DDoS attacks, employee actions for human errors, and for 954.41s - 961.29s | employee actions here, malicious intention, usually they need to use one day to one week 961.29s - 968.49s | to recover their environment. But if you see the virus, if you see a third-party vendor, 968.49s - 975.69s | they need to take care for almost five minutes to one hour, or just real-time. 976.25s - 980.81s | It's a very interesting part, but we still carry out, we still figure out why they answer this 980.81s - 987.93s | question. And also, currently surveyed, we still try to understand why those CISO can show the 987.93s - 995.05s | real-time recovery from here, this table. We still try to know why for this. 997.26s - 1003.10s | And for third-party, it's a huge impact on critical infrastructure. We always say, 1003.10s - 1011.34s | well, OT is very important. They


chunk_text:
940.65s | because it's already a little bit different with our thinking here. So here is where we 940.81s - 947.05s | real-time recovery for the OT attack remain a challenge here. You will see the major 948.01s - 954.41s | attackers, such as APT attacks, DDoS attacks, employee actions for human errors, and for 954.41s - 961.29s | employee actions here, malicious intention, usually they need to use one day to one week 961.29s - 968.49s | to recover their environment. But if you see the virus, if you see a third-party vendor, 968.49s - 975.69s | they need to take care for almost five minutes to one hour, or just real-time. 976.25s - 980.81s | It's a very interesting part, but we still carry out, we still figure out why they answer this 980.81s - 987.93s | question. And also, currently surveyed, we still try to understand why those CISO can show the 987.93s - 995.05s | real-time recovery from here, this table. We still try to know why for this. 997.26s - 1003.10s | And for third-party, it's a huge impact on critical infrastructure. We always say, 1003.10s - 1011.34s | well, OT is very important. They are very critical. There are many money, but here is 1012.14s - 1019.58s | our survey to show the proof, say, according to those directors, labor people from a different 1019.58s - 1025.90s | manufacturing industry. In this question, in this survey, they can answer the three 1026.94s - 1032.30s | questions, they can choose the three answers for the most concerning part of a security incident. 1032.30s - 1037.66s | And they are worried about, they also, some people on the survey, they already encounter 1037.66s - 1046.06s | a lot of attacks. They're also afraid for the compromised operational functions or productivity 1046.06s - 1052.14s | loss. You will see that including Germany, including USA, including basically in total, 1052.14s - 1057.74s | they are afraid on that. They know those cybersecurity events will make a huge impact, 1057.74s - 1064.46s | and some of them have happened before. And also, they're also afraid for the key point, 1064.46s - 1071.34s | since it's a loss of operation control and safety issues in Japan. And Japan is also very 1071.50s - 1075.74s | worried about that. So I would say different countries still have a little different situation.


chunk_text:
are very critical. There are many money, but here is 1012.14s - 1019.58s | our survey to show the proof, say, according to those directors, labor people from a different 1019.58s - 1025.90s | manufacturing industry. In this question, in this survey, they can answer the three 1026.94s - 1032.30s | questions, they can choose the three answers for the most concerning part of a security incident. 1032.30s - 1037.66s | And they are worried about, they also, some people on the survey, they already encounter 1037.66s - 1046.06s | a lot of attacks. They're also afraid for the compromised operational functions or productivity 1046.06s - 1052.14s | loss. You will see that including Germany, including USA, including basically in total, 1052.14s - 1057.74s | they are afraid on that. They know those cybersecurity events will make a huge impact, 1057.74s - 1064.46s | and some of them have happened before. And also, they're also afraid for the key point, 1064.46s - 1071.34s | since it's a loss of operation control and safety issues in Japan. And Japan is also very 1071.50s - 1075.74s | worried about that. So I would say different countries still have a little different situation. 1075.74s - 1080.94s | Because of this survey, we deal with Germany, we deal with USA, we deal with Japan, or UAE, 1080.94s - 1085.10s | and including Taiwan. But I'm not raising Taiwan's situation here, because Taiwan's situation is very, 1085.10s - 1092.46s | very special here. So you will see in 2024, reputation damage, revenue losses, 1093.18s - 1100.54s | can be raised for the answer. For those CISOs, they are more taking care for the reputation, 1101.10s - 1109.34s | and revenue, than in 2023. This is a very interesting part. But back to the worries, 1109.34s - 1115.66s | the key point highlight is they really worry about those security attacks and cybersecurity attacks 1115.66s - 1121.90s | will impact their productivity, or their operation and realities. They're just afraid of that. 1122.62s - 1132.46s | And also, in the average, they also try to do a draw, or survey, or planning on that. So they 1132.46s - 1139.58s | want to evaluate if those cybersecurity attacks happened, how many lost in their OT environment? 1140.62s - 1148.86s | How many? So they also do a survey. So on average, you will see 100k here, 1149.82s


chunk_text:
1075.74s - 1080.94s | Because of this survey, we deal with Germany, we deal with USA, we deal with Japan, or UAE, 1080.94s - 1085.10s | and including Taiwan. But I'm not raising Taiwan's situation here, because Taiwan's situation is very, 1085.10s - 1092.46s | very special here. So you will see in 2024, reputation damage, revenue losses, 1093.18s - 1100.54s | can be raised for the answer. For those CISOs, they are more taking care for the reputation, 1101.10s - 1109.34s | and revenue, than in 2023. This is a very interesting part. But back to the worries, 1109.34s - 1115.66s | the key point highlight is they really worry about those security attacks and cybersecurity attacks 1115.66s - 1121.90s | will impact their productivity, or their operation and realities. They're just afraid of that. 1122.62s - 1132.46s | And also, in the average, they also try to do a draw, or survey, or planning on that. So they 1132.46s - 1139.58s | want to evaluate if those cybersecurity attacks happened, how many lost in their OT environment? 1140.62s - 1148.86s | How many? So they also do a survey. So on average, you will see 100k here, 1149.82s - 1156.30s | to the 15k here, will be the major part for the 21%. In general, they were afraid of that. 1157.10s - 1161.10s | But according to our survey, internally, enough survey to those CISO people, 1161.82s - 1170.70s | a little more highlight on that. Because in a real war, if the one operation loses, 1172.70s - 1177.10s | is dropped, or shut down, according to our survey, or our real experience, 1177.10s - 1184.54s | those factories usually will be lost, maybe 200 million, or above, in a key industry, 1184.54s - 1191.50s | in a major manufacturing. But most people's answer is, they usually between 100k to 15k here, 1191.50s - 1201.66s | in 2024. And also, in Japan, they are a little higher than other countries. They usually target 1201.66s - 1208.14s | 300k here, the level, they are just afraid they are lost. But in Japan, our target mainly 1208.14s - 1213.82s | focus on the manufacturing, for general manufacturing here. And also, for number A, 1213.82s - 1220.78s | will be enterprise are aware of cybersecurity, of OT, and constrain their strategy from perspective 1220.78s - 1230.30s | here. So why we


chunk_text:
- 1156.30s | to the 15k here, will be the major part for the 21%. In general, they were afraid of that. 1157.10s - 1161.10s | But according to our survey, internally, enough survey to those CISO people, 1161.82s - 1170.70s | a little more highlight on that. Because in a real war, if the one operation loses, 1172.70s - 1177.10s | is dropped, or shut down, according to our survey, or our real experience, 1177.10s - 1184.54s | those factories usually will be lost, maybe 200 million, or above, in a key industry, 1184.54s - 1191.50s | in a major manufacturing. But most people's answer is, they usually between 100k to 15k here, 1191.50s - 1201.66s | in 2024. And also, in Japan, they are a little higher than other countries. They usually target 1201.66s - 1208.14s | 300k here, the level, they are just afraid they are lost. But in Japan, our target mainly 1208.14s - 1213.82s | focus on the manufacturing, for general manufacturing here. And also, for number A, 1213.82s - 1220.78s | will be enterprise are aware of cybersecurity, of OT, and constrain their strategy from perspective 1220.78s - 1230.30s | here. So why we say that? The most important thing is the budget. So in 2023, 76% of people's 1230.30s - 1238.86s | answers say they will increase their budget. In 2024, 68% here. But Japan, they decrease 1239.66s - 1245.90s | their budget for the OT cybersecurity. And the people answer this question for 102. 1246.70s - 1255.74s | 102 people, so mainly 102 companies in Japan, answers they will decrease their cybersecurity 1255.74s - 1262.70s | budget in the 2024 area. So the importance will be different from a different country perspective 1262.70s - 1271.34s | here. And solution. Solution is very interesting part, because they already deployed solution 1271.34s - 1275.42s | cannot solve the problem practically. Why we say that? But interesting part is, 1275.42s - 1281.74s | 93 companies already deployed a cybersecurity solution in their OT environment, according to 1282.70s - 1288.94s | the answer we get. And also, they also deploy for network solution or endpoint solution in 1288.94s - 1296.06s | a major part. But however, and also they need to run a POC or they need to improve their product, 1296.06s - 1303.66s | we've chosen a product from three to six months on average.


chunk_text:
say that? The most important thing is the budget. So in 2023, 76% of people's 1230.30s - 1238.86s | answers say they will increase their budget. In 2024, 68% here. But Japan, they decrease 1239.66s - 1245.90s | their budget for the OT cybersecurity. And the people answer this question for 102. 1246.70s - 1255.74s | 102 people, so mainly 102 companies in Japan, answers they will decrease their cybersecurity 1255.74s - 1262.70s | budget in the 2024 area. So the importance will be different from a different country perspective 1262.70s - 1271.34s | here. And solution. Solution is very interesting part, because they already deployed solution 1271.34s - 1275.42s | cannot solve the problem practically. Why we say that? But interesting part is, 1275.42s - 1281.74s | 93 companies already deployed a cybersecurity solution in their OT environment, according to 1282.70s - 1288.94s | the answer we get. And also, they also deploy for network solution or endpoint solution in 1288.94s - 1296.06s | a major part. But however, and also they need to run a POC or they need to improve their product, 1296.06s - 1303.66s | we've chosen a product from three to six months on average. But why we say that? 1304.46s - 1311.18s | It's still not good. Why? Because they usually deploy, they usually use IT cybersecurity 1311.18s - 1318.46s | solution in their environment, not OT specific. This will be different. For example, 1320.62s - 1328.86s | if IT solution, they usually use heavy memory usage or they don't care BSOD situation in their 1328.86s - 1335.02s | product. But in OT specific environment, they usually put operation as a first priority. 1335.58s - 1340.94s | This will be key difference between IT and OT cybersecurity issue. And also, 1340.94s - 1350.62s | the main power is still not enough for an OT environment. For 26% staff, only one staff for 1351.42s - 1355.58s | over 200 devices. They need to take care. It's a very heavy things. 1356.38s - 1361.98s | And also, it's a lot for the number nine here is the unprotected Windows devices in 1361.98s - 1370.22s | OT environment are common. Why? Why we have number 10? In the number nine, we say they deploy, 1370.22s - 1377.58s | we already have 93% company or answers, they deploy their cybersecurity solution in OT environment. 1377.58s - 1389.82s |


chunk_text:
But why we say that? 1304.46s - 1311.18s | It's still not good. Why? Because they usually deploy, they usually use IT cybersecurity 1311.18s - 1318.46s | solution in their environment, not OT specific. This will be different. For example, 1320.62s - 1328.86s | if IT solution, they usually use heavy memory usage or they don't care BSOD situation in their 1328.86s - 1335.02s | product. But in OT specific environment, they usually put operation as a first priority. 1335.58s - 1340.94s | This will be key difference between IT and OT cybersecurity issue. And also, 1340.94s - 1350.62s | the main power is still not enough for an OT environment. For 26% staff, only one staff for 1351.42s - 1355.58s | over 200 devices. They need to take care. It's a very heavy things. 1356.38s - 1361.98s | And also, it's a lot for the number nine here is the unprotected Windows devices in 1361.98s - 1370.22s | OT environment are common. Why? Why we have number 10? In the number nine, we say they deploy, 1370.22s - 1377.58s | we already have 93% company or answers, they deploy their cybersecurity solution in OT environment. 1377.58s - 1389.82s | But the deploy coverage is not 100%. So you will see only 61% organization still have 1390.86s - 1396.94s | unprotected Windows devices in their environment, no matter when endpoint solution or network 1396.94s - 1403.02s | solution. In 2024, 77% because Windows 7 also including Windows 10 also including 1403.82s - 1408.86s | in the legacy Windows devices. So here is the interesting part is, 1408.86s - 1412.94s | even they say they already deploy cybersecurity solution in their OT environment, 1412.94s - 1419.90s | but the answer is they are not 100% deploy in their OT environment. So their protection still 1419.90s - 1426.86s | not enough, according to our survey for the answer here. So I know there's a very quick part is, 1428.46s - 1432.70s | we will say the organizations in a different industry, they need to prioritize 1432.94s - 1439.74s | OT proactive defense strategy. We need to take care many, too many things in their environment, 1439.74s - 1444.54s | including supply chain, asset expansion, straight intelligence, no experimentation, 1444.54s - 1448.38s | they need to take care because they encountered too many attacks surface 1448.38s - 1455.50s | on their OT environment.


chunk_text:
But the deploy coverage is not 100%. So you will see only 61% organization still have 1390.86s - 1396.94s | unprotected Windows devices in their environment, no matter when endpoint solution or network 1396.94s - 1403.02s | solution. In 2024, 77% because Windows 7 also including Windows 10 also including 1403.82s - 1408.86s | in the legacy Windows devices. So here is the interesting part is, 1408.86s - 1412.94s | even they say they already deploy cybersecurity solution in their OT environment, 1412.94s - 1419.90s | but the answer is they are not 100% deploy in their OT environment. So their protection still 1419.90s - 1426.86s | not enough, according to our survey for the answer here. So I know there's a very quick part is, 1428.46s - 1432.70s | we will say the organizations in a different industry, they need to prioritize 1432.94s - 1439.74s | OT proactive defense strategy. We need to take care many, too many things in their environment, 1439.74s - 1444.54s | including supply chain, asset expansion, straight intelligence, no experimentation, 1444.54s - 1448.38s | they need to take care because they encountered too many attacks surface 1448.38s - 1455.50s | on their OT environment. But they need to evaluate what kinds of risks is their first priority here 1456.06s - 1462.38s | in their OT environment, and they need to take care of that. So this will be the 2024 part we 1462.86s - 1467.50s | take care for the environment here. So I think it will be all over on my presentation. 1467.50s - 1472.30s | And if you have any questions, you can go to the stage, I will answer you. Thank you.


chunk_text:
But they need to evaluate what kinds of risks is their first priority here 1456.06s - 1462.38s | in their OT environment, and they need to take care of that. So this will be the 2024 part we 1462.86s - 1467.50s | take care for the environment here. So I think it will be all over on my presentation. 1467.50s - 1472.30s | And if you have any questions, you can go to the stage, I will answer you. Thank you.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=8e1vRFpP72w", "title": "DEF CON 32 - Inside Dash Cam Custom Protocols and Discovered 0days - Hyo Jin Lee & Hanryeol Park", "description": "In recent years, the use of dash cams has surged, making them an essential component of modern vehicles. To enhance user convenience, many dash cams are now equipped with network connectivity. This growth in the dash cam market has heightened the importance of vehicle and personal data security. However, network-connected dash cams pose potential security risks to their availability and key functionalities. In this presentation, we will comprehensively analyze dash cams from various countries, including South Korea, the USA, Germany, and China, as well as built-in dash cams. During our analysis, we discovered numerous zero-day vulnerabilities (such as OS Command Injection, Logical Bugs, and insufficient authentication) that pose significant security threats. Vulnerabilities were primarily found during the dash cam boot process, configuration changes, and communications via custom protocols.\n\nWe will detail the dash cam analysis process in the following sequence:\n\n[Analysis Process]\nAcquiring firmware through official websites or apps\nExtracting the file system to analyze the initial boot logic\nAnalyzing the boot logic to identify vulnerabilities or debugging ports to gain shell access\nUtilizing the obtained shell for remote debugging of the main system\nInterestingly, our analysis of 10 different dash cams revealed that 4 devices used the same OEM board from a common manufacturer. These 4 devices shared similar vulnerabilities, and exploiting a vulnerability found in one device allowed us to successfully exploit all of them. Our research uncovered common security vulnerabilities across multiple dash cams, and we will discuss measures to prevent these vulnerabilities. We will particularly focus on analyzing the custom protocols used by dash cams and the security risks associated with them. This presentation aims to raise awareness of potential security threats in dash cams and encourage manufacturers to produce more secure products. We hope to drive industry standards and best practices to ensure the safety and security of these increasingly critical devices. By sharing our findings, we aim to highlight the importance of dash cam security and provide insights that can lead to more secure designs and implementations.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1163, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 15.00s | This text was transcribed using whisper model: large-v2 Hello everyone. Thank you for attending this presentation. This is my first time presenting in English, so I appreciate your understanding if there are any mistakes. Today,


chunk_text:
main system\nInterestingly, our analysis of 10 different dash cams revealed that 4 devices used the same OEM board from a common manufacturer. These 4 devices shared similar vulnerabilities, and exploiting a vulnerability found in one device allowed us to successfully exploit all of them. Our research uncovered common security vulnerabilities across multiple dash cams, and we will discuss measures to prevent these vulnerabilities. We will particularly focus on analyzing the custom protocols used by dash cams and the security risks associated with them. This presentation aims to raise awareness of potential security threats in dash cams and encourage manufacturers to produce more secure products. We hope to drive industry standards and best practices to ensure the safety and security of these increasingly critical devices. By sharing our findings, we aim to highlight the importance of dash cam security and provide insights that can lead to more secure designs and implementations.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1163, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 15.00s | This text was transcribed using whisper model: large-v2 Hello everyone. Thank you for attending this presentation. This is my first time presenting in English, so I appreciate your understanding if there are any mistakes. Today, we will discuss the topic Inside Dash Cam. 15.00s - 30.34s | Thank you. Before we begin, let's introduce ourselves. I am Hyojin Lee, and the other speaker is Hanyeol Park. We are researchers at Xi'an, the XIoT security convergence company. 30.34s - 42.20s | We have been conducting research and development on automated XIoT firmware SECA solutions and are continuously advancing our work. 42.20s - 55.20s | Our agenda for today is as follows. First, we will provide an overview of dash cams, including market size, reasons for choosing this topic, and general information about dash cams. 55.20s - 71.38s | Following that, we will explain the methods used to analyze dash cams. And then, we will describe the features of dash cams and explore potential zero-day scenarios that may arise from these features. 71.38s - 77.38s | Finally, we will propose future countermeasures and wrap up the presentation. 77.38s - 83.38s | Let's begin by providing some preliminary information about dash cams. 83.38s - 107.10s | Several dash cam vendors, such as Mobidian, Blackview, Nextbase, and HL Mando. The global dash cam market was valued at $4.03 billion in 2023. Experts project a compound annual growth rate of


chunk_text:
we will discuss the topic Inside Dash Cam. 15.00s - 30.34s | Thank you. Before we begin, let's introduce ourselves. I am Hyojin Lee, and the other speaker is Hanyeol Park. We are researchers at Xi'an, the XIoT security convergence company. 30.34s - 42.20s | We have been conducting research and development on automated XIoT firmware SECA solutions and are continuously advancing our work. 42.20s - 55.20s | Our agenda for today is as follows. First, we will provide an overview of dash cams, including market size, reasons for choosing this topic, and general information about dash cams. 55.20s - 71.38s | Following that, we will explain the methods used to analyze dash cams. And then, we will describe the features of dash cams and explore potential zero-day scenarios that may arise from these features. 71.38s - 77.38s | Finally, we will propose future countermeasures and wrap up the presentation. 77.38s - 83.38s | Let's begin by providing some preliminary information about dash cams. 83.38s - 107.10s | Several dash cam vendors, such as Mobidian, Blackview, Nextbase, and HL Mando. The global dash cam market was valued at $4.03 billion in 2023. Experts project a compound annual growth rate of 9.6% from 2024 to 2030. 108.10s - 125.10s | Unlike in the past, when only SD cards were used, most modern dash cams now use networks for connectivity and are controlled via dedicated apps. This convenience has played a significant role in contributing to the dash cam market's growth. 125.10s - 146.92s | However, this technological advancement introduces new security threats. Despite this, only three CVEs have been reported in the past three years. To raise awareness about dash cam security and contribute to a safer market, we have chosen this topic. 147.92s - 161.92s | It looks delicious, right? We analyzed a total of nine dash cams. Four from Korea, one from China, and four built-in models. Here are the features we discovered by type. 161.92s - 176.92s | Korean dash cams generally provide firmware downloads on their official websites and some offer cloud services. Chinese dash cam also offers firmware downloads on their official websites, and we found 10 at port open. 177.92s - 195.92s | Built-in dash cams typically do not provide firmware downloads on their official websites and use the RTSP protocol. Many of built-in dash cams are OEM devices, which means they are manufactured by


chunk_text:
9.6% from 2024 to 2030. 108.10s - 125.10s | Unlike in the past, when only SD cards were used, most modern dash cams now use networks for connectivity and are controlled via dedicated apps. This convenience has played a significant role in contributing to the dash cam market's growth. 125.10s - 146.92s | However, this technological advancement introduces new security threats. Despite this, only three CVEs have been reported in the past three years. To raise awareness about dash cam security and contribute to a safer market, we have chosen this topic. 147.92s - 161.92s | It looks delicious, right? We analyzed a total of nine dash cams. Four from Korea, one from China, and four built-in models. Here are the features we discovered by type. 161.92s - 176.92s | Korean dash cams generally provide firmware downloads on their official websites and some offer cloud services. Chinese dash cam also offers firmware downloads on their official websites, and we found 10 at port open. 177.92s - 195.92s | Built-in dash cams typically do not provide firmware downloads on their official websites and use the RTSP protocol. Many of built-in dash cams are OEM devices, which means they are manufactured by one company and sold under another company's brand. 196.92s - 208.92s | For OEM devices, if a vulnerability is discovered in one device, it can potentially affect devices, highlighting the critical importance of implementing robust security measures. 211.20s - 226.20s | Dash cam connectivity can be categorized into three types, connecting via Bluetooth and dash cam Wi-Fi, connecting through a phone's hotspot, and communicating via the cloud. We'll explore these categories in detail on the next slide. 227.20s - 243.20s | First, the app connects to the dash cam via Bluetooth. Then, the dash cam activates AP mode. Once the app connects to the dash cam's Wi-Fi, communication between the app and the dash cam is established. 244.20s - 265.54s | By configuring the phone's hotspot to align with the dash cam's Wi-Fi settings and activating the hotspot, the dash cam can establish and communicate through it. In cloud communication, the dash cam's AP mode remains activated and no need Bluetooth connection. 266.54s - 283.54s | Begin by connecting to the dash cam's Wi-Fi, then translate the router's SSID and password to connect the dash cam to the internet and enable cloud functionality. Communication between the app and the dash


chunk_text:
one company and sold under another company's brand. 196.92s - 208.92s | For OEM devices, if a vulnerability is discovered in one device, it can potentially affect devices, highlighting the critical importance of implementing robust security measures. 211.20s - 226.20s | Dash cam connectivity can be categorized into three types, connecting via Bluetooth and dash cam Wi-Fi, connecting through a phone's hotspot, and communicating via the cloud. We'll explore these categories in detail on the next slide. 227.20s - 243.20s | First, the app connects to the dash cam via Bluetooth. Then, the dash cam activates AP mode. Once the app connects to the dash cam's Wi-Fi, communication between the app and the dash cam is established. 244.20s - 265.54s | By configuring the phone's hotspot to align with the dash cam's Wi-Fi settings and activating the hotspot, the dash cam can establish and communicate through it. In cloud communication, the dash cam's AP mode remains activated and no need Bluetooth connection. 266.54s - 283.54s | Begin by connecting to the dash cam's Wi-Fi, then translate the router's SSID and password to connect the dash cam to the internet and enable cloud functionality. Communication between the app and the dash cam is managed through the cloud. 284.54s - 306.18s | Now, let's review the method we employed to analyze the dash cams. Before beginning the analysis, it's essential to obtain the firmware. This is crucial for tasks such as decompiling code, analyzing the file system, and understanding the boot logic. 307.18s - 323.68s | There are four primary methods to obtain firmware. The first method is to download it from the official website. The second method involves using debugging ports such as UART or JTAG. 324.68s - 341.05s | During our analysis, we found the UART port as illustrated in the picture, soldered connecting cables, and accessed the shell. Here are the statistics for UART shells found in the analyzed devices. 341.05s - 351.05s | Out of nine devices, five had UART shells and four of these allowed shell access without a password. One of these four had a custom shell. 352.05s - 363.03s | Using the debugging shell obtained earlier, you can copy the firmware to an SD card, connect the SD card to a laptop, and extract the firmware. 364.03s - 379.38s | All the analyzed dash cams have firmware upgrade functionality. The third method involves analyzing this


chunk_text:
cam is managed through the cloud. 284.54s - 306.18s | Now, let's review the method we employed to analyze the dash cams. Before beginning the analysis, it's essential to obtain the firmware. This is crucial for tasks such as decompiling code, analyzing the file system, and understanding the boot logic. 307.18s - 323.68s | There are four primary methods to obtain firmware. The first method is to download it from the official website. The second method involves using debugging ports such as UART or JTAG. 324.68s - 341.05s | During our analysis, we found the UART port as illustrated in the picture, soldered connecting cables, and accessed the shell. Here are the statistics for UART shells found in the analyzed devices. 341.05s - 351.05s | Out of nine devices, five had UART shells and four of these allowed shell access without a password. One of these four had a custom shell. 352.05s - 363.03s | Using the debugging shell obtained earlier, you can copy the firmware to an SD card, connect the SD card to a laptop, and extract the firmware. 364.03s - 379.38s | All the analyzed dash cams have firmware upgrade functionality. The third method involves analyzing this functionality to either obtain the firmware download URL or capture package to get the latest firmware. 380.38s - 398.91s | The final method involves extracting firmware from APK files. Many recent dash cams come with dedicated apps. By installing the app and accessing the ADB shell, you can find firmware-related APK files in the app's installation directory. 399.91s - 413.61s | Extracting and decompressing these files can provide access to the firmware. Most of the analyzed dash cams allowed us to obtain firmware from their official websites. 414.61s - 419.61s | We successfully retrieved firmware for all devices and none of the firmware was encrypted. 420.61s - 434.14s | The next step is to extract the file system from the obtained firmware. Tools such as binoc and 7zip can be used for this purpose as illustrated in the picture. 435.14s - 449.46s | The second step in the analysis process is port scanning. Using the nmap tool, we can identify open ports on the dash cam, analyze services, and discover potential security vulnerabilities. 449.46s - 461.46s | For instance, if port 21 is open, we might attempt an FTP connection. Similarly, if port 80 is open, it suggests the presence


chunk_text:
functionality to either obtain the firmware download URL or capture package to get the latest firmware. 380.38s - 398.91s | The final method involves extracting firmware from APK files. Many recent dash cams come with dedicated apps. By installing the app and accessing the ADB shell, you can find firmware-related APK files in the app's installation directory. 399.91s - 413.61s | Extracting and decompressing these files can provide access to the firmware. Most of the analyzed dash cams allowed us to obtain firmware from their official websites. 414.61s - 419.61s | We successfully retrieved firmware for all devices and none of the firmware was encrypted. 420.61s - 434.14s | The next step is to extract the file system from the obtained firmware. Tools such as binoc and 7zip can be used for this purpose as illustrated in the picture. 435.14s - 449.46s | The second step in the analysis process is port scanning. Using the nmap tool, we can identify open ports on the dash cam, analyze services, and discover potential security vulnerabilities. 449.46s - 461.46s | For instance, if port 21 is open, we might attempt an FTP connection. Similarly, if port 80 is open, it suggests the presence of a web service. 462.46s - 476.46s | Here are the statistics for open ports on the analyzed devices. Among the well-known ports, FTP, Telnet, DNS, HTTP, RPC, and RTSP ports were frequently open. 477.46s - 494.46s | The third step in the analysis process is analyzing boot logic. We examine files in etc-init-daemon, etc-rc-local, and system-daemon configuration files to identify and analyze the scripts executed during boot. 495.46s - 511.46s | For example, the picture shows the rcs file in etc-init-daemon, which runs all files starting with s in etc-init-daemon. We analyze the code of all s files to understand the boot logic. 512.46s - 526.46s | Next, we access the shell obtained via UART, JTAG, or other vulnerabilities. By using the ps command, we can identify running processes and understand how service operations and main binaries. 527.46s - 542.46s | The nested command helps us identify open ports and the binaries using those ports. This information provides valuable insights into the current state of the system and the services that are running. 543.46s - 548.46s | Now, he will discuss the process of debugging the main binary. 553.84s - 558.84s | Hi, I'm Hanyeol Park. I'll continue the


chunk_text:
of a web service. 462.46s - 476.46s | Here are the statistics for open ports on the analyzed devices. Among the well-known ports, FTP, Telnet, DNS, HTTP, RPC, and RTSP ports were frequently open. 477.46s - 494.46s | The third step in the analysis process is analyzing boot logic. We examine files in etc-init-daemon, etc-rc-local, and system-daemon configuration files to identify and analyze the scripts executed during boot. 495.46s - 511.46s | For example, the picture shows the rcs file in etc-init-daemon, which runs all files starting with s in etc-init-daemon. We analyze the code of all s files to understand the boot logic. 512.46s - 526.46s | Next, we access the shell obtained via UART, JTAG, or other vulnerabilities. By using the ps command, we can identify running processes and understand how service operations and main binaries. 527.46s - 542.46s | The nested command helps us identify open ports and the binaries using those ports. This information provides valuable insights into the current state of the system and the services that are running. 543.46s - 548.46s | Now, he will discuss the process of debugging the main binary. 553.84s - 558.84s | Hi, I'm Hanyeol Park. I'll continue the presentation by discussing the next topic. 558.84s - 565.84s | For convenience, tools such as gdb and bgbox can be stored in the sd card directory for easy access. 567.84s - 576.84s | We decompile the main binary and track the vulnerable functions such as system, beopen, string copy, get, and scanf for code analysis. 577.84s - 584.84s | Using our R&D solution, gIoT, we work to quickly and easily visualize and analyze the vulnerabilities. 585.84s - 593.63s | Using the UART shell, we proceed with debugging by utilizing the gdb binary stored on the sd card. 594.63s - 600.63s | The example code is a script that gets the PID of the running main binary and executes gdb. 602.63s - 606.63s | Running this script connects directly to gdb for debugging. 607.63s - 613.63s | This allows us to analyze the main binary's behavior in real time and debug any vulnerabilities. 614.63s - 623.10s | During debugging, the watchdog timer, which detects system unresponsiveness, often causes the device to reboot. 625.10s - 629.10s | We tried many things, but it was quite challenging to bypass the watchdog. 631.10s - 637.10s | Even though we made it, we managed to


chunk_text:
presentation by discussing the next topic. 558.84s - 565.84s | For convenience, tools such as gdb and bgbox can be stored in the sd card directory for easy access. 567.84s - 576.84s | We decompile the main binary and track the vulnerable functions such as system, beopen, string copy, get, and scanf for code analysis. 577.84s - 584.84s | Using our R&D solution, gIoT, we work to quickly and easily visualize and analyze the vulnerabilities. 585.84s - 593.63s | Using the UART shell, we proceed with debugging by utilizing the gdb binary stored on the sd card. 594.63s - 600.63s | The example code is a script that gets the PID of the running main binary and executes gdb. 602.63s - 606.63s | Running this script connects directly to gdb for debugging. 607.63s - 613.63s | This allows us to analyze the main binary's behavior in real time and debug any vulnerabilities. 614.63s - 623.10s | During debugging, the watchdog timer, which detects system unresponsiveness, often causes the device to reboot. 625.10s - 629.10s | We tried many things, but it was quite challenging to bypass the watchdog. 631.10s - 637.10s | Even though we made it, we managed to crack it in three cases, and we'd like to share those with you. 638.10s - 645.06s | In the first case, the initial script executed at boot contained a function to stop the watchdog. 645.06s - 649.06s | We used this function to execute the corresponding command. 650.06s - 659.06s | For instance, writing the value 1A3A to test register stops the watchdog, allowing us to dynamically debug the main binary with gdb. 660.06s - 668.06s | In the second case, we repeatedly pressed Ctrl-G during boot to interrupt the boot script. 669.06s - 674.06s | Then, we executed the code to disable the watchdog and resume the script, 674.06s - 678.06s | enabling dynamic debugging of the binary with gdb. 679.06s - 685.56s | In the third case, we entered the boot loader and modified the boot arguments. 686.56s - 691.56s | By repeatedly pressing Esc and F1, we accessed the boot loader. 693.56s - 700.56s | In the boot arguments, we modified the init value from linux.hash to bin.sh and added the value no-watchdog. 700.56s - 707.56s | After that, we manually executed the initial scripts line-by-line and used gdb to debug the main binary. 708.56s - 721.88s


chunk_text:
crack it in three cases, and we'd like to share those with you. 638.10s - 645.06s | In the first case, the initial script executed at boot contained a function to stop the watchdog. 645.06s - 649.06s | We used this function to execute the corresponding command. 650.06s - 659.06s | For instance, writing the value 1A3A to test register stops the watchdog, allowing us to dynamically debug the main binary with gdb. 660.06s - 668.06s | In the second case, we repeatedly pressed Ctrl-G during boot to interrupt the boot script. 669.06s - 674.06s | Then, we executed the code to disable the watchdog and resume the script, 674.06s - 678.06s | enabling dynamic debugging of the binary with gdb. 679.06s - 685.56s | In the third case, we entered the boot loader and modified the boot arguments. 686.56s - 691.56s | By repeatedly pressing Esc and F1, we accessed the boot loader. 693.56s - 700.56s | In the boot arguments, we modified the init value from linux.hash to bin.sh and added the value no-watchdog. 700.56s - 707.56s | After that, we manually executed the initial scripts line-by-line and used gdb to debug the main binary. 708.56s - 721.88s | Protocol analysis capturing the analyzing communication packets between the app and the dashcam, or analyzing APK code and dashcam binary code. 722.88s - 732.88s | Among the analyzed devices, six used custom protocols, four had web interfaces, two supported cloud services, and three used APKs. 732.88s - 736.88s | Two supported cloud services, and one used encrypted communication. 738.88s - 744.88s | For encrypted communication, we can use Frida to hook the app and inspect plain text packets. 745.88s - 754.92s | Among the analyzed dashcams, here are the custom protocol formats for four devices. 756.92s - 760.92s | Custom protocol formats are mainly divided into HEX and JSON formats. 761.92s - 773.92s | Bvendor's request format is in HEX, consisting of four bytes for dummy data, two bytes for the command number, two bytes for command number, and four or more bytes for the parameters. 774.92s - 780.92s | In this example, since there are no parameters, four bytes of data are sent to represent null values. 781.92s - 791.92s | Mvendor's request format consists of four bytes of command number, four bytes for packet length, four bytes for command number, and four or more bytes for the


chunk_text:
| Protocol analysis capturing the analyzing communication packets between the app and the dashcam, or analyzing APK code and dashcam binary code. 722.88s - 732.88s | Among the analyzed devices, six used custom protocols, four had web interfaces, two supported cloud services, and three used APKs. 732.88s - 736.88s | Two supported cloud services, and one used encrypted communication. 738.88s - 744.88s | For encrypted communication, we can use Frida to hook the app and inspect plain text packets. 745.88s - 754.92s | Among the analyzed dashcams, here are the custom protocol formats for four devices. 756.92s - 760.92s | Custom protocol formats are mainly divided into HEX and JSON formats. 761.92s - 773.92s | Bvendor's request format is in HEX, consisting of four bytes for dummy data, two bytes for the command number, two bytes for command number, and four or more bytes for the parameters. 774.92s - 780.92s | In this example, since there are no parameters, four bytes of data are sent to represent null values. 781.92s - 791.92s | Mvendor's request format consists of four bytes of command number, four bytes for packet length, four bytes for command number, and four or more bytes for the parameters. 792.92s - 797.92s | In this example, the parameter is sent as cmd equals set semicolon. 798.92s - 805.94s | Next, tvendor's request format is in JSON and consists of three keys. 806.94s - 813.94s | A token generated at the session start, a command number labeled message underscore ID, and a parameter labeled param. 814.94s - 821.41s | Hvendor's request format is similar to tvendor's, but has slight differences. 822.41s - 832.41s | It consists of a token incremented by one from the previous request token, a command number labeled message ID, and a parameter labeled param. 833.41s - 842.41s | Each vendor's custom protocol format has a unique structure, and analyzing these formats helps us understand the communication content. 843.41s - 846.69s | Now, we will discuss zero-day scenarios. 847.69s - 851.93s | Dash cams have the following features. 852.93s - 858.93s | They use SD cards for video storage, and employ the RTSP protocol for live view functionality. 859.93s - 866.93s | They offer settings for Wi-Fi, ADAS, GPS, firmware updates, and communication via custom protocols. 867.93s - 873.93s | Let's explore which vulnerabilities associated with these features in the next slide. 874.93s - 881.91s |


chunk_text:
parameters. 792.92s - 797.92s | In this example, the parameter is sent as cmd equals set semicolon. 798.92s - 805.94s | Next, tvendor's request format is in JSON and consists of three keys. 806.94s - 813.94s | A token generated at the session start, a command number labeled message underscore ID, and a parameter labeled param. 814.94s - 821.41s | Hvendor's request format is similar to tvendor's, but has slight differences. 822.41s - 832.41s | It consists of a token incremented by one from the previous request token, a command number labeled message ID, and a parameter labeled param. 833.41s - 842.41s | Each vendor's custom protocol format has a unique structure, and analyzing these formats helps us understand the communication content. 843.41s - 846.69s | Now, we will discuss zero-day scenarios. 847.69s - 851.93s | Dash cams have the following features. 852.93s - 858.93s | They use SD cards for video storage, and employ the RTSP protocol for live view functionality. 859.93s - 866.93s | They offer settings for Wi-Fi, ADAS, GPS, firmware updates, and communication via custom protocols. 867.93s - 873.93s | Let's explore which vulnerabilities associated with these features in the next slide. 874.93s - 881.91s | The use of SD card is associated with the shell script execution vulnerabilities. 882.91s - 884.91s | Let's explore this scenario. 884.91s - 889.91s | The boot script includes code that executes test shell from the SD card path. 890.91s - 899.91s | An attacker can create a test shell file on the SD card with a script using a Telethemon binary to open a Teleth connection. 900.91s - 911.91s | When the SD card is inserted into the dash cam and the device is booted, the boot script runs test shell, which enables Teleth access and allows the attacker to gain a shell. 911.91s - 921.96s | The live view feature provided through the RTSP protocol is associated with the stack buffer overflow vulnerabilities. 922.96s - 930.96s | An attacker crafts an RTSP request for live view and hooks the app library to modify the RTSP header data. 931.96s - 941.96s | If the dash cam does not properly check the request length when receiving data, a stack buffer overflow can occur, and potentially altering the PC register. 942.96s - 950.96s | By gathering gadgets for the buffer overflow attack and performing gadget chaining, the attacker can exploit this


chunk_text:
The use of SD card is associated with the shell script execution vulnerabilities. 882.91s - 884.91s | Let's explore this scenario. 884.91s - 889.91s | The boot script includes code that executes test shell from the SD card path. 890.91s - 899.91s | An attacker can create a test shell file on the SD card with a script using a Telethemon binary to open a Teleth connection. 900.91s - 911.91s | When the SD card is inserted into the dash cam and the device is booted, the boot script runs test shell, which enables Teleth access and allows the attacker to gain a shell. 911.91s - 921.96s | The live view feature provided through the RTSP protocol is associated with the stack buffer overflow vulnerabilities. 922.96s - 930.96s | An attacker crafts an RTSP request for live view and hooks the app library to modify the RTSP header data. 931.96s - 941.96s | If the dash cam does not properly check the request length when receiving data, a stack buffer overflow can occur, and potentially altering the PC register. 942.96s - 950.96s | By gathering gadgets for the buffer overflow attack and performing gadget chaining, the attacker can exploit this vulnerability to gain a shell. 951.96s - 961.68s | The settings for Wi-Fi, ADAS, GPS, and other features can lead to OS command injection vulnerabilities. 962.68s - 971.68s | When sending device configuration package, an attacker can manipulate the data using a proxy tool with backticks and dollar parentheses. 971.68s - 981.68s | If the dash cam does not validate special characters and uses this data as parameters for system functions, OS command injection can occur. 982.68s - 985.68s | This can allow the attacker to take control of the system. 986.68s - 995.82s | The feature of app and dash cam communication via custom protocols can lead to improper authentication vulnerabilities. 995.82s - 1000.82s | Capturing a packet requesting the file list from the app shows the data in hex format. 1001.82s - 1017.82s | The packet consists of 4 bytes representing the command number for the file list request, followed by 4 bytes for the packet length, another 4 bytes for the command number, and finally 4 bytes for the parameter, which is null in this case. 1018.82s - 1028.87s | By replicating the same packet and sending it to the dash cam, the response will yield the


chunk_text:
vulnerability to gain a shell. 951.96s - 961.68s | The settings for Wi-Fi, ADAS, GPS, and other features can lead to OS command injection vulnerabilities. 962.68s - 971.68s | When sending device configuration package, an attacker can manipulate the data using a proxy tool with backticks and dollar parentheses. 971.68s - 981.68s | If the dash cam does not validate special characters and uses this data as parameters for system functions, OS command injection can occur. 982.68s - 985.68s | This can allow the attacker to take control of the system. 986.68s - 995.82s | The feature of app and dash cam communication via custom protocols can lead to improper authentication vulnerabilities. 995.82s - 1000.82s | Capturing a packet requesting the file list from the app shows the data in hex format. 1001.82s - 1017.82s | The packet consists of 4 bytes representing the command number for the file list request, followed by 4 bytes for the packet length, another 4 bytes for the command number, and finally 4 bytes for the parameter, which is null in this case. 1018.82s - 1028.87s | By replicating the same packet and sending it to the dash cam, the response will yield the file list. 1033.33s - 1040.33s | After capturing the SD card format packet, you can perform a replay attack to execute the function. 1041.33s - 1047.33s | Additionally, all functions can be accessed without authentication, and you can try a replay attack. 1051.08s - 1053.08s | Finally, let's move on to the conclusion. 1053.08s - 1060.58s | Across the 9 analyzed dash cams, we discovered 8 types of CWEs. 1061.58s - 1068.75s | Based on these findings, we have outlined our recommendations and future work. 1069.75s - 1072.75s | First, we need to remove script execution code. 1073.75s - 1078.75s | Remove script execution code from the SD card path used for developer testing. 1079.75s - 1082.75s | Second, enhance communication security. 1082.75s - 1087.75s | Add authentication and verification processes during communication. 1088.75s - 1090.75s | Third, input validation. 1091.75s - 1098.75s | Implement thorough input validation for special characters and length values to prevent security vulnerabilities. 1099.75s - 1110.63s | In closing, throughout this presentation, we aim to raise awareness about the potential security threats associated with dash cams. 1110.63s - 1120.63s | We hope to encourage dash cam manufacturers to develop more secure products, ultimately leading to


chunk_text:
file list. 1033.33s - 1040.33s | After capturing the SD card format packet, you can perform a replay attack to execute the function. 1041.33s - 1047.33s | Additionally, all functions can be accessed without authentication, and you can try a replay attack. 1051.08s - 1053.08s | Finally, let's move on to the conclusion. 1053.08s - 1060.58s | Across the 9 analyzed dash cams, we discovered 8 types of CWEs. 1061.58s - 1068.75s | Based on these findings, we have outlined our recommendations and future work. 1069.75s - 1072.75s | First, we need to remove script execution code. 1073.75s - 1078.75s | Remove script execution code from the SD card path used for developer testing. 1079.75s - 1082.75s | Second, enhance communication security. 1082.75s - 1087.75s | Add authentication and verification processes during communication. 1088.75s - 1090.75s | Third, input validation. 1091.75s - 1098.75s | Implement thorough input validation for special characters and length values to prevent security vulnerabilities. 1099.75s - 1110.63s | In closing, throughout this presentation, we aim to raise awareness about the potential security threats associated with dash cams. 1110.63s - 1120.63s | We hope to encourage dash cam manufacturers to develop more secure products, ultimately leading to safer and more reliable devices for consumers. 1121.63s - 1130.63s | Due to our limited ability to provide prompt answers, we are unable to open the floor for real-time Q&A during this presentation. 1131.63s - 1139.63s | However, please use the QR code displayed above to contact our company or send an email with your inquiries. 1140.63s - 1144.63s | We are committed to provide detailed responses to your questions. 1145.63s - 1153.67s | We extend our gratitude to the IoT Village team for giving us this opportunity to present. 1154.67s - 1156.67s | Thank you for listening to our presentation.


chunk_text:
safer and more reliable devices for consumers. 1121.63s - 1130.63s | Due to our limited ability to provide prompt answers, we are unable to open the floor for real-time Q&A during this presentation. 1131.63s - 1139.63s | However, please use the QR code displayed above to contact our company or send an email with your inquiries. 1140.63s - 1144.63s | We are committed to provide detailed responses to your questions. 1145.63s - 1153.67s | We extend our gratitude to the IoT Village team for giving us this opportunity to present. 1154.67s - 1156.67s | Thank you for listening to our presentation.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=-re_QOQoILY", "title": "DEF CON 32 No Symbols When Reversing No Problem Bring Your Own Max \u2018Libra\u2019 Kersten", "description": "We all know it all too well: that ominous feeling when opening an unknown file in your favorite analysis tool, only to be greeted with hundreds or thousands of unknown functions, none of which are matched by your existing function signatures, nor any of your helper scripts. This makes the analysis a painfully slow and tedious process. Additionally, it sometimes means that the required analysis time exceeds the available time, and another file is chosen to be reversed instead. Especially when dealing with malware, this is an undesired scenario, as it would create a blind spot from a blue team\u2019s perspective.\n\nThe goal of this talk is to share a tried and tested method on how to deal with thousands of unknown functions in a given file, significantly decreasing the time spent on the analysis. The example throughout the talk is the Golang based qBit family, but is applicable to any kind of binary. While this talk focuses on using Ghidra, given its free and open-source nature, it is equally possible with other industry standard tools. The focus will be on scripts, as well as the creation and usage of FunctionID and BSim databases. By combining these, you will be able to create your own symbols, and bring them anywhere you go, for any language of choice.\n\nWhile the symbols are portable, an aggregation of them scales very well over any number of analysts. As such, this methodology works well for individual researchers, but when scaling it for a team of researchers, the outcome will be greater than the sum of its parts.\n\nThis talk will use (malicious) Golang binaries as examples and provide a large dataset of symbols for this language. The scripts, as well as FunctionID and BSim databases, mentioned in this talk will all be made publicly available at the time of this talk.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1312, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.27s - 9.27s | This text was transcribed using whisper model: large-v2 So it's 20 minutes, there's a lot of information, there's links in the slides at the end for, well, the whole version. 9.27s - 11.27s | Thank you all for coming. 11.27s - 19.27s | Table of contents for today, we'll be looking at Ghidra and some related info to that, mostly. 19.27s


chunk_text:
scripts, as well as the creation and usage of FunctionID and BSim databases. By combining these, you will be able to create your own symbols, and bring them anywhere you go, for any language of choice.\n\nWhile the symbols are portable, an aggregation of them scales very well over any number of analysts. As such, this methodology works well for individual researchers, but when scaling it for a team of researchers, the outcome will be greater than the sum of its parts.\n\nThis talk will use (malicious) Golang binaries as examples and provide a large dataset of symbols for this language. The scripts, as well as FunctionID and BSim databases, mentioned in this talk will all be made publicly available at the time of this talk.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1312, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.27s - 9.27s | This text was transcribed using whisper model: large-v2 So it's 20 minutes, there's a lot of information, there's links in the slides at the end for, well, the whole version. 9.27s - 11.27s | Thank you all for coming. 11.27s - 19.27s | Table of contents for today, we'll be looking at Ghidra and some related info to that, mostly. 19.27s - 24.27s | So first I'll introduce myself, and then I'll give you some background information. 24.27s - 29.27s | We'll go a bit more into the nitty-gritty details, and I want to end a bit with the methodology. 29.27s - 32.27s | And then, in the end, there might be time for Q&A. 32.27s - 38.27s | If not, find me afterwards, or run to a microphone if there is time. 38.27s - 41.27s | So my name is Max Gersta, I go by the nickname of Libra. 41.27s - 44.27s | I work for Trellix within the advanced research team. 44.27s - 48.27s | We do research into all kinds of malware-related things. 48.27s - 53.27s | That can be something new, can be a trend, can be anything that piques interest. 53.27s - 60.27s | And one of the things we do is outreach and share that with the community, such as, well, here. 60.27s - 68.27s | Now, the talk itself is about symbols, or rather the lack thereof in binaries, and how to recover them. 68.27s - 72.27s | But before diving into that, I want to share a bit what is a symbol. 72.27s


chunk_text:
- 24.27s | So first I'll introduce myself, and then I'll give you some background information. 24.27s - 29.27s | We'll go a bit more into the nitty-gritty details, and I want to end a bit with the methodology. 29.27s - 32.27s | And then, in the end, there might be time for Q&A. 32.27s - 38.27s | If not, find me afterwards, or run to a microphone if there is time. 38.27s - 41.27s | So my name is Max Gersta, I go by the nickname of Libra. 41.27s - 44.27s | I work for Trellix within the advanced research team. 44.27s - 48.27s | We do research into all kinds of malware-related things. 48.27s - 53.27s | That can be something new, can be a trend, can be anything that piques interest. 53.27s - 60.27s | And one of the things we do is outreach and share that with the community, such as, well, here. 60.27s - 68.27s | Now, the talk itself is about symbols, or rather the lack thereof in binaries, and how to recover them. 68.27s - 72.27s | But before diving into that, I want to share a bit what is a symbol. 72.27s - 76.27s | And this slide should show you exactly what it's not. 76.27s - 81.27s | So a symbol is normally the function name from a reversing perspective. 81.27s - 88.27s | And normally, when you have symbols, they should be recognizable, they should be self-explanatory, and they should be unambiguous. 88.27s - 95.27s | Unlike the symbols I used here, this would be more useful for you to recognize something with. 95.27s - 101.35s | So binaries consist of multiple types of code. 101.35s - 108.35s | Now, this is no official definition, but it's more to what I adhere to, and it will make more sense down the road. 108.35s - 117.35s | So in terms of types of code, I'm going to be making a difference between the runtime, libraries, and user code. 117.35s - 120.35s | Now, there are some gray areas in between. 120.35s - 123.35s | It obviously has room for discussion. 123.35s - 130.35s | But in this case, the purpose is mainly to focus on the big aspects that they each have. 130.35s - 135.35s | So for runtime, I'm going to use Golang as an example. 135.35s - 140.35s |


chunk_text:
- 76.27s | And this slide should show you exactly what it's not. 76.27s - 81.27s | So a symbol is normally the function name from a reversing perspective. 81.27s - 88.27s | And normally, when you have symbols, they should be recognizable, they should be self-explanatory, and they should be unambiguous. 88.27s - 95.27s | Unlike the symbols I used here, this would be more useful for you to recognize something with. 95.27s - 101.35s | So binaries consist of multiple types of code. 101.35s - 108.35s | Now, this is no official definition, but it's more to what I adhere to, and it will make more sense down the road. 108.35s - 117.35s | So in terms of types of code, I'm going to be making a difference between the runtime, libraries, and user code. 117.35s - 120.35s | Now, there are some gray areas in between. 120.35s - 123.35s | It obviously has room for discussion. 123.35s - 130.35s | But in this case, the purpose is mainly to focus on the big aspects that they each have. 130.35s - 135.35s | So for runtime, I'm going to use Golang as an example. 135.35s - 140.35s | The runtime is statically compiled within your binary, or at least the part that you use. 140.35s - 149.35s | Meaning that if you have 10 different Golang binaries of the same Golang version, you will have a lot of overlap of code. 149.35s - 156.35s | Now, that's not to say that those 10 binaries are related to each other, other than the fact that they share the same Golang runtime. 156.35s - 164.35s | But if you have zero functions or function names within your binary, it's kind of hard to find out what the function does. 164.35s - 167.35s | Even though your tools might say there's overlap. 167.35s - 172.35s | Now, the same kind of goes for the libraries, but libraries might give you more of an indication. 172.35s - 180.35s | If you're searching for a specific version of a library, or if you're tracking a piece of malware based on the library that they use, 180.35s - 188.35s | you might be very interested in the library, but to do so, you would need to know where to find it and what libraries include it. 188.35s - 191.35s | And then as a


chunk_text:
The runtime is statically compiled within your binary, or at least the part that you use. 140.35s - 149.35s | Meaning that if you have 10 different Golang binaries of the same Golang version, you will have a lot of overlap of code. 149.35s - 156.35s | Now, that's not to say that those 10 binaries are related to each other, other than the fact that they share the same Golang runtime. 156.35s - 164.35s | But if you have zero functions or function names within your binary, it's kind of hard to find out what the function does. 164.35s - 167.35s | Even though your tools might say there's overlap. 167.35s - 172.35s | Now, the same kind of goes for the libraries, but libraries might give you more of an indication. 172.35s - 180.35s | If you're searching for a specific version of a library, or if you're tracking a piece of malware based on the library that they use, 180.35s - 188.35s | you might be very interested in the library, but to do so, you would need to know where to find it and what libraries include it. 188.35s - 191.35s | And then as a last part, we have the user code. 191.35s - 194.35s | And the user code would be anything that the user writes. 194.35s - 202.35s | So the user code generally calls functions within the runtime and the library, or consists of purely user code itself. 202.35s - 213.35s | So you make a minimalistic C binary and you use no external software, then your binary will be very small and you'll just have your user code. 213.35s - 219.35s | Now, the user code is obviously of interest from my perspective as a malware researcher, 219.35s - 227.35s | because if I can find that in other binaries, it will tell me that this is likely a shared piece of code. 227.35s - 234.35s | And the user code is generally relatively unique to the extent that we can say these binaries overlap. 234.35s - 242.35s | So to recover symbols, we have multiple ways and three of them are what I'm going to be focusing on. 242.35s - 247.35s | So you have metadata in your binaries that you might be able to use. 247.35s - 254.35s | Golang is another great example of this, where you have


chunk_text:
last part, we have the user code. 191.35s - 194.35s | And the user code would be anything that the user writes. 194.35s - 202.35s | So the user code generally calls functions within the runtime and the library, or consists of purely user code itself. 202.35s - 213.35s | So you make a minimalistic C binary and you use no external software, then your binary will be very small and you'll just have your user code. 213.35s - 219.35s | Now, the user code is obviously of interest from my perspective as a malware researcher, 219.35s - 227.35s | because if I can find that in other binaries, it will tell me that this is likely a shared piece of code. 227.35s - 234.35s | And the user code is generally relatively unique to the extent that we can say these binaries overlap. 234.35s - 242.35s | So to recover symbols, we have multiple ways and three of them are what I'm going to be focusing on. 242.35s - 247.35s | So you have metadata in your binaries that you might be able to use. 247.35s - 254.35s | Golang is another great example of this, where you have the PCLN tab and the information within, so you can recover the function names. 254.35s - 257.35s | Obviously, using this is of great benefit. 257.35s - 259.35s | However, not all binaries have this. 259.35s - 264.35s | Say you have a stripped C++ binary, you're going to have a hard time, right? 264.35s - 269.35s | Now, Ghidra has two features that you can use to recover symbols. 270.35s - 273.35s | One is specifically made for this, which is function ID. 273.35s - 278.35s | For those using IDA, that would be flirt signatures, but then Ghidra is equivalent. 278.35s - 282.35s | And it has a hash of a function and a function name. 282.35s - 288.35s | So it hashes your function, cutting some corners here, but the gist of it is that you have a hash, 288.35s - 295.35s | and if the hash is found in another place, you can compare the hash and take the name from the mapping that you already have. 295.35s - 299.35s | Now, and then there's bsim, which stands for behavioral similarity. 299.35s - 305.35s | This was recently released by the NSA, recently being the day


chunk_text:
the PCLN tab and the information within, so you can recover the function names. 254.35s - 257.35s | Obviously, using this is of great benefit. 257.35s - 259.35s | However, not all binaries have this. 259.35s - 264.35s | Say you have a stripped C++ binary, you're going to have a hard time, right? 264.35s - 269.35s | Now, Ghidra has two features that you can use to recover symbols. 270.35s - 273.35s | One is specifically made for this, which is function ID. 273.35s - 278.35s | For those using IDA, that would be flirt signatures, but then Ghidra is equivalent. 278.35s - 282.35s | And it has a hash of a function and a function name. 282.35s - 288.35s | So it hashes your function, cutting some corners here, but the gist of it is that you have a hash, 288.35s - 295.35s | and if the hash is found in another place, you can compare the hash and take the name from the mapping that you already have. 295.35s - 299.35s | Now, and then there's bsim, which stands for behavioral similarity. 299.35s - 305.35s | This was recently released by the NSA, recently being the day before last Christmas. 305.35s - 312.35s | And what you can do is you have the decompiler, produces intermediate language called p-code, 312.35s - 317.35s | and based on the high p-code vectors and some other things are calculated, 317.35s - 321.35s | based on which you can find functions that overlap code. 321.35s - 331.35s | Within Ghidra, you have the advantage that you have the decompiler of your match and of your original function side by side. 331.35s - 336.35s | So say you're patch diffing a file, you can very nicely see the differences. 338.35s - 343.35s | In order to do that, you do need to retain access to the Ghidra project and the files therein, 343.35s - 349.35s | which you're using, or where the match is found, as well as your program that you're analyzing. 350.35s - 356.35s | The script I have is kind of shoehorning that, where we do not use the last part, 356.35s - 362.35s | meaning we have less data required, and we can also automate the process, 362.35s - 365.35s | because in the end it's code that you can use for this. 366.35s - 373.35s | So,


chunk_text:
before last Christmas. 305.35s - 312.35s | And what you can do is you have the decompiler, produces intermediate language called p-code, 312.35s - 317.35s | and based on the high p-code vectors and some other things are calculated, 317.35s - 321.35s | based on which you can find functions that overlap code. 321.35s - 331.35s | Within Ghidra, you have the advantage that you have the decompiler of your match and of your original function side by side. 331.35s - 336.35s | So say you're patch diffing a file, you can very nicely see the differences. 338.35s - 343.35s | In order to do that, you do need to retain access to the Ghidra project and the files therein, 343.35s - 349.35s | which you're using, or where the match is found, as well as your program that you're analyzing. 350.35s - 356.35s | The script I have is kind of shoehorning that, where we do not use the last part, 356.35s - 362.35s | meaning we have less data required, and we can also automate the process, 362.35s - 365.35s | because in the end it's code that you can use for this. 366.35s - 373.35s | So, for the function ID databases, I wrote a script that you can automate. 373.35s - 378.35s | First the ingestion, you can run Ghidra headless to just import your files, 378.35s - 385.35s | and then this script will make for each unique architecture and what Ghidra calls a language ID, 385.35s - 389.35s | it will make a different function ID database that you can use later on. 389.35s - 397.35s | Now a language ID, very briefly put, is a PE file, 32 bits, for Windows for a specific compiler, 397.35s - 399.35s | and then we do that for each. 399.35s - 405.35s | This allows you to have the files that you can share with colleagues, either internally or externally. 406.35s - 409.35s | And this is the quickest way of recovering the symbols. 410.35s - 416.95s | So as a case study, I have a Qubit Stealer sample, which is Golang-based, 416.95s - 422.95s | and it has a lot of functions, but it has no real names, and we'll get more statistics on this in a bit. 422.95s - 430.95s | But just to showcase function ID, the first top screenshot is a screenshot


chunk_text:
for the function ID databases, I wrote a script that you can automate. 373.35s - 378.35s | First the ingestion, you can run Ghidra headless to just import your files, 378.35s - 385.35s | and then this script will make for each unique architecture and what Ghidra calls a language ID, 385.35s - 389.35s | it will make a different function ID database that you can use later on. 389.35s - 397.35s | Now a language ID, very briefly put, is a PE file, 32 bits, for Windows for a specific compiler, 397.35s - 399.35s | and then we do that for each. 399.35s - 405.35s | This allows you to have the files that you can share with colleagues, either internally or externally. 406.35s - 409.35s | And this is the quickest way of recovering the symbols. 410.35s - 416.95s | So as a case study, I have a Qubit Stealer sample, which is Golang-based, 416.95s - 422.95s | and it has a lot of functions, but it has no real names, and we'll get more statistics on this in a bit. 422.95s - 430.95s | But just to showcase function ID, the first top screenshot is a screenshot that is post-default analysis from Ghidra. 431.95s - 437.95s | So it just has fun underscore, which is the equivalent in IDA of saying sub underscore. 437.95s - 440.95s | So these are just functions that have no names. 440.95s - 445.95s | Now in the bottom screenshot, we can see that the P256 subinternal function has been recognized 445.95s - 449.95s | and subsequently been renamed, which saves you time as the analyst. 449.95s - 456.95s | This is part of your default analysis, because the function ID is an analyzer which runs within. 456.95s - 464.95s | For the sake here, I first ran it without the function ID library, which contains these functions, and then the one after. 464.95s - 471.87s | So for bsim, I already mentioned it's a bit shoehorned, because we're not going to be using the GUI to do this, 471.87s - 476.87s | and we're also not relying on the fact that you need access to the Ghidra projects, 476.87s - 480.87s | meaning that if I make a bsim database and I give it to you, 480.87s - 483.87s | then you can still use those databases with this script, 483.87s


chunk_text:
that is post-default analysis from Ghidra. 431.95s - 437.95s | So it just has fun underscore, which is the equivalent in IDA of saying sub underscore. 437.95s - 440.95s | So these are just functions that have no names. 440.95s - 445.95s | Now in the bottom screenshot, we can see that the P256 subinternal function has been recognized 445.95s - 449.95s | and subsequently been renamed, which saves you time as the analyst. 449.95s - 456.95s | This is part of your default analysis, because the function ID is an analyzer which runs within. 456.95s - 464.95s | For the sake here, I first ran it without the function ID library, which contains these functions, and then the one after. 464.95s - 471.87s | So for bsim, I already mentioned it's a bit shoehorned, because we're not going to be using the GUI to do this, 471.87s - 476.87s | and we're also not relying on the fact that you need access to the Ghidra projects, 476.87s - 480.87s | meaning that if I make a bsim database and I give it to you, 480.87s - 483.87s | then you can still use those databases with this script, 483.87s - 490.87s | even though you do not have access to the Ghidra project and the files therein, which I used to create it. 490.87s - 499.87s | So these are, along with function ID databases and some more information, all available on GitHub afterwards. 499.87s - 508.87s | So it's not necessarily using bsim as intended, but since the screenshot on top is relatively readable, I think, on screen, 508.87s - 516.87s | you can see that it has a function name, which is within the fdesc function description XML object, 516.87s - 521.87s | and within there you can see that there are some vectors and calls being made to other functions, 521.87s - 525.87s | which is what bsim uses to identify this. 525.87s - 531.87s | The fact that you can automate this doesn't mean it's fully magically working for you. 531.87s - 536.87s | You still need to specify what your threshold is for the similarity, 536.87s - 541.87s | which is a value between zero, meaning no overlap, and one being an exact match. 541.87s - 552.87s | You also need to specify how many results do you want from the bsim database to


chunk_text:
- 490.87s | even though you do not have access to the Ghidra project and the files therein, which I used to create it. 490.87s - 499.87s | So these are, along with function ID databases and some more information, all available on GitHub afterwards. 499.87s - 508.87s | So it's not necessarily using bsim as intended, but since the screenshot on top is relatively readable, I think, on screen, 508.87s - 516.87s | you can see that it has a function name, which is within the fdesc function description XML object, 516.87s - 521.87s | and within there you can see that there are some vectors and calls being made to other functions, 521.87s - 525.87s | which is what bsim uses to identify this. 525.87s - 531.87s | The fact that you can automate this doesn't mean it's fully magically working for you. 531.87s - 536.87s | You still need to specify what your threshold is for the similarity, 536.87s - 541.87s | which is a value between zero, meaning no overlap, and one being an exact match. 541.87s - 552.87s | You also need to specify how many results do you want from the bsim database to match or to be collected for use. 552.87s - 557.87s | So you can do one, meaning if you have the first match it finds, it will say, oh, it's this. 557.87s - 565.87s | But especially if you're not relying on an exact match, but rather say 75% or more of overlap, 565.87s - 569.87s | you might be interested in what other functions might be matching as well. 569.87s - 576.87s | Now, obviously, if all those functions have the exact same name, it's pretty clear that based on the database that you use, 576.87s - 578.87s | there's only one match. 578.87s - 584.87s | But you can also have the case that you have multiple functions, different names that match, 584.87s - 587.87s | which requires you to do a bit more research. 587.87s - 594.18s | To automate this in the script, you have identical matches. 594.18s - 596.18s | So these are renamed as is, right? 596.18s - 602.18s | Identical meaning there's only one name matched, even if you have multiple functions. 602.18s - 609.18s | The information, the metadata that's still available in the signatures is added to that function within Kedra,


chunk_text:
match or to be collected for use. 552.87s - 557.87s | So you can do one, meaning if you have the first match it finds, it will say, oh, it's this. 557.87s - 565.87s | But especially if you're not relying on an exact match, but rather say 75% or more of overlap, 565.87s - 569.87s | you might be interested in what other functions might be matching as well. 569.87s - 576.87s | Now, obviously, if all those functions have the exact same name, it's pretty clear that based on the database that you use, 576.87s - 578.87s | there's only one match. 578.87s - 584.87s | But you can also have the case that you have multiple functions, different names that match, 584.87s - 587.87s | which requires you to do a bit more research. 587.87s - 594.18s | To automate this in the script, you have identical matches. 594.18s - 596.18s | So these are renamed as is, right? 596.18s - 602.18s | Identical meaning there's only one name matched, even if you have multiple functions. 602.18s - 609.18s | The information, the metadata that's still available in the signatures is added to that function within Kedra, 609.18s - 616.18s | and it will show you the original file, the similarity for the match based on the function you're looking at, 616.18s - 623.18s | the significance, which tends to be based on your function size, and the architecture, right? 623.18s - 628.18s | It should only match the architecture that you have, though bsim has specifics. 628.18s - 637.18s | So since it's based on a decompiler, you can make databases that are known specifically for the bitness of your architecture. 637.18s - 643.18s | So say you have a Intel-based binary, one 32-bit version and one 64-bit version, 643.18s - 646.18s | the size of an integer, for example, is different, right? 646.18s - 648.18s | It's four versus eight bytes. 648.18s - 654.18s | What you can tell bsim to do when making or importing the signatures in a database 654.18s - 659.18s | is you can give it a no-size database, meaning that it will ignore certain values 660.18s - 667.18s | and allow you to find matches of code from a 64-bit binary in a 32-bit binary or vice versa. 667.18s - 674.71s | So the information here will allow you to


chunk_text:
609.18s - 616.18s | and it will show you the original file, the similarity for the match based on the function you're looking at, 616.18s - 623.18s | the significance, which tends to be based on your function size, and the architecture, right? 623.18s - 628.18s | It should only match the architecture that you have, though bsim has specifics. 628.18s - 637.18s | So since it's based on a decompiler, you can make databases that are known specifically for the bitness of your architecture. 637.18s - 643.18s | So say you have a Intel-based binary, one 32-bit version and one 64-bit version, 643.18s - 646.18s | the size of an integer, for example, is different, right? 646.18s - 648.18s | It's four versus eight bytes. 648.18s - 654.18s | What you can tell bsim to do when making or importing the signatures in a database 654.18s - 659.18s | is you can give it a no-size database, meaning that it will ignore certain values 660.18s - 667.18s | and allow you to find matches of code from a 64-bit binary in a 32-bit binary or vice versa. 667.18s - 674.71s | So the information here will allow you to more accurately decide if this matches, 674.71s - 681.71s | and given the original file name, right, this says empty project go 1.9, for example, 681.71s - 683.71s | and you can see 1.14, 1.13. 683.71s - 688.71s | So these are the Go versions where this function was also found in when making signatures. 688.71s - 692.71s | So this gives you an indication as to which Golang version it might be, 692.71s - 697.71s | and it will also tell you it's a Golang function on its own. 697.71s - 703.71s | Now, obviously, the original file name is based on what you use as a file name in GDRA when making the signatures. 703.71s - 706.71s | So if you give it useful names, that's great. 706.71s - 712.15s | If not, then it might not be as great. 712.15s - 716.15s | Having said that, there's also a generic match, right, because we want to automate this. 716.15s - 722.15s | You can have functions with thousands of, well, unknown functions within your binary. 722.15s - 728.15s | So there's also what I call a generic match, meaning there is more than one unique name 728.15s


chunk_text:
more accurately decide if this matches, 674.71s - 681.71s | and given the original file name, right, this says empty project go 1.9, for example, 681.71s - 683.71s | and you can see 1.14, 1.13. 683.71s - 688.71s | So these are the Go versions where this function was also found in when making signatures. 688.71s - 692.71s | So this gives you an indication as to which Golang version it might be, 692.71s - 697.71s | and it will also tell you it's a Golang function on its own. 697.71s - 703.71s | Now, obviously, the original file name is based on what you use as a file name in GDRA when making the signatures. 703.71s - 706.71s | So if you give it useful names, that's great. 706.71s - 712.15s | If not, then it might not be as great. 712.15s - 716.15s | Having said that, there's also a generic match, right, because we want to automate this. 716.15s - 722.15s | You can have functions with thousands of, well, unknown functions within your binary. 722.15s - 728.15s | So there's also what I call a generic match, meaning there is more than one unique name 728.15s - 731.15s | that has been returned from the database. 731.15s - 736.15s | Now, not renaming these at all will not help you, right, 736.15s - 740.15s | because you can make these databases for very specific purposes. 740.15s - 744.15s | Say, right, this is my database for the Golang runtime. 744.15s - 750.15s | Then any match that I have based on my similarity threshold 750.15s - 756.15s | will be Golang runtime related, or at least be very likely to be related to it. 756.15s - 763.15s | So in this case, we have two functions, and we can see that the package name within Golang 763.15s - 768.15s | has changed over time, yet the function name itself is the same. 768.15s - 772.15s | Now, obviously, we could add a lot more logic as to how do we identify this between strings, 772.15s - 778.15s | but that is a future work, but also kind of depends on what you're using, right? 778.15s - 782.15s | If it's multiple versions of the same runtime, that works, but maybe you have a database 782.15s - 785.15s | where you put in not only Golang, but


chunk_text:
- 731.15s | that has been returned from the database. 731.15s - 736.15s | Now, not renaming these at all will not help you, right, 736.15s - 740.15s | because you can make these databases for very specific purposes. 740.15s - 744.15s | Say, right, this is my database for the Golang runtime. 744.15s - 750.15s | Then any match that I have based on my similarity threshold 750.15s - 756.15s | will be Golang runtime related, or at least be very likely to be related to it. 756.15s - 763.15s | So in this case, we have two functions, and we can see that the package name within Golang 763.15s - 768.15s | has changed over time, yet the function name itself is the same. 768.15s - 772.15s | Now, obviously, we could add a lot more logic as to how do we identify this between strings, 772.15s - 778.15s | but that is a future work, but also kind of depends on what you're using, right? 778.15s - 782.15s | If it's multiple versions of the same runtime, that works, but maybe you have a database 782.15s - 785.15s | where you put in not only Golang, but a lot more. 785.15s - 788.15s | It gets a lot harder to do the differentiation. 788.15s - 795.15s | So instead, I opted to rename all those functions that match generically with a prefix, 795.15s - 801.15s | and you can provide this prefix when running the script headless so that any match is then renamed. 801.15s - 806.15s | And if you run it over multiple databases, so the script, unless you change it, 806.15s - 813.15s | uses only one database at a time, what you can do is simply provide the prefix, 813.15s - 817.15s | and any function that has the non-default function naming scheme 817.15s - 820.15s | is not included in subsequent runs. 820.15s - 825.15s | So if a function starts with fun underscore or thunk underscore fun underscore, 825.15s - 827.15s | it's included in the search. 827.15s - 833.15s | However, if you have this function right now, it's Golang underscore whatever. 833.15s - 839.15s | If I now run it on another database I have for bsim, 839.15s - 842.15s | then this function is not going to be included anymore. 842.15s - 848.15s | So your subsequent runs


chunk_text:
a lot more. 785.15s - 788.15s | It gets a lot harder to do the differentiation. 788.15s - 795.15s | So instead, I opted to rename all those functions that match generically with a prefix, 795.15s - 801.15s | and you can provide this prefix when running the script headless so that any match is then renamed. 801.15s - 806.15s | And if you run it over multiple databases, so the script, unless you change it, 806.15s - 813.15s | uses only one database at a time, what you can do is simply provide the prefix, 813.15s - 817.15s | and any function that has the non-default function naming scheme 817.15s - 820.15s | is not included in subsequent runs. 820.15s - 825.15s | So if a function starts with fun underscore or thunk underscore fun underscore, 825.15s - 827.15s | it's included in the search. 827.15s - 833.15s | However, if you have this function right now, it's Golang underscore whatever. 833.15s - 839.15s | If I now run it on another database I have for bsim, 839.15s - 842.15s | then this function is not going to be included anymore. 842.15s - 848.15s | So your subsequent runs will A, be faster, but also likely more accurate 848.15s - 853.15s | depending on the order you run it in and how you structure your databases. 853.15s - 859.15s | So to continue with our case study, we have the top screenshot, which is after function ID. 859.15s - 863.15s | And I would recommend you first run function ID because it's faster 863.15s - 867.15s | and it is designed literally for this purpose. 867.15s - 872.15s | And bsim is a bit misused for this purpose, yet it works. 872.15s - 876.15s | And then we see in the bottom one, we see that the different functions 876.15s - 879.15s | are now renamed to Golang underscore. 879.15s - 882.15s | So these are all generic matches. 882.15s - 886.15s | Now looking at this function, and it's a bit of a spoiler alert, 886.15s - 890.15s | it is just a function within the Golang runtime that I used as an example. 890.15s - 899.15s | But you would also guess that it is given that there's only calls to the Golang runtime within. 899.15s - 902.15s | So aside from making these scripts, 902.15s -


chunk_text:
will A, be faster, but also likely more accurate 848.15s - 853.15s | depending on the order you run it in and how you structure your databases. 853.15s - 859.15s | So to continue with our case study, we have the top screenshot, which is after function ID. 859.15s - 863.15s | And I would recommend you first run function ID because it's faster 863.15s - 867.15s | and it is designed literally for this purpose. 867.15s - 872.15s | And bsim is a bit misused for this purpose, yet it works. 872.15s - 876.15s | And then we see in the bottom one, we see that the different functions 876.15s - 879.15s | are now renamed to Golang underscore. 879.15s - 882.15s | So these are all generic matches. 882.15s - 886.15s | Now looking at this function, and it's a bit of a spoiler alert, 886.15s - 890.15s | it is just a function within the Golang runtime that I used as an example. 890.15s - 899.15s | But you would also guess that it is given that there's only calls to the Golang runtime within. 899.15s - 902.15s | So aside from making these scripts, 902.15s - 907.15s | I decided that making this invoke would A, be a good test case, 907.15s - 911.15s | but it would also save CPU cycles for others as soon as we share this. 911.15s - 916.15s | So I downloaded hundreds of gigabytes of benign binaries, 916.15s - 921.15s | mostly runtimes and libraries, compiled them if need be. 921.15s - 928.15s | And I ended up with 117 gigabytes of signatures for bsim. 928.15s - 933.15s | And the data doesn't necessarily say much, 933.15s - 937.15s | but there's not a lot of exact details I have for the bsim part. 937.15s - 942.15s | I do, however, for function ID, because you get a lot of detailed information in return. 942.15s - 947.15s | So 60% is Golang based as to what I created. 947.15s - 951.15s | And then we have 35 related to Boost, right, the C++ library, 951.15s - 954.15s | which contains a lot and it's used a lot. 954.15s - 957.15s | And then there's other. Now, what is other? 957.15s - 959.15s | You might ask the 5%. 959.15s - 964.15s | So here I have the signature generation with


chunk_text:
907.15s | I decided that making this invoke would A, be a good test case, 907.15s - 911.15s | but it would also save CPU cycles for others as soon as we share this. 911.15s - 916.15s | So I downloaded hundreds of gigabytes of benign binaries, 916.15s - 921.15s | mostly runtimes and libraries, compiled them if need be. 921.15s - 928.15s | And I ended up with 117 gigabytes of signatures for bsim. 928.15s - 933.15s | And the data doesn't necessarily say much, 933.15s - 937.15s | but there's not a lot of exact details I have for the bsim part. 937.15s - 942.15s | I do, however, for function ID, because you get a lot of detailed information in return. 942.15s - 947.15s | So 60% is Golang based as to what I created. 947.15s - 951.15s | And then we have 35 related to Boost, right, the C++ library, 951.15s - 954.15s | which contains a lot and it's used a lot. 954.15s - 957.15s | And then there's other. Now, what is other? 957.15s - 959.15s | You might ask the 5%. 959.15s - 964.15s | So here I have the signature generation with the unique number of signatures within each. 965.15s - 969.15s | So for Golang, that was any runtime available that I had at the time. 969.15s - 973.15s | For Boost, it's roughly the last 10 years of Boost. 973.15s - 978.15s | And then we have say libXML, openSSL, libgcrypt and other libraries that are used. 978.15s - 982.15s | Now, depending on how big they are, you have more or less functions. 982.15s - 986.15s | But overall, this is, well, I would say a decent amount of functions 986.15s - 991.15s | that now you don't have to reverse or make signatures for anymore. 991.15s - 994.15s | So to put that in a broader perspective for the qubit stealer, 994.15s - 999.15s | when you do the default KEDA analysis, it will find 2016 functions 999.15s - 1003.15s | out of which one has a name, right, the entry function. 1003.15s - 1006.15s | If we then run function ID, one function is merged, right? 1006.15s - 1012.15s | So we go, the total goes down one, but we recover about 40% of the function names. 1012.15s - 1020.15s | If we then use bsim with


chunk_text:
the unique number of signatures within each. 965.15s - 969.15s | So for Golang, that was any runtime available that I had at the time. 969.15s - 973.15s | For Boost, it's roughly the last 10 years of Boost. 973.15s - 978.15s | And then we have say libXML, openSSL, libgcrypt and other libraries that are used. 978.15s - 982.15s | Now, depending on how big they are, you have more or less functions. 982.15s - 986.15s | But overall, this is, well, I would say a decent amount of functions 986.15s - 991.15s | that now you don't have to reverse or make signatures for anymore. 991.15s - 994.15s | So to put that in a broader perspective for the qubit stealer, 994.15s - 999.15s | when you do the default KEDA analysis, it will find 2016 functions 999.15s - 1003.15s | out of which one has a name, right, the entry function. 1003.15s - 1006.15s | If we then run function ID, one function is merged, right? 1006.15s - 1012.15s | So we go, the total goes down one, but we recover about 40% of the function names. 1012.15s - 1020.15s | If we then use bsim with a 75%, right, 0.75 threshold for similarity, 1020.15s - 1025.15s | we recover another 16%, leaving us at 58. 1025.15s - 1029.15s | Now, that doesn't necessarily sound too much. So why is that? 1029.15s - 1036.15s | Now, we had access to the qubit stealer source code and it imports a library 1036.15s - 1040.15s | and there's no signatures for Golang libraries in this corpus. 1040.15s - 1046.15s | So if you make this, you will have even more matches. 1046.15s - 1054.15s | So as a methodology, I would suggest you use, feedback is obviously welcome, 1054.15s - 1057.15s | that you identify metadata within the binary if you can. 1057.15s - 1061.15s | You can utilize that if you find it. 1061.15s - 1065.15s | You want to identify the runtimes and libraries used within your binary. 1065.15s - 1069.15s | You might need to make signatures for them if you don't have them yet, right? 1069.15s - 1072.15s | Maybe you identified something, so you first make the signatures, 1072.15s - 1075.15s | you apply them, and you do that process both for function ID 1075.15s - 1077.15s | and for the behavior signatures. 1077.15s


chunk_text:
a 75%, right, 0.75 threshold for similarity, 1020.15s - 1025.15s | we recover another 16%, leaving us at 58. 1025.15s - 1029.15s | Now, that doesn't necessarily sound too much. So why is that? 1029.15s - 1036.15s | Now, we had access to the qubit stealer source code and it imports a library 1036.15s - 1040.15s | and there's no signatures for Golang libraries in this corpus. 1040.15s - 1046.15s | So if you make this, you will have even more matches. 1046.15s - 1054.15s | So as a methodology, I would suggest you use, feedback is obviously welcome, 1054.15s - 1057.15s | that you identify metadata within the binary if you can. 1057.15s - 1061.15s | You can utilize that if you find it. 1061.15s - 1065.15s | You want to identify the runtimes and libraries used within your binary. 1065.15s - 1069.15s | You might need to make signatures for them if you don't have them yet, right? 1069.15s - 1072.15s | Maybe you identified something, so you first make the signatures, 1072.15s - 1075.15s | you apply them, and you do that process both for function ID 1075.15s - 1077.15s | and for the behavior signatures. 1077.15s - 1081.15s | Once that's done, you can have any other further logic that you can use, right? 1081.15s - 1084.15s | A lot of people are using LLMs to help rename functions 1084.15s - 1088.15s | without looking at them necessarily, so you can apply more scripts. 1088.15s - 1093.15s | And you can all do this from importing a binary, running function ID, bsim, 1093.15s - 1098.15s | and your other logic within the headless execution. 1098.15s - 1100.15s | So essentially, you can do that at night. 1100.15s - 1103.15s | When you wake up, everything is ready for you to analyze. 1103.15s - 1107.82s | That leaves room for questions. 1107.82s - 1109.82s | There's two minutes left. 1109.82s - 1113.82s | Either ask them now or find me offstage. 1113.82s - 1117.82s | The GitHub link here, I will activate them after the talk, 1117.82s - 1121.82s | has the Github scripts for this talk that I created. 1121.82s - 1125.82s | It has function ID databases, and it has the bsim databases. 1125.82s - 1130.82s | Additionally, there is about 66 gigabytes of Golang binaries. 1130.82s - 1134.82s | It's an empty main function


chunk_text:
- 1081.15s | Once that's done, you can have any other further logic that you can use, right? 1081.15s - 1084.15s | A lot of people are using LLMs to help rename functions 1084.15s - 1088.15s | without looking at them necessarily, so you can apply more scripts. 1088.15s - 1093.15s | And you can all do this from importing a binary, running function ID, bsim, 1093.15s - 1098.15s | and your other logic within the headless execution. 1098.15s - 1100.15s | So essentially, you can do that at night. 1100.15s - 1103.15s | When you wake up, everything is ready for you to analyze. 1103.15s - 1107.82s | That leaves room for questions. 1107.82s - 1109.82s | There's two minutes left. 1109.82s - 1113.82s | Either ask them now or find me offstage. 1113.82s - 1117.82s | The GitHub link here, I will activate them after the talk, 1117.82s - 1121.82s | has the Github scripts for this talk that I created. 1121.82s - 1125.82s | It has function ID databases, and it has the bsim databases. 1125.82s - 1130.82s | Additionally, there is about 66 gigabytes of Golang binaries. 1130.82s - 1134.82s | It's an empty main function and contains the entire runtime of that version. 1134.82s - 1137.82s | And if you want to make signatures, play around with them, 1137.82s - 1140.82s | then feel very much free to as well. 1140.82s - 1143.82s | So the URL is at the top, 1143.82s - 1146.82s | and then you have the slash for each of the suboptions, 1146.82s - 1149.82s | or just go there and find the repositories. 1149.82s - 1173.83s | Thank you very much. 1173.83s - 1175.83s | You have a microphone in the front. 1175.83s - 1187.25s | All right, if you just shout, I'll repeat the question. 1187.25s - 1200.40s | So the question is, how good is bsim when matching functions compiled with different compilers? 1200.40s - 1202.40s | I haven't tested this myself. 1202.40s - 1207.40s | It's a relatively new feature within Kedra. 1207.40s - 1212.40s | I think it does relatively well because it uses the decompiler, 1212.40s - 1215.40s | so some of the abstractions are moved away. 1215.40s - 1225.75s | And I think it also depends if Kedra knows the used calling conventions and such. 1225.75s - 1230.75s | So in a similar vein,


chunk_text:
and contains the entire runtime of that version. 1134.82s - 1137.82s | And if you want to make signatures, play around with them, 1137.82s - 1140.82s | then feel very much free to as well. 1140.82s - 1143.82s | So the URL is at the top, 1143.82s - 1146.82s | and then you have the slash for each of the suboptions, 1146.82s - 1149.82s | or just go there and find the repositories. 1149.82s - 1173.83s | Thank you very much. 1173.83s - 1175.83s | You have a microphone in the front. 1175.83s - 1187.25s | All right, if you just shout, I'll repeat the question. 1187.25s - 1200.40s | So the question is, how good is bsim when matching functions compiled with different compilers? 1200.40s - 1202.40s | I haven't tested this myself. 1202.40s - 1207.40s | It's a relatively new feature within Kedra. 1207.40s - 1212.40s | I think it does relatively well because it uses the decompiler, 1212.40s - 1215.40s | so some of the abstractions are moved away. 1215.40s - 1225.75s | And I think it also depends if Kedra knows the used calling conventions and such. 1225.75s - 1230.75s | So in a similar vein, how do you deal with different compiler options? 1230.75s - 1235.75s | Things like F function sections, all the moving symbols around. 1235.75s - 1239.75s | What of those kind of break this process? 1239.75s - 1242.75s | Yes and no. 1242.75s - 1246.75s | It's the standard engineering answer, right? 1246.75s - 1247.75s | It depends. 1247.75s - 1253.75s | So if you say use an unoptimized compiler run versus a very optimized, 1253.75s - 1258.75s | you will have differences in code, meaning there's differences within the signatures as well. 1258.75s - 1262.75s | For bsim, it might break it because it does match certain things, 1262.75s - 1268.75s | but if the match isn't matching well enough, it will not find a hit. 1268.75s - 1272.75s | For bsim, you can tweak how much it should look alike. 1272.75s - 1279.75s | So if you are aware that something specific is used and you have a database for this, it might help. 1279.75s - 1283.75s | But if it changed too much, then you need to lower your threshold too much 1283.75s - 1287.75s | and you will probably get too many hits to make sense of


chunk_text:
how do you deal with different compiler options? 1230.75s - 1235.75s | Things like F function sections, all the moving symbols around. 1235.75s - 1239.75s | What of those kind of break this process? 1239.75s - 1242.75s | Yes and no. 1242.75s - 1246.75s | It's the standard engineering answer, right? 1246.75s - 1247.75s | It depends. 1247.75s - 1253.75s | So if you say use an unoptimized compiler run versus a very optimized, 1253.75s - 1258.75s | you will have differences in code, meaning there's differences within the signatures as well. 1258.75s - 1262.75s | For bsim, it might break it because it does match certain things, 1262.75s - 1268.75s | but if the match isn't matching well enough, it will not find a hit. 1268.75s - 1272.75s | For bsim, you can tweak how much it should look alike. 1272.75s - 1279.75s | So if you are aware that something specific is used and you have a database for this, it might help. 1279.75s - 1283.75s | But if it changed too much, then you need to lower your threshold too much 1283.75s - 1287.75s | and you will probably get too many hits to make sense of it. 1287.75s - 1294.75s | So I think the best option is to compile the target libraries in all options 1294.75s - 1298.75s | and then make signatures for all, which is obviously a lot more work. 1298.75s - 1303.75s | But I think that is the most accurate option that you have. 1303.75s - 1308.27s | Thank you. 1308.27s - 1310.27s | All right. Thank you very much.


chunk_text:
it. 1287.75s - 1294.75s | So I think the best option is to compile the target libraries in all options 1294.75s - 1298.75s | and then make signatures for all, which is obviously a lot more work. 1298.75s - 1303.75s | But I think that is the most accurate option that you have. 1303.75s - 1308.27s | Thank you. 1308.27s - 1310.27s | All right. Thank you very much.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=120iDYzscD4", "title": "DEF CON 32 - Efficient Bug Bounty Automation Techniques - Gunnar Andrews", "description": "If you're a bug bounty hunter, time can literally mean money. For this reason, automation can be a vital part of how you hunt. But automation has limits. Whether this is hardware limits, target rate limits, WAFs & bot detection, and the list goes on. Successful automation techniques should EFFICIENTLY enhance your hunting. Whether it is being first to a fresh target, or finding targets other hunters haven't. We will go over some techniques and tools to get ahead of the pack, without wasting all your time and money.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1327, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.11s - 5.47s | This text was transcribed using whisper model: large-v2 So, this is the, uh, efficient bug bounty automation techniques talk, if that isn't 5.47s - 9.35s | the talk you're here for, you know. 9.35s - 14.23s | So my name is Gunner Andrews, I'm an AppSec engineer by day, bug bounty hunter by night. 14.23s - 18.35s | Um, I do a little bit of content creation on YouTube and Twitch and some other stuff 18.35s - 20.15s | around basically the same thing. 20.15s - 24.41s | Bug bounty hunting, recon, um, tool dev, that kind of thing. 24.41s - 28.51s | There's three main goals for the talk that I want to go over, so three basically different 28.51s - 29.51s | parts. 29.51s - 34.67s | Um, the first one is the idea of resources versus findings in bug bounty automation. 34.67s - 40.09s | You can get a lot of data really fast, um, and have zero findings, which means $0. 40.09s - 44.75s | So we're going to talk about getting from zero to a hundred with as little cost as possible 44.75s - 49.55s | and scaling up to actually having results that can get you bugs, which means hopefully 49.55s - 50.55s | money. 50.55s - 52.49s | The second part is automating collection. 52.49s - 55.99s | So I'm going to talk about what I personally collect and how I collect it efficiently. 56.55s - 59.83s | Um, and then the little last portion at the end is going to be kind of a portion on data 59.83s - 64.67s | engineering for bug bounty automation, uh, to hopefully encourage some


chunk_text:
around basically the same thing. 20.15s - 24.41s | Bug bounty hunting, recon, um, tool dev, that kind of thing. 24.41s - 28.51s | There's three main goals for the talk that I want to go over, so three basically different 28.51s - 29.51s | parts. 29.51s - 34.67s | Um, the first one is the idea of resources versus findings in bug bounty automation. 34.67s - 40.09s | You can get a lot of data really fast, um, and have zero findings, which means $0. 40.09s - 44.75s | So we're going to talk about getting from zero to a hundred with as little cost as possible 44.75s - 49.55s | and scaling up to actually having results that can get you bugs, which means hopefully 49.55s - 50.55s | money. 50.55s - 52.49s | The second part is automating collection. 52.49s - 55.99s | So I'm going to talk about what I personally collect and how I collect it efficiently. 56.55s - 59.83s | Um, and then the little last portion at the end is going to be kind of a portion on data 59.83s - 64.67s | engineering for bug bounty automation, uh, to hopefully encourage some people to move 64.67s - 70.27s | away from flat text files as much as, uh, bug bounty hunters seem to love those. 70.27s - 74.67s | So I want to start the talk with this slide because I think it's a weird take for some 74.67s - 75.67s | automationists. 75.67s - 82.51s | Um, I basically don't do any brute forcing at all until I have to, uh, I monitor millions 82.51s - 84.55s | of domains every day. 84.59s - 87.67s | I found all of them without brute forcing anything. 87.67s - 90.95s | I monitor a ton of end points, JavaScript files, all that kind of stuff, just like everybody 90.95s - 91.95s | else does. 91.95s - 93.79s | I didn't brute force for any of those. 93.79s - 98.61s | I only brute force something when I absolutely have to, because brute forcing is guessing. 98.61s - 103.45s | And nowadays there's just a lot of other techniques to cover before you start guessing. 103.45s - 106.67s | When you're taking a test, the last thing you do is guess. 106.67s - 109.05s | When you're totally screwed, then you guess. 109.05s -


chunk_text:
people to move 64.67s - 70.27s | away from flat text files as much as, uh, bug bounty hunters seem to love those. 70.27s - 74.67s | So I want to start the talk with this slide because I think it's a weird take for some 74.67s - 75.67s | automationists. 75.67s - 82.51s | Um, I basically don't do any brute forcing at all until I have to, uh, I monitor millions 82.51s - 84.55s | of domains every day. 84.59s - 87.67s | I found all of them without brute forcing anything. 87.67s - 90.95s | I monitor a ton of end points, JavaScript files, all that kind of stuff, just like everybody 90.95s - 91.95s | else does. 91.95s - 93.79s | I didn't brute force for any of those. 93.79s - 98.61s | I only brute force something when I absolutely have to, because brute forcing is guessing. 98.61s - 103.45s | And nowadays there's just a lot of other techniques to cover before you start guessing. 103.45s - 106.67s | When you're taking a test, the last thing you do is guess. 106.67s - 109.05s | When you're totally screwed, then you guess. 109.05s - 114.79s | So I'm going over all this stuff before you're screwed and you have to guess. 114.79s - 119.51s | So I'm going to start at the beginning with Apex domains and kind of a warning about Apex 119.51s - 120.51s | domains. 120.51s - 126.03s | Because Apex domains are very important in bug bounty, especially for bug bounty automationists. 126.03s - 130.75s | Seeing that wild card, star dot anything dot com means that we can hunt on everything. 130.75s - 134.11s | There's a lot of bug bounty programs that say hunt all of our stuff no matter what. 134.11s - 139.27s | Um, just anything that Meta owns or anything that Yahoo owns or anything like that. 139.27s - 144.07s | So for some programs, the place to start is Apex domains, finding all of the root domains 144.15s - 147.95s | to then put into automation, finding all of the IP space they own, that kind of stuff. 147.95s - 153.31s | But specifically for Apex domains, these are some of the sources. 153.31s - 156.51s | It's not the complete picture, especially if they're cloud friendly, and we'll get into 156.51s - 158.31s


chunk_text:
114.79s | So I'm going over all this stuff before you're screwed and you have to guess. 114.79s - 119.51s | So I'm going to start at the beginning with Apex domains and kind of a warning about Apex 119.51s - 120.51s | domains. 120.51s - 126.03s | Because Apex domains are very important in bug bounty, especially for bug bounty automationists. 126.03s - 130.75s | Seeing that wild card, star dot anything dot com means that we can hunt on everything. 130.75s - 134.11s | There's a lot of bug bounty programs that say hunt all of our stuff no matter what. 134.11s - 139.27s | Um, just anything that Meta owns or anything that Yahoo owns or anything like that. 139.27s - 144.07s | So for some programs, the place to start is Apex domains, finding all of the root domains 144.15s - 147.95s | to then put into automation, finding all of the IP space they own, that kind of stuff. 147.95s - 153.31s | But specifically for Apex domains, these are some of the sources. 153.31s - 156.51s | It's not the complete picture, especially if they're cloud friendly, and we'll get into 156.51s - 158.31s | the cloud stuff later. 158.31s - 162.99s | There is reverse whizzing, there's ASN, like checking their ASNs against certain ASN sources. 162.99s - 165.95s | But the thing at the bottom, I'm not going to hit on this for a whole bunch, because 165.95s - 170.51s | I personally don't like automating this a ton. 170.51s - 171.55s | I do a little bit of it. 171.55s - 176.91s | I write some scripts to run it, but then I manually look at the output, because I found, 176.91s - 181.67s | and I have personally been burned multiple times on very big bugs, where I turn in a 181.67s - 187.47s | huge bug, get really excited, and then the domain isn't in scope, right? 187.47s - 190.63s | Maybe they shared some kind of registrar, they did some kind of thing and it happened 190.63s - 194.43s | to slip into my automation because I automated it, and I got burned. 194.43s - 199.11s | So these are some of the sources, I put them up there anyway, but as a warning, I personally 199.11s - 201.51s | don't start at Apex domains for that reason.


chunk_text:
| the cloud stuff later. 158.31s - 162.99s | There is reverse whizzing, there's ASN, like checking their ASNs against certain ASN sources. 162.99s - 165.95s | But the thing at the bottom, I'm not going to hit on this for a whole bunch, because 165.95s - 170.51s | I personally don't like automating this a ton. 170.51s - 171.55s | I do a little bit of it. 171.55s - 176.91s | I write some scripts to run it, but then I manually look at the output, because I found, 176.91s - 181.67s | and I have personally been burned multiple times on very big bugs, where I turn in a 181.67s - 187.47s | huge bug, get really excited, and then the domain isn't in scope, right? 187.47s - 190.63s | Maybe they shared some kind of registrar, they did some kind of thing and it happened 190.63s - 194.43s | to slip into my automation because I automated it, and I got burned. 194.43s - 199.11s | So these are some of the sources, I put them up there anyway, but as a warning, I personally 199.11s - 201.51s | don't start at Apex domains for that reason. 201.51s - 207.77s | Because it's hard to automatically 100% confirm that it's in scope. 207.77s - 213.19s | So if you are interested in looking for Apex domains, though, automate it, and we'll talk 213.19s - 216.83s | about some of this later, but these are some of the things I do. 216.83s - 222.23s | So nowadays, it is very easy for everybody in this room to get a hold of enough hardware 222.23s - 225.99s | to scan the entire IPv4 IP address space. 225.99s - 228.31s | You don't need an ASN. 228.31s - 234.07s | Some companies do run on IPv6 only, but it's very few, to be really honest. 234.07s - 236.93s | I built some of my own tooling for this. 236.93s - 240.03s | If you look on my GitHub, one of the tools is called Caduceus. 240.03s - 244.83s | I like naming all my tools after mythological weapons, you'll see. 244.83s - 245.83s | But there are some ports there. 245.83s - 250.19s | I always do port 443, but there are some other ports that will have certificates on them 250.19s - 251.75s | that are used. 251.75s -


chunk_text:
201.51s - 207.77s | Because it's hard to automatically 100% confirm that it's in scope. 207.77s - 213.19s | So if you are interested in looking for Apex domains, though, automate it, and we'll talk 213.19s - 216.83s | about some of this later, but these are some of the things I do. 216.83s - 222.23s | So nowadays, it is very easy for everybody in this room to get a hold of enough hardware 222.23s - 225.99s | to scan the entire IPv4 IP address space. 225.99s - 228.31s | You don't need an ASN. 228.31s - 234.07s | Some companies do run on IPv6 only, but it's very few, to be really honest. 234.07s - 236.93s | I built some of my own tooling for this. 236.93s - 240.03s | If you look on my GitHub, one of the tools is called Caduceus. 240.03s - 244.83s | I like naming all my tools after mythological weapons, you'll see. 244.83s - 245.83s | But there are some ports there. 245.83s - 250.19s | I always do port 443, but there are some other ports that will have certificates on them 250.19s - 251.75s | that are used. 251.75s - 256.99s | Basically what Caduceus does is it does half the TLS handshake, enough to get the certificate, 256.99s - 260.75s | and then it pulls any domain names out of the common name and subject alternative name 260.75s - 267.75s | fields and then gives the output with what IP address it found it from and what domains. 267.75s - 273.11s | So you can use this, scan the entire internet, and I end up with a whole list of domain names 273.11s - 275.27s | and what IP address I got them from. 275.27s - 278.49s | And we'll talk about this a little bit more later in depth, because this obviously works 278.49s - 280.39s | for subdomains, too. 280.39s - 282.75s | But the other half of it is reverse DNS lookup. 282.75s - 286.87s | So I do reverse DNS, which is searching for PTR records, so it basically does the opposite 286.87s - 287.87s | of DNS, right? 287.87s - 291.75s | So instead of what IP address does this DNS name resolve to, it's the other way around. 291.75s - 294.03s | You put an IP address and it gives you DNS names.


chunk_text:
256.99s | Basically what Caduceus does is it does half the TLS handshake, enough to get the certificate, 256.99s - 260.75s | and then it pulls any domain names out of the common name and subject alternative name 260.75s - 267.75s | fields and then gives the output with what IP address it found it from and what domains. 267.75s - 273.11s | So you can use this, scan the entire internet, and I end up with a whole list of domain names 273.11s - 275.27s | and what IP address I got them from. 275.27s - 278.49s | And we'll talk about this a little bit more later in depth, because this obviously works 278.49s - 280.39s | for subdomains, too. 280.39s - 282.75s | But the other half of it is reverse DNS lookup. 282.75s - 286.87s | So I do reverse DNS, which is searching for PTR records, so it basically does the opposite 286.87s - 287.87s | of DNS, right? 287.87s - 291.75s | So instead of what IP address does this DNS name resolve to, it's the other way around. 291.75s - 294.03s | You put an IP address and it gives you DNS names. 294.03s - 295.75s | I do that using some of those tools. 295.75s - 298.43s | I prefer ZDNS, but there's a bunch of good tools. 298.43s - 302.21s | I do that across the whole IPv4 space as well. 302.21s - 305.91s | And then those scans can also give you Apex domains. 305.91s - 308.79s | We'll talk about it, because it can give you subdomains, too. 308.79s - 314.11s | But for Apex domains, I've found a lot of Apex domains just looking around the internet. 314.11s - 318.27s | You'll find something that says Yahoo on it that you've never seen before, and then 318.27s - 321.39s | you can go back and check who it's registered to and all that kind of stuff and confirm 321.39s - 325.03s | that it does in fact belong to Yahoo or whatever company it is, right? 325.03s - 329.83s | The little tip at the bottom, we can mention later, too, but if you are scanning the IPv4 329.83s - 333.27s | space, a big chunk of that is cloud providers. 333.27s - 340.55s | If you want to take the time, scanning a cloud provider from the


chunk_text:
294.03s - 295.75s | I do that using some of those tools. 295.75s - 298.43s | I prefer ZDNS, but there's a bunch of good tools. 298.43s - 302.21s | I do that across the whole IPv4 space as well. 302.21s - 305.91s | And then those scans can also give you Apex domains. 305.91s - 308.79s | We'll talk about it, because it can give you subdomains, too. 308.79s - 314.11s | But for Apex domains, I've found a lot of Apex domains just looking around the internet. 314.11s - 318.27s | You'll find something that says Yahoo on it that you've never seen before, and then 318.27s - 321.39s | you can go back and check who it's registered to and all that kind of stuff and confirm 321.39s - 325.03s | that it does in fact belong to Yahoo or whatever company it is, right? 325.03s - 329.83s | The little tip at the bottom, we can mention later, too, but if you are scanning the IPv4 329.83s - 333.27s | space, a big chunk of that is cloud providers. 333.27s - 340.55s | If you want to take the time, scanning a cloud provider from the cloud provider is disgustingly 340.55s - 343.41s | fast compared to everything else. 343.41s - 345.97s | You might not like it, but it is. 345.97s - 354.53s | So if you scan U.S. East 1 in AWS from U.S. East 1, you can finish it in, like, a minute. 354.53s - 357.25s | But I didn't tell you that. 357.25s - 358.25s | Okay? 358.25s - 362.21s | So now we're going to start with the other, with what actually is just automatically for 362.21s - 364.13s | me is automated. 364.13s - 366.61s | Everyone likes to start with subdomains, so that's where we're going to start. 366.61s - 369.69s | It's basically like Pokemon, right? 369.69s - 378.21s | I full, like, wholeheartedly use passive DNS sources, because if you read the small print 378.21s - 385.01s | for all these companies, especially the ones that run public DNS servers and big ISPs, 385.01s - 388.09s | everyone sells their DNS data to someone. 388.09s - 392.93s | They might say they don't sell it, but then at the end, it's loopholed because they add 392.93s - 397.97s | their DNS data as part of some other


chunk_text:
cloud provider is disgustingly 340.55s - 343.41s | fast compared to everything else. 343.41s - 345.97s | You might not like it, but it is. 345.97s - 354.53s | So if you scan U.S. East 1 in AWS from U.S. East 1, you can finish it in, like, a minute. 354.53s - 357.25s | But I didn't tell you that. 357.25s - 358.25s | Okay? 358.25s - 362.21s | So now we're going to start with the other, with what actually is just automatically for 362.21s - 364.13s | me is automated. 364.13s - 366.61s | Everyone likes to start with subdomains, so that's where we're going to start. 366.61s - 369.69s | It's basically like Pokemon, right? 369.69s - 378.21s | I full, like, wholeheartedly use passive DNS sources, because if you read the small print 378.21s - 385.01s | for all these companies, especially the ones that run public DNS servers and big ISPs, 385.01s - 388.09s | everyone sells their DNS data to someone. 388.09s - 392.93s | They might say they don't sell it, but then at the end, it's loopholed because they add 392.93s - 397.97s | their DNS data as part of some other business contract with another company. 397.97s - 401.41s | So a lot of these companies you've heard of, like VirusTotal, Security Trails and stuff 401.41s - 405.17s | like that, they do their own Internet scanning, sure, they might put bots out there and scan 405.17s - 410.37s | the Internet and stuff like that, but they also buy a lot of this data from major DNS 410.37s - 413.29s | providers that are happy to also profit from it. 413.29s - 415.97s | So I pay for some. 415.97s - 416.97s | You don't have to. 416.97s - 419.61s | I'm not here to tell you to pay for any product, obviously, because I don't work for any of 419.61s - 424.13s | them, but I do pay for some of them, because in my opinion, they've been way worth it for 424.13s - 425.49s | me. 425.49s - 430.21s | I always, always, always tell someone, do not just hook up a tool and use it because 430.21s - 432.09s | it says it hits that API. 432.09s - 436.13s | Read the docs, look at the rate limiting, look at the pagination, how many credits you 436.13s


chunk_text:
business contract with another company. 397.97s - 401.41s | So a lot of these companies you've heard of, like VirusTotal, Security Trails and stuff 401.41s - 405.17s | like that, they do their own Internet scanning, sure, they might put bots out there and scan 405.17s - 410.37s | the Internet and stuff like that, but they also buy a lot of this data from major DNS 410.37s - 413.29s | providers that are happy to also profit from it. 413.29s - 415.97s | So I pay for some. 415.97s - 416.97s | You don't have to. 416.97s - 419.61s | I'm not here to tell you to pay for any product, obviously, because I don't work for any of 419.61s - 424.13s | them, but I do pay for some of them, because in my opinion, they've been way worth it for 424.13s - 425.49s | me. 425.49s - 430.21s | I always, always, always tell someone, do not just hook up a tool and use it because 430.21s - 432.09s | it says it hits that API. 432.09s - 436.13s | Read the docs, look at the rate limiting, look at the pagination, how many credits you 436.13s - 439.81s | use per this or that, and just try writing it yourself first. 439.81s - 443.85s | Because we're going to talk about it right now, but all those tools on the right, everyone 443.85s - 448.41s | has made all these tools that hit every passive DNS source on the planet and you can put in 448.41s - 451.17s | your keys and that's all great and they are amazing. 452.17s - 459.61s | The people that made a mass, they're all amazing, they've made amazing tools and they work amazing, 459.61s - 464.21s | but if you want specific things, I would write your own logic just so you 100% know what's 464.21s - 465.77s | going on. 465.77s - 471.57s | One of the reasons for that is because when you audit these tools, they try and make everybody, 471.57s - 476.01s | all of you in this room, as happy as they can, all at the same time. 476.01s - 479.61s | And to do that, sometimes you have to cut corners. 479.61s - 484.29s | Some of those corners are, for instance, failing quietly, right? 484.29s - 486.73s | So when you audit


chunk_text:
- 439.81s | use per this or that, and just try writing it yourself first. 439.81s - 443.85s | Because we're going to talk about it right now, but all those tools on the right, everyone 443.85s - 448.41s | has made all these tools that hit every passive DNS source on the planet and you can put in 448.41s - 451.17s | your keys and that's all great and they are amazing. 452.17s - 459.61s | The people that made a mass, they're all amazing, they've made amazing tools and they work amazing, 459.61s - 464.21s | but if you want specific things, I would write your own logic just so you 100% know what's 464.21s - 465.77s | going on. 465.77s - 471.57s | One of the reasons for that is because when you audit these tools, they try and make everybody, 471.57s - 476.01s | all of you in this room, as happy as they can, all at the same time. 476.01s - 479.61s | And to do that, sometimes you have to cut corners. 479.61s - 484.29s | Some of those corners are, for instance, failing quietly, right? 484.29s - 486.73s | So when you audit tools, you'll find something like this. 486.73s - 489.01s | If anyone recognizes this, this is sub finder. 489.01s - 492.33s | Again, if someone from project discovery is here, I love you, please talk to me, okay? 492.33s - 493.77s | I'm sorry. 493.77s - 498.17s | But you'll notice on like the fifth row down, I ran this. 498.17s - 502.21s | If you run it with a dash stats flag, you'll get this output that will tell you the statistics 502.21s - 503.25s | of your run. 503.25s - 508.53s | I ran this against Tesla.com with dash all, meaning use all the sources you possibly can, 508.53s - 510.77s | which is how a lot of people are encouraged to run it. 510.77s - 514.45s | You'll notice it took 43 seconds and 43 and a half. 514.45s - 518.15s | Well, common crawl took 43 and a half seconds. 518.15s - 519.85s | And how many results did I get? 519.85s - 525.17s | Negative 70,782, which makes a ton of sense. 525.17s - 529.45s | So I ran for 43 seconds for an error, basically. 529.45s - 533.65s | If you look at the


chunk_text:
tools, you'll find something like this. 486.73s - 489.01s | If anyone recognizes this, this is sub finder. 489.01s - 492.33s | Again, if someone from project discovery is here, I love you, please talk to me, okay? 492.33s - 493.77s | I'm sorry. 493.77s - 498.17s | But you'll notice on like the fifth row down, I ran this. 498.17s - 502.21s | If you run it with a dash stats flag, you'll get this output that will tell you the statistics 502.21s - 503.25s | of your run. 503.25s - 508.53s | I ran this against Tesla.com with dash all, meaning use all the sources you possibly can, 508.53s - 510.77s | which is how a lot of people are encouraged to run it. 510.77s - 514.45s | You'll notice it took 43 seconds and 43 and a half. 514.45s - 518.15s | Well, common crawl took 43 and a half seconds. 518.15s - 519.85s | And how many results did I get? 519.85s - 525.17s | Negative 70,782, which makes a ton of sense. 525.17s - 529.45s | So I ran for 43 seconds for an error, basically. 529.45s - 533.65s | If you look at the next fastest source or the next slowest, it was 10 seconds from security 533.65s - 539.21s | trails or 30 seconds from way back archive that also gave me nothing. 539.21s - 544.21s | So if I cut out common crawl and way back archive, lose no results, and I would have 544.21s - 548.13s | ran in about 10 seconds, because I think security trails is the next slowest. 548.13s - 551.49s | So I would have ran in a fourth of the time and gotten the same things, just by paying 551.49s - 556.63s | attention to what sources I'm using and what they're actually giving me, right? 556.63s - 559.21s | So back to certificates, okay? 559.21s - 564.49s | So again, I do IPv4 certificate scanning with Caduceus, which I just talked about. 564.49s - 568.53s | You get Apex domains from that, but what you really can look for is subdomains. 568.53s - 572.85s | Those subdomains can be used in a ton of different ways, which I will talk about in a second. 572.85s - 578.09s | But when we talk about certificates, we cannot not talk about cert.sh and ctlogs. 578.09s - 582.45s


chunk_text:
next fastest source or the next slowest, it was 10 seconds from security 533.65s - 539.21s | trails or 30 seconds from way back archive that also gave me nothing. 539.21s - 544.21s | So if I cut out common crawl and way back archive, lose no results, and I would have 544.21s - 548.13s | ran in about 10 seconds, because I think security trails is the next slowest. 548.13s - 551.49s | So I would have ran in a fourth of the time and gotten the same things, just by paying 551.49s - 556.63s | attention to what sources I'm using and what they're actually giving me, right? 556.63s - 559.21s | So back to certificates, okay? 559.21s - 564.49s | So again, I do IPv4 certificate scanning with Caduceus, which I just talked about. 564.49s - 568.53s | You get Apex domains from that, but what you really can look for is subdomains. 568.53s - 572.85s | Those subdomains can be used in a ton of different ways, which I will talk about in a second. 572.85s - 578.09s | But when we talk about certificates, we cannot not talk about cert.sh and ctlogs. 578.09s - 582.45s | So ctlogs are Merkle trees that are public to everybody, and cert.sh was made by some 582.45s - 583.45s | really smart people. 583.45s - 587.77s | It ingests those logs and saves them in a database that is queryable. 588.77s - 590.77s | And you can do it directly. 590.77s - 596.01s | The problem I found with cert.sh is I want domains before all of you have it. 596.01s - 597.01s | Sorry. 597.01s - 598.01s | Right? 598.01s - 603.29s | Some of the bigger ctlogs, cert.sh actually won't have in their database queryable for 603.29s - 604.73s | up to 48 hours. 604.73s - 607.21s | Some are instant, some are not. 607.21s - 609.33s | So what I did is I made my own tool. 609.33s - 610.45s | It's also in my repo. 610.45s - 613.39s | It's called Gungnir, also another weapon. 613.39s - 619.11s | And all it does is it does the same thing that cert.sh does, but I already have databases 619.11s - 620.71s | and all that other stuff later. 620.71s - 624.31s | So it's just the Unix philosophy of ctlog scraping. 624.31s - 630.23s | So


chunk_text:
| So ctlogs are Merkle trees that are public to everybody, and cert.sh was made by some 582.45s - 583.45s | really smart people. 583.45s - 587.77s | It ingests those logs and saves them in a database that is queryable. 588.77s - 590.77s | And you can do it directly. 590.77s - 596.01s | The problem I found with cert.sh is I want domains before all of you have it. 596.01s - 597.01s | Sorry. 597.01s - 598.01s | Right? 598.01s - 603.29s | Some of the bigger ctlogs, cert.sh actually won't have in their database queryable for 603.29s - 604.73s | up to 48 hours. 604.73s - 607.21s | Some are instant, some are not. 607.21s - 609.33s | So what I did is I made my own tool. 609.33s - 610.45s | It's also in my repo. 610.45s - 613.39s | It's called Gungnir, also another weapon. 613.39s - 619.11s | And all it does is it does the same thing that cert.sh does, but I already have databases 619.11s - 620.71s | and all that other stuff later. 620.71s - 624.31s | So it's just the Unix philosophy of ctlog scraping. 624.31s - 630.23s | So it just scrapes the ctlogs as fast as it can with exponential backoffs in case it gets 630.23s - 635.35s | rate limited and then it catches back up, and it will give you a domain within seconds 635.35s - 637.35s | of that certificate getting created. 637.35s - 643.79s | So if someone creates new site.example.com, it will show up in Gungnir in under 20 seconds. 643.79s - 645.45s | You'll know instantly. 645.45s - 650.27s | So if anyone puts a new service online and they want a real certificate behind it that's 650.27s - 655.43s | backed by a certificate authority, you'll know about it basically the second the certificate's 655.43s - 657.75s | created, no matter where they put it. 657.75s - 663.23s | Now again, cert.sh will do that for you, and you can look historically with cert.sh, so 663.23s - 665.55s | it's still a fantastic tool. 665.55s - 667.95s | Whereas just if you want it, immediately. 667.95s - 669.75s | So that's what I do. 669.75s - 671.87s | We'll talk about virtual hosting later. 671.87s - 676.11s | But Caduceus, like I said, Gungnir will give you certificates, but no IP


chunk_text:
it just scrapes the ctlogs as fast as it can with exponential backoffs in case it gets 630.23s - 635.35s | rate limited and then it catches back up, and it will give you a domain within seconds 635.35s - 637.35s | of that certificate getting created. 637.35s - 643.79s | So if someone creates new site.example.com, it will show up in Gungnir in under 20 seconds. 643.79s - 645.45s | You'll know instantly. 645.45s - 650.27s | So if anyone puts a new service online and they want a real certificate behind it that's 650.27s - 655.43s | backed by a certificate authority, you'll know about it basically the second the certificate's 655.43s - 657.75s | created, no matter where they put it. 657.75s - 663.23s | Now again, cert.sh will do that for you, and you can look historically with cert.sh, so 663.23s - 665.55s | it's still a fantastic tool. 665.55s - 667.95s | Whereas just if you want it, immediately. 667.95s - 669.75s | So that's what I do. 669.75s - 671.87s | We'll talk about virtual hosting later. 671.87s - 676.11s | But Caduceus, like I said, Gungnir will give you certificates, but no IP address to what 676.11s - 677.11s | they go with. 677.11s - 680.67s | Caduceus and the certificate scanning will give me the IP address it came from as well 680.67s - 682.27s | as all the domains. 682.27s - 683.79s | So keep that in mind. 683.79s - 685.31s | These are some other good things that I do. 685.31s - 688.19s | I automate them, but I don't do them constantly. 688.19s - 692.19s | Gwen made a very good tool called GitHub subdomains that I think he's actually rewriting, I've 692.19s - 693.39s | heard. 693.39s - 697.83s | I've talked about the reverse DNSing, and then I'll do light spidering, as in I'll land 697.83s - 702.51s | on a page and pull all the second order assets, which costs me nothing and it doesn't get 702.51s - 703.51s | you banned. 703.51s - 709.07s | One get request has not gotten me banned yet, fingers crossed. 709.07s - 712.87s | Virtual host scanning, I wanted to release a tool today, it will be public very soon 712.87s - 717.71s | in my same repo, but I found a bug literally this morning, which is just


chunk_text:
address to what 676.11s - 677.11s | they go with. 677.11s - 680.67s | Caduceus and the certificate scanning will give me the IP address it came from as well 680.67s - 682.27s | as all the domains. 682.27s - 683.79s | So keep that in mind. 683.79s - 685.31s | These are some other good things that I do. 685.31s - 688.19s | I automate them, but I don't do them constantly. 688.19s - 692.19s | Gwen made a very good tool called GitHub subdomains that I think he's actually rewriting, I've 692.19s - 693.39s | heard. 693.39s - 697.83s | I've talked about the reverse DNSing, and then I'll do light spidering, as in I'll land 697.83s - 702.51s | on a page and pull all the second order assets, which costs me nothing and it doesn't get 702.51s - 703.51s | you banned. 703.51s - 709.07s | One get request has not gotten me banned yet, fingers crossed. 709.07s - 712.87s | Virtual host scanning, I wanted to release a tool today, it will be public very soon 712.87s - 717.71s | in my same repo, but I found a bug literally this morning, which is just terrible. 717.71s - 722.27s | But it's going to be called Harpy, and basically what it'll do is you can take the JSON output 722.35s - 727.15s | from Caduceus and you can pipe it right into Harpy and it will do virtual host scanning 727.15s - 731.83s | specifically only for that IP address and the domains found on that certificate. 731.83s - 736.95s | So it's really efficient, and it doesn't do virtual host scanning for a huge list of subdomains 736.95s - 742.43s | against every single IP address, it's just what domains actually came from the certificate 742.43s - 743.87s | on that IP address. 743.87s - 747.59s | And I've already found a lot of nice stuff with it. 747.59s - 751.35s | So I would encourage you to look at it. 751.43s - 756.19s | So this is the other big part, is DNS resolution, because if you get stuff from passive DNS, 756.19s - 761.23s | you are not 100% sure it resolves, right? 761.23s - 766.95s | So there's an issue if you're going to do very high speed, very consistent resolving, 766.95s - 772.11s | is a lot of current tooling


chunk_text:
terrible. 717.71s - 722.27s | But it's going to be called Harpy, and basically what it'll do is you can take the JSON output 722.35s - 727.15s | from Caduceus and you can pipe it right into Harpy and it will do virtual host scanning 727.15s - 731.83s | specifically only for that IP address and the domains found on that certificate. 731.83s - 736.95s | So it's really efficient, and it doesn't do virtual host scanning for a huge list of subdomains 736.95s - 742.43s | against every single IP address, it's just what domains actually came from the certificate 742.43s - 743.87s | on that IP address. 743.87s - 747.59s | And I've already found a lot of nice stuff with it. 747.59s - 751.35s | So I would encourage you to look at it. 751.43s - 756.19s | So this is the other big part, is DNS resolution, because if you get stuff from passive DNS, 756.19s - 761.23s | you are not 100% sure it resolves, right? 761.23s - 766.95s | So there's an issue if you're going to do very high speed, very consistent resolving, 766.95s - 772.11s | is a lot of current tooling silently fails, just like I talked about with sub finder, 772.11s - 776.07s | or it returns surf fails, which if you're not looking for those, it will just drop, 776.07s - 780.07s | but surf fails can actually, if you guys are into like subdomain takeovers and stuff, those 780.07s - 781.95s | are nice to know about. 781.95s - 786.99s | If you attempt to resolve one time, like if you get a domain from one of these APIs and 786.99s - 790.67s | you try and resolve it once, I promise you, you're missing assets. 790.67s - 795.27s | I promise you right now, if you don't have a running retry list of I'll try this for 795.27s - 800.23s | the next five days or something, I promise you, you're missing assets. 800.23s - 805.31s | So the trickest has a list of trusted resolvers that are public and out there and that kind 805.31s - 809.67s | of stuff, and I know a lot of people use those, it's what I started with, but I moved on, 810.19s - 813.67s | they have rate limits, they have timeouts, and they have a bunch of different


chunk_text:
silently fails, just like I talked about with sub finder, 772.11s - 776.07s | or it returns surf fails, which if you're not looking for those, it will just drop, 776.07s - 780.07s | but surf fails can actually, if you guys are into like subdomain takeovers and stuff, those 780.07s - 781.95s | are nice to know about. 781.95s - 786.99s | If you attempt to resolve one time, like if you get a domain from one of these APIs and 786.99s - 790.67s | you try and resolve it once, I promise you, you're missing assets. 790.67s - 795.27s | I promise you right now, if you don't have a running retry list of I'll try this for 795.27s - 800.23s | the next five days or something, I promise you, you're missing assets. 800.23s - 805.31s | So the trickest has a list of trusted resolvers that are public and out there and that kind 805.31s - 809.67s | of stuff, and I know a lot of people use those, it's what I started with, but I moved on, 810.19s - 813.67s | they have rate limits, they have timeouts, and they have a bunch of different issues. 813.67s - 817.01s | I actually wasn't going to talk about this, but I'll just do it anyway. 817.01s - 823.03s | So I look for subdomain takeovers personally, not in a bug bounty presence, but in a different 823.03s - 824.83s | engagement for consulting. 824.83s - 830.99s | I actually found a whole handful of takeovers that every public resolver on trickest's list 830.99s - 837.27s | actually says it's a no error, and what we'll talk about next actually gave it a surf fail, 837.27s - 840.59s | it was a surf fail, they were all takeoverable Azure assets. 840.59s - 846.67s | So I'm not sure why, because I'm not a DNS expert by any means, but the public resolvers, 846.67s - 850.79s | because they have to be on the edge and all that kind of stuff and very fast, can have 850.79s - 854.15s | other things behind the scenes that might mess up what you as a bug bounty hunter are 854.15s - 855.95s | trying to do. 855.95s - 858.79s | So this is what I did instead. 858.79s - 863.11s | So there's a tool or a set of tools


chunk_text:
issues. 813.67s - 817.01s | I actually wasn't going to talk about this, but I'll just do it anyway. 817.01s - 823.03s | So I look for subdomain takeovers personally, not in a bug bounty presence, but in a different 823.03s - 824.83s | engagement for consulting. 824.83s - 830.99s | I actually found a whole handful of takeovers that every public resolver on trickest's list 830.99s - 837.27s | actually says it's a no error, and what we'll talk about next actually gave it a surf fail, 837.27s - 840.59s | it was a surf fail, they were all takeoverable Azure assets. 840.59s - 846.67s | So I'm not sure why, because I'm not a DNS expert by any means, but the public resolvers, 846.67s - 850.79s | because they have to be on the edge and all that kind of stuff and very fast, can have 850.79s - 854.15s | other things behind the scenes that might mess up what you as a bug bounty hunter are 854.15s - 855.95s | trying to do. 855.95s - 858.79s | So this is what I did instead. 858.79s - 863.11s | So there's a tool or a set of tools called PowerDNS. 863.11s - 867.21s | They have three main tools, they have an authoritative server, which we don't really care about, 867.25s - 871.93s | they have a tool called PowerDNS Recursor, which is a recursive DNS resolver we definitely 871.93s - 878.73s | care about, and they have a tool called DNSdist, which is just a load balancer for DNS servers. 878.73s - 880.05s | Sounds pretty nice. 880.05s - 885.85s | So with very little dev effort, you can create a virtual IP so all of your cluster has the 885.85s - 891.69s | same IP using something like Keepalived and using DNSdist and Recursor, which all work 891.69s - 895.17s | together because they're the same company and it's basically plug and play, you can 895.17s - 901.73s | make your own DNS resolution cluster that has unlimited rate limits, can be tuned to 901.73s - 907.15s | your exact needs, whatever caching you want, using this, you can attempt to resolve a domain 907.15s - 912.41s | as many times as you want, you don't hit rate limits, you can put it into Prometheus or 912.41s - 915.69s | any other kind of monitoring and


chunk_text:
called PowerDNS. 863.11s - 867.21s | They have three main tools, they have an authoritative server, which we don't really care about, 867.25s - 871.93s | they have a tool called PowerDNS Recursor, which is a recursive DNS resolver we definitely 871.93s - 878.73s | care about, and they have a tool called DNSdist, which is just a load balancer for DNS servers. 878.73s - 880.05s | Sounds pretty nice. 880.05s - 885.85s | So with very little dev effort, you can create a virtual IP so all of your cluster has the 885.85s - 891.69s | same IP using something like Keepalived and using DNSdist and Recursor, which all work 891.69s - 895.17s | together because they're the same company and it's basically plug and play, you can 895.17s - 901.73s | make your own DNS resolution cluster that has unlimited rate limits, can be tuned to 901.73s - 907.15s | your exact needs, whatever caching you want, using this, you can attempt to resolve a domain 907.15s - 912.41s | as many times as you want, you don't hit rate limits, you can put it into Prometheus or 912.41s - 915.69s | any other kind of monitoring and monitor your own stack and make sure your stuff is working 915.69s - 920.53s | as you think it's working, and then to solve the problem of attempting to resolve multiple 920.53s - 924.27s | times, I actually use caching, I use Redis, you can use Memcache, you can use whatever 924.27s - 929.61s | you want, using just sorted sets with timestamps or anything else or the number of retries, 929.61s - 933.69s | whatever you want to do, it's lightning fast, you can pull it automatically, you're not 933.69s - 937.57s | pulling from a DB, you don't have to worry about a schema, you can just keep a running 937.57s - 940.97s | list of these are all the domains I've seen, this is how many times I've tried it or the 940.97s - 944.57s | last time I've seen it, whatever you want to do, that kind of stuff is what I do, so 944.57s - 949.01s | I can see when I resolve stuff last, how many times I've tried it, if it hasn't, that kind 949.01s - 952.13s | of stuff, and it's really fast, right out of the box. 952.13s - 957.13s |


chunk_text:
monitor your own stack and make sure your stuff is working 915.69s - 920.53s | as you think it's working, and then to solve the problem of attempting to resolve multiple 920.53s - 924.27s | times, I actually use caching, I use Redis, you can use Memcache, you can use whatever 924.27s - 929.61s | you want, using just sorted sets with timestamps or anything else or the number of retries, 929.61s - 933.69s | whatever you want to do, it's lightning fast, you can pull it automatically, you're not 933.69s - 937.57s | pulling from a DB, you don't have to worry about a schema, you can just keep a running 937.57s - 940.97s | list of these are all the domains I've seen, this is how many times I've tried it or the 940.97s - 944.57s | last time I've seen it, whatever you want to do, that kind of stuff is what I do, so 944.57s - 949.01s | I can see when I resolve stuff last, how many times I've tried it, if it hasn't, that kind 949.01s - 952.13s | of stuff, and it's really fast, right out of the box. 952.13s - 957.13s | Those are the records that I look for for bug bounty, I don't pull them all, so using 957.13s - 965.09s | this stack, just for reference, I spend about $25 a month on my cluster, and just two days 965.09s - 971.97s | ago I was able to ramp it up with no errors and no packet drops to write about 125,000 971.97s - 978.33s | queries per second, so I do a couple hundred million, like 600 to 800 million requests 978.33s - 984.13s | a day to that cluster, and it works pretty nice. 984.13s - 988.77s | Support scanning, now we're getting into the good stuff, okay, kind of. 988.77s - 993.87s | So there's active and there's passive, now I hold an opinion on this, this is a purely 993.87s - 1000.25s | opinion post, there are active tools out there, but there is a passive tool that I learned 1000.25s - 1005.05s | about from Jason Haddix, if he's in this room, but it's called SMAP, and all it does 1005.05s - 1011.13s | is it takes your Nmap flags, whatever, but it does it all against Shodan, not, it doesn't 1011.13s - 1015.21s


chunk_text:
Those are the records that I look for for bug bounty, I don't pull them all, so using 957.13s - 965.09s | this stack, just for reference, I spend about $25 a month on my cluster, and just two days 965.09s - 971.97s | ago I was able to ramp it up with no errors and no packet drops to write about 125,000 971.97s - 978.33s | queries per second, so I do a couple hundred million, like 600 to 800 million requests 978.33s - 984.13s | a day to that cluster, and it works pretty nice. 984.13s - 988.77s | Support scanning, now we're getting into the good stuff, okay, kind of. 988.77s - 993.87s | So there's active and there's passive, now I hold an opinion on this, this is a purely 993.87s - 1000.25s | opinion post, there are active tools out there, but there is a passive tool that I learned 1000.25s - 1005.05s | about from Jason Haddix, if he's in this room, but it's called SMAP, and all it does 1005.05s - 1011.13s | is it takes your Nmap flags, whatever, but it does it all against Shodan, not, it doesn't 1011.13s - 1015.21s | actively port scan, so if you want to port scan a bunch of IPs, it actually does it against 1015.21s - 1021.97s | Shodan, so what I do is I run everything through SMAP with Shodan, and then all the ports that 1021.97s - 1028.01s | it says are up, I then actively check with mass scan, Naboo, Nmap, whatever you want 1028.01s - 1032.97s | to use, way less traffic, I've gotten banned zero times, and SMAP is right a lot of the 1032.97s - 1038.05s | time, because Shodan is pretty good, so you can still find all those ports on the right 1038.05s - 1042.09s | with all kinds of juice and all kinds of stuff without scanning every single port on every 1042.09s - 1046.97s | single IP until you eventually get abuse reports and get banned off of a cloud provider. 1046.97s - 1049.01s | I've never done that. 1049.01s - 1055.97s | Okay, web servers and endpoints, same thing scanning the web, so I obviously only do web 1055.97s - 1061.85s | fingerprinting on stuff that resolved, so again, do DNS resolution first, I I I'm assuming 1061.85s - 1065.01s | that's pretty


chunk_text:
| actively port scan, so if you want to port scan a bunch of IPs, it actually does it against 1015.21s - 1021.97s | Shodan, so what I do is I run everything through SMAP with Shodan, and then all the ports that 1021.97s - 1028.01s | it says are up, I then actively check with mass scan, Naboo, Nmap, whatever you want 1028.01s - 1032.97s | to use, way less traffic, I've gotten banned zero times, and SMAP is right a lot of the 1032.97s - 1038.05s | time, because Shodan is pretty good, so you can still find all those ports on the right 1038.05s - 1042.09s | with all kinds of juice and all kinds of stuff without scanning every single port on every 1042.09s - 1046.97s | single IP until you eventually get abuse reports and get banned off of a cloud provider. 1046.97s - 1049.01s | I've never done that. 1049.01s - 1055.97s | Okay, web servers and endpoints, same thing scanning the web, so I obviously only do web 1055.97s - 1061.85s | fingerprinting on stuff that resolved, so again, do DNS resolution first, I I I'm assuming 1061.85s - 1065.01s | that's pretty basic, but we're going to start with that, again, you don't want to get blocked, 1065.01s - 1070.13s | you don't want to get banned, so slow scanning is an idea, always watch your user agent, 1070.13s - 1073.65s | a lot of these tools make their own custom user agents and they're all blocked, okay, 1073.65s - 1078.49s | there's probably someone from Akamai or someone else in this room, they block HTTPX, they 1078.49s - 1083.85s | block all that stuff that come with the custom user agents, go to Chrome, download Chrome, 1083.85s - 1088.85s | look in the request, find the the most recent user agent and just paste that into your tooling 1088.85s - 1094.45s | and like once a month, make sure it still matches, you're golden, all right? 1094.45s - 1099.37s | Some of the other things that we're not supposed to talk about are proxies and lambdas, right? 1099.37s - 1104.93s | AWS lambda, every time you spin up a lambda, comes with a brand new IP address out of AWS's 1104.93s - 1108.69s | IP pool, it's a huge IP pool and each one is new. 1108.69s - 1112.65s | I


chunk_text:
basic, but we're going to start with that, again, you don't want to get blocked, 1065.01s - 1070.13s | you don't want to get banned, so slow scanning is an idea, always watch your user agent, 1070.13s - 1073.65s | a lot of these tools make their own custom user agents and they're all blocked, okay, 1073.65s - 1078.49s | there's probably someone from Akamai or someone else in this room, they block HTTPX, they 1078.49s - 1083.85s | block all that stuff that come with the custom user agents, go to Chrome, download Chrome, 1083.85s - 1088.85s | look in the request, find the the most recent user agent and just paste that into your tooling 1088.85s - 1094.45s | and like once a month, make sure it still matches, you're golden, all right? 1094.45s - 1099.37s | Some of the other things that we're not supposed to talk about are proxies and lambdas, right? 1099.37s - 1104.93s | AWS lambda, every time you spin up a lambda, comes with a brand new IP address out of AWS's 1104.93s - 1108.69s | IP pool, it's a huge IP pool and each one is new. 1108.69s - 1112.65s | I know Shubbs has talked about it, I know Shadow Clone has been out there for a ton, 1112.65s - 1118.89s | if you are going to do high speed scanning on the web, brute forcing, directories, whatever 1118.89s - 1124.97s | it may be, split it up with serverless architecture, it's cheap, I'm not supposed to tell you that, 1124.97s - 1128.45s | people don't like it, do it anyway, okay? 1128.45s - 1131.33s | This is DEF CON, it's kind of the point, okay? 1131.33s - 1135.77s | But on the flip side, one git request gets you a ton of data, again, it will get you 1135.77s - 1141.01s | any second order resources, JavaScript files, S3 buckets, whatever it may be, it will get 1141.01s - 1144.97s | you the title, status code, you'll follow redirects, whatever that may be, you'll get 1144.97s - 1149.97s | your CSP from it, you'll get a lot of cookies from it, so to be fair, on the flip side, 1149.97s - 1154.49s | one git request gets you a ton of information, right? 1154.49s - 1160.09s | So you don't have to scan the web, and I personally don't, because


chunk_text:
know Shubbs has talked about it, I know Shadow Clone has been out there for a ton, 1112.65s - 1118.89s | if you are going to do high speed scanning on the web, brute forcing, directories, whatever 1118.89s - 1124.97s | it may be, split it up with serverless architecture, it's cheap, I'm not supposed to tell you that, 1124.97s - 1128.45s | people don't like it, do it anyway, okay? 1128.45s - 1131.33s | This is DEF CON, it's kind of the point, okay? 1131.33s - 1135.77s | But on the flip side, one git request gets you a ton of data, again, it will get you 1135.77s - 1141.01s | any second order resources, JavaScript files, S3 buckets, whatever it may be, it will get 1141.01s - 1144.97s | you the title, status code, you'll follow redirects, whatever that may be, you'll get 1144.97s - 1149.97s | your CSP from it, you'll get a lot of cookies from it, so to be fair, on the flip side, 1149.97s - 1154.49s | one git request gets you a ton of information, right? 1154.49s - 1160.09s | So you don't have to scan the web, and I personally don't, because basically every request you 1160.09s - 1165.89s | send nowadays, you risk incurring wrath from someone, especially because bug bounty tests 1165.89s - 1169.65s | in prod, because we're gangster, all right? 1169.65s - 1176.53s | So for endpoints, there are passive sources, varying results, obviously if you hit a brand 1176.53s - 1181.61s | new endpoint from Gungnir or something like that, and you go look for it in Gal or Waymore, 1181.61s - 1185.21s | which hits some of these passive sources, there's not going to be anything there. 1185.21s - 1188.17s | But if you find some old stuff, something might be there. 1188.17s - 1193.77s | So it's worth looking, again, it costs you nothing, I have two minutes, okay, we're going 1193.77s - 1195.29s | to have to hustle. 1195.29s - 1198.11s | So spidering and crawling is hard to do. 1198.11s - 1202.87s | When you kick off spidering, find stuff that looks interesting, headless works best, okay, 1202.87s - 1204.43s | actually I'm doing pretty good. 1204.43s - 1206.39s | So this is the data engineering side. 1206.39s - 1212.13s | So subdomains versus IP addresses, they're both extremely useful for those reasons.


chunk_text:
basically every request you 1160.09s - 1165.89s | send nowadays, you risk incurring wrath from someone, especially because bug bounty tests 1165.89s - 1169.65s | in prod, because we're gangster, all right? 1169.65s - 1176.53s | So for endpoints, there are passive sources, varying results, obviously if you hit a brand 1176.53s - 1181.61s | new endpoint from Gungnir or something like that, and you go look for it in Gal or Waymore, 1181.61s - 1185.21s | which hits some of these passive sources, there's not going to be anything there. 1185.21s - 1188.17s | But if you find some old stuff, something might be there. 1188.17s - 1193.77s | So it's worth looking, again, it costs you nothing, I have two minutes, okay, we're going 1193.77s - 1195.29s | to have to hustle. 1195.29s - 1198.11s | So spidering and crawling is hard to do. 1198.11s - 1202.87s | When you kick off spidering, find stuff that looks interesting, headless works best, okay, 1202.87s - 1204.43s | actually I'm doing pretty good. 1204.43s - 1206.39s | So this is the data engineering side. 1206.39s - 1212.13s | So subdomains versus IP addresses, they're both extremely useful for those reasons. 1212.13s - 1213.51s | So use both. 1213.51s - 1217.35s | I track subdomains and IPs and I cross reference them. 1217.35s - 1218.39s | Track both. 1218.39s - 1223.15s | Do not just make subdomains your primary key in a database, do not just make IPs, do both, 1223.15s - 1224.15s | please. 1224.15s - 1225.15s | For those reasons. 1225.15s - 1226.15s | Okay? 1226.19s - 1228.63s | So look into data engineering, please. 1228.63s - 1229.63s | This is a plug. 1229.63s - 1230.63s | Okay? 1230.63s - 1234.31s | There are two books on the right side and a list of topics under them. 1234.31s - 1240.23s | I highly recommend, those are both audio books on Audible, you can listen to them and fall 1240.23s - 1243.83s | asleep, I've never done it, right? 1243.83s - 1244.91s | Read them, okay? 1244.91s - 1247.99s | They are boring, they are technical, but it's so good. 1247.99s - 1252.63s | You're going to end up with so much data and if you don't use the data or just put it in 1252.63s - 1257.51s | flat files in Postgres, you're going to regret it, I promise


chunk_text:
1212.13s - 1213.51s | So use both. 1213.51s - 1217.35s | I track subdomains and IPs and I cross reference them. 1217.35s - 1218.39s | Track both. 1218.39s - 1223.15s | Do not just make subdomains your primary key in a database, do not just make IPs, do both, 1223.15s - 1224.15s | please. 1224.15s - 1225.15s | For those reasons. 1225.15s - 1226.15s | Okay? 1226.19s - 1228.63s | So look into data engineering, please. 1228.63s - 1229.63s | This is a plug. 1229.63s - 1230.63s | Okay? 1230.63s - 1234.31s | There are two books on the right side and a list of topics under them. 1234.31s - 1240.23s | I highly recommend, those are both audio books on Audible, you can listen to them and fall 1240.23s - 1243.83s | asleep, I've never done it, right? 1243.83s - 1244.91s | Read them, okay? 1244.91s - 1247.99s | They are boring, they are technical, but it's so good. 1247.99s - 1252.63s | You're going to end up with so much data and if you don't use the data or just put it in 1252.63s - 1257.51s | flat files in Postgres, you're going to regret it, I promise you, okay? 1257.51s - 1262.39s | So please take a picture of this slide, more data is more bugs, but only if you use it 1262.39s - 1265.19s | correctly, okay? 1265.19s - 1269.91s | This slide is automation's advantage, again, we can cruise through this, take a picture, 1269.91s - 1274.19s | whatever, this is what you want out of your automation, this should be your mission statement 1274.19s - 1276.23s | right here. 1276.23s - 1281.71s | This is what I do, feel free to take a picture of it, this is basically my workflow. 1281.79s - 1287.75s | That's the second page of the workflow, it's a long workflow, okay? 1287.75s - 1292.35s | The last thing I want to say is the people on this slide right here have been huge with 1292.35s - 1296.79s | me learning this stuff and there's so many more people to list, I see some of you out 1296.79s - 1303.27s | there, but anyone who has interacted with me, thank you so much, these people are people 1303.27s - 1308.67s | I interact with every day, find them, look their names up, everyone in this space is 1308.67s -


chunk_text:
you, okay? 1257.51s - 1262.39s | So please take a picture of this slide, more data is more bugs, but only if you use it 1262.39s - 1265.19s | correctly, okay? 1265.19s - 1269.91s | This slide is automation's advantage, again, we can cruise through this, take a picture, 1269.91s - 1274.19s | whatever, this is what you want out of your automation, this should be your mission statement 1274.19s - 1276.23s | right here. 1276.23s - 1281.71s | This is what I do, feel free to take a picture of it, this is basically my workflow. 1281.79s - 1287.75s | That's the second page of the workflow, it's a long workflow, okay? 1287.75s - 1292.35s | The last thing I want to say is the people on this slide right here have been huge with 1292.35s - 1296.79s | me learning this stuff and there's so many more people to list, I see some of you out 1296.79s - 1303.27s | there, but anyone who has interacted with me, thank you so much, these people are people 1303.27s - 1308.67s | I interact with every day, find them, look their names up, everyone in this space is 1308.67s - 1313.47s | great, don't do automation in a vacuum, there's bugs for everybody, share your stuff, talk 1313.47s - 1318.87s | to people, and this is a really crappy slide, if you want to reach out further, that's all 1318.87s - 1320.15s | I got, I think I made time.


chunk_text:
1313.47s | great, don't do automation in a vacuum, there's bugs for everybody, share your stuff, talk 1313.47s - 1318.87s | to people, and this is a really crappy slide, if you want to reach out further, that's all 1318.87s - 1320.15s | I got, I think I made time.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=BE0va6f3QwE", "title": "DEF CON 32 Cybersecurity Schoolhouse Rock Avi McGrady", "description": "Almost since the internet was made widely available to the general public, average technology users have fallen prey to threats from malicious spam, malware, phishing, smishing, scams, fraud, and ransomware. In most of the US, primary and secondary education (in the US, comprising kindergarten through 12th grade) now incorporate computing technology as an integral part of the classroom, and some families introduce computing platforms to children in their toddler and preschool years. Despite our society's growing dependence on computing technology in the world of education, there remain no national standards or curricula for the teaching of data privacy or information security principles. This disconnect sets future generations up for failure, and a continuation of a cycle of ignorance that perpetuates cybercrime victimization. This presentation makes the case that schools must adopt and incorporate concepts of data privacy, information security, defense against fraud and phishing, and internet safety, in age-appropriate ways, into lesson plans at all grade levels. Further, school districts and independent schools must take steps to protect themselves from the threat of ransomware, data breaches, and other forms of criminal activity.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1415, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 3.92s | This text was transcribed using whisper model: large-v2 My name is Avi McGrady, and this talk is about how to teach kids 4.48s - 8.32s | cybersecurity first principles in kindergarten through 12th grade, 8.96s - 12.72s | and why schools everywhere need to start implementing this. 13.36s - 16.80s | I just graduated from Nuvista High School in Boulder, Colorado, 16.80s - 19.76s | and will be attending Rensselaer Polytechnic this fall. 28.22s - 32.30s | I became interested in cybersecurity when I was around eight years old, 32.30s - 37.26s | and my Roblox account was hacked. I've lost everything in my account, 37.26s - 41.74s | but it inspired me to learn more about how things like this could happen, 41.74s - 45.02s | so I could prevent it in the future and teach my friends, too. 45.82s - 50.14s | I wanted to dig into this in school, but there were no classes that I could take. 50.70s - 54.78s | I soon realized that an absence of cybersecurity curriculum 54.78s - 59.26s | is a problem almost everywhere, and even though there are a ton


chunk_text:
"DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 3.92s | This text was transcribed using whisper model: large-v2 My name is Avi McGrady, and this talk is about how to teach kids 4.48s - 8.32s | cybersecurity first principles in kindergarten through 12th grade, 8.96s - 12.72s | and why schools everywhere need to start implementing this. 13.36s - 16.80s | I just graduated from Nuvista High School in Boulder, Colorado, 16.80s - 19.76s | and will be attending Rensselaer Polytechnic this fall. 28.22s - 32.30s | I became interested in cybersecurity when I was around eight years old, 32.30s - 37.26s | and my Roblox account was hacked. I've lost everything in my account, 37.26s - 41.74s | but it inspired me to learn more about how things like this could happen, 41.74s - 45.02s | so I could prevent it in the future and teach my friends, too. 45.82s - 50.14s | I wanted to dig into this in school, but there were no classes that I could take. 50.70s - 54.78s | I soon realized that an absence of cybersecurity curriculum 54.78s - 59.26s | is a problem almost everywhere, and even though there are a ton of resources 59.26s - 62.54s | available to help school boards and boards of education develop one, 63.18s - 67.74s | I set out to help districts like mine figure out what they needed to do next. 69.34s - 75.26s | In addition to this, I also challenged my school board of my district to make this happen. 75.26s - 79.58s | The QR code here links to the public comment I gave at a board meeting last May. 83.31s - 89.23s | So, schools are where we learn our most fundamental things to function in everyday life. 89.23s - 96.83s | So, with cybersecurity a more common requirement for adulting and educational technology or edtech 96.83s - 102.83s | more widespread, it makes sense to begin teaching it now and develop good habits early. 104.11s - 109.55s | Students, teachers, and admin staff should all be included, since they are all potential targets. 110.11s - 114.11s | It's also a problem that schools are frequent targets for cyber attacks, 114.11s - 118.91s | because in this country, schools are often under-resourced for cyber defense. 119.31s - 120.19s | Among other things. 121.31s - 126.99s | Modeling good practices also


chunk_text:
of resources 59.26s - 62.54s | available to help school boards and boards of education develop one, 63.18s - 67.74s | I set out to help districts like mine figure out what they needed to do next. 69.34s - 75.26s | In addition to this, I also challenged my school board of my district to make this happen. 75.26s - 79.58s | The QR code here links to the public comment I gave at a board meeting last May. 83.31s - 89.23s | So, schools are where we learn our most fundamental things to function in everyday life. 89.23s - 96.83s | So, with cybersecurity a more common requirement for adulting and educational technology or edtech 96.83s - 102.83s | more widespread, it makes sense to begin teaching it now and develop good habits early. 104.11s - 109.55s | Students, teachers, and admin staff should all be included, since they are all potential targets. 110.11s - 114.11s | It's also a problem that schools are frequent targets for cyber attacks, 114.11s - 118.91s | because in this country, schools are often under-resourced for cyber defense. 119.31s - 120.19s | Among other things. 121.31s - 126.99s | Modeling good practices also helps employ a good way of teaching them and helps build teamwork. 129.52s - 133.52s | So, we have a lot of very big problems to address here. 133.52s - 139.20s | These include scams and phishing, in particular those that harm the youngest and oldest people. 140.00s - 143.28s | Bullying and trolling is also a problem everywhere, 143.28s - 147.12s | and the internet makes it even more challenging to address, 147.12s - 153.28s | especially with new generative AI tools that make it easy to, for example, 153.28s - 157.12s | publish a non-consensual fake nude image of a classmate, 157.12s - 161.52s | harass them and their friends online, or troll them into doing bad things. 162.32s - 167.52s | Older kids need to learn about malware, how it can be embedded in pirated software, 167.52s - 170.32s | and shared on Discord or other online chats. 170.96s - 174.00s | And, as they achieve more financial freedom, 174.00s - 179.28s | kids need to know how to protect their payment cards and financial information, 179.28s - 182.72s | and need to know what to do if that info gets compromised. 183.60s - 187.92s | We


chunk_text:
helps employ a good way of teaching them and helps build teamwork. 129.52s - 133.52s | So, we have a lot of very big problems to address here. 133.52s - 139.20s | These include scams and phishing, in particular those that harm the youngest and oldest people. 140.00s - 143.28s | Bullying and trolling is also a problem everywhere, 143.28s - 147.12s | and the internet makes it even more challenging to address, 147.12s - 153.28s | especially with new generative AI tools that make it easy to, for example, 153.28s - 157.12s | publish a non-consensual fake nude image of a classmate, 157.12s - 161.52s | harass them and their friends online, or troll them into doing bad things. 162.32s - 167.52s | Older kids need to learn about malware, how it can be embedded in pirated software, 167.52s - 170.32s | and shared on Discord or other online chats. 170.96s - 174.00s | And, as they achieve more financial freedom, 174.00s - 179.28s | kids need to know how to protect their payment cards and financial information, 179.28s - 182.72s | and need to know what to do if that info gets compromised. 183.60s - 187.92s | We can't just lay down a set of rules and expect kids to follow them. 187.92s - 192.56s | After all, being a kid myself, I don't want to follow rules unless I know exactly what they're for. 193.68s - 196.88s | They need buy-in about why we need these things. 196.88s - 199.60s | We should teach them about how attackers work 199.60s - 203.84s | and what negative consequences of getting hacked costs a victim. 206.66s - 211.38s | Everybody here knows Bo Woods, probably, who was a founder of this village. 211.38s - 216.74s | I interviewed Bo for my culminating project for my high school graduation requirement. 216.74s - 218.10s | He made some very good points. 218.90s - 223.78s | He advocates for a more-than-surface-level instruction in cybersecurity. 223.78s - 228.82s | And we can't just tell people to look for the padlock in the browser address bar, 228.82s - 232.18s | but what the padlock means and why it's even there. 233.14s - 239.30s | Bo supports the idea of a broad-based educational curriculum around cybersecurity 239.30s - 241.46s | and for it to apply in every grade. 242.02s - 245.78s | There are cybersecurity


chunk_text:
can't just lay down a set of rules and expect kids to follow them. 187.92s - 192.56s | After all, being a kid myself, I don't want to follow rules unless I know exactly what they're for. 193.68s - 196.88s | They need buy-in about why we need these things. 196.88s - 199.60s | We should teach them about how attackers work 199.60s - 203.84s | and what negative consequences of getting hacked costs a victim. 206.66s - 211.38s | Everybody here knows Bo Woods, probably, who was a founder of this village. 211.38s - 216.74s | I interviewed Bo for my culminating project for my high school graduation requirement. 216.74s - 218.10s | He made some very good points. 218.90s - 223.78s | He advocates for a more-than-surface-level instruction in cybersecurity. 223.78s - 228.82s | And we can't just tell people to look for the padlock in the browser address bar, 228.82s - 232.18s | but what the padlock means and why it's even there. 233.14s - 239.30s | Bo supports the idea of a broad-based educational curriculum around cybersecurity 239.30s - 241.46s | and for it to apply in every grade. 242.02s - 245.78s | There are cybersecurity lessons for every classroom and every subject. 246.74s - 251.78s | He also said that some parts of the curriculum should be introduced at an early age, 252.42s - 255.78s | then revisited in later grades with more detail. 259.90s - 262.06s | So, you all probably know Josh, too. 262.86s - 266.46s | Josh is a founder of the I Am the Cavalry Project 266.46s - 270.30s | and helps organize the annual Hackers on the Hill gathering 270.30s - 273.50s | at the Capitol in Washington, D.C., every year. 274.14s - 277.58s | I interviewed Bo, and he made some valuable observations. 278.62s - 282.78s | Cybersecurity hits on every part of an organization or school, 282.78s - 286.38s | so everyone should be involved in cybersecurity training, 286.38s - 293.50s | not just the teachers and staff, but also, I'm sorry, not just the IT folks, 293.50s - 295.66s | but including the teachers and staff. 296.70s - 303.02s | He also said that there should be more cybersecurity information available to more people, 303.02s - 307.82s | including people who don't have a career interest in doing cybersecurity work 307.82s - 310.06s | or going into


chunk_text:
lessons for every classroom and every subject. 246.74s - 251.78s | He also said that some parts of the curriculum should be introduced at an early age, 252.42s - 255.78s | then revisited in later grades with more detail. 259.90s - 262.06s | So, you all probably know Josh, too. 262.86s - 266.46s | Josh is a founder of the I Am the Cavalry Project 266.46s - 270.30s | and helps organize the annual Hackers on the Hill gathering 270.30s - 273.50s | at the Capitol in Washington, D.C., every year. 274.14s - 277.58s | I interviewed Bo, and he made some valuable observations. 278.62s - 282.78s | Cybersecurity hits on every part of an organization or school, 282.78s - 286.38s | so everyone should be involved in cybersecurity training, 286.38s - 293.50s | not just the teachers and staff, but also, I'm sorry, not just the IT folks, 293.50s - 295.66s | but including the teachers and staff. 296.70s - 303.02s | He also said that there should be more cybersecurity information available to more people, 303.02s - 307.82s | including people who don't have a career interest in doing cybersecurity work 307.82s - 310.06s | or going into a technology field. 310.62s - 312.38s | Everyone must be included. 313.26s - 318.06s | Additionally, he touched on the importance of teaching strong cyber ethics 318.06s - 324.46s | to ensure our next generations of hackers don't walk down the wrong path into criminal activity. 327.34s - 333.18s | So, this leads to the question of what's missing from the curriculum we currently have? 333.74s - 334.78s | The answer is a lot. 335.50s - 339.58s | We don't have basic online privacy or safety instruction. 340.38s - 344.38s | We don't get taught about password managers or why we might need them. 345.18s - 350.70s | We don't learn about ethical behavior online and how others might be harmed by your actions, 350.70s - 354.30s | by, for example, posting something harmful to social media. 354.94s - 359.50s | We don't get taught about why pirating software is bad 359.50s - 364.78s | and why we shouldn't just run any old program someone posts online. 365.34s - 371.26s | And most importantly, we aren't getting instruction in online critical thinking skills, 371.26s - 375.02s | encountering online misinformation and disinformation. 375.90s - 379.66s | In brief, most of


chunk_text:
a technology field. 310.62s - 312.38s | Everyone must be included. 313.26s - 318.06s | Additionally, he touched on the importance of teaching strong cyber ethics 318.06s - 324.46s | to ensure our next generations of hackers don't walk down the wrong path into criminal activity. 327.34s - 333.18s | So, this leads to the question of what's missing from the curriculum we currently have? 333.74s - 334.78s | The answer is a lot. 335.50s - 339.58s | We don't have basic online privacy or safety instruction. 340.38s - 344.38s | We don't get taught about password managers or why we might need them. 345.18s - 350.70s | We don't learn about ethical behavior online and how others might be harmed by your actions, 350.70s - 354.30s | by, for example, posting something harmful to social media. 354.94s - 359.50s | We don't get taught about why pirating software is bad 359.50s - 364.78s | and why we shouldn't just run any old program someone posts online. 365.34s - 371.26s | And most importantly, we aren't getting instruction in online critical thinking skills, 371.26s - 375.02s | encountering online misinformation and disinformation. 375.90s - 379.66s | In brief, most of what we should be teaching kids 379.66s - 383.18s | is not being taught in a systematic, widespread way. 387.02s - 390.38s | To give more structure to what I've been talking about, 390.38s - 392.94s | I developed a bare bones framework curriculum. 393.58s - 395.10s | We start with the youngest kids. 395.74s - 400.86s | Kindergarten through fifth graders need some basic instruction into what is privacy 400.86s - 404.38s | and why it's dangerous to share information about yourself online. 405.18s - 409.26s | These kids also need to internalize an important concept. 409.26s - 412.86s | When it seems too good to be true, it usually is, 412.86s - 417.02s | which can apply to lessons in phishing and malware avoidance. 417.90s - 423.90s | Through middle school, we begin to introduce harm reduction strategies for cyberbullying. 423.90s - 429.98s | I encourage schools to introduce restorative justice principles to help address this. 430.86s - 434.14s | And we need to address interacting safely 434.14s - 437.90s | with people you only know online and have never met in person. 439.26s - 442.62s | Finally, as kids become more tech proficient, 442.62s - 447.34s |


chunk_text:
what we should be teaching kids 379.66s - 383.18s | is not being taught in a systematic, widespread way. 387.02s - 390.38s | To give more structure to what I've been talking about, 390.38s - 392.94s | I developed a bare bones framework curriculum. 393.58s - 395.10s | We start with the youngest kids. 395.74s - 400.86s | Kindergarten through fifth graders need some basic instruction into what is privacy 400.86s - 404.38s | and why it's dangerous to share information about yourself online. 405.18s - 409.26s | These kids also need to internalize an important concept. 409.26s - 412.86s | When it seems too good to be true, it usually is, 412.86s - 417.02s | which can apply to lessons in phishing and malware avoidance. 417.90s - 423.90s | Through middle school, we begin to introduce harm reduction strategies for cyberbullying. 423.90s - 429.98s | I encourage schools to introduce restorative justice principles to help address this. 430.86s - 434.14s | And we need to address interacting safely 434.14s - 437.90s | with people you only know online and have never met in person. 439.26s - 442.62s | Finally, as kids become more tech proficient, 442.62s - 447.34s | we begin to introduce concepts like what is executable code 447.34s - 452.14s | and what are the possible consequences of running it when you don't know what it will do, 452.70s - 457.82s | as well as tackling phishing, online fraud, scams, and password management. 461.44s - 465.76s | The youngest kids obviously need topics that are tailored to them. 465.76s - 469.84s | The term of art in education is developmentally appropriate 469.84s - 474.88s | because we can't burden them with all the heaviest stuff we as adults deal with, 474.88s - 479.68s | but we can teach these fundamentals because we have no choice. 480.88s - 485.84s | Some kids are already using their parents' devices before they start school. 486.48s - 491.68s | So we explain it to them in the same way we teach them to cross the street 491.68s - 494.24s | with a lot of hand-holding and gentle guidance. 495.44s - 498.48s | It's also a bit like teaching stranger danger. 498.48s - 501.04s | You wouldn't walk away with a person you don't know, 501.04s - 504.32s | so don't tell that person your name where you go to school or


chunk_text:
we begin to introduce concepts like what is executable code 447.34s - 452.14s | and what are the possible consequences of running it when you don't know what it will do, 452.70s - 457.82s | as well as tackling phishing, online fraud, scams, and password management. 461.44s - 465.76s | The youngest kids obviously need topics that are tailored to them. 465.76s - 469.84s | The term of art in education is developmentally appropriate 469.84s - 474.88s | because we can't burden them with all the heaviest stuff we as adults deal with, 474.88s - 479.68s | but we can teach these fundamentals because we have no choice. 480.88s - 485.84s | Some kids are already using their parents' devices before they start school. 486.48s - 491.68s | So we explain it to them in the same way we teach them to cross the street 491.68s - 494.24s | with a lot of hand-holding and gentle guidance. 495.44s - 498.48s | It's also a bit like teaching stranger danger. 498.48s - 501.04s | You wouldn't walk away with a person you don't know, 501.04s - 504.32s | so don't tell that person your name where you go to school or live. 508.43s - 513.87s | Alongside the youngest kids, it bears repeating important lessons 513.87s - 516.03s | about deception through middle school. 516.75s - 520.99s | It is not a tool to destroy trust, but to build resilience. 521.71s - 529.63s | The euphemism we use here is if it seems or if it is too good to be true, then it probably is. 530.59s - 535.23s | It's the same lesson we teach about stranger danger, but with a more concrete example. 536.11s - 540.03s | This lesson can be applied broadly to topics like phishing, 540.03s - 543.79s | downloading trojanized pirated games, or cheat apps. 544.67s - 548.27s | It can be simplistic for the younger kids, but by middle school, 548.27s - 552.99s | we can introduce the concept of people intentionally lying to you 552.99s - 557.71s | and able for you to do something you wouldn't normally do. 558.75s - 564.27s | This is an important critical thinking skill that will support people all their lives. 566.85s - 570.45s | Ask anyone who has been a middle school student in recent years. 571.01s - 574.21s | It's the worst time pretty much for


chunk_text:
live. 508.43s - 513.87s | Alongside the youngest kids, it bears repeating important lessons 513.87s - 516.03s | about deception through middle school. 516.75s - 520.99s | It is not a tool to destroy trust, but to build resilience. 521.71s - 529.63s | The euphemism we use here is if it seems or if it is too good to be true, then it probably is. 530.59s - 535.23s | It's the same lesson we teach about stranger danger, but with a more concrete example. 536.11s - 540.03s | This lesson can be applied broadly to topics like phishing, 540.03s - 543.79s | downloading trojanized pirated games, or cheat apps. 544.67s - 548.27s | It can be simplistic for the younger kids, but by middle school, 548.27s - 552.99s | we can introduce the concept of people intentionally lying to you 552.99s - 557.71s | and able for you to do something you wouldn't normally do. 558.75s - 564.27s | This is an important critical thinking skill that will support people all their lives. 566.85s - 570.45s | Ask anyone who has been a middle school student in recent years. 571.01s - 574.21s | It's the worst time pretty much for everyone. 574.93s - 577.73s | Kids are learning to stretch themselves, 577.73s - 581.73s | and sometimes that extends into some pretty negative places. 582.53s - 586.37s | Bullying and teasing gets more common and more real, 586.37s - 590.93s | and as self-awareness grows, kids feel that a lot more strongly. 592.77s - 596.85s | Encouraging kids to be strong and self-sufficient is great, 597.57s - 600.37s | but their peers mean more to them at this age. 601.01s - 606.13s | So in this case, we adults should be supporting them as much as we can 606.13s - 612.37s | with a restorative justice framing to guide kids into empathy rather than driving them apart. 613.89s - 620.61s | New technologies like generative AI are already making things worse for kids at this age, 620.61s - 624.05s | so some guardrails about AI are called for. 628.10s - 634.58s | One thing that we never really talk about is how you socialize safely over the internet. 634.58s - 639.46s | Forget curriculum, it's very rare that even parents talk with their kids 639.46s - 641.94s | about how to interact with others online. 642.66s - 647.62s | It's


chunk_text:
everyone. 574.93s - 577.73s | Kids are learning to stretch themselves, 577.73s - 581.73s | and sometimes that extends into some pretty negative places. 582.53s - 586.37s | Bullying and teasing gets more common and more real, 586.37s - 590.93s | and as self-awareness grows, kids feel that a lot more strongly. 592.77s - 596.85s | Encouraging kids to be strong and self-sufficient is great, 597.57s - 600.37s | but their peers mean more to them at this age. 601.01s - 606.13s | So in this case, we adults should be supporting them as much as we can 606.13s - 612.37s | with a restorative justice framing to guide kids into empathy rather than driving them apart. 613.89s - 620.61s | New technologies like generative AI are already making things worse for kids at this age, 620.61s - 624.05s | so some guardrails about AI are called for. 628.10s - 634.58s | One thing that we never really talk about is how you socialize safely over the internet. 634.58s - 639.46s | Forget curriculum, it's very rare that even parents talk with their kids 639.46s - 641.94s | about how to interact with others online. 642.66s - 647.62s | It's a lot more common that it just happens because kids are curious 647.62s - 651.22s | and talk to their friends who invite them into social spaces. 651.94s - 657.14s | The social spaces kids visit have a strong impact on impressionable minds. 658.10s - 665.54s | Studies have shown that, for example, white supremacists sometimes target spaces for kids 666.10s - 668.26s | specifically for this reason. 669.94s - 674.34s | This is also the time to talk about how not to overshare 674.90s - 677.54s | and don't put anything online out of anger. 678.50s - 682.26s | Don't post something that you wouldn't want projected on the screen 683.06s - 686.50s | during a school assembly in the auditorium. 691.47s - 694.67s | So, what is executable code? 694.67s - 698.03s | If your child asks you right now, do you know how to answer? 698.67s - 704.11s | Probably, because it's DEF CON, but could you help them understand the difference 704.11s - 708.03s | between double-clicking a document and double-clicking an application? 708.75s - 712.83s | To someone who has never been explicitly told these things, 712.83s - 717.87s | it can be a shock


chunk_text:
a lot more common that it just happens because kids are curious 647.62s - 651.22s | and talk to their friends who invite them into social spaces. 651.94s - 657.14s | The social spaces kids visit have a strong impact on impressionable minds. 658.10s - 665.54s | Studies have shown that, for example, white supremacists sometimes target spaces for kids 666.10s - 668.26s | specifically for this reason. 669.94s - 674.34s | This is also the time to talk about how not to overshare 674.90s - 677.54s | and don't put anything online out of anger. 678.50s - 682.26s | Don't post something that you wouldn't want projected on the screen 683.06s - 686.50s | during a school assembly in the auditorium. 691.47s - 694.67s | So, what is executable code? 694.67s - 698.03s | If your child asks you right now, do you know how to answer? 698.67s - 704.11s | Probably, because it's DEF CON, but could you help them understand the difference 704.11s - 708.03s | between double-clicking a document and double-clicking an application? 708.75s - 712.83s | To someone who has never been explicitly told these things, 712.83s - 717.87s | it can be a shock to discover that things you can just click can do harm. 718.67s - 724.59s | So, for kids in middle school and older, we need to go over what are executables, 724.59s - 729.87s | how they can appear in a myriad of ways in Windows, Mac, and Linux environments, 729.87s - 732.19s | and how to safely assess them. 733.07s - 735.79s | Teach your kids to use VirusTotal, too. 735.79s - 738.35s | It's free and can totally save your bacon. 741.73s - 746.85s | So, once kids reach high school, they will likely be playing a lot of games online, 747.33s - 752.61s | probably using different devices like consoles, computers, and mobile devices, 752.61s - 758.13s | and they will also be doing a lot of classwork, homework, and projects with others 758.13s - 762.77s | on various ed-tech platforms like Google Classroom or Schoology. 763.65s - 767.89s | This is the right time to instill them a habit of using a password manager, 768.53s - 774.45s | generating different passwords for everything they use, and as they get older, adopting MFA. 775.25s - 779.81s | We can also never get enough phishing training, so let's


chunk_text:
to discover that things you can just click can do harm. 718.67s - 724.59s | So, for kids in middle school and older, we need to go over what are executables, 724.59s - 729.87s | how they can appear in a myriad of ways in Windows, Mac, and Linux environments, 729.87s - 732.19s | and how to safely assess them. 733.07s - 735.79s | Teach your kids to use VirusTotal, too. 735.79s - 738.35s | It's free and can totally save your bacon. 741.73s - 746.85s | So, once kids reach high school, they will likely be playing a lot of games online, 747.33s - 752.61s | probably using different devices like consoles, computers, and mobile devices, 752.61s - 758.13s | and they will also be doing a lot of classwork, homework, and projects with others 758.13s - 762.77s | on various ed-tech platforms like Google Classroom or Schoology. 763.65s - 767.89s | This is the right time to instill them a habit of using a password manager, 768.53s - 774.45s | generating different passwords for everything they use, and as they get older, adopting MFA. 775.25s - 779.81s | We can also never get enough phishing training, so let's get more of that here, too. 781.01s - 787.57s | And finally, it's important to give kids direction on what to do if they make a mistake 787.57s - 790.29s | and have a password stolen or get scammed. 790.93s - 794.93s | As an adult, be gentle, lead with empathy and kindness, 794.93s - 798.29s | and help them understand that it isn't their fault they were misled. 799.01s - 803.89s | Don't give kids a reason not to come to you in the future if something bad happens. 808.40s - 813.76s | For kids who are interested in cybersecurity, they have a lot of options available to them, 813.76s - 818.08s | but not particularly support for them and their district. 819.20s - 822.72s | I want to highlight a few of these programs that work well, 822.72s - 826.16s | in my opinion, as someone who has done a bit of all of these things. 826.88s - 833.92s | Schools can also sponsor or run some of these programs that introduce various cybersecurity 833.92s - 838.56s | concepts, including red team work, defensive security, 838.56s - 843.28s | and getting experience in industry with internships or volunteer


chunk_text:
get more of that here, too. 781.01s - 787.57s | And finally, it's important to give kids direction on what to do if they make a mistake 787.57s - 790.29s | and have a password stolen or get scammed. 790.93s - 794.93s | As an adult, be gentle, lead with empathy and kindness, 794.93s - 798.29s | and help them understand that it isn't their fault they were misled. 799.01s - 803.89s | Don't give kids a reason not to come to you in the future if something bad happens. 808.40s - 813.76s | For kids who are interested in cybersecurity, they have a lot of options available to them, 813.76s - 818.08s | but not particularly support for them and their district. 819.20s - 822.72s | I want to highlight a few of these programs that work well, 822.72s - 826.16s | in my opinion, as someone who has done a bit of all of these things. 826.88s - 833.92s | Schools can also sponsor or run some of these programs that introduce various cybersecurity 833.92s - 838.56s | concepts, including red team work, defensive security, 838.56s - 843.28s | and getting experience in industry with internships or volunteer work. 844.08s - 850.16s | Could you imagine the good it would do for a whole high school cybersecurity club 850.16s - 853.68s | to go out into the community to do volunteer work, 853.68s - 857.52s | helping nonprofits, retirement homes, or charities 857.52s - 861.12s | to defend themselves or pass along the knowledge they've gained? 861.52s - 865.68s | Some of these kinds of programs can be done just by kids, 865.68s - 868.24s | but some of them need teachers to sponsor them. 868.24s - 871.92s | So find your nerdiest computer teacher and ask them for help. 872.48s - 879.95s | In most US states, new curriculum gets adopted by a state board of education 879.95s - 882.67s | and then passed down to school districts to implement. 883.71s - 886.59s | Schools, school districts, and state boards of ed 886.59s - 892.19s | have a lot of resources available to them to give them a push towards developing curriculum. 892.19s - 898.11s | Including model curriculum and guidelines for a specific cybersecurity subject matter. 898.91s - 903.39s | The US federal government has several agencies, including CISA, 903.39s - 907.23s | the National Institute


chunk_text:
work. 844.08s - 850.16s | Could you imagine the good it would do for a whole high school cybersecurity club 850.16s - 853.68s | to go out into the community to do volunteer work, 853.68s - 857.52s | helping nonprofits, retirement homes, or charities 857.52s - 861.12s | to defend themselves or pass along the knowledge they've gained? 861.52s - 865.68s | Some of these kinds of programs can be done just by kids, 865.68s - 868.24s | but some of them need teachers to sponsor them. 868.24s - 871.92s | So find your nerdiest computer teacher and ask them for help. 872.48s - 879.95s | In most US states, new curriculum gets adopted by a state board of education 879.95s - 882.67s | and then passed down to school districts to implement. 883.71s - 886.59s | Schools, school districts, and state boards of ed 886.59s - 892.19s | have a lot of resources available to them to give them a push towards developing curriculum. 892.19s - 898.11s | Including model curriculum and guidelines for a specific cybersecurity subject matter. 898.91s - 903.39s | The US federal government has several agencies, including CISA, 903.39s - 907.23s | the National Institute of Standards and Technology, 907.23s - 912.11s | the Department of Education, and various branches of the US military 912.11s - 916.91s | all provide resources and sometimes sponsor events and competitions 916.91s - 921.23s | designed to encourage kids to find a career path in cybersecurity. 923.07s - 927.87s | Career and guidance counselors can also help students find local internships 927.87s - 930.11s | or apprentice programs they can apply for. 930.99s - 936.19s | And don't forget, you can contact the members of your state board of education 936.19s - 940.59s | and tell them why you think this is important 940.59s - 945.63s | and advocate to them about adopting a cybersecurity curriculum at all grade levels. 946.35s - 954.02s | Of course, all of these gaps in our educational curriculum 954.98s - 961.06s | could be filled if we had lawmakers who support the idea of teaching cybersecurity 961.06s - 967.06s | and pass bills to pay for new and continuing training and competition events. 967.06s - 972.18s | It goes without saying that it would be a lot easier to accomplish these things 972.18s - 977.30s | if we didn't have to explain the


chunk_text:
of Standards and Technology, 907.23s - 912.11s | the Department of Education, and various branches of the US military 912.11s - 916.91s | all provide resources and sometimes sponsor events and competitions 916.91s - 921.23s | designed to encourage kids to find a career path in cybersecurity. 923.07s - 927.87s | Career and guidance counselors can also help students find local internships 927.87s - 930.11s | or apprentice programs they can apply for. 930.99s - 936.19s | And don't forget, you can contact the members of your state board of education 936.19s - 940.59s | and tell them why you think this is important 940.59s - 945.63s | and advocate to them about adopting a cybersecurity curriculum at all grade levels. 946.35s - 954.02s | Of course, all of these gaps in our educational curriculum 954.98s - 961.06s | could be filled if we had lawmakers who support the idea of teaching cybersecurity 961.06s - 967.06s | and pass bills to pay for new and continuing training and competition events. 967.06s - 972.18s | It goes without saying that it would be a lot easier to accomplish these things 972.18s - 977.30s | if we didn't have to explain the most basic cybersecurity principles 977.30s - 980.74s | to lawmakers who don't really understand the problem space. 981.70s - 987.46s | All of this to say is that it would benefit us all to elect a few more hackers 987.46s - 992.98s | and hacker-friendly politicians to Congress, state houses, and state school boards. 993.78s - 999.78s | This is another supporting reason for why we need more widespread education. 999.78s - 1004.26s | If we begin teaching the masses on cybersecurity principles, 1004.26s - 1009.86s | our future lawmakers will have a great grasp on the topics we need them to understand. 1012.85s - 1017.65s | This talk serves as a call to action for everyone's involvement. 1018.29s - 1023.33s | Cybersecurity public education is in dire need of attention and funding, 1023.33s - 1027.57s | and as hackers, we understand the gravity of this situation. 1028.93s - 1034.85s | To make a difference, consider writing letters to your legislators and state boards of ed 1034.85s - 1038.37s | advocating for cybersecurity education in schools. 1038.37s - 1042.85s | Raising awareness among your family and friends is also equally important. 1043.97s - 1049.09s | Foster an environment where everyone


chunk_text:
most basic cybersecurity principles 977.30s - 980.74s | to lawmakers who don't really understand the problem space. 981.70s - 987.46s | All of this to say is that it would benefit us all to elect a few more hackers 987.46s - 992.98s | and hacker-friendly politicians to Congress, state houses, and state school boards. 993.78s - 999.78s | This is another supporting reason for why we need more widespread education. 999.78s - 1004.26s | If we begin teaching the masses on cybersecurity principles, 1004.26s - 1009.86s | our future lawmakers will have a great grasp on the topics we need them to understand. 1012.85s - 1017.65s | This talk serves as a call to action for everyone's involvement. 1018.29s - 1023.33s | Cybersecurity public education is in dire need of attention and funding, 1023.33s - 1027.57s | and as hackers, we understand the gravity of this situation. 1028.93s - 1034.85s | To make a difference, consider writing letters to your legislators and state boards of ed 1034.85s - 1038.37s | advocating for cybersecurity education in schools. 1038.37s - 1042.85s | Raising awareness among your family and friends is also equally important. 1043.97s - 1049.09s | Foster an environment where everyone is part of the fight, all ages and professions. 1052.77s - 1061.73s | So, to wrap it up, let me summarize what schools, lawmakers, kids, teachers, administrators, 1061.73s - 1064.45s | counselors, and parents need to know. 1065.41s - 1071.49s | We build a more resilient society by teaching all kids at all grade levels principles of 1071.49s - 1077.65s | cybersecurity. We currently have a desperate need for more people who can work in this field, 1077.65s - 1082.13s | and developing a larger workforce of cybersecurity professionals 1082.13s - 1085.65s | begins with teaching all kids the basics. 1086.69s - 1091.01s | Schools remain targets for ransomware and other cybercrime, 1091.01s - 1097.65s | and a cyber smart administration and staff can help protect a school or district better 1097.65s - 1102.05s | than a small number of IT staff who are already overtaxed. 1103.09s - 1107.57s | We will never be able to put a dent in our cybersecurity problem 1107.57s - 1112.69s | until we dig our way out of the hole of cyber ignorance we live in. 1112.69s - 1119.89s | It's time to put an end to the vicious cycle that creates an ever


chunk_text:
is part of the fight, all ages and professions. 1052.77s - 1061.73s | So, to wrap it up, let me summarize what schools, lawmakers, kids, teachers, administrators, 1061.73s - 1064.45s | counselors, and parents need to know. 1065.41s - 1071.49s | We build a more resilient society by teaching all kids at all grade levels principles of 1071.49s - 1077.65s | cybersecurity. We currently have a desperate need for more people who can work in this field, 1077.65s - 1082.13s | and developing a larger workforce of cybersecurity professionals 1082.13s - 1085.65s | begins with teaching all kids the basics. 1086.69s - 1091.01s | Schools remain targets for ransomware and other cybercrime, 1091.01s - 1097.65s | and a cyber smart administration and staff can help protect a school or district better 1097.65s - 1102.05s | than a small number of IT staff who are already overtaxed. 1103.09s - 1107.57s | We will never be able to put a dent in our cybersecurity problem 1107.57s - 1112.69s | until we dig our way out of the hole of cyber ignorance we live in. 1112.69s - 1119.89s | It's time to put an end to the vicious cycle that creates an ever larger pool of cybercrime victims. 1121.57s - 1125.57s | I'm extending a special thanks to everyone who has supported me on this journey, 1125.57s - 1129.81s | and in specific, Andrew Brandt for the relentless mentorship and guidance. 1129.81s - 1134.85s | Your amazing help with this project and others has gotten me to the point of where I am today. 1134.85s - 1136.13s | I could not have done it without you. 1137.33s - 1139.89s | Thanks so much for coming to my talk. Any questions? 1161.66s - 1163.26s | I'm not really sure specifically. 1163.26s - 1166.22s | I think that there are districts that are going in the right direction, 1166.22s - 1172.22s | like more progressive districts and districts that began to teach cyber citizenship, I know, 1172.22s - 1173.58s | are a thing already. 1173.58s - 1178.94s | But I don't think there's any districts that teach this at a widespread level quite yet. 1179.66s - 1181.42s | But there definitely are districts. 1181.42s - 1185.90s | I think Douglas County and a county nearby where I live, it's in Colorado, 1185.90s - 1191.82s | I think they have a pretty strong cyber program that


chunk_text:
larger pool of cybercrime victims. 1121.57s - 1125.57s | I'm extending a special thanks to everyone who has supported me on this journey, 1125.57s - 1129.81s | and in specific, Andrew Brandt for the relentless mentorship and guidance. 1129.81s - 1134.85s | Your amazing help with this project and others has gotten me to the point of where I am today. 1134.85s - 1136.13s | I could not have done it without you. 1137.33s - 1139.89s | Thanks so much for coming to my talk. Any questions? 1161.66s - 1163.26s | I'm not really sure specifically. 1163.26s - 1166.22s | I think that there are districts that are going in the right direction, 1166.22s - 1172.22s | like more progressive districts and districts that began to teach cyber citizenship, I know, 1172.22s - 1173.58s | are a thing already. 1173.58s - 1178.94s | But I don't think there's any districts that teach this at a widespread level quite yet. 1179.66s - 1181.42s | But there definitely are districts. 1181.42s - 1185.90s | I think Douglas County and a county nearby where I live, it's in Colorado, 1185.90s - 1191.82s | I think they have a pretty strong cyber program that has community outreach, things like that. 1191.82s - 1198.06s | That's a really great step to the beginning of what I think a good cyber security future 1198.06s - 1198.70s | would look like. 1205.79s - 1207.15s | Yeah, exactly. 1213.92s - 1215.28s | Can you repeat that real quick? 1241.71s - 1255.71s | Great, that's amazing. 1255.71s - 1256.51s | That's great to hear. 1257.07s - 1258.91s | We need more people like that for sure. 1259.79s - 1260.03s | Yeah. 1273.97s - 1300.29s | Yeah, so districts who say like, we don't have time or resources to do this. 1300.37s - 1305.49s | It can be as simple as giving a very small lesson to kids, 1305.49s - 1308.29s | even when they get their school assigned laptops. 1308.29s - 1310.61s | I think that's an amazing first step. 1310.61s - 1314.85s | Because giving them a piece of technology and not telling them how to be safe on it 1314.85s - 1317.33s | is a recipe for a disaster, as we've seen. 1319.57s - 1325.81s | And I think that a really great first step is just putting a little informational thing 1325.81s - 1329.33s | that


chunk_text:
has community outreach, things like that. 1191.82s - 1198.06s | That's a really great step to the beginning of what I think a good cyber security future 1198.06s - 1198.70s | would look like. 1205.79s - 1207.15s | Yeah, exactly. 1213.92s - 1215.28s | Can you repeat that real quick? 1241.71s - 1255.71s | Great, that's amazing. 1255.71s - 1256.51s | That's great to hear. 1257.07s - 1258.91s | We need more people like that for sure. 1259.79s - 1260.03s | Yeah. 1273.97s - 1300.29s | Yeah, so districts who say like, we don't have time or resources to do this. 1300.37s - 1305.49s | It can be as simple as giving a very small lesson to kids, 1305.49s - 1308.29s | even when they get their school assigned laptops. 1308.29s - 1310.61s | I think that's an amazing first step. 1310.61s - 1314.85s | Because giving them a piece of technology and not telling them how to be safe on it 1314.85s - 1317.33s | is a recipe for a disaster, as we've seen. 1319.57s - 1325.81s | And I think that a really great first step is just putting a little informational thing 1325.81s - 1329.33s | that they go over 10 minutes, whatever, and then done. 1329.33s - 1336.85s | But as this becomes a larger problem, as we'll see in the coming years, if we don't take action, 1336.85s - 1341.33s | I think school administrators and staff will start taking this a little bit more seriously, 1341.33s - 1342.53s | as well as school boards. 1343.41s - 1347.97s | And this is kind of why I'm making this presentation, is because we need to get a 1347.97s - 1350.13s | jump on it before it gets out of hand. 1350.85s - 1354.13s | And we start seeing future generations be cyber illiterate. 1398.99s - 1399.71s | Exactly. 1399.71s - 1401.15s | Yeah, I think that's a great point. 1403.41s - 1407.49s | So yeah, I think we have to do a cut off here, unfortunately. 1407.49s - 1409.81s | So yeah, thank you so much.


chunk_text:
they go over 10 minutes, whatever, and then done. 1329.33s - 1336.85s | But as this becomes a larger problem, as we'll see in the coming years, if we don't take action, 1336.85s - 1341.33s | I think school administrators and staff will start taking this a little bit more seriously, 1341.33s - 1342.53s | as well as school boards. 1343.41s - 1347.97s | And this is kind of why I'm making this presentation, is because we need to get a 1347.97s - 1350.13s | jump on it before it gets out of hand. 1350.85s - 1354.13s | And we start seeing future generations be cyber illiterate. 1398.99s - 1399.71s | Exactly. 1399.71s - 1401.15s | Yeah, I think that's a great point. 1403.41s - 1407.49s | So yeah, I think we have to do a cut off here, unfortunately. 1407.49s - 1409.81s | So yeah, thank you so much.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=3kA6oLhPbbs", "title": "DEF CON 32 - Differential privacy beyond algorithm: Challenges for deployment - Rachel Cummings", "description": "Differential privacy (DP) has been hailed as the gold standard of privacy-preserving data analysis, by providing strong privacy guarantees while still enabling use of potentially sensitive data. Formally, DP gives a mathematically rigorous worst-case bound on the maximum amount of information that can be learned about an individual's data from the output of a computation. In the past two decades, the privacy community has developed DP algorithms that satisfy this privacy guarantee and allow for accurate data analysis for a wide variety of computational problems and application domains. We have also begun to see a number of high-profile deployments of DP systems in practice, both at large technology companies and government entities. Despite the promise and success of DP thus far, there are a number of critical challenges left to be addressed before DP can be easily deployed in practice, including: mapping the mathematical privacy guarantees onto protection against real-world threats, developing explanations of its guarantees and tradeoffs for non-technical users, integration with other privacy & security tools, preventing misuse, and more.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1550, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 6.72s | This text was transcribed using whisper model: large-v2 All right, very fast intro. Welcome to, well, Creator Stage is one, but CPB is over that way 6.72s - 13.76s | right afterwards. But go to our second talk first, over here, again, afterwards. But welcome. And 13.76s - 21.28s | this is Professor, or Rachel. We're thrilled to have her. She's a professor, once again, 21.28s - 26.24s | at Columbia University. And we are so excited for this talk. I got a chance to see these slides 26.24s - 30.88s | last night. You're going to walk away thinking I know everything about differential privacy. 32.08s - 38.96s | So, once again, here you go. Thank you. Thank you. We made it. 41.36s - 46.96s | This is my first DEF CON. Super excited to be here, all of that. Thank you for your extreme 46.96s - 52.88s | patience as we got things going. As a result, I'm going to have to skip some things in my talk so 52.88s - 58.08s | that we can end on time. But I will be hanging out afterwards at the Crypto Privacy Village. 58.08s


chunk_text:
"20241016" } 0.00s - 6.72s | This text was transcribed using whisper model: large-v2 All right, very fast intro. Welcome to, well, Creator Stage is one, but CPB is over that way 6.72s - 13.76s | right afterwards. But go to our second talk first, over here, again, afterwards. But welcome. And 13.76s - 21.28s | this is Professor, or Rachel. We're thrilled to have her. She's a professor, once again, 21.28s - 26.24s | at Columbia University. And we are so excited for this talk. I got a chance to see these slides 26.24s - 30.88s | last night. You're going to walk away thinking I know everything about differential privacy. 32.08s - 38.96s | So, once again, here you go. Thank you. Thank you. We made it. 41.36s - 46.96s | This is my first DEF CON. Super excited to be here, all of that. Thank you for your extreme 46.96s - 52.88s | patience as we got things going. As a result, I'm going to have to skip some things in my talk so 52.88s - 58.08s | that we can end on time. But I will be hanging out afterwards at the Crypto Privacy Village. 58.08s - 65.20s | And so, come see me and say hi. I'm giving a surprise talk there at 1.30, which I think 65.20s - 73.68s | the surprise will be the slides that I skipped. So, come and see that. Great. So, my work is 73.68s - 78.40s | really about differential privacy. If you haven't heard of it, you might be an expert by the end of 78.40s - 90.03s | this talk. It's okay. It would be over here. Oh, no. Okay. So, the like a mental model you should 90.03s - 95.07s | think about as we talk about differential privacy should be something about there's a database, 95.07s - 100.27s | it's important, and we want to analyze it and do like a scientific business analytics, whatever, 100.27s - 106.03s | on it. And there's an analyst who's going to like send some queries, receive back a few answers. 106.03s - 111.55s | This process is going to like continue. And so, she says, I've made some like a scientific 111.55s - 119.23s | discovery. Maybe it's like, you know, this this drug works. Maybe it's here is a database that 119.23s - 124.75s | can


chunk_text:
- 65.20s | And so, come see me and say hi. I'm giving a surprise talk there at 1.30, which I think 65.20s - 73.68s | the surprise will be the slides that I skipped. So, come and see that. Great. So, my work is 73.68s - 78.40s | really about differential privacy. If you haven't heard of it, you might be an expert by the end of 78.40s - 90.03s | this talk. It's okay. It would be over here. Oh, no. Okay. So, the like a mental model you should 90.03s - 95.07s | think about as we talk about differential privacy should be something about there's a database, 95.07s - 100.27s | it's important, and we want to analyze it and do like a scientific business analytics, whatever, 100.27s - 106.03s | on it. And there's an analyst who's going to like send some queries, receive back a few answers. 106.03s - 111.55s | This process is going to like continue. And so, she says, I've made some like a scientific 111.55s - 119.23s | discovery. Maybe it's like, you know, this this drug works. Maybe it's here is a database that 119.23s - 124.75s | can be freely published that I have made as a function of the original database, such that 124.75s - 129.87s | if you were to evaluate all my same answers, you would get back approximately the same answer on 129.87s - 136.99s | this new database. And you might want some kind of like a privacy preserving barrier at some point 136.99s - 142.59s | in this process. And so, maybe it's between the database and the analyst if you don't fully like 142.59s - 147.87s | trust this analyst. Maybe it's between between these sort of analysts and the outputs. If the 147.87s - 153.23s | outputs are going to be like a publicly viewed, maybe you also want some some like boundaries 153.23s - 166.46s | there. And the model that I think of in my work is a mental model about about privacy promising 166.46s - 173.42s | people freedom from harm. Nothing bad is going to happen to you because you have shared your data 173.42s - 180.38s | with this analysis process. Informally, we're going to say, or like informally, 181.82s - 189.10s | some analysis of a data set is going to be private if


chunk_text:
be freely published that I have made as a function of the original database, such that 124.75s - 129.87s | if you were to evaluate all my same answers, you would get back approximately the same answer on 129.87s - 136.99s | this new database. And you might want some kind of like a privacy preserving barrier at some point 136.99s - 142.59s | in this process. And so, maybe it's between the database and the analyst if you don't fully like 142.59s - 147.87s | trust this analyst. Maybe it's between between these sort of analysts and the outputs. If the 147.87s - 153.23s | outputs are going to be like a publicly viewed, maybe you also want some some like boundaries 153.23s - 166.46s | there. And the model that I think of in my work is a mental model about about privacy promising 166.46s - 173.42s | people freedom from harm. Nothing bad is going to happen to you because you have shared your data 173.42s - 180.38s | with this analysis process. Informally, we're going to say, or like informally, 181.82s - 189.10s | some analysis of a data set is going to be private if an analyst can know almost no more about Alice 189.10s - 199.18s | afterwards than he would before. Or sorry, if he had instead done done like the same analysis on 199.18s - 203.74s | the same data set without Alice's data. And this allows us to learn things like, you know, 203.74s - 208.94s | smoking causes cancer, but it doesn't allow us to learn things about your specific health 208.94s - 222.56s | information. So the so the like a differential privacy definition visually looks like this. 223.20s - 228.88s | Imagine if I have a database containing data coming from lots of people, and I plug that 228.88s - 235.84s | into my favorite randomized algorithm, that will that will produce some some like curve, 237.20s - 243.44s | which is a like a PDF of the outputs of this algorithm when instantiated on this particular 243.44s - 249.04s | database. And so on the x axis, imagine like all possible things and sort of like a might 249.04s - 256.16s | be a produced by by this algorithm on the y axis is going to be how likely is that output to occur 256.16s - 271.58s


chunk_text:
an analyst can know almost no more about Alice 189.10s - 199.18s | afterwards than he would before. Or sorry, if he had instead done done like the same analysis on 199.18s - 203.74s | the same data set without Alice's data. And this allows us to learn things like, you know, 203.74s - 208.94s | smoking causes cancer, but it doesn't allow us to learn things about your specific health 208.94s - 222.56s | information. So the so the like a differential privacy definition visually looks like this. 223.20s - 228.88s | Imagine if I have a database containing data coming from lots of people, and I plug that 228.88s - 235.84s | into my favorite randomized algorithm, that will that will produce some some like curve, 237.20s - 243.44s | which is a like a PDF of the outputs of this algorithm when instantiated on this particular 243.44s - 249.04s | database. And so on the x axis, imagine like all possible things and sort of like a might 249.04s - 256.16s | be a produced by by this algorithm on the y axis is going to be how likely is that output to occur 256.16s - 271.58s | if I input D. I'm going to move this a little bit closer. See if that helps. Good. So now we're 271.58s - 278.30s | going to imagine if I change one person's data, say they change Alice into being Javier, and I 278.30s - 285.58s | plug my new database that is the same except for one person's data into my same randomized algorithm, 285.58s - 293.02s | I'm going to get out a slightly different curve. And our hope in a privacy space is that like the 293.02s - 301.50s | ratio between these two curves is going to be bounded point wise along this x axis. So now why 301.50s - 305.66s | is this this privacy, I've talked about like, you know, freedom from harm. And now I'm talking about 305.66s - 311.34s | like, you know, bounding ratios as to the PDFs of algorithms. Well, imagine there was a particular 311.34s - 318.70s | output observed by some adversary, who then wanted to decide that I observed this output because of 318.70s - 327.26s | Alice's data, or, or like because of Javier's data, or that adversary information theoretically 327.26s - 335.66s | could


chunk_text:
| if I input D. I'm going to move this a little bit closer. See if that helps. Good. So now we're 271.58s - 278.30s | going to imagine if I change one person's data, say they change Alice into being Javier, and I 278.30s - 285.58s | plug my new database that is the same except for one person's data into my same randomized algorithm, 285.58s - 293.02s | I'm going to get out a slightly different curve. And our hope in a privacy space is that like the 293.02s - 301.50s | ratio between these two curves is going to be bounded point wise along this x axis. So now why 301.50s - 305.66s | is this this privacy, I've talked about like, you know, freedom from harm. And now I'm talking about 305.66s - 311.34s | like, you know, bounding ratios as to the PDFs of algorithms. Well, imagine there was a particular 311.34s - 318.70s | output observed by some adversary, who then wanted to decide that I observed this output because of 318.70s - 327.26s | Alice's data, or, or like because of Javier's data, or that adversary information theoretically 327.26s - 335.66s | could not make a guess or the individual's data, and the input beyond the like a small amount 335.66s - 345.36s | allowed, allowed by the ratio. So now in math, it says this. So an algorithm M, the maps the maps 345.36s - 352.00s | from a like a data set of size n, that is like a data data coming from n people into some arbitrary 352.00s - 357.84s | output range R is going to be parametrized epsilon differentiate private, if it is the case, 358.96s - 364.40s | that for all neighboring databases, D and D prime, they're the same except for one person's data. 364.96s - 371.12s | And for all possible things I may produce as a result of the analysis for all sets of S, 372.08s - 379.20s | I'm going to produce something in that set S with about the same probability under D and, 379.84s - 385.84s | and like a D prime. And so we're saying if I change one person's data, I'm going to output 385.84s - 392.64s | the same thing with about the same probability. And so notice that our epsilon parameter occurs 392.64s - 399.28s | in


chunk_text:
not make a guess or the individual's data, and the input beyond the like a small amount 335.66s - 345.36s | allowed, allowed by the ratio. So now in math, it says this. So an algorithm M, the maps the maps 345.36s - 352.00s | from a like a data set of size n, that is like a data data coming from n people into some arbitrary 352.00s - 357.84s | output range R is going to be parametrized epsilon differentiate private, if it is the case, 358.96s - 364.40s | that for all neighboring databases, D and D prime, they're the same except for one person's data. 364.96s - 371.12s | And for all possible things I may produce as a result of the analysis for all sets of S, 372.08s - 379.20s | I'm going to produce something in that set S with about the same probability under D and, 379.84s - 385.84s | and like a D prime. And so we're saying if I change one person's data, I'm going to output 385.84s - 392.64s | the same thing with about the same probability. And so notice that our epsilon parameter occurs 392.64s - 399.28s | in the exponent, which is probably not how you think about privacy, which makes it harder to 399.44s - 405.28s | explain to people without a like a technical background. I'm like imagining somebody's 405.28s - 409.68s | grandmother might like and have a hard time with this, unless you have a like an extremely, 409.68s - 417.36s | extremely like a mathematical grandmother, maybe. And we're going to get back to that 417.36s - 425.20s | point in the talk, that's going to be sort of a core point. Before we get there, why do we care 425.20s - 433.28s | about this particular privacy notion? One thing is that it's used kind of, kind of ubiquitously. 434.24s - 440.08s | No one talks about it as much because it isn't a super sexy privacy notion as we talk about like, 440.08s - 446.72s | you know, bounding ratios and exponents, but it's used by like a virtually every like a big tech 446.72s - 458.19s | company, and now sort of like a growing use in, in like government. So now let's return to, 459.15s - 467.79s | to the like a core of my talk, which is, which


chunk_text:
the exponent, which is probably not how you think about privacy, which makes it harder to 399.44s - 405.28s | explain to people without a like a technical background. I'm like imagining somebody's 405.28s - 409.68s | grandmother might like and have a hard time with this, unless you have a like an extremely, 409.68s - 417.36s | extremely like a mathematical grandmother, maybe. And we're going to get back to that 417.36s - 425.20s | point in the talk, that's going to be sort of a core point. Before we get there, why do we care 425.20s - 433.28s | about this particular privacy notion? One thing is that it's used kind of, kind of ubiquitously. 434.24s - 440.08s | No one talks about it as much because it isn't a super sexy privacy notion as we talk about like, 440.08s - 446.72s | you know, bounding ratios and exponents, but it's used by like a virtually every like a big tech 446.72s - 458.19s | company, and now sort of like a growing use in, in like government. So now let's return to, 459.15s - 467.79s | to the like a core of my talk, which is, which is the field of like a differential privacy has 467.79s - 473.31s | paid a whole lot of attention into like algorithms, guarantees, mathematics, theorems, proofs, 473.31s - 479.07s | publishing academic papers, which is wonderful. And that's my entire background. But there has 479.07s - 485.47s | been very little attention paid to these really core concepts of things like policies, regulation, 485.47s - 492.75s | government, practice, how do organizations make decisions about these tools, communication, 492.75s - 497.71s | how to tell people how they work, why they work and the nature of the guarantees. 499.63s - 506.83s | So in particular, there is no step by step guide for a new organization who may be like, 506.83s - 511.71s | here's my talk. And it's like, wow, wow, that's amazing. I want those tools for my data. 511.71s - 519.71s | There's, there's no handbook for it. And in particular, a couple, four things that are 519.71s - 525.87s | missing is there's no guidance in terms of how do you pick epsilon, it seems really important, 525.87s - 534.91s | how do you pick it? How do you communicate guarantees about this, about these sort


chunk_text:
is the field of like a differential privacy has 467.79s - 473.31s | paid a whole lot of attention into like algorithms, guarantees, mathematics, theorems, proofs, 473.31s - 479.07s | publishing academic papers, which is wonderful. And that's my entire background. But there has 479.07s - 485.47s | been very little attention paid to these really core concepts of things like policies, regulation, 485.47s - 492.75s | government, practice, how do organizations make decisions about these tools, communication, 492.75s - 497.71s | how to tell people how they work, why they work and the nature of the guarantees. 499.63s - 506.83s | So in particular, there is no step by step guide for a new organization who may be like, 506.83s - 511.71s | here's my talk. And it's like, wow, wow, that's amazing. I want those tools for my data. 511.71s - 519.71s | There's, there's no handbook for it. And in particular, a couple, four things that are 519.71s - 525.87s | missing is there's no guidance in terms of how do you pick epsilon, it seems really important, 525.87s - 534.91s | how do you pick it? How do you communicate guarantees about this, about these sort of 534.91s - 540.11s | like a nature and strength of the privacy guarantees to the stakeholders? How do you 540.11s - 546.11s | understand privacy accuracy trade off? Inherently, if you are doing something that gives stronger 546.11s - 552.35s | differential privacy, you're gonna take a little bit of an accuracy loss. How do you how do you 552.35s - 558.67s | understand that? And then finally, how do you align technical privacy guarantees with the like 558.67s - 566.35s | policies and laws? And is that and this is also a sort of like an outline of my talk. 566.35s - 569.23s | Realistically, I'm going to skip four so that they don't get mad at me. 572.03s - 580.03s | But let's talk first about about one. So, so this is sort of like, you know, at the crux 580.03s - 585.39s | of a sort of everyone's implementation questions. I always get asked, what's the right epsilon? 586.35s - 592.91s | And the truth is, there is no single right answer. There's no easy answer. So this epsilon 592.91s - 600.43s | parameter quantifies information leakage, how much can can be learned in a like,


chunk_text:
of 534.91s - 540.11s | like a nature and strength of the privacy guarantees to the stakeholders? How do you 540.11s - 546.11s | understand privacy accuracy trade off? Inherently, if you are doing something that gives stronger 546.11s - 552.35s | differential privacy, you're gonna take a little bit of an accuracy loss. How do you how do you 552.35s - 558.67s | understand that? And then finally, how do you align technical privacy guarantees with the like 558.67s - 566.35s | policies and laws? And is that and this is also a sort of like an outline of my talk. 566.35s - 569.23s | Realistically, I'm going to skip four so that they don't get mad at me. 572.03s - 580.03s | But let's talk first about about one. So, so this is sort of like, you know, at the crux 580.03s - 585.39s | of a sort of everyone's implementation questions. I always get asked, what's the right epsilon? 586.35s - 592.91s | And the truth is, there is no single right answer. There's no easy answer. So this epsilon 592.91s - 600.43s | parameter quantifies information leakage, how much can can be learned in a like, slightly 600.43s - 608.11s | convoluted, definitional way about individuals, and the epsilon can be tuned to be any value 608.11s - 614.91s | between zero and infinity. So, so like, you know, how, how much privacy leakage is acceptable? 619.15s - 626.91s | Oops. And there's no easy answer, in part, because there are no best practices for it 626.91s - 633.15s | is kind of a wild, wild west. Everybody just like picks something that that works. They also don't 633.15s - 637.15s | don't really tell people what they do. Most of the time, there's a lot of like, you know, 637.15s - 643.15s | closed door meetings about the right epsilon, but it's very infrequently published. Additionally, 644.19s - 650.67s | this is sort of getting at the privacy accuracy trade off, they'll talk about more. And of course, 650.67s - 655.23s | like a different applications are going to have have like a different privacy needs and different 655.23s - 660.51s | accuracy needs. And so they're like, quote, unquote, right, epsilon should depend on the 660.51s - 665.79s | use case on the specifics on the needs on the organization. And it might look


chunk_text:
slightly 600.43s - 608.11s | convoluted, definitional way about individuals, and the epsilon can be tuned to be any value 608.11s - 614.91s | between zero and infinity. So, so like, you know, how, how much privacy leakage is acceptable? 619.15s - 626.91s | Oops. And there's no easy answer, in part, because there are no best practices for it 626.91s - 633.15s | is kind of a wild, wild west. Everybody just like picks something that that works. They also don't 633.15s - 637.15s | don't really tell people what they do. Most of the time, there's a lot of like, you know, 637.15s - 643.15s | closed door meetings about the right epsilon, but it's very infrequently published. Additionally, 644.19s - 650.67s | this is sort of getting at the privacy accuracy trade off, they'll talk about more. And of course, 650.67s - 655.23s | like a different applications are going to have have like a different privacy needs and different 655.23s - 660.51s | accuracy needs. And so they're like, quote, unquote, right, epsilon should depend on the 660.51s - 665.79s | use case on the specifics on the needs on the organization. And it might look like a very 665.79s - 673.31s | different in the federal government bend versus in a startup versus versus in a large tech company. 673.31s - 678.35s | It might look different if we're talking about advertising versus versus healthcare, it makes 678.35s - 685.87s | sense that it should be different. So in fact, one thing that the field has has like, um, proposed, 685.87s - 691.63s | but it's not quite done yet, is the notion of an epsilon registry. And this is an idea that 691.63s - 697.87s | will sort of like increase our transparency around privacy parameters. So the organizations 697.87s - 707.07s | can really share, share, share, share, share, share, not just what is their epsilon, but also 707.07s - 713.23s | sort of like all the other features that are important in terms of why why that was their right 713.23s - 722.82s | choice. One more reason why it's hard is because it's hard to articulate what this epsilon 722.82s - 728.34s | means. No one like who has an intuitive, yes, 1.2 feels right in my soul. 729.86s - 737.06s | But instead, it's really hard to explain. It's a


chunk_text:
like a very 665.79s - 673.31s | different in the federal government bend versus in a startup versus versus in a large tech company. 673.31s - 678.35s | It might look different if we're talking about advertising versus versus healthcare, it makes 678.35s - 685.87s | sense that it should be different. So in fact, one thing that the field has has like, um, proposed, 685.87s - 691.63s | but it's not quite done yet, is the notion of an epsilon registry. And this is an idea that 691.63s - 697.87s | will sort of like increase our transparency around privacy parameters. So the organizations 697.87s - 707.07s | can really share, share, share, share, share, share, not just what is their epsilon, but also 707.07s - 713.23s | sort of like all the other features that are important in terms of why why that was their right 713.23s - 722.82s | choice. One more reason why it's hard is because it's hard to articulate what this epsilon 722.82s - 728.34s | means. No one like who has an intuitive, yes, 1.2 feels right in my soul. 729.86s - 737.06s | But instead, it's really hard to explain. It's a unitless parameter. It is contextless. But as we 737.06s - 743.46s | talked about, like a context is important. It's like a very mathematical, it involves a like a 743.46s - 749.70s | logarithm on the worst case bound of the of the like, you know, probabilities of a randomized 749.70s - 753.94s | algorithm. It's hard to like, you know, gain intuition about what is right there. 755.70s - 760.02s | And it's sort of like it doesn't match what we think about when we think about privacy. 760.02s - 769.46s | So you can sort of imagine there's a picture and it looks like this. And it's like, you know, 769.46s - 777.94s | stronger privacy guarantees versus weaker privacy guarantees. And like an important detail is that 777.94s - 784.18s | like the way in which in which like a differential privacy is achieved algorithmically is by sort of 784.42s - 790.02s | sort of like I'm adding noise to the process. And you add noise in a carefully calibrated way. 790.02s - 794.34s | And there's a lot of work thinking about how much noise what type of noise and like where 794.34s - 798.98s |


chunk_text:
unitless parameter. It is contextless. But as we 737.06s - 743.46s | talked about, like a context is important. It's like a very mathematical, it involves a like a 743.46s - 749.70s | logarithm on the worst case bound of the of the like, you know, probabilities of a randomized 749.70s - 753.94s | algorithm. It's hard to like, you know, gain intuition about what is right there. 755.70s - 760.02s | And it's sort of like it doesn't match what we think about when we think about privacy. 760.02s - 769.46s | So you can sort of imagine there's a picture and it looks like this. And it's like, you know, 769.46s - 777.94s | stronger privacy guarantees versus weaker privacy guarantees. And like an important detail is that 777.94s - 784.18s | like the way in which in which like a differential privacy is achieved algorithmically is by sort of 784.42s - 790.02s | sort of like I'm adding noise to the process. And you add noise in a carefully calibrated way. 790.02s - 794.34s | And there's a lot of work thinking about how much noise what type of noise and like where 794.34s - 798.98s | and in your process, you sort of like I'm always add a little bit of randomization in there. 798.98s - 806.66s | And so the question is really about how much noise. This is a question that I have worked on, 806.66s - 812.10s | but I think I'm gonna skip it. So they don't get mad at me. And I'm sorry that we started late. 812.90s - 821.46s | I'm very happy to like, you know, share share things about this. But I'll say that are sort 821.46s - 826.18s | of like, you know, main me like I'm finding of this work is that if you give people 827.54s - 832.26s | math based explanations in terms of the like a likelihood of what will happen 832.26s - 837.78s | under various choices, accompanied by some like a visualization of those choices, 837.78s - 845.86s | it increases objective comprehension, and also increases feelings of self efficacy 845.86s - 850.18s | in terms of like, you know, having enough information to make choices. And again, 850.18s - 856.50s | this sort of right answer isn't global, but it is like, you know, what is the right choice for


chunk_text:
and in your process, you sort of like I'm always add a little bit of randomization in there. 798.98s - 806.66s | And so the question is really about how much noise. This is a question that I have worked on, 806.66s - 812.10s | but I think I'm gonna skip it. So they don't get mad at me. And I'm sorry that we started late. 812.90s - 821.46s | I'm very happy to like, you know, share share things about this. But I'll say that are sort 821.46s - 826.18s | of like, you know, main me like I'm finding of this work is that if you give people 827.54s - 832.26s | math based explanations in terms of the like a likelihood of what will happen 832.26s - 837.78s | under various choices, accompanied by some like a visualization of those choices, 837.78s - 845.86s | it increases objective comprehension, and also increases feelings of self efficacy 845.86s - 850.18s | in terms of like, you know, having enough information to make choices. And again, 850.18s - 856.50s | this sort of right answer isn't global, but it is like, you know, what is the right choice for your 856.50s - 862.34s | for you for your application. And so feeling as though you like you have enough information is 862.34s - 870.90s | important. Let's go to number two, talking about like, you know, communicating guarantees to the 870.90s - 876.74s | other stakeholders. So the previous sort of like an explanation of epsilon was really just about 876.74s - 883.38s | the epsilon to people who are going to share data in some like an algorithmic process. There's lots 883.38s - 891.70s | of other important people in this process. So we have so we have data subjects, who are the ones 891.70s - 898.98s | who have to like share, share data. And like I decided, it's a good idea. We also have how 898.98s - 903.86s | like I'm engineers who have to make decisions, and they have to like implement code and they 903.86s - 908.50s | have to think about like, you know, parameter tracking, downstream implications of privacy, 908.50s - 915.86s | and so on. We have how like I'm data curators, who are the ones with a power to either share 915.86s - 921.78s | or to not share data


chunk_text:
your 856.50s - 862.34s | for you for your application. And so feeling as though you like you have enough information is 862.34s - 870.90s | important. Let's go to number two, talking about like, you know, communicating guarantees to the 870.90s - 876.74s | other stakeholders. So the previous sort of like an explanation of epsilon was really just about 876.74s - 883.38s | the epsilon to people who are going to share data in some like an algorithmic process. There's lots 883.38s - 891.70s | of other important people in this process. So we have so we have data subjects, who are the ones 891.70s - 898.98s | who have to like share, share data. And like I decided, it's a good idea. We also have how 898.98s - 903.86s | like I'm engineers who have to make decisions, and they have to like implement code and they 903.86s - 908.50s | have to think about like, you know, parameter tracking, downstream implications of privacy, 908.50s - 915.86s | and so on. We have how like I'm data curators, who are the ones with a power to either share 915.86s - 921.78s | or to not share data sets with like, you know, various analysts, and they have to like a decide 921.78s - 926.98s | what is the right time to share or to not share under what conditions under what agreements. 933.52s - 940.24s | We have data analysts, who really don't care about the privacy part at all. They just care 940.24s - 944.96s | about analyzing data and about maintaining exactly the same pipeline they were doing before. 946.40s - 950.88s | And so if you're like a difference of private pipeline looks completely different, and you like 950.88s - 957.20s | can't use Python, people will be mad at you. And so it's important you also incorporate privacy, 959.44s - 963.76s | privacy tools in a way that is not not so like a destructive in that. 965.92s - 974.00s | There's also like a privacy officers have to think about things like things like a compliance 974.08s - 982.24s | in the organization, regulatory requirements. Executives have to make a decision. Is this good 982.24s - 986.72s | for my company? What is the cost of I have to like, you know, hire a bunch of privacy engineers? 986.72s - 991.28s |


chunk_text:
sets with like, you know, various analysts, and they have to like a decide 921.78s - 926.98s | what is the right time to share or to not share under what conditions under what agreements. 933.52s - 940.24s | We have data analysts, who really don't care about the privacy part at all. They just care 940.24s - 944.96s | about analyzing data and about maintaining exactly the same pipeline they were doing before. 946.40s - 950.88s | And so if you're like a difference of private pipeline looks completely different, and you like 950.88s - 957.20s | can't use Python, people will be mad at you. And so it's important you also incorporate privacy, 959.44s - 963.76s | privacy tools in a way that is not not so like a destructive in that. 965.92s - 974.00s | There's also like a privacy officers have to think about things like things like a compliance 974.08s - 982.24s | in the organization, regulatory requirements. Executives have to make a decision. Is this good 982.24s - 986.72s | for my company? What is the cost of I have to like, you know, hire a bunch of privacy engineers? 986.72s - 991.28s | How much is that going to cost? If you talk to me about like, you know, accuracy loss, 991.28s - 1001.17s | I don't want accuracy loss. There are lawyers who have to like a decide is the use of this 1001.17s - 1008.45s | technology compliant with the privacy laws and the regulations around the use of data. 1009.09s - 1013.65s | And there's also like a policymakers who get to make new laws around the use of data, 1013.65s - 1020.64s | if we think our current ones are like not particularly, particularly adequate. 1022.56s - 1029.92s | And so for sort of all of these entities, they have to make different types of decisions, 1030.48s - 1037.36s | they have to, and they also have like a different amounts of sort of like a background expertise, 1037.36s - 1043.84s | and, and like, you know, realistically, attention span. And so you want to tailor, 1043.84s - 1049.04s | tailor like communication strategies to these individuals in a way in a way that sort of 1049.04s - 1056.24s | really like a meets meets their, their, their needs. I have more to say about a lot of these.


chunk_text:
How much is that going to cost? If you talk to me about like, you know, accuracy loss, 991.28s - 1001.17s | I don't want accuracy loss. There are lawyers who have to like a decide is the use of this 1001.17s - 1008.45s | technology compliant with the privacy laws and the regulations around the use of data. 1009.09s - 1013.65s | And there's also like a policymakers who get to make new laws around the use of data, 1013.65s - 1020.64s | if we think our current ones are like not particularly, particularly adequate. 1022.56s - 1029.92s | And so for sort of all of these entities, they have to make different types of decisions, 1030.48s - 1037.36s | they have to, and they also have like a different amounts of sort of like a background expertise, 1037.36s - 1043.84s | and, and like, you know, realistically, attention span. And so you want to tailor, 1043.84s - 1049.04s | tailor like communication strategies to these individuals in a way in a way that sort of 1049.04s - 1056.24s | really like a meets meets their, their, their needs. I have more to say about a lot of these. 1056.32s - 1061.52s | But again, we're going to skip to the next topic. And like, talk to me afterwards, 1061.52s - 1070.93s | if you want to hear more. Good. So, so for topic three, understanding this sort of a privacy 1070.93s - 1077.65s | accuracy trade off is really important. Because of course, nobody likes to lose privacy, but also 1077.65s - 1086.96s | nobody likes to lose accuracy. So we have this like a picture before. And this is really the 1086.96s - 1093.76s | way it is like I described in academia is we say, on the left, there's like good privacy and bad 1093.76s - 1099.44s | accuracy. And on the right, there is bad privacy and good accuracy. And like, you know, pick a 1099.44s - 1106.56s | spot in the middle. And, and like, you know, you can pick where in the middle you feel like being, 1106.56s - 1112.72s | but that's sort of what you get. But I think this is not really capturing what is happening. 1113.68s - 1118.16s | Instead, I think the picture looks a little more like this, how there's some like, you know, 1118.16s - 1123.52s


chunk_text:
1056.32s - 1061.52s | But again, we're going to skip to the next topic. And like, talk to me afterwards, 1061.52s - 1070.93s | if you want to hear more. Good. So, so for topic three, understanding this sort of a privacy 1070.93s - 1077.65s | accuracy trade off is really important. Because of course, nobody likes to lose privacy, but also 1077.65s - 1086.96s | nobody likes to lose accuracy. So we have this like a picture before. And this is really the 1086.96s - 1093.76s | way it is like I described in academia is we say, on the left, there's like good privacy and bad 1093.76s - 1099.44s | accuracy. And on the right, there is bad privacy and good accuracy. And like, you know, pick a 1099.44s - 1106.56s | spot in the middle. And, and like, you know, you can pick where in the middle you feel like being, 1106.56s - 1112.72s | but that's sort of what you get. But I think this is not really capturing what is happening. 1113.68s - 1118.16s | Instead, I think the picture looks a little more like this, how there's some like, you know, 1118.16s - 1123.52s | privacy accuracy curves. And of course, you can't get like, you know, amazing privacy, 1123.52s - 1129.60s | amazing accuracy at the same, same time. And so that's infeasible. In the bottom left, 1129.60s - 1134.56s | you get bad accuracy and bad privacy. And you can for sure do that, but it's not particularly helpful. 1135.44s - 1139.04s | And then you have these like, you know, spaces in between, maybe there's some like, you know, 1139.04s - 1144.56s | feasibility curve or some like, you know, Pareto frontier of the trade-off based on current, 1144.56s - 1149.84s | like a technology. And then, you know, a lot of the work on the algorithmic side is sort of like, 1149.84s - 1156.56s | you know, pushing this curve further out so that we can, we can get like, you know, better privacy 1156.56s - 1162.40s | and better accuracy simultaneously. Like at a current moment in time, we have some, 1163.12s - 1167.60s | some, some curve and the company can, can like pick, I feel like being there on this curve. 1169.60s - 1178.96s | One important question, this is a cartoon. How do we quantify privacy?


chunk_text:
| privacy accuracy curves. And of course, you can't get like, you know, amazing privacy, 1123.52s - 1129.60s | amazing accuracy at the same, same time. And so that's infeasible. In the bottom left, 1129.60s - 1134.56s | you get bad accuracy and bad privacy. And you can for sure do that, but it's not particularly helpful. 1135.44s - 1139.04s | And then you have these like, you know, spaces in between, maybe there's some like, you know, 1139.04s - 1144.56s | feasibility curve or some like, you know, Pareto frontier of the trade-off based on current, 1144.56s - 1149.84s | like a technology. And then, you know, a lot of the work on the algorithmic side is sort of like, 1149.84s - 1156.56s | you know, pushing this curve further out so that we can, we can get like, you know, better privacy 1156.56s - 1162.40s | and better accuracy simultaneously. Like at a current moment in time, we have some, 1163.12s - 1167.60s | some, some curve and the company can, can like pick, I feel like being there on this curve. 1169.60s - 1178.96s | One important question, this is a cartoon. How do we quantify privacy? How do we quantify accuracy? 1178.96s - 1185.92s | What do these things actually really mean so that we can like actually truly plot them? And the 1185.92s - 1193.36s | truth is we're not super good at doing either of them. So, so we'll start with the privacy challenge, 1194.08s - 1201.76s | which is, which is it like, yes, on the privacy axis, we can plot epsilon. But as I already 1201.76s - 1207.44s | mentioned, epsilon is probably not what your company's executive thinks about as being important. 1207.44s - 1211.52s | But rather they probably think about like, you know, privacy risk, privacy threats, 1211.52s - 1216.96s | how will this privacy tool protect my data against various attacks, threats, and so on. 1216.96s - 1225.76s | But, but you sort of like us, sort of, sort of like standard version of doing like a risk 1225.76s - 1232.08s | assessment under a DP, it doesn't quite match what people think about. So this is typically 1232.08s - 1237.60s | like a worst case. So we're thinking of an adversary that has complete knowledge of the 1237.60s - 1243.20s | data set. And they're trying to


